{ "Event": { "published": true, "date": "2026-02-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-19", "timestamp": 1771545781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "65dd9b2e-f5bb-4f8e-a781-0d50c5027a31", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc7a860-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771493561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493561, "uuid": "fb4f035b-6ecd-47f0-8841-905dfe46e11c", "comment": "Malware payload (PhantomStealer)", "value": "063e83bb8849a1801a86c221a3cd1f0f", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493561, "uuid": "acaff22f-3400-4568-aef0-6e2678655dc0", "comment": "Malware payload (PhantomStealer)", "value": "0018b70b54c1f5ce670b6e119a81773f20430d8f1e8957197c4512c5f09d710c", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493561, "uuid": "daea50e7-3e7a-44a7-8c5b-7c4c0aeafcaa", "comment": "Malware payload (PhantomStealer)", "value": "5135ad435d82a335c9301c0a73b84efe11b51427", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493561, "uuid": "5a912154-52e3-442a-9c55-af37004d9c64", "comment": "Malware payload (PhantomStealer)", "value": "d327b92543beccb4e2e114eb0638aab21a98384db6e2d816025cbeb2dadbed05dd2f018ebf16cab1ed5eb78b151771cd", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493561, "uuid": "ae97f9a3-9683-47d6-a7f5-45bb004f0f18", "value": "T1CB839474294C45EF24D3EAB4B084A7E3FE6C0A5C9FED664F525087DA163EA8734C3981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493561, "uuid": "98f1ba60-dece-4eca-ae88-4c6ad2602d87", "value": "768:AG4DJtZUQTV3ZyKJVnSuONBuChn500/scJzHYb9Y7dND5Qo7sJU:iUQxpHLqfuYnScJzO90ND5QKsJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493561, "uuid": "eb888dd2-2fac-421c-9d5b-0aaf7f8eeccf", "value": 87430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493561, "uuid": "2c16f526-72a2-48c2-938a-9d6a2c51181e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493561, "uuid": "c1bb1cbd-205a-4c5b-8487-4c684ec0d1e8", "value": "RFQ-SM10022609.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140768e4-0d9a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509083, "uuid": "8c15778f-6315-4596-ba70-e5d6715cd740", "comment": "Malware payload", "value": "c3cc788bcb45bf0bb697e18f70178f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509083, "uuid": "4b69603a-d487-4c17-98d0-6586c1a0b8fd", "comment": "Malware payload", "value": "010e0b57a5ad6f13d47dbcb3ed8aa6242685b89bf3e1ec8c99879c09e6b0e34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509083, "uuid": "ae34c233-6bb7-4b4f-98be-129a57cdb1d5", "comment": "Malware payload", "value": "b315fab3933c383bfba300fbafa081b4aceb7156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509083, "uuid": "097e510e-7c33-4941-ad3a-fb24aa4db508", "comment": "Malware payload", "value": "937b8ba9c6b143a557bc2e6e458ef37cd592a9cade71d6d3e304dcccbd495b035ab9d87f606c9de0df3e1df4c8e5b079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509083, "uuid": "e24bcf42-c07b-43aa-97d2-feac9b065a40", "value": "T12145BF0273D1D062FFAB91334F5AF6115BBC79260123A62F13981D7ABA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509083, "uuid": "3487d89f-e04d-4431-ae1c-999cf17a3361", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509083, "uuid": "9cb2c41e-5f55-4ceb-af8d-b56b02321705", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1MAXDzTnZmqm70XUvpXb/6rFu:ZPVt/LZeJbInGizTZ+QUvpr/6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509083, "uuid": "4fc4ba06-8792-480a-a039-ecf6b5b46f74", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509083, "uuid": "12e7a53a-80e2-449b-9842-7a964ec3678c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509083, "uuid": "c67a5d8b-400c-4716-b420-8d2e0e37cdfb", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843a0d92-0d63-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771485649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485649, "uuid": "f6a4fa8e-ec4e-42b5-b503-8f1c41edaa24", "comment": "Malware payload (Mirai)", "value": "cffff0155bc089cafa559fb675121435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485649, "uuid": "5ac2d805-0195-44a1-af87-59b51218fa1e", "comment": "Malware payload (Mirai)", "value": "0215ba1fe7485c018716da20007e3ff77dd7ba8e57e1bce08d80f2a90f70a74d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485649, "uuid": "22355e01-7f21-4d4f-a707-c39aef8bb002", "comment": "Malware payload (Mirai)", "value": "873b4cba915a307d8e036f5753ce0196ac1808b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485649, "uuid": "e0a1f0f9-6ba1-4445-8e92-a2c3f78a011b", "comment": "Malware payload (Mirai)", "value": "95b29d151e605575d38f6d8144064e3a79d86a7fd424150eeb7593fe7ca2906ed6e63d66b8d1b474ef444e81e801858f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485649, "uuid": "5e78badb-a06e-468e-ade7-c6b6eec157a1", "value": "T17DE3C60AAF610FBBDCABDC7702F90B5125CCB85715A93B757574E818B60A1CB0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485649, "uuid": "3c54b5b9-5864-4b7b-8201-a923e715e486", "value": "1536:uZeuQVqPCobtvIONd+E0W1kj7GGHqOuekdfjCtsHlITzQZYG9vLZbPDnaDAQEUov:x6tvRNhrkj7OjGsHoQz9FA5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771485649, "uuid": "e9227ae1-d356-448e-be52-b0668bb58255", "value": 152988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771485649, "uuid": "158d02e9-d52f-4572-985e-a89b9a9c707c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485649, "uuid": "f8ef3a56-252a-4290-91bd-1ee1d8e1e616", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10687be-0d44-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771472383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771472383, "uuid": "4b8149ef-71fe-46cd-a14f-363543d93601", "comment": "Malware payload (Gafgyt)", "value": "2e3443b3adf77cfe8284af29e09ad860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771472383, "uuid": "9f9fe848-f3e9-4b2c-aa24-5b75877a9162", "comment": "Malware payload (Gafgyt)", "value": "031ef3b088393e9dd620ae5ffafadfb886125da47fe3a57b1ff308a9b253ac9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771472383, "uuid": "297916c1-1e14-44fa-abb8-fc240a942055", "comment": "Malware payload (Gafgyt)", "value": "1164894a9d2b5995b2f6458b3c7ac057839a3634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771472383, "uuid": "f024094e-5d53-4d4f-89bd-c2ac58f192d1", "comment": "Malware payload (Gafgyt)", "value": "be1b273c65f61068f944ee60e591db75b837707b73982d6003f0b895781bfcc3c159724f9d1a0cd120e8972ef65184f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771472383, "uuid": "2967885b-f086-44da-8c3d-fb9fa978fc23", "value": "T100042803759186FBC4D68FB41BEB95118933F8391B32620AB398FDA91F0DED86E1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771472383, "uuid": "41aae5fd-d034-4017-86c1-7ea886c83b01", "value": "3072:b867ZLIEK/lRvGGzbJs4lpqppZVsDtaP+o9muan+wshqo0ENbfhhi:b8e8DWh8omuan+wshqo0ENbfhhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771472383, "uuid": "722b5c06-c3ec-4d89-b664-4ba50df2adac", "value": 182678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771472383, "uuid": "7c27552d-180b-4f1d-beb5-b88f55f54a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771472383, "uuid": "9b8851d5-b414-4d8c-80b3-57d60c2deb72", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1eda23-0d74-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1771493122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493122, "uuid": "8df95144-d9e1-4d80-9153-c1a01761f1f1", "comment": "Malware payload (DarkCloud)", "value": "81610f5d0068a607f11d174a9ade340c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493122, "uuid": "1b0cf751-cb88-478a-8e5b-7108dbf5a36c", "comment": "Malware payload (DarkCloud)", "value": "03c1e1356e020b7abc43173ecccaae224cce1b7e38bc81fc02a9ad44447a30f5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493122, "uuid": "bb244106-afec-4900-8da7-aadafb04c861", "comment": "Malware payload (DarkCloud)", "value": "28b4492edd74afcadb6950d216284c46e6867e96", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493122, "uuid": "706ac22d-4e7e-4826-adee-3f325cf7bd24", "comment": "Malware payload (DarkCloud)", "value": "18ef1f9a0acb523f7ba92f448f7009733cb2d1b72d9615cb3a7e32e3ef10a64a6349a717c91066863916014d4329fb35", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493122, "uuid": "b0d7956f-feb1-4a9a-b22c-6482e341db21", "value": "T12F35E8AB0157CB6670DD2C66BEF9AEF59AD02303F542E56B3C10D3DE964B28F4670A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493122, "uuid": "72d84f0e-7990-4604-a57e-d2a0f65013d8", "value": "48:8bJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJbJ6:j5bjro/qkVXKWpii9St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493122, "uuid": "b0f803ef-e9bb-408d-8b07-728cf670c34c", "value": 1084531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493122, "uuid": "89e5b722-34f4-402b-a751-da0ffb60994c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493122, "uuid": "08afeae6-33f8-4942-bff8-51b7787d44ee", "value": "INQUIRED ITEMS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115afd97-0dca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771529695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529695, "uuid": "60ac46ae-c510-42c3-ab0f-06bf1e8a631e", "comment": "Malware payload (Mirai)", "value": "907e108379a367dd4507ec57daa02370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529695, "uuid": "ebfbdb35-41bd-4629-9994-0524aeac5ccf", "comment": "Malware payload (Mirai)", "value": "043681008988394ea1995fd1e88cc50b281ab0a8120cac5178ea8c1df4930040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529695, "uuid": "d4f62b91-2852-48cd-9135-45f7cd77f761", "comment": "Malware payload (Mirai)", "value": "2d57a4afdbcfd382b882b12dfbbe764f71f111c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529695, "uuid": "06aa65e8-b7db-4344-ac98-b2696d650dfc", "comment": "Malware payload (Mirai)", "value": "310d4ab96e99374d517bab3aba8313ea66ec3c1bb8820c2aee6117c54436f5378433e41234d8ebdcc7ad37551a709e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529695, "uuid": "7ffd7650-fbc3-457b-9e78-980f5b1f9197", "value": "T1A8C31BCABC858F10D5D665BAFE0E618D33134B78E3FA7103CE149B29278AC5B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529695, "uuid": "b89ef43f-ddc8-4f24-999d-3c8e7c14f604", "value": "3072:mI2wShxZcG8aE6gfXVp/43VLJ0mpxe2xDslxW68oFAlmjg2NF51n4:fGrUVp/43VLJ08eOs3W68oalUgUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529695, "uuid": "f2c09017-2a87-49cc-a745-ca0502744578", "value": 120356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529695, "uuid": "0a4b2660-4eb5-47ad-b947-6767fc251eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529695, "uuid": "3adf5088-d121-4996-850f-419b28c163fd", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a921a4-0d6a-11f1-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1771488609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488609, "uuid": "36997d79-1f51-4113-99d2-92b147f324cd", "comment": "Malware payload (NanoCore)", "value": "26f46a281cbd2456c4df54a75007d9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488609, "uuid": "5d44fcba-231f-41de-9f56-7d15c5bd59d2", "comment": "Malware payload (NanoCore)", "value": "04c147559ea23daa59503c0b935c8df2728893ea82211813c8428b630fcd3768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488609, "uuid": "139c0eab-606b-4ffb-991b-66ee62eaefd4", "comment": "Malware payload (NanoCore)", "value": "e8a2678fde54f56ef016528c8229952c258a765e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488609, "uuid": "79b8a291-1e06-4567-afcf-94aece09ab6c", "comment": "Malware payload (NanoCore)", "value": "9b6461eedf06f045168807adb90b961795b021e7b74c842b779f354ac3e0e0f9e8b4904fb6a90a4ae5008c1bdb78eb84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488609, "uuid": "7c2dbc2c-0ff9-4ecc-99c7-fdd4385bed68", "value": "T1FC74124F660CB527C6DC88B765F661C4937594EF1903E2AEAA4C32582C42FEB8157F0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488609, "uuid": "1d156f06-5cd4-4368-a0b6-b387813adc3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488609, "uuid": "24fe2e02-7a8c-4fac-be7c-e4e1d9925547", "value": "6144:tSMPvteRMSiLJ0BG6izC7nWuOBSBiudd5fAylWkfhCXgguVT2UCT8faK5u4zq0P:vPAJiN0k47nUBLu/5fAy5ZCQ/VqU9vrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488609, "uuid": "054111f2-2eca-4df6-8466-e135536974b6", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488609, "uuid": "16b90525-cb42-4e0e-9969-9e810b729eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488609, "uuid": "8a59b139-aadd-4787-9b42-143d95790de4", "value": "26F46A281CBD2456C4DF54A75007D9AB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8b1d3c-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771484911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484911, "uuid": "102ea32a-9f9a-4967-88dd-adaccb2405bc", "comment": "Malware payload (Vidar)", "value": "f8b49c073f6731ec4c1083cf086c8e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484911, "uuid": "afe478e0-feca-453b-b581-4b98f05c878a", "comment": "Malware payload (Vidar)", "value": "054c6b9cf054fd62fd0d2d4c21173d23992fb90ff65d9229986caa71cd2b878b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484911, "uuid": "314b399b-5eb2-45ca-8bda-78d1b0532314", "comment": "Malware payload (Vidar)", "value": "1a886437fb8303bd63930be2a27ce5baa938564b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484911, "uuid": "eb926944-2087-4fc4-b815-1c99d1281a64", "comment": "Malware payload (Vidar)", "value": "76a809e59911918a69e741983e053f624653bc79a396822035f813da056b621d67cd6554984d9d7c5084e5712ee6b23a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484911, "uuid": "e9637471-fa67-4725-b1ff-38ed2cb7fc60", "value": "T1D9D41ABDAC20E366F70D90BAE246D3534F2138410636A9A329BED7141246873DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484911, "uuid": "c339e5f3-4030-4416-8ae9-42c9308c4b24", "value": "272da274133b3bd9f0a6f58d3842d526", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484911, "uuid": "2ac44520-c4f3-4425-9d49-9547a1423d19", "value": "12288:orW8rSu9JOwZD6GIlgjfnI48z4He981xvO6qYO:o3rSu9JOwFdbjf2z4He98jO6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484911, "uuid": "9388a731-c73e-4b3e-8e3c-418fd408739c", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484911, "uuid": "bd15ff56-a1cc-4f1f-beeb-9251b5e93755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484911, "uuid": "2a66b8a1-ae8a-4fc1-8be2-131e4b4e1806", "value": "KoC0dj3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96663f12-0d63-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771485680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485680, "uuid": "885d632a-0820-4e34-b193-364a86f92424", "comment": "Malware payload (Mirai)", "value": "4d5816e8a3e19286846a72c24788f402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485680, "uuid": "54c54618-c644-4b2c-983f-72cccbbf46e7", "comment": "Malware payload (Mirai)", "value": "06609b1dd4778be00b308633fee516be1397cc2c3a1740fb6ff83647a6adfbda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485680, "uuid": "6fc0583c-7918-4764-aafc-2d364777c05f", "comment": "Malware payload (Mirai)", "value": "a5f4d426c701c9c8d240354e2b39b39faf95e0c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485680, "uuid": "caa39cdc-94e2-42f7-ab31-5e3ea946c0c3", "comment": "Malware payload (Mirai)", "value": "803f17ab9ab971285904de2f2b0597c92893909ca68c67972281e2da5c8eda092eadf5d1b00554172408fd4a9427079f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485680, "uuid": "8f0b615d-20be-4ad1-9cad-015b58c6483d", "value": "T187C36B86E6B2E0F0E68701B00557E3E78A35EA305416CDC6EFA93D71EC716819D9B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485680, "uuid": "1aaf50df-4173-4414-9b10-c28957960834", "value": "3072:1hopwnG4fuSVms1KdM1pTA6KsryiYUGRm:HVnG4fuSVmutrSUGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771485680, "uuid": "05458f6f-0e71-406f-8fa5-9b30d4dbf40d", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771485680, "uuid": "4a8a79de-a907-4c20-bcc9-cba25d94ccbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485680, "uuid": "de34f2d5-a4ed-4434-a24b-f4887736e208", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c83940-0dc1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771525976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771525976, "uuid": "0eb36747-6cdf-4f59-b039-7dd67b75efac", "comment": "Malware payload", "value": "737edcee199dee2c2004b06015039ef5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771525976, "uuid": "1a90dec3-f1e7-4a87-8ac1-11802b277a3b", "comment": "Malware payload", "value": "06f42fa9e9d8f0c01a7c560490ea71e4cc582069527a5336cdfc299ed1e67c32", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771525976, "uuid": "d0a5a14f-1184-45ff-967f-1d3495decc86", "comment": "Malware payload", "value": "b316dbbd9742b7c6f1ff536984fda926948e75da", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771525976, "uuid": "17f4a166-a7ba-4711-a6b3-584ca86cc683", "comment": "Malware payload", "value": "75e4808f238db96d4dc0c034d1161c75962b0f5b6ac7e6b9372ab08eef21e5e03677033a92816b11a99203b7a0c379e5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771525976, "uuid": "98132374-e357-4c07-927e-bb8caa0fc6ae", "value": "T1C4871212B9AD16B9C5FAE2388469A211B67238650331BBC71BE8157B1F376D46F3F304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771525976, "uuid": "d535ff4d-c623-47cc-9591-041687690924", "value": "1f74bdd8275d1c99b371f4a5243e6cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771525976, "uuid": "cb16943f-d3c3-4610-908e-e1a72e74a26a", "value": "786432:Ti51FLXqrRtb/S/N1ILX3JtUpTbLYH4Baj3SWL:251NqrvbY1u3HUxbQ3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771525976, "uuid": "70d9ed26-42c1-47ff-9838-0091630ae6ac", "value": 37245952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771525976, "uuid": "9f3039ab-1d9b-4118-952d-c315548d01b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771525976, "uuid": "9cfdf3e9-18bc-4738-96e0-fb41c50aad70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586c265f-0dce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771531532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531532, "uuid": "41e34961-9854-44a7-b781-aeed6573551f", "comment": "Malware payload (Mirai)", "value": "0ce1e9f6c267e178879b31065cd9e7e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531532, "uuid": "23690893-3a4d-4c37-b527-ec1e4f15c668", "comment": "Malware payload (Mirai)", "value": "08de83c2902efadcd82ff6780c4f8097ac3e15107f71ad4a4768ea550c01dbb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531532, "uuid": "b4969c6b-06ca-4b01-b402-bbfeb80d97d4", "comment": "Malware payload (Mirai)", "value": "17e0a41031392905a73977c8d75e563e365da593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531532, "uuid": "4d654bfb-110c-4a9f-a9a2-c5087f514eeb", "comment": "Malware payload (Mirai)", "value": "df79c80f4e9ad7fec8e3717160abdb513ac30b49dd6bdae381f06f13000cfe3540e921b2073cbf7c2dc19c0b4abff508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531532, "uuid": "55db1368-103f-4463-a981-03eddb020915", "value": "T1BF834A95BC819613C6D012BBFB5E418E372A53A8D2EF32079D266F21378B81F0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531532, "uuid": "103ace20-bfd7-4c77-836e-2b075157db94", "value": "1536:qNEYDH3I0qLLJFDsk65atmARXji1Ad7Yvm/5:aEYDCik65X0X0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531532, "uuid": "39fa7b69-a917-499d-9e6e-262547b4d806", "value": 83664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531532, "uuid": "20972cf9-d237-4dc3-ba34-e1f4caf4ebb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531532, "uuid": "72cbac99-35e9-45ea-9f10-271d3577ad2e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff277fa-0d4c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771475844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475844, "uuid": "ce0e0b49-2e31-4dfb-80e0-17d26fd3352d", "comment": "Malware payload (Mirai)", "value": "cf46de5341b77c9fbb5406dbd72a6046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475844, "uuid": "427eb0a0-9743-4886-a607-35d8fcabb164", "comment": "Malware payload (Mirai)", "value": "0b609a87b16bb43868239a83ec76fc04627f3eaa779df0f2719965be30f94e72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475844, "uuid": "1bb85702-3910-4e0b-a158-a531f717aa1b", "comment": "Malware payload (Mirai)", "value": "936447eefc1280c16763d7670636fa48377c0fc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475844, "uuid": "47e1d073-09d7-449e-9763-df1637fe2b6a", "comment": "Malware payload (Mirai)", "value": "3e4dbe08ece1c855536832545ab9fefcd44355ee6f07a07421bcde3ff0bd95b235c0452c5521d47395dba4ba662b37cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771475844, "uuid": "77d2832b-fdbc-4877-8742-01f153f56e8f", "value": "T14F146B2BB3C39CD6D11067308C316366776FDB081518EAFFDA0B3794A997B225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771475844, "uuid": "34f4073a-fe10-432d-b110-0e295fae009c", "value": "6144:T9BOm51554Dk9mLH/Dex/omafjiFyT7IKTtS:n4DkCrexdsRT7IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771475844, "uuid": "9db625da-dc51-43d5-a74f-294014bdb211", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771475844, "uuid": "49fdc84f-5bc2-4574-be4f-1dad6acb6af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771475844, "uuid": "0dd83e2a-4022-496e-856e-4e82b6309bea", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9b1e4a-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771484613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484613, "uuid": "008b60f4-df61-422f-bec1-c90daa31cae4", "comment": "Malware payload (Mirai)", "value": "6203c3d0e4ae8fa248427970d62e0e7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484613, "uuid": "dc601101-32fb-438f-939a-291a83bd4a79", "comment": "Malware payload (Mirai)", "value": "109227d0de65cd2d0170295e729a57973642ea7a35deb6af8c5b85a703d0719b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484613, "uuid": "05563341-73b6-4c0e-95ab-4d4ae3986383", "comment": "Malware payload (Mirai)", "value": "f0dbb0885eaf42d1934083547790c2e7c66c3272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484613, "uuid": "1a81a0f1-63eb-46bc-8ae8-03c688306e05", "comment": "Malware payload (Mirai)", "value": "13ddd9d49f5dbb4982a4a022b0836750b43b7c7d9fe5d46ee49aa54ddee5e9cd5652acac9df9bb6a0e28ceed39bda325", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484613, "uuid": "6ffb6350-acda-4bea-97b5-4822ddb1823f", "value": "T177B31A56BE82DF13C5C311F7BBAE42583B136B6CD6EA3102ED247FA123864DA0E27551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484613, "uuid": "38962cb2-e535-4d39-8567-e5a6a4b359e6", "value": "1536:ec/1V/EbQm82QGOcJfkf3qlLvTJdqdRl/I890qqzHv8OEid3NaevSlQBIyTgNC+/:F9V/U5d+3qrIdrA890quLa3W+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484613, "uuid": "a30a36df-86c6-413e-858f-f351cc62adc1", "value": 113576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484613, "uuid": "a1efc45f-6a8f-4f8d-af9d-dd5117c8665f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484613, "uuid": "8c645901-4dc5-49b5-9cb9-e28b27fa2b6e", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255448b8-0da2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771512548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512548, "uuid": "4a4f0d3b-0d95-4c9a-b232-88fa40370c6a", "comment": "Malware payload (Mirai)", "value": "89c70644b9ab482e77eaa3b4d18d2bb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512548, "uuid": "06b7556f-37e4-4bb8-b072-6240baf278c2", "comment": "Malware payload (Mirai)", "value": "11c45ff6e309f5d8108ac2c2596df1eaa0b5d077e624ae0e16578272a35724ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512548, "uuid": "199901f2-761f-4640-9207-44e8123c90e8", "comment": "Malware payload (Mirai)", "value": "b52650fc2bfd98bc23a08e009c7f45af85a7eb35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512548, "uuid": "1a3c9588-64a6-419d-9f13-8fe1696c8e60", "comment": "Malware payload (Mirai)", "value": "769635fb78bcdde6c06c9aaa873ca68d131f45d64304b58ff631bb93a8eb3b4447ef0bb2049596f61ac3ac3dcb9783d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512548, "uuid": "78ce3b69-2cc6-4049-ac15-a26f7fed4b68", "value": "T112A3299ABC85C602C5E2A1F2FB1E51CD371643B8E3E67147CD18AB29674F8670E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512548, "uuid": "a2925fe3-b653-49c0-b530-c7a1bb3458b0", "value": "1536:E4I6S0ZNrv97r5f4tCxKpvq5cm2gqCbqRWw5Wv2Db+R:E4I6lrV7SkxKpvq5cC2RLM2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512548, "uuid": "3003aeb2-83c9-45f9-a9cc-de6131ab3040", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512548, "uuid": "ed42adbb-80f2-48e7-9ce1-7e48ba399ef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512548, "uuid": "f3cb3770-05b0-48fb-b576-f3247e946d82", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb1e676-0d8b-11f1-a129-42010a9c0007", "comment": "Malware payload (PromptSpy)", "timestamp": 1771503029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503029, "uuid": "c8f99937-21c8-4bef-b3e0-152810db4977", "comment": "Malware payload (PromptSpy)", "value": "be9e8803e294e7cd5f1a991774ea81b9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503029, "uuid": "b6a39e0d-7529-4558-8182-4994e2924b23", "comment": "Malware payload (PromptSpy)", "value": "11f5c91d24c9d1eee16dacacfb9160e299544c1a854af92f79daf88364cea0b6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503029, "uuid": "12207b54-96a8-47b8-849b-849bfe3a4ada", "comment": "Malware payload (PromptSpy)", "value": "6bbc9ab132ba066f63676e05da13d108598bc29b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503029, "uuid": "99ee9e2c-361e-49bb-a78d-b78caeff0061", "comment": "Malware payload (PromptSpy)", "value": "869e1629c382ff66e108159386dadccd9bab54b02610bcb9490e25b782db66bde4b2351cf89e3d151aa95d69603be42f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503029, "uuid": "7ddecb01-583e-484c-acb4-8d72ccec00c3", "value": "T1C696BDC6E2954C2ADBF64071CD5A92B1671A3C1E87F38AB77500B2D838336D47E69BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503029, "uuid": "22ff8e9f-e200-4efc-9145-f37ec8b1b2e5", "value": "98304:kTGvSHX5aL6waAk1ks+0arZrZBb8ysANFlV8iBDO3SxzKVjtdZNTStD4e/957bMD:UG1O1n+196yv7x63izKBnWtDtj14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503029, "uuid": "4703f560-9e2a-43b3-862e-8e6fb74e3c30", "value": 9034250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503029, "uuid": "bb060ec1-5514-435a-8644-6b91ed2023f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503029, "uuid": "387fb745-4923-44bd-baf4-a7bbab7a4992", "value": "app-release (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031fec8c-0d9a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509055, "uuid": "b0ba073e-5dad-4f13-bafb-9e66de0147f4", "comment": "Malware payload", "value": "dc63d61ec2c2f004e25e89d0ee7f56fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509055, "uuid": "5c4035ac-d016-4544-b188-0aa94d9b9cca", "comment": "Malware payload", "value": "12a8b3a84edee0911d548e92dcff18de315d48a5f116e2639768b434ee07cec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509055, "uuid": "f05a863b-ff1d-428f-9717-01de799e51b7", "comment": "Malware payload", "value": "044617ce8fe94bf7419843946f7bbcfdd349de9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509055, "uuid": "690023a5-0120-42bc-8131-92e997abaa72", "comment": "Malware payload", "value": "2a678f44328e2d60dd1756d0b134a00adb346a71c62c715ee1d506f6f8cab401293e9e82fb8bd07fee83462c9a94126e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509055, "uuid": "ed2b5069-bcfa-4c1d-974f-1e209d580642", "value": "T1C7F423A6A8D47A90D56173308831CC6849B87871AD19733FC329F57BB870383D963B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509055, "uuid": "8c9558b3-b1e4-432b-b7ca-b2fe48ca1a07", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509055, "uuid": "19a394de-606e-4b35-a950-1f19b0ecc6eb", "value": "12288:Zz7hU5I5yuNHIgzSFKxWltRohBfSTso93UZBff6ZB4yHm7DjkXU3x2+p2Sq3oFCU:Zf+iN57Gtene3aQZmqm70XUvpXb/6r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509055, "uuid": "65bb9065-f0fb-486c-938e-6c83e079e664", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509055, "uuid": "301ee95e-95ca-487c-98f1-2cfd4ed7cb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509055, "uuid": "79dfa7c1-24bc-44fd-9b53-fab9536f6dc6", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b79fea-0d87-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771501161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771501161, "uuid": "8087924f-6e04-4e1a-9300-40d3fb4d46ff", "comment": "Malware payload", "value": "fceddc1f970f9b0c6ff7652607669280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771501161, "uuid": "7e64f2d0-9f70-475b-b336-0bf31ccc90af", "comment": "Malware payload", "value": "1325a627124c5372e5825fa7329c76ea0f421ea96574fc42e7ea18c783692ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771501161, "uuid": "4a3dc23c-fdaf-43f4-a0b6-7c1339819fe0", "comment": "Malware payload", "value": "5ab3f37962641f00a89b4afd2f0e19dab17a31a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771501161, "uuid": "c1cb2e9e-20c9-468f-8d2f-beac2163f804", "comment": "Malware payload", "value": "b4cd8904c5d800fd6d26d5b5f86abac57dc3d6a86f36c25028b12f2d39563523b11cfc4a94a5a7064d4199c0f22c0859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771501161, "uuid": "6c949ab9-8bce-4ea4-a2f5-5a8d2b156f90", "value": "T1AEE73380713681FBC8C1C9F5BA2696D6DB09BF4802D6713D70DF7936B134A59A138A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771501161, "uuid": "f5aac768-c405-44d1-b18e-a78b6a83cc84", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771501161, "uuid": "73738c1e-87f6-4aa9-a41a-2c2f6f019f38", "value": "1572864:vejOYfm8BrC3qEzaT8rLXpHhxwLixMA6rd:v4JrC6EzaCLXpHhxwLix/6rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771501161, "uuid": "2e4981be-0510-4d36-a788-1ae4fe5f8227", "value": 69326232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771501161, "uuid": "e1b18695-a7d0-435a-afb2-f3c2864f9190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771501161, "uuid": "e8f2d957-3f5f-4710-a960-b36855dcaa0a", "value": "Webex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a1443d-0d69-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771488012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488012, "uuid": "82b0dee5-898e-409e-b0d3-83ce669cc1d3", "comment": "Malware payload (RemcosRAT)", "value": "71a470805c9aea2600482d0dce53dc58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488012, "uuid": "ef2dfed1-d46f-4f9d-bffd-5b6cc19bf216", "comment": "Malware payload (RemcosRAT)", "value": "14f718e3f15dd384cd37aa53a901288decb9addf7e5852937ed35d610368f1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488012, "uuid": "93eea3f9-99da-4668-b05b-d342e77cdbef", "comment": "Malware payload (RemcosRAT)", "value": "48f56bebd2f68e4102927b0bbd441f0dadc2eca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488012, "uuid": "24ef04e9-50e6-4eab-8887-8d7409504602", "comment": "Malware payload (RemcosRAT)", "value": "92a5bf9e4a68be286c8091049598413688b1544267de548e4a870666da5bade78a183ed6646c5e29d55f8aaa8d2c5100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488012, "uuid": "d8dd5cea-940b-493c-8849-5379f3b0d525", "value": "T1C55501DF310460A9E81CE4F6D4234FA18E619D3BD9A035CDE6C5B71758321E2B22EE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488012, "uuid": "8fc2dfb2-c803-4d40-8ea1-24dd221985af", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488012, "uuid": "84d2a971-ce32-4970-9207-eb127b6ef22a", "value": "24576:OoG4uohoCHbGdnJpDmAcgaVePNbso/sJHh3NF/:RGeXidJkAcg74lNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488012, "uuid": "8097e795-b399-4f87-912c-875c4582a4d5", "value": 1327808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488012, "uuid": "c73a9b3c-9570-40e5-98fc-9530254a2a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488012, "uuid": "ab2805bd-8ea5-4708-8ac4-184a41e45444", "value": "rMateriallist_TDSandSpecifications_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa7a933-0d9d-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771510759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510759, "uuid": "bcfa20f4-7662-41de-83f1-b67c876033cb", "comment": "Malware payload (PhantomStealer)", "value": "328778137faaccef0bc009d29e911ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510759, "uuid": "a07bfa9f-d770-4e73-9804-414b7bba81cd", "comment": "Malware payload (PhantomStealer)", "value": "16a077a72759886ef0d75bf397268220526228d79177fa37242a04d176106dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510759, "uuid": "8b637fd4-24cb-4db9-b40d-5b0778e942c6", "comment": "Malware payload (PhantomStealer)", "value": "87a7774c2192f113686466a898aaf7e5f32ac0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510759, "uuid": "2582f207-1198-4aa7-8e90-1a4a37ef6d6c", "comment": "Malware payload (PhantomStealer)", "value": "4f108255dc3fa68bd9545df6c70c651c9bfd82aae37bb482028550d3687b09c2f861b6413ee421ed5d3866922395b64a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510759, "uuid": "257f5ba2-1748-40fb-a50a-45ee4e81f36e", "value": "T12575E00273C1D062FFAB91734F5AF6115BBC6A260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510759, "uuid": "ff444979-d4b2-494b-9b95-59e3127c08ed", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510759, "uuid": "a97d240f-5adc-458d-9abd-44b1fc5098c4", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaPBfu7z6KBHs5FFOYvxF7pUL+7E+H8Hd+2X:FPVt/LZeJbInQRaPIH626FLxwydHyU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771510759, "uuid": "e94fe463-4611-4d17-9dfa-4d5e33819f78", "value": 1695232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771510759, "uuid": "8dd5d740-a7a6-4b48-bebe-c7c1ba0b7ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510759, "uuid": "9ad2501a-5198-4c19-8b29-3d512b7fa04a", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb924f4-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512076, "uuid": "fc481559-dac6-4efe-b894-af0158cd5ba8", "comment": "Malware payload (GCleaner)", "value": "12d285f08a8454901d5dcbbf9d83a764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512076, "uuid": "49bc208b-73d6-4408-83a9-212658ff0545", "comment": "Malware payload (GCleaner)", "value": "1a3af553659746b2068c87cd45eabd4d01147342f20339b80afe01d0697cf857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512076, "uuid": "d15a0449-8fe3-4cc8-8713-d7b2f6f6c54b", "comment": "Malware payload (GCleaner)", "value": "ff675dad74a670ba28e57696effcfa16351bf535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512076, "uuid": "ff2c437f-3185-41b1-ae9d-d90ff17e4d90", "comment": "Malware payload (GCleaner)", "value": "1966341f72008f362077e83694f9524a5e5e5754b7bf6954ecf38e6bc14ca15566b1dbcdb7d1ebe366224851f51edde3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512076, "uuid": "cac05c36-87b4-4de6-bce9-4833e16cf793", "value": "T18026E060B1691231E27E4B3D873AC7DBF7FA34AC97E8C10E62845AC00AA754557386F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512076, "uuid": "b00bbcf1-f7f1-4959-ba24-3dc7787d1e8a", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512076, "uuid": "7d961511-d210-4a02-935b-9a3714c6ac75", "value": "98304:AEz3SsTX8JcCwVz26rAFFUSdSdRqLYYDn/h0kybMAU:AOrX8JcCS28AFFUzdRqFDnMbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512076, "uuid": "afc43c1e-a4e7-4768-8753-22fcdfa20483", "value": 4563968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512076, "uuid": "48f15af3-6bcd-48ef-b341-036367292b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512076, "uuid": "b78aab25-d337-4c93-8006-4d509f798983", "value": "12d285f08a8454901d5dcbbf9d83a764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d76ccc-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493415, "uuid": "d5aa2879-dd60-44c3-b091-6ba6c1c98e94", "comment": "Malware payload (XWorm)", "value": "7a2c16969b20a6e7f257ac49788e048c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493415, "uuid": "c21d5ce3-bf95-4ac8-9f8d-fec2551f469c", "comment": "Malware payload (XWorm)", "value": "1a74a399470680af7094c655dfbf2e2852d636f1c23b4837e99a4778ca3f746e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493415, "uuid": "a1621134-3c1b-45ba-833f-ba9bb55f869f", "comment": "Malware payload (XWorm)", "value": "ea194f095e2a469dd7ac941403791a18b0c07012", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493415, "uuid": "584826e2-71f3-4f77-abf2-c5770578685d", "comment": "Malware payload (XWorm)", "value": "b08f11bf420114757a38e7b355b4127d1c529b14635f9764d21b18c5ce51c969c69abfd54d8a5165b6f985115fdd54d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493415, "uuid": "63455343-a2f5-4111-84ae-c217b98c0374", "value": "T18A8417B0DA1001778F87BB8CBCA50260C66DD325856709A0FAD9CB0D950EDECF77966B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493415, "uuid": "8eca01b9-cff4-4edf-a2ff-ccce46080248", "value": "12288:aeblDgGTVF2iXltRjoKg1SDs1t6HopNeldBpt57TiDffIV:3blDgGTVF2YKKg1SDs1t6HopNeldBp3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493415, "uuid": "0a1a4b47-510b-4092-a3b5-19deb1961434", "value": 396669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493415, "uuid": "8a3d7e41-a9b2-4cad-9be5-a5f213be8d56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493415, "uuid": "dbf96b59-fd31-4fec-8cb9-dfdd2a5401f9", "value": "Antimonsoo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a615cc-0d8b-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771502650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502650, "uuid": "af28184b-376a-4217-b5fd-1af69de0c1e1", "comment": "Malware payload (SantaStealer)", "value": "55c87e91299305ff7b187c1c86168d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502650, "uuid": "fd88631b-b008-42a0-aa68-464716da46d3", "comment": "Malware payload (SantaStealer)", "value": "1aa1df929ec2ae17313108b77afad3ed644f1a6aa21978db86190959ab029b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502650, "uuid": "3dc3f8db-573e-487d-a4a0-29c3bffee200", "comment": "Malware payload (SantaStealer)", "value": "be211290f93ac9e4551c1b9e13ce9b4147bea57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502650, "uuid": "9a35e649-ba9a-48f7-ad4f-ec300c92066e", "comment": "Malware payload (SantaStealer)", "value": "53f99a708119aac9dca38888506d3e3cbe817a4c536283678c13a1a1b410e862ee666d1c48081dca1f8e4ec33ff6773d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502650, "uuid": "640c2773-5ccb-4391-8672-dd525b76c029", "value": "T1BBD5AE0AF55349D5CC6BC0BC839B7131EB317C69CB242EDB17918B613E55B806B29F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502650, "uuid": "a545ea4a-163e-4e80-b8ab-9f3ac0bd5e64", "value": "1e71a6dfe71991a69e79c1243f113f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502650, "uuid": "49f40d21-9095-4637-9212-8beba00ea600", "value": "49152:EXzKVxKbdjNu40J41Rx/oKCQOydhYMJucKK6q3MqCc/9k5Olo:EjBbIMx/oFQOyrYMkcKzjw9kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502650, "uuid": "2d169160-7f0e-47b2-a73f-f696fcad1151", "value": 2992128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502650, "uuid": "3b5fec92-471a-46c5-aefc-5e278f64af2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502650, "uuid": "38823edf-40eb-43e0-97e7-b341e322b3d6", "value": "x1aa1df929ec2ae17313108b77afad3ed644f1a6aa21978db86190959ab029b0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163f096e-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482888, "uuid": "a33745ee-1404-4e4e-a4f1-64f3945de312", "comment": "Malware payload (Mirai)", "value": "aafafdb027de087d7b37cd30e7ccf251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482888, "uuid": "35710e8e-cd75-4180-8e15-2fcd9a6f8144", "comment": "Malware payload (Mirai)", "value": "1ab85a1a4d6694858dd7507e5095313643bb583c77f61e6b139c7f78f5909f1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482888, "uuid": "d56a8b90-f603-44d1-9984-1f45a3662ed1", "comment": "Malware payload (Mirai)", "value": "76630d789c84dcbc382b5b3fa93655b7de5b5e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482888, "uuid": "92bc8572-300b-47ad-960b-38d3124c95f5", "comment": "Malware payload (Mirai)", "value": "06f614f7e59c7175972f0c7ef906dc274422f30e23f01ced01e631546a7dcf3c8dc36a6fe793f4e1771a963069c8b051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482888, "uuid": "979e6d3f-46da-4141-895c-223d04b048e7", "value": "T147148060FA0663B1CC730A38679A2E5A6E7704159FEB26312D1F533DDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482888, "uuid": "0aed46db-0d44-470a-b5f3-992b96dade68", "value": "3072:8bX5sLSIxMftAvSWnewnKRp7b7s4kmyliGX2UKQ:83ttISser7sXmATl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482888, "uuid": "be347d01-dbfc-43f7-a80c-2bc2b2818595", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482888, "uuid": "d8703171-65b1-45fa-a95a-2fd960827fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482888, "uuid": "c3f070db-345c-4397-90f1-b3ab6366225c", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a02d98-0d9b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509539, "uuid": "413a4ae9-1800-4486-ab24-238ef1236dee", "comment": "Malware payload", "value": "5b2ad4a7baea54d0158b884129b94b75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509539, "uuid": "efaaeb54-8f29-4ea5-8e04-fb2775de968b", "comment": "Malware payload", "value": "1d2c95eca2c5f66512f9c3e7ca7232cc6de46cc731bacefea8dc31e636a9a2e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509539, "uuid": "117f6686-569b-4a5c-b847-ea30907ba4d1", "comment": "Malware payload", "value": "6c18affa74dd6e1a4c6d204752534383277c57ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509539, "uuid": "3c3f57da-f674-4c6b-a4ba-b259ebe39c1a", "comment": "Malware payload", "value": "7fe6e906b84ea8649dec4abb3b77b3ee323fc9836b746608a12680a3fef395a2ddb5d99346b0ed7974e20834b75bdc7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509539, "uuid": "ab3605a6-6f45-4c59-9d48-0a9445f39dd7", "value": "T1FE06B096E4862F94DA5D9F2CD07F020B2634F58B6D45248FB256FD4FBE97860120EBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509539, "uuid": "91c2a33c-82aa-4972-b355-50528613560e", "value": "49152:naD6wlCLJYmJ5e8gMbOoVRJIJgYrbiIJwk02ANoJuBQgRQbxfephL3DNhP2MOYxt:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509539, "uuid": "15f89c59-1729-428f-9020-8fe878bd8da9", "value": 3989475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509539, "uuid": "2ca64a58-bcfd-4d3f-b98e-d6c911290891", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509539, "uuid": "39716d71-ea14-47ba-ab2a-49928310433a", "value": "New Purchase Order and Drawings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee4010d-0dc7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771528536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528536, "uuid": "7f1deb48-14f4-45a3-a4f0-6c8be452f437", "comment": "Malware payload (Mirai)", "value": "f2585a7154eeea4e3fa96f23e1691b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528536, "uuid": "2359b9a0-fc3c-4981-b18c-08e9809b3a39", "comment": "Malware payload (Mirai)", "value": "1e8493f5691bfefbb6c563018ba32bd53e02e2606ba08160b02258f6cb2bd7d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528536, "uuid": "548a3a26-5614-4b99-81a2-8a888423eb0c", "comment": "Malware payload (Mirai)", "value": "492222adcf75d2643d51df4eaf1cae67337b543c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528536, "uuid": "b5b4f0c5-68fc-46ed-9355-37e0c95bf077", "comment": "Malware payload (Mirai)", "value": "7e331705375372a9f0af06440356e1a8a5d9d8641e73c7161444dc7862e8c70cf9aeac3d7f0207b3d9903bb6c2bd046f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528536, "uuid": "4d989a43-1e52-4443-90dd-4dec962bea46", "value": "T1BAA32B8ABC85C602C5E1A1F6FB1F51CD372643B8E3EA7147CD18AF29674B86B0A37151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528536, "uuid": "cd6dbe7d-ef16-4bc8-aa83-f1b4fe7bc95b", "value": "1536:JCroZnbaqB8Pz184PXCIPQt/6SkBCMaz98+OVcCgBvLn4b+R:JCro5VGPvvCIPQt/6roRhcghLn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771528536, "uuid": "b35d3f9b-acd3-4bcb-bb5c-a5949e72b6dd", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771528536, "uuid": "66628ec2-7c7b-4c6d-ab6a-88e9899c8650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528536, "uuid": "40381bec-c494-4982-9eae-a57891bac12e", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1675a8-0d5e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771483706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483706, "uuid": "3c05baad-1808-4df4-b4d8-6f590e4fb031", "comment": "Malware payload (Mirai)", "value": "53448f4dbd4b0c562581aaa4b14c42f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483706, "uuid": "c20079eb-c742-4db4-a209-8799a1f548f3", "comment": "Malware payload (Mirai)", "value": "1ee7e31f927a4a9a5341b3f1a5b9544f88a68197949bae2409a41df883eca957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483706, "uuid": "7a8a4a23-af13-4020-bc52-ebf0f00667d1", "comment": "Malware payload (Mirai)", "value": "9fbaa825d2794d545749632ae4fa4c60f92c287a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483706, "uuid": "2c53e006-10d2-4f91-9a1e-1336b41640e2", "comment": "Malware payload (Mirai)", "value": "beaba7bec0d92f84c25025ee73f8a3bdc75cfec9791e378826e7a5e3d53c5de5e02b778e8a8840413f43509d6097b41f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483706, "uuid": "a3e57d05-988a-4077-bf4e-8d739764bc9b", "value": "T16204392F358191F0FA411B746BCBD3976C290BBF519990DF6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483706, "uuid": "6e636ebe-30bf-4799-8c7d-0be771bc6295", "value": "3072:XsYcnTjVnSJkW26nE50YNnLBp+RR6zgOKNAHIm/NIp1QKq55eWUX3:XsdTMTES0nLk4ncoFIkKq5MjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771483706, "uuid": "d6141f57-edaa-4f28-a2b1-b5e2c5b2e8ed", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771483706, "uuid": "6b218527-de5a-455f-a748-8297c7b7f17d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483706, "uuid": "285d6ce0-aadf-4755-9d85-c9bb1d35ca84", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f54225-0d74-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771492985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771492985, "uuid": "dd39af88-be5b-47c3-a369-47dd6ec64686", "comment": "Malware payload (XWorm)", "value": "d5c8f776df9750a8e6fe2da651a28f78", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771492985, "uuid": "7dd7062d-a4cc-4335-b5e7-983cd1bad2fa", "comment": "Malware payload (XWorm)", "value": "1eea69be6c5274258ef70607632a375fc42245930530a18d849db485a306525d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771492985, "uuid": "7be9add5-e571-4a5a-98ca-32f01bcc9895", "comment": "Malware payload (XWorm)", "value": "3a4d8eecd0c72b66936e45e12c36df7f4e36d9d8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771492985, "uuid": "5355b21e-dcad-41a4-b1b5-227b48912b2d", "comment": "Malware payload (XWorm)", "value": "287293eff1612413a8dc14b50a507b9d13d739cff5d112c26842d63254aa44733040ac7b7ee83c818c416b021b7535c2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771492985, "uuid": "f37e6cf4-2f8b-444c-8de0-be383996c020", "value": "T10A45C8E5FF35500C85CAF52FAB16214D682E935A4D9F71860DF2C268980EE246FB706F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771492985, "uuid": "d02ea6c8-7315-44e2-a090-a46a758d8fc1", "value": "768:v1blvBEIkfJkq6nEmei7urkFuwSuVE78lP5i:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771492985, "uuid": "602d461a-1429-49d6-b46d-862ad75c277f", "value": 1251704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771492985, "uuid": "4b8ab79e-8988-44fd-b86d-590c18048469", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771492985, "uuid": "5d2f983f-3c11-4a4f-b9b4-2f645b0a9227", "value": "REQ#9533 - Pruches 19022026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10ac595-0d65-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771486610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486610, "uuid": "d0be77ba-827e-4fd1-9a76-5074138acbf4", "comment": "Malware payload (Mirai)", "value": "5271ed04f4bf500f4fecc94e38d9344e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486610, "uuid": "7d7f29de-23db-4e05-a755-3373665ad1fd", "comment": "Malware payload (Mirai)", "value": "2053ece66644c5641208ca75d47e9ecf78ccc71b7edfcc15cee7e49579f7fc1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486610, "uuid": "e8779a62-7ee6-4c1b-a07a-c8be9691b436", "comment": "Malware payload (Mirai)", "value": "5e96684f9a1e40137434af8a301dcc0bec153b44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486610, "uuid": "6014695b-5775-4851-bfa0-18d3df97761f", "comment": "Malware payload (Mirai)", "value": "c7e961d765d8ad01f95ff8f272a82c015aec04b31fbc4d911ac39397e9560240539f48531ffe952a427d3780799352c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486610, "uuid": "af1b2cfc-10a3-4664-8678-9075f21e5e16", "value": "T1B5E3860E6E228F6EF769C77143F78E30975977D61AE1C684E16CE5401E602CE241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486610, "uuid": "eda2e879-e4e9-4706-9b09-cacc8ea11dc5", "value": "3072:QpKag1xg4/pUKSoV9ykRZQhRDaLF+5mf6qlL/:QpKL1xz3TNg3ap+5LcL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771486610, "uuid": "d56ba49e-161b-43c6-9cf6-280e2b3fee27", "value": 152988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771486610, "uuid": "4aa4b384-7f53-4710-b16d-de15936cc534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486610, "uuid": "6e30cc61-12a5-4947-94c7-dc05d8671d89", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafad1c5-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493579, "uuid": "f2b6b724-d8f0-4933-8c7d-a7ddacf14185", "comment": "Malware payload", "value": "672faa5e4ce0a1638d13bebbb3db9c26", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493579, "uuid": "da66d65e-05ea-4b52-9a97-5ade23e51643", "comment": "Malware payload", "value": "21354d7b35659d4e18f69eb30c6537948e45368f7718e6fa4cf15083d7065450", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493579, "uuid": "7841772d-aa59-4f26-8940-1c6265cd0a0d", "comment": "Malware payload", "value": "4eca5b5d6e64bfc9844803fecf3db9f8532567a1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493579, "uuid": "d3173db3-82d3-4df3-96be-2358ac338237", "comment": "Malware payload", "value": "9c2778ed43ac8bf6e76f43ccc1beb551b752f8987c5a4e5f7d90706b024b41f0e667ceb87a9b8a8d1ddb23bbe8d6fe49", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493579, "uuid": "4390c940-c87b-4fb4-9caa-ed1cd5d5aeed", "value": "T153827737F658EFF80B1F51E1008B6D01505457A6B53A49BDA8DEC0987F2A7108EEA8FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493579, "uuid": "22b455ce-c5ad-45a4-b26e-214741330459", "value": "384:sD7pRQqZdU9hg9gxuPBs3D0kxijj+C/qP:CpUTxIuINlSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493579, "uuid": "b5d0fcf6-3608-4746-8b5b-98f4ced08f22", "value": 18254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493579, "uuid": "29ede2de-f165-4e6e-9f7a-44046779316c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493579, "uuid": "765844f2-3fa4-4820-88f5-b2c453f254e2", "value": "Revised pi_18_02_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f823e914-0d8a-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771502594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502594, "uuid": "79f690ac-242a-4c7c-8230-34b90d35caec", "comment": "Malware payload (SantaStealer)", "value": "2d8cd7f71ee96307da390f09028790af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502594, "uuid": "2dd905d8-1deb-4167-b1ff-41d5a81196a1", "comment": "Malware payload (SantaStealer)", "value": "230212c075f002078b06b01c9a953b390dea05e2bf22a43bbd3c29d6c4bdcbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502594, "uuid": "3ad6338f-4ca3-4c09-bcb5-c572a46e754e", "comment": "Malware payload (SantaStealer)", "value": "db7ec05aba75b6a709b3cd175f64c85e97849ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502594, "uuid": "7b7ca523-3d19-4e2f-8be7-fbe2abfdb0d9", "comment": "Malware payload (SantaStealer)", "value": "f4990d7be331357b69f64546c1bfe8518b908d17b3b05ee7c936e1560dce23d3b0ff981fda2e533b5615c293bd284b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502594, "uuid": "a19667ab-c88b-4de3-b05f-979c2f3dfd5d", "value": "T1F7E53335C182197CEB42CCF8A8F7D2F8AEA2B851046D197E79ED8B557A1ECC14317A70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502594, "uuid": "15ba471d-d7e4-4c0f-8546-99ec725c872e", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502594, "uuid": "ddb7f70a-e37f-474a-9ae4-d08aa7286686", "value": "49152:th/10Gf1FYkFrffk58Y0KaTvIxl422+/ju8eiWCRsOvb3fP5Q5Qevtzfmhuh6:t8S15D/NKaT6gWuOWCCOvT5Q5V5fmhuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502594, "uuid": "e868ec7a-ac1f-4499-9a1e-176180b25949", "value": 3126784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502594, "uuid": "0a7c3cd1-9000-416f-9492-1d27d3a0aa59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502594, "uuid": "972e9df2-01f9-48a5-9b40-15a4204f7dc9", "value": "230212c075f002078b06b01c9a953b390dea05e2bf22a43bbd3c29d6c4bdcbb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c80354-0d6a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771488650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488650, "uuid": "111f88ec-1efe-4fa9-8697-466f555517cf", "comment": "Malware payload", "value": "63300cd99de6a95b8359ea1a20b12ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488650, "uuid": "51fd00ec-61b1-44e5-bb87-8f8aad26556b", "comment": "Malware payload", "value": "2340e4f1e94232b12861cde3bfe1bbd81e42cc5d85fbf07b44feaee57476fc67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488650, "uuid": "68ba4c4d-7458-4dad-8894-34dbdc6fd4d8", "comment": "Malware payload", "value": "d50c2629a0f95aed3c3e487d225dfbcaa5599d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488650, "uuid": "f84b5029-1d15-44f0-bdd6-7a03ad9e4344", "comment": "Malware payload", "value": "0622c09d3877eda4dd74a0d50337e88f79c7a859f87c86bd9a58d0e7a416eb918f2d1c2072a0a3325e5641f8f5da1e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488650, "uuid": "5f872349-69e5-4fb6-951b-b04a0b18efa3", "value": "T12AD6338273F859EFD1F3123251A3C496AEB6B8C55732C9CF0B7811921F6B1914A7AE70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488650, "uuid": "6fcf333e-f0e5-4eac-9dc2-5a3f06b852c4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488650, "uuid": "9dbaa9b8-6606-434b-967c-3dc28be60647", "value": "393216:/85vzGf8uGN1+TtIiFGvvB5IjWqO6eCzO2pqUmeA:k5vzJuGN1QtIZX3ILO6el2pGeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488650, "uuid": "5aedbbe1-063e-4689-ac13-dab645400051", "value": 13137124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488650, "uuid": "83799ea9-302f-44a6-b59a-8d7d4e494e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488650, "uuid": "7ae6c5a5-1af8-419b-aec5-11e1bdcc75c5", "value": "63300cd99de6a95b8359ea1a20b12ce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302b859f-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493239, "uuid": "786da4ef-8e34-4d7d-966c-220a72d3134e", "comment": "Malware payload (XWorm)", "value": "f803d04e5ef6638e2224a040016121e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493239, "uuid": "d4631ee7-2f39-4997-b1c3-a1d39ad8ef93", "comment": "Malware payload (XWorm)", "value": "24680e723b51232178e6f746f3192197444d1950faeea2aced3730afbd526204", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493239, "uuid": "d6153200-19a3-4056-b8d4-e8bd0d4c7304", "comment": "Malware payload (XWorm)", "value": "243c47cfc122887720c11a837481b9096fe19033", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493239, "uuid": "2252d82d-5852-4758-b779-510a9cf24cad", "comment": "Malware payload (XWorm)", "value": "1fd811be334b5d6bdfec8f81853122b26f1f518b02ffbec855d92ff7c117dc440aa013661406b255c73a46bbdcd0fa0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493239, "uuid": "1c40dcb1-b44f-4478-8442-ef777b63013e", "value": "T1448406B0DA1001778F87BB9CBCA50260C66DD325866709A0FAC9CB0D950EDECF779667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493239, "uuid": "72f65013-9232-478d-8b07-8f4f16baf25f", "value": "12288:aeberPGT/F2iFItajIZdTmDI1iJ2ovOd2dPyIz7TiDffIE:3berPGT/F2qYZdTmDI1iJ2ovOd2dPy6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493239, "uuid": "bbbf4614-3c01-484f-9dd2-246daf42aa28", "value": 396923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493239, "uuid": "e1b8ee02-865a-405f-8a1b-8b1b0e88dd6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493239, "uuid": "0b3790af-897c-4e29-a297-114fbd13a930", "value": "SH09876546789000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6d452a-0d4c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771475842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475842, "uuid": "f79a71da-e07d-4d08-bf3e-b8dfe07941aa", "comment": "Malware payload (Mirai)", "value": "e2f2ba47c8b4247bfc75d2bcbcdba1d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475842, "uuid": "da7bd3d7-cc9c-4381-8f71-f09f07de465d", "comment": "Malware payload (Mirai)", "value": "2489bce156c575ea520d23b5a6a44172c069c7b80f0299cb645baebc1dbec6d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475842, "uuid": "c6b27454-aefe-48a8-90d7-335307732459", "comment": "Malware payload (Mirai)", "value": "f51d13a2a1512b10b79c1aef8b81d63bb4fb5445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771475842, "uuid": "87f3ae4c-c0bf-4edd-a6ca-bec798d299b2", "comment": "Malware payload (Mirai)", "value": "03a57947747ea5700cca5f18a2d1b64001347c02885045c14f5b205e13c00c2d27e40231aee0b3060683931d73b0187c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771475842, "uuid": "b5282b6f-ef49-4b27-9a86-8ff609bdf323", "value": "T18E04392F258191F0FA411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771475842, "uuid": "5c3f7057-d746-4126-bb3c-8db4dfa86a23", "value": "3072:ug8JifJCLRSk0L6L4CUbGyJltg+6TgO/NVGLxNxKurrz55UlUX/:ug/V+8rqyJkn10Dx3rz5emP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771475842, "uuid": "98f1d8f1-c7c7-42a9-b326-c55944b74602", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771475842, "uuid": "38c499bb-870e-4d3c-b86f-a5027748e57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771475842, "uuid": "2f948f5f-30e7-4314-a734-c58598eb957f", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16baf78-0d9b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509884, "uuid": "3246fb26-0839-41a3-b2c8-23e1cbc0daf8", "comment": "Malware payload", "value": "2654c08491a0f7c4a3dfc6282de5638b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509884, "uuid": "045b504b-7865-4ccb-a6c7-f095ff78364b", "comment": "Malware payload", "value": "24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509884, "uuid": "05d82354-de5a-4d9a-8a77-81f5eed90c23", "comment": "Malware payload", "value": "4b8ab808442bf7cb084fddf983a558c2cd4b3ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509884, "uuid": "17ebca65-b399-4064-b8c3-901dbcd38ebf", "comment": "Malware payload", "value": "ad2765b0dec9c1a8244311a3953b4d468d3b764d710446b627aa7dfa9cd3d79cccb1f33bdcb217bc1e9825ce35575409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509884, "uuid": "70d62ad6-8e63-40ee-985d-6b401edab8c0", "value": "T1A5869D04B7611CA5E19AC7348B1F95768DB4BCA20B24841F897EF2462FB7933E71B631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509884, "uuid": "ff59776f-bd7d-46f5-8bba-5c5d528ea4d9", "value": "98304:C//zl7M481oQdM5JH5eeGU19DGEIZDtAv5Ew+QsrtaDcE:iQ231DtWDyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509884, "uuid": "08907259-3892-41a6-8748-0cb9332f19ad", "value": 8187704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509884, "uuid": "777aa638-1371-41ec-8700-913c3bbb9a3d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509884, "uuid": "ba8f7d2e-514d-4528-886b-ec8fc32925aa", "value": "support", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594160e0-0d62-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771485148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485148, "uuid": "e154a0e9-9570-4f23-9816-4a2ee386911d", "comment": "Malware payload (Mirai)", "value": "033a9fd5f556f735c6b756df25be34b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485148, "uuid": "983625de-7e2d-4e55-9c67-1fbf8e027109", "comment": "Malware payload (Mirai)", "value": "24b297c13e1b260f45ebfb907a5180c938941abd391e5bd55e7455f87954ec5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485148, "uuid": "9c8d514a-fb4c-4e4d-9e62-8b1303f5b7ee", "comment": "Malware payload (Mirai)", "value": "72b4e62dc763c2244975192f9307e37392822a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485148, "uuid": "e1c7b235-be4a-4c1e-80f4-769e1bbf95d9", "comment": "Malware payload (Mirai)", "value": "008bde2952902068aee2b5d0869659ea586cac32cf87ec1210eaf57aae440aac1bee8b628712fb472bd80db668c81228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485148, "uuid": "6dd871b8-aeae-4d68-854f-ff5a7a0bb50d", "value": "T132A3D705F9404B13C6D267BBF39B83CD7B366658ABD7330295297EB02BC17992E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485148, "uuid": "de022f19-2c83-4dbb-a077-e0a48f7a9963", "value": "3072:lqDUOulvQ+nozmrCppEDtkLWN5h8MbKZlrDoeZNi:0pEcWN5h8MbKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771485148, "uuid": "21f8b117-365a-4b04-ba57-d593334c8bb4", "value": 105417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771485148, "uuid": "6a4b110f-c748-429f-96b1-21f11d7f7b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485148, "uuid": "c55c1b93-ddf6-452a-9d99-a56f7bb2a392", "value": "yakuza.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6549202-0d6a-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771488847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488847, "uuid": "14bb4a1a-1d5a-4f16-837f-ad14f0fa6efd", "comment": "Malware payload (VIPKeylogger)", "value": "aa3a6c175ce21a921163c4701099268d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488847, "uuid": "d7873637-1240-4926-a155-98a0ad9268c1", "comment": "Malware payload (VIPKeylogger)", "value": "24d6cbd8f4eb920651f82adb1288cd4d5227f6bcd8fe71341ebdeb434bbfae01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488847, "uuid": "53e5a213-5b01-4734-a757-bd0d60fd1a6f", "comment": "Malware payload (VIPKeylogger)", "value": "3efed1ceba40a9e82c261bacd1389f467cc0d706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488847, "uuid": "e860007c-912d-41dc-b05f-a88abbd3d538", "comment": "Malware payload (VIPKeylogger)", "value": "b18c9cc70764e6ab7b892161ac9e124f4d762d050d4fbef406deedf407b4759ce0963dc6372f0302fc65e68db6cfe29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488847, "uuid": "b4c5e62b-565a-48c2-bac0-7a2386c51e3e", "value": "T14825BF2537F50A44F4BB97394A360E5007F0BD528923CB1FAE5940FDA939BB19B62723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488847, "uuid": "d80c5ba4-3efb-4d55-9c6f-db46dcf9a095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488847, "uuid": "d39ffc59-1a23-4f52-91e4-ac946c49db03", "value": "12288:rJ68Cq7Jb8G26y7p3YS+quCvCY6+6WGEJ5Bj32YI1Qsc6F3lrK/CD+IG11Pj5XUN:thP4lTp3YHdCvVGEdsjF3lefH111Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488847, "uuid": "d4f4c669-8f0c-4bc2-be3b-7879b6207947", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488847, "uuid": "8b4cce32-b1da-4352-9929-cbd68361dfec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488847, "uuid": "7fca41e3-8d0d-4f7a-96ce-b1226a451d0d", "value": "F\u0130YAT TEKL\u0130F\u0130 VE TEKL\u0130F TALEB\u0130 -T\u00dcB\u0130TAK-SAGE PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfc990d-0dc4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771527513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527513, "uuid": "80b5ece2-953b-43a8-8d03-eb200945a255", "comment": "Malware payload (Mirai)", "value": "995a351e8cd020f2d769df9484569807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527513, "uuid": "8f6c88d1-988a-438f-84b6-bc64279a05fb", "comment": "Malware payload (Mirai)", "value": "258756b3c892b221fccaa515d7a57f886f670679e2066a1e382328aba6143a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527513, "uuid": "818810c0-f6ce-4992-8fb1-bca5808871bc", "comment": "Malware payload (Mirai)", "value": "3798061dd728ed2b5c6ad5b7d7b811c87aee6c87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527513, "uuid": "0f978397-e4e9-4c2a-aef4-9479f0c77adf", "comment": "Malware payload (Mirai)", "value": "b419c160393c093eb2130b2592906ace45465607ea8f6fba889e53577ef4b47f7da6605c2825cd812c6cd625cf0cfec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527513, "uuid": "38c08109-f844-430a-ad83-39d64c1843b9", "value": "T160043B46AA404B13C0D627BAFADF424633339B5497EB73069528AFB43F8679E4F13605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527513, "uuid": "cdad6cdf-e168-4fb8-94e1-b10e78037a3e", "value": "3072:cZ3jFFNr5wZscdaECL8l5y+30ehLLlU3RDrRoNM/RVq0PAFuy:cVjtr5wPdaECL8l5yqvLlU3JiNM/RVqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771527513, "uuid": "5b0e12d7-ff75-4ad7-b8d9-491202f6767c", "value": 188102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771527513, "uuid": "cb34872d-4af1-4077-9b7d-0b0b9a96613f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527513, "uuid": "974577a2-6090-4494-89ad-77ad8bac18f7", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac81a19f-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493448, "uuid": "3b66a668-d339-4755-aa6f-b13ec979149b", "comment": "Malware payload (AgentTesla)", "value": "3772e99eab2e700508b716916e8cf058", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493448, "uuid": "a067cc04-a5f3-4633-af64-9ed90d5b58c3", "comment": "Malware payload (AgentTesla)", "value": "27f2250108acc27989c51abc3dabb82206f79422207759dd63bd658ce3ee2f36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493448, "uuid": "db1d7841-ce14-4fed-b676-84ed7886e962", "comment": "Malware payload (AgentTesla)", "value": "15c7180cf596f0c8daad962ef9ea28cc3185c994", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493448, "uuid": "203d88f8-73f4-43a7-8bda-8e4c526bafcb", "comment": "Malware payload (AgentTesla)", "value": "bc0c0620fee3910219c3758704be75d4544c1b72cb60aa2dac3cd3967d20f9d0894bf7421ba22503c80d914281db5d17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493448, "uuid": "fda8c6ee-c11d-4331-a582-31d5e012d67b", "value": "T1FD659F143EE61F19F738BD2E00F92F1097925CC6D0AF24541A20B99D4BEE6522A5F1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493448, "uuid": "149e0ee9-adde-4cf9-8858-f6fbaa98111d", "value": "24576:cMI0vBJk+3Zdrj10vKx9dVLxD2QSfrRGXsxr5z/PluutBClF2DYTzEeD/1zx2lyS:jFrrR0vKx9/Rs9GXUzQuLClF2D8BD9Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493448, "uuid": "923a8ceb-2711-43ec-849c-350cdb8e1876", "value": 1418355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493448, "uuid": "4e92fca5-382d-4387-93bb-e0fc51c7775d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493448, "uuid": "1b2fd1ae-a730-42e4-8dea-5b1810b7ae91", "value": "Gulf_Tradings - 20260218008_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee54d705-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493558, "uuid": "724df73e-0696-401c-a7e3-7bbf30a1c766", "comment": "Malware payload (XWorm)", "value": "2f5274e4145f7558d159ff9e88658850", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493558, "uuid": "ea60b115-c438-4679-8fc7-50716e60627d", "comment": "Malware payload (XWorm)", "value": "28dd23a549aa008e3632a38864ea4103ec132f86c43f4bdea1e563c58089ed26", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493558, "uuid": "ce477cf8-f2a7-44c6-8d66-966c30efe536", "comment": "Malware payload (XWorm)", "value": "92f198b06d92f2163079154863b12c4b33016ead", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493558, "uuid": "273a8c27-9357-417e-a7be-0b4f0bf7cb17", "comment": "Malware payload (XWorm)", "value": "18f28cf2f90644d3f5a0c7bf84d4a2ba877440ce520cbb784f407fb587f3b41c1e79fe1775d5990246257a6c20c5d0f3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493558, "uuid": "97976ea1-99d1-452b-bdd2-2670467c72b9", "value": "T1315517AAD886BB302713F3A753B1F605539848875229FFECBE835751289C7DC8721E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493558, "uuid": "b94aaf6b-5916-4045-8461-743d601e403d", "value": "96:GzHeNrANNZbIBhbIreIqAbIrr4d8CPhp2OVx8VbTppVqe5tXsztoQhfxun7szltF:UHSSdqE2ohp2bTpH6B1tTszn6EDlSSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493558, "uuid": "b62885ed-bdef-4b80-a32b-4e09e62ff15f", "value": 1304597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493558, "uuid": "c1840840-55dd-4bdb-8fc0-eb08805e8850", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493558, "uuid": "7f3c47b1-761a-407f-aea8-7c55f99162d9", "value": "ORDEN DE COMPRA Y PERFIL DE LA EMPRESA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdfc6bd-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493556, "uuid": "a62f961e-c39f-40d4-bc00-1405e8c5378c", "comment": "Malware payload", "value": "c96243e4064ee2b7d093c3fe3fa238c3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493556, "uuid": "a97b3a96-9507-44f8-aa3c-d4e3e78ae4a3", "comment": "Malware payload", "value": "2a3e4803257e2c42f2a9f3ca755ec1dc01c8c05f266ab175c94bbc05104ba025", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493556, "uuid": "f0564c2b-8603-4f82-aa6c-4bb738d65992", "comment": "Malware payload", "value": "04ea6b2cf2d683b5b02d9f27fac0c0473435c011", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493556, "uuid": "bc99084e-537a-494c-b575-d1387f023014", "comment": "Malware payload", "value": "64405c97230dcdf953e5722a93561d77f556637a222b9658b9f35c1ddf85611025fb9378738c791b9862858df26b0524", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493556, "uuid": "faf9ef71-b499-44bd-aa16-b73db4d0cd0b", "value": "T13F829737F95CDFF80B2E51D1018B6C02605497A6B43A49BDA8CDC5987F267148EEB8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493556, "uuid": "cb4b1592-bdb7-401c-afcd-6235e3054724", "value": "384:472gUKohep/wPS19QsePertq6QnxiCIsC/qP:A7fp/w4eWrFQsCOSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493556, "uuid": "e6d31158-83f4-4f47-90d3-5a8e3cf25d96", "value": 18403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493556, "uuid": "d34e896e-3d2e-42fa-9967-5dc672057e0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493556, "uuid": "72dc75f9-5c1a-4278-a1bb-11a9aac33a22", "value": "payment Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2643bacb-0dca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771529730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529730, "uuid": "7e3b8fc4-459f-4bfc-90d3-31d6d927d4ea", "comment": "Malware payload (Mirai)", "value": "3b44ca40c440244a89dda19d93325601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529730, "uuid": "90c1ab53-31cd-4979-a324-670b6c68474c", "comment": "Malware payload (Mirai)", "value": "2a82d1f6769b400559bec4e75c76193c27c924b42971a8168dfa31f457862319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529730, "uuid": "f77424dd-7419-4f8a-9e8a-53184a9a8b39", "comment": "Malware payload (Mirai)", "value": "055d9be8df2eb1fe886a56ef8758a7893b531e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529730, "uuid": "451696b8-133e-40f4-a0f6-768095672716", "comment": "Malware payload (Mirai)", "value": "002adb48657252ab5e82c3cc0d441fe54b1e33a3388b9979c6926f2459b406fd32585c6020fd2b783ac56a06cf78924c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529730, "uuid": "4d104d9c-20bd-41b4-a85a-44b43600e744", "value": "T151635BC5A643D8F5ED5601752133AB334736F43A112EEA87C779D932ACA2B00E66B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529730, "uuid": "246c71e6-2a6c-4619-bea3-7d8bd01efd93", "value": "1536:t5DvJ3eI+fiyaS7KnhBthqliMCKAgkHwUr4CgHwtnlOIufQSPXYQ:t57FeI+f9GnX7qBcwC4DH6lOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529730, "uuid": "05576d22-9ee8-4dd3-9acb-4d7cc995fb84", "value": 68496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529730, "uuid": "bb3d9df1-2fcb-481f-8525-07c8ffe7243f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529730, "uuid": "4cf88868-571e-4747-beb1-74b6dcbc17a2", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a81dd7c-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1771493310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493310, "uuid": "2c3b5f78-d75b-4dce-bd3a-1ad4f55ebb09", "comment": "Malware payload (MassLogger)", "value": "9ce5b4c57017db38795892f54eaaecae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493310, "uuid": "7493bf20-f35b-4fb8-b163-24c5409c7e48", "comment": "Malware payload (MassLogger)", "value": "2ae443f6a0a5bb22b68ce64e4a388680fc6a8790b3676df62d008abbb342094b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493310, "uuid": "b12a51b4-52bb-461c-8ce8-8dbc83d632d6", "comment": "Malware payload (MassLogger)", "value": "f0aa51b7735ea8180ae0d1c4521326cbb0bcaee7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493310, "uuid": "416973be-ed1f-470b-98a9-edef2f509649", "comment": "Malware payload (MassLogger)", "value": "9b55c6238129dd6748afaf1ab6a5ea9da89ff319584b76ccf7c3c63970ecce9cf133ad571933c4a1822f6c4c0bcb4045", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493310, "uuid": "edee65fa-77d6-4cd9-8fb7-ae6750f64989", "value": "T166758D310AC8BB29CAC8B716C54851DE63B4D4472A24FA6ED963F91CBFBE304172DD91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493310, "uuid": "b594492e-beee-47a0-8039-f6ff6e675778", "value": "24576:BNnAD9I81J1R5gKSr7B3ByJdwK7nX1paa945o:zoTvjWZOdwZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493310, "uuid": "ed95f406-6b1b-4a52-bee7-c3dbd3a93173", "value": 1630983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493310, "uuid": "f21ea283-4766-4892-8335-37f5364ef837", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493310, "uuid": "2061d596-3363-4174-aa80-b617ba2b67ab", "value": "\u0e23\u0e32\u0e22\u0e25\u0e30\u0e40\u0e2d\u0e35\u0e22\u0e14\u0e02\u0e2d\u0e07\u0e17\u0e35\u0e48\u0e15\u0e49\u0e2d\u0e07\u0e01\u0e32\u0e23.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6028ca95-0da7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771514794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514794, "uuid": "84a3e186-bb98-4af3-80ab-32e25d4e3956", "comment": "Malware payload", "value": "e6fafcb72f2f315692218182ba84e0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514794, "uuid": "5e07f1ae-00b7-46a2-89f4-30aa47d2826c", "comment": "Malware payload", "value": "2b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514794, "uuid": "a276236f-e58c-4fbd-9a2a-50afa65854f7", "comment": "Malware payload", "value": "9c5cc25e80df75f91873bf31a6269e7bdab7c6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514794, "uuid": "8eb3b830-2a5f-4c54-8532-4680441eef06", "comment": "Malware payload", "value": "ea563938bfc49a565d34fdafd4cd332caaa8f48a797c5415448dfdbade05654780f5102f6ad58457ed3c8e71ceb5dc21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514794, "uuid": "d570407a-d622-4350-be77-d505c270c606", "value": "T195183323E09583F4E0924FB0DD1DA1764E8AA8DC51852E0D4F9EA1FC6A878DDC5F1AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514794, "uuid": "2a736e49-f657-4e3a-8e29-5cfbafa29d5b", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514794, "uuid": "70bcb68c-9048-4fca-8a9b-2af634eba720", "value": "1572864:h6sZA+TMMdh0OWzeRxhsyw1CvawblHmTJGGrxLPXBNGA72PWDt+wzN7R2:h6smSjdhbWzKxhsh1CvaeGNGGrxjXBN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771514794, "uuid": "3d83edac-e4ef-48eb-9e8d-3dd3ac84af1b", "value": 87211504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771514794, "uuid": "359720c2-83f5-4788-98f4-fbf6ecfb7158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514794, "uuid": "e9d5e6e9-641e-4d53-90ed-dee1226b74db", "value": "Dashlane-win-x64-14.38.2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e096a5c-0db6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771521260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521260, "uuid": "5916ed1c-e4fb-44c4-a3ae-70ed1d2d5aa6", "comment": "Malware payload", "value": "4334d40fbf7f45e4c0d49c26e3fe5622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521260, "uuid": "3c53025e-5d65-410a-9628-ac313646c7d0", "comment": "Malware payload", "value": "2cc9373e656d2784e7392480574371fa2f0432d6c63c2f7d735fa04eb1ad7d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521260, "uuid": "29416d79-0684-45bf-bf11-fceda92e831c", "comment": "Malware payload", "value": "af311475bdf4d89eb87fdf4506aed07837c170b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521260, "uuid": "b6bb8bcf-7290-4262-984f-62c412f2d957", "comment": "Malware payload", "value": "d5eed4c17ec41ce0c6d4b6dd6400a071d4ca034b235c22cf137b933717aa4f47bdc83dcb4f180c47b55b3ea3834d3962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521260, "uuid": "677af4ad-b860-47b2-bcff-e110249e2e7e", "value": "T10185BF15B3C866ECD117D938CB55E232D2B2B4624B62A4CF0A9AD7091FB7E905F3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521260, "uuid": "e50054e3-4a2d-49ce-bfa0-89be27914204", "value": "81dd90c72763c9e240b06b6944974d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521260, "uuid": "85973a2a-ae5b-4213-a2af-8efc66a13be1", "value": "49152:8y89DKRQMa1oV5UTgIwHx9sWia/imMHV/GK+NK1oU8F+F5SZ8en:jRgZmMHV/GK+NK1oU8F+F5SZ8en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771521260, "uuid": "edb80bba-fc11-4667-af17-08861ddd880c", "value": 1848832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771521260, "uuid": "9148b749-d427-4738-ad35-9e829fc1b3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521260, "uuid": "be6b9704-cbcf-46f0-9bf7-134ea6dec7bd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474157a8-0dc9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771529356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529356, "uuid": "772fb3f6-b9d0-49d1-b11e-12108e6bb128", "comment": "Malware payload (Mirai)", "value": "5c902c2fa906595351f1bc18c087a465", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529356, "uuid": "edc16898-9bb4-4ee9-af37-960d11b091df", "comment": "Malware payload (Mirai)", "value": "2d973c2b94e4862b6ed637a56b2e2d48b87ac7e0ba4d1137f3a31c5d0f159881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529356, "uuid": "23c3b137-e98e-42bc-b31f-dda330acc79c", "comment": "Malware payload (Mirai)", "value": "f0808f6ec049d444d2f621b2103041bb81c45abe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529356, "uuid": "6776e94f-1ff2-4d2f-9a12-f0bdd1ce3bb0", "comment": "Malware payload (Mirai)", "value": "59902f46a0052f3bcd2476de47ab4e1150d37e42f34e637dec0d711252a381476580798ab829daf4a4fd12659935456b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529356, "uuid": "49c8bdee-a7d4-4bf8-a9eb-4445969ee54d", "value": "T1D7E339C7F900DDB9F80AE73748530909B230BB9245825B372297797BED3B1D91963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529356, "uuid": "d413734c-57a1-4ad7-b38b-302529964aa2", "value": "3072:r477HjgvFO/yiPj0PtuVdWKp+0loYVxjbiMLNBXWS3C:r4ecyiL0PtuHWqlo+LGS3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529356, "uuid": "941440b5-e6ec-4273-8c43-4ba50b722555", "value": 154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529356, "uuid": "b0792e9d-13f8-474c-8726-a2f559387688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529356, "uuid": "3ef4b53c-79c1-4859-af25-a704ac2957a7", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f37d30-0dc5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771527556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527556, "uuid": "0ba865b3-0b79-42de-8a4e-4216db9f1e23", "comment": "Malware payload (Mirai)", "value": "abb73843fa11a59bba8664e9cc85efb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527556, "uuid": "ae2e7143-df60-4597-9d07-1bd4578343b5", "comment": "Malware payload (Mirai)", "value": "2ea92a99ccc453176d8c65757d3c4f477fab9e498fc8328c3b9f2009fbb2189f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527556, "uuid": "d99dad29-8d8f-4689-8350-417e75481f2d", "comment": "Malware payload (Mirai)", "value": "aab884522abaf9854748b521a19dcdb2c341741b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527556, "uuid": "bcc4000b-2edb-4c9e-9489-466a820d96ee", "comment": "Malware payload (Mirai)", "value": "cc74ad0f45633ffbc83f12af0c5380833dbd4cf140b2b2fa9b89c5dacf61c795204a6ec0721ff15bdda57c4f5b5f32f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527556, "uuid": "423aa45e-8a49-4f02-af91-c33c9ad52b1e", "value": "T1D7831A96BC814B12D5D512BEFA1E118E3323177CE3DE72129D206F20778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527556, "uuid": "42125109-73c2-405e-82e1-b233f8410c85", "value": "1536:i3nVOVVBbcHsDtaJMSF46VRcKa9E5EQQMlWiX0+o3Yr7225pY0/wq:zBVtAMSeCRcKa9Q0+o3Yrq2X0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771527556, "uuid": "f6a49a95-36d1-4aa4-bbcc-837c3c1a6962", "value": 88140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771527556, "uuid": "2bef8289-6acb-4665-8d18-dc068191cd22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527556, "uuid": "00fc830a-3741-41a7-80fe-c66b04bc454e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b7c49b-0d5f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771483987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483987, "uuid": "4984d8ef-0e37-4188-9294-1011ea2ac2c7", "comment": "Malware payload (Mirai)", "value": "d8b0499ab9aead2ea0006f65ca150aeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483987, "uuid": "79be7d9d-2f2e-4b37-bc02-72f2ee1925b3", "comment": "Malware payload (Mirai)", "value": "2f1c1807d411da9332f13b6a2cb33ac534f00d656f9758b9704db4b298897fb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483987, "uuid": "66ee5aa6-1142-4bbf-8f46-333db01a3a74", "comment": "Malware payload (Mirai)", "value": "0d4547ab2fe411acb9b0422a7d8e596b178115d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483987, "uuid": "30db5551-6426-4e7d-be27-68103f9ba69c", "comment": "Malware payload (Mirai)", "value": "fff4e4eb8a16f80b3b65a24e85bfce4dd4738b5bcb5fee9262dd540d175843e212ff3a7ec568a03fc33a4d11a9e5135f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483987, "uuid": "380e2cc5-c324-4900-837f-edb8c4fdfeaf", "value": "T163145C47EE890ECAC457CEB046FE83AB1EE7559B49D1F1F4443CCC1C395D29A4AA3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483987, "uuid": "2d537a8e-ab83-48cf-a4b9-646157857a94", "value": "3072:EZon8uO2w8WeiGnm8kC3IPGSsazsuP1ibU8/DPpxAP5Hf8fSsUBNGq/:/8/L8GqYVzF1ibU2PpxY5UpUBNGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771483987, "uuid": "87868b11-d582-418f-8a52-a58b2c78272d", "value": 201712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771483987, "uuid": "a15bca35-a246-4508-aad2-e4035b685591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483987, "uuid": "0352a769-b5b3-49dd-85bc-ae516ef14c91", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722b0d7f-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771512248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512248, "uuid": "ade9b073-6e84-413f-996f-20e7fbd74434", "comment": "Malware payload (RemcosRAT)", "value": "013f15e0f925d535a6b1d2cb3615395f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512248, "uuid": "db0244a7-c5dc-4b86-91d1-5ee76525fe51", "comment": "Malware payload (RemcosRAT)", "value": "316ae66100464e3baed671368e5c66d2daa7440085a654d09e17a4c8e0a138c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512248, "uuid": "14cb8d8a-199f-479b-8636-e60afcf598e4", "comment": "Malware payload (RemcosRAT)", "value": "e2ff02dad5128063d3c3a842421161f1f0df58a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512248, "uuid": "9c4f9afe-d649-423e-ace8-2beeb3e1151b", "comment": "Malware payload (RemcosRAT)", "value": "e122ae4fa7358b863b17e87c46f88051f13f9171252d2967abaf1373084c70159731cbc5fc3bf95af9f3b19fe27fd682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512248, "uuid": "a0a281fb-2afc-4be3-95d6-3ae98a3c70d1", "value": "T192E423AD95A0C85FC0B15632B9349357FFFE9C21002AA62F72627FEF2859347A44E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512248, "uuid": "f4907bc5-162d-477a-9423-b8653800ed23", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512248, "uuid": "8e1d35e6-37bc-4125-875e-a6ffdb300163", "value": "12288:5DW2vV3MEBS8t0ZfmOJHbq4X86d8zI0EBI59sxfuZSVRY+qsYI1zKdtTde:5DrvxL091bqv59sxGZ670I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512248, "uuid": "c4697e2d-492e-4dd2-b0ca-f209504e0c5a", "value": 713056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512248, "uuid": "474bc0f8-2de0-456b-a48b-bd33fa79f4a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512248, "uuid": "832a1427-6239-4daa-bfc5-f13d023167dd", "value": "Payment Confirmation_INV-2026-0147.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a84b6a-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771483153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483153, "uuid": "f1f16bd0-fd82-40c5-9e19-9205deb5da71", "comment": "Malware payload (Mirai)", "value": "e65957e9ca5829a2b261c147fbfd4409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483153, "uuid": "4649f11e-6d59-445d-8349-a8e3497bc35c", "comment": "Malware payload (Mirai)", "value": "33f8079aa04508c27d37ce487d774cc9ce83987837dc19efd4029d10311e5d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483153, "uuid": "30271f35-e71b-432e-94ea-029187723207", "comment": "Malware payload (Mirai)", "value": "5274e4de48d79bbffae7551544fffe086e41a039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483153, "uuid": "dac8814f-514a-47fa-af5b-c2d3e3e1fad7", "comment": "Malware payload (Mirai)", "value": "7da8c674f8e9bba7140c6dd01e55b8119aff4a62a18cb3421d823ad735e05383f56f01b8fc30c0df10fc3eddbb26b882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483153, "uuid": "9e624766-0eb3-4258-8dbd-e858dfbf1cff", "value": "T1E4B31952BE429B13C5C356F7F7AE42583B136B7CD7EA3102DD207FA0278A8DA0E26551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483153, "uuid": "12253732-cfaf-4ce8-89fc-ef17fa7a7695", "value": "1536:nlGXJ1+6wdBkIvoT7UjzKkVha/3rvfdnRH6l+SgL3+vO+OOM4mwKCdWNbTHx/1:lU+6OzvadshaTfV56l+Sg6Wxpx/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771483153, "uuid": "9ee9d38d-70d6-446e-8c46-75452845bf45", "value": 115756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771483153, "uuid": "cfa156a8-3a76-444b-8f7c-53f14770f6b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483153, "uuid": "27e87769-623a-4d3e-b918-6932ae144c88", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8c262a-0d5c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482603, "uuid": "949c8da5-8cc8-4251-8089-5075f946df08", "comment": "Malware payload (Mirai)", "value": "bc73b2c34ea493a43a4af475d1e3b189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482603, "uuid": "d3105f11-5cdf-4b90-a4ba-e40fbd7387ab", "comment": "Malware payload (Mirai)", "value": "3489463bbde761e4b1b1ad51a8c616cd3cb8fec026d740b8cb562f54bb753ac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482603, "uuid": "1157a846-65bf-49e6-b1fb-74d5d294ccc2", "comment": "Malware payload (Mirai)", "value": "fdff015e835b60ecdab151537ea433af2587e9fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482603, "uuid": "474c09fa-9537-429f-9e0d-aa761fd5f33a", "comment": "Malware payload (Mirai)", "value": "c2f2109e024a2ca2ce869a3a319a5a3c0ed435abc8811c975119794640e23caee6450264c6d4e3f9f8c08164eefb4002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482603, "uuid": "23194467-b018-4013-a5b0-154b3e83c0df", "value": "T198157C9DEBC6E4F1F26340F1025EDBF71534A12A5013F6F6EB46266370327A1AF1621A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482603, "uuid": "5d7181dd-2c12-45f3-9147-65f31356123a", "value": "24576:dO82RzCW0EhR3hdbUyguvy/nwbXmuuaZ:32jHhR3hd46aefZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482603, "uuid": "74a1e5f6-05d4-46fc-8ba2-9beaf05ea9df", "value": 895576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482603, "uuid": "64b22327-0eae-4821-bee7-909046033b3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482603, "uuid": "fdad6ea0-43d0-4654-a4aa-79a7d5552b96", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e5d68c-0dce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771531528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531528, "uuid": "67cd5bfc-a3fb-439e-8deb-d56ef4d01750", "comment": "Malware payload (Mirai)", "value": "2ba1f461d48b12d07e2c2e937b39cf09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531528, "uuid": "cc7f0475-38c1-4158-ba50-6ea973023e1a", "comment": "Malware payload (Mirai)", "value": "34bd1bf33eb262aaf06df805edd1dcc185e700fff8626d4e4ed7b898d5831d15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531528, "uuid": "5daef2e7-0375-4f68-94e4-637d6929f6eb", "comment": "Malware payload (Mirai)", "value": "a0f8af6b1c585dabde87884f88a5c9c72896acf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531528, "uuid": "c5af4c01-6803-4779-943a-7966f532a4f7", "comment": "Malware payload (Mirai)", "value": "4164912edc5e76067845aa85d1e7cec3f0b0d5f9af8b162279cb7c67ead37a674f277fcc59a1f407e4e5ab80589fe3cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531528, "uuid": "d4f17799-5076-4df1-a0ff-d814f0f0ae71", "value": "T1E423F891F8E2865BC1E023BBB66E918D336567A8C2DF7397C9115B503B8691F0D63B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531528, "uuid": "d1ac3a73-41dd-4526-a618-325404687c5d", "value": "768:haa0phhF67jPMeuNAG6CTgeeB6tJvTsx8Y4Q+cpoLd/1bkU3:hUFGj0QCsee7OH3cq/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531528, "uuid": "b09db014-0104-4424-8cec-57b71d6b3a29", "value": 47612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531528, "uuid": "2c5c2cd8-4d93-436a-b5f0-cbfceb1edee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531528, "uuid": "a9d2edf7-4c9c-427d-b203-a6ed24f6525f", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83d8e74-0dca-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1771529975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529975, "uuid": "2cdc215d-ef66-4c22-829e-fa2877b65809", "comment": "Malware payload (Smoke Loader)", "value": "cde63f095f08623b986b6835e0a413ae", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529975, "uuid": "d9591ed6-2657-46c9-bdcf-2329cef37297", "comment": "Malware payload (Smoke Loader)", "value": "34fe12d8a22f1056b69145a64cf96742e813eb3ecf51ed5c4fc79f0500b41349", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529975, "uuid": "72091468-e41d-4cf1-9e08-d916078d5f79", "comment": "Malware payload (Smoke Loader)", "value": "9605fa5b182be7f2ac788a27991467a0b6b2ac44", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529975, "uuid": "c191248b-7705-4061-a0ac-955411b3f33a", "comment": "Malware payload (Smoke Loader)", "value": "782a359b65f156d458898bf6a0e518b55f1d8eea1ebca3e6fdd43e4d62b2b9222899cc7376276181f62c4d39a5644819", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529975, "uuid": "c44f606b-1401-42da-bc68-1a3f41e549b4", "value": "T1D5C5CFE2799AE0D3E3CB32B1A55816F15B70FDA1BA8043D6B99C37454C353072E2BA17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529975, "uuid": "d237748e-939d-46a3-9910-c017ff19010a", "value": "49152:C5ZewlSo2qX4owl76bAlPYQ83x+R0AfXT19YKv+262tItBE:6kqXZq6boYf3AR0Ax9Y2+vSIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529975, "uuid": "db481c77-59c9-48c5-83e9-e96b199c9b05", "value": 2715088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529975, "uuid": "ebd99cd1-9bf6-486b-9030-e50efb9f0c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529975, "uuid": "63a4511b-591f-4aa4-a42e-279688d496df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f64dc2-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482302, "uuid": "31436c6b-90a9-4361-ae2f-e05746fc12b5", "comment": "Malware payload (Mirai)", "value": "8288abb9c1682d627ac797695a8025dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482302, "uuid": "7f99550f-69a6-4ee0-bbfd-2600ed2ee049", "comment": "Malware payload (Mirai)", "value": "353c6f0cd8b4bdd69ee7b546ed9fc0f28a4f7a8f21095ec5b0f47702b48e1865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482302, "uuid": "18f9c6ed-681d-411d-8f8a-5e4dbcc7da49", "comment": "Malware payload (Mirai)", "value": "ba170daf211cf8ae6ccb3835477fbdd9e3384056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482302, "uuid": "22b8bf22-e1ad-4241-8569-c97a906f530c", "comment": "Malware payload (Mirai)", "value": "c66262ec110dbab25727e5bbe7cc9cfd61165c2a50c0ec7957ac4fb1508d2e6dc585b2e03da3fc92c29f4c4e7c78ae7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482302, "uuid": "d18989aa-e23e-42a5-a367-7086f9bcbc35", "value": "T183B3BF87A1A07ABEE0546D7FC413CE17F6259FB01D87172AA1BCF9905D393807293E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482302, "uuid": "8fb2e09b-faf8-405d-af5c-11359062cf69", "value": "1536:Yo9+x2Cgvxt0oDKi6M50Zf3fXDdQFDu9aVlr6BHSuBUyV/T5VOcGndYn3g8rSW:Ym+8pt0ougCXDdUDusit0yVZGnmwUSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482302, "uuid": "af8186a9-ef60-4b6c-b1e0-e68bcbab4e98", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482302, "uuid": "a0d3f18c-ac04-45e9-82c7-7f1d9d817b10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482302, "uuid": "ba6a5679-38d1-48e4-8ec3-d4bc501e609b", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4343e42a-0dbb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771523336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523336, "uuid": "aba3ac4a-2c25-4509-b3fa-79ad43ae50f4", "comment": "Malware payload", "value": "cc65e4b18850c64f0cea41a82b105c33", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523336, "uuid": "5bf5ee04-c952-41eb-9ea5-2abbd4157e5e", "comment": "Malware payload", "value": "35ac7885ba6085601822e938e8b102bcb0c9d90a35cd25fc3b3d18d93ef3e58d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523336, "uuid": "882b2086-15fa-4b3a-9d63-f0d078bd58f3", "comment": "Malware payload", "value": "a61273e10b01ae0ac1cbb8d9a25c155bb6927f93", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523336, "uuid": "7b1ae9a9-0982-4ed7-829c-3eb858e7f00b", "comment": "Malware payload", "value": "df5d175fd1e27f354fac2ac200f72f297c47f3efb494a679ec85d6d06628a44269b581f9eead45812a13bc25f3220dcf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523336, "uuid": "04029eaa-348d-403e-b6ff-9380542d975f", "value": "T1682423A62DB4C5A4C5BD99BA37CA91C9C1C3FE0A6A72AF763BC1C88D41BF404440E5D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523336, "uuid": "2e726de6-8ba1-4200-a544-986c07a57d57", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523336, "uuid": "a7f0276f-89e3-44a3-ae46-a74ceb79b7dc", "value": "6144:SoLVqwxmhbGPiHqRAVlfTjofo5J9k8bGwu29QsGk1f5TVMdnQcR:SAqwSbCvmVdooHbC2JGk1fU2cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771523336, "uuid": "d1c32df2-0060-4388-855a-a01454e51274", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771523336, "uuid": "dc66aac8-7d54-41ab-ace9-c5991ceb4b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523336, "uuid": "4c1516ff-b09a-47b6-aadf-c3a2ec97aa42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc81199a-0da6-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1771514547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514547, "uuid": "cd66b65b-3dc0-4e60-bb87-bd3e72781cc7", "comment": "Malware payload (GoToResolve)", "value": "a35cf72e2cdd9e27558538d5c7aebfca", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514547, "uuid": "5acf6cbe-1943-4833-b160-b7c505f66976", "comment": "Malware payload (GoToResolve)", "value": "367c9649c72475481e0d064ad1e7f2c6b76110b4da05e3891a317cdab55390e8", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514547, "uuid": "9364b54e-1b58-41a5-944b-69a3ff9c0941", "comment": "Malware payload (GoToResolve)", "value": "5fc6fbfce2eeb9481839d0ec9feae5ca7ea7612c", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514547, "uuid": "104b421a-c327-40d7-9e67-1847f5be76e6", "comment": "Malware payload (GoToResolve)", "value": "39aa63c3a20c866892a669a62912ad69e3f75e1e59680531e886ce9306b7ebe8d6a9fbc3d8076c71e10db3f406e41dbc", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514547, "uuid": "1a188a53-f364-4bba-a9e7-da642ca2d987", "value": "T1E13733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514547, "uuid": "e114ce4e-8ed0-4f99-9be6-d286a956a27e", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771514547, "uuid": "120b2c20-a481-45c5-b768-b4ec941c3d72", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771514547, "uuid": "ca288049-6221-4b66-b2eb-23ac664ca58f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514547, "uuid": "966e5d97-eea7-4322-abac-81ba982a0f63", "value": "spec.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74704a8-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493573, "uuid": "27ad0070-6421-43a2-9154-1c2d9f751caa", "comment": "Malware payload (AgentTesla)", "value": "043d587675079219fb781633b5b6b627", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493573, "uuid": "da3c549d-3769-44ec-bfd7-0971045afb04", "comment": "Malware payload (AgentTesla)", "value": "369adb44553696774a75b19d7aaa7998821e01fa648eb5e778b249483cafc446", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493573, "uuid": "3f4bb307-0bc2-4638-8b47-777772750f85", "comment": "Malware payload (AgentTesla)", "value": "41f903bebf36cb93f116d3ca653600fb2ac5134b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493573, "uuid": "f5ca4b56-6821-4629-adcd-68a10ed0fdbd", "comment": "Malware payload (AgentTesla)", "value": "6ac395c77f64d29d9a014c020123bd44a1344ec6f840244283bdd779b79401a4d4c73bdd0e742609c4ec0c004615448d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493573, "uuid": "1bd011ec-81b8-4d9c-b8b2-0aba16ea2f64", "value": "T172939474194C45EF2493EAB4B084A7E3FE6C0A5C9FEC6A4F925487DA163EA8734C35C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493573, "uuid": "b2528b8a-5aa4-4758-b594-4f5c94ec4b27", "value": "768:sZa7uu1pf2gSjRJLnY5YKMMrURfUQO3wpMpiU/OAJcV:Wa7Zx2xjc5JvQO3SaiU/OAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493573, "uuid": "282888a8-871a-4309-9013-74ed7714254b", "value": 93527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493573, "uuid": "721e8696-b905-48c3-8d4d-a187b0328707", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493573, "uuid": "e1cdc00a-7b6f-4941-947e-f7a38940a54b", "value": "RFQ-Quotation INQ-RFQ-D-0022026.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56233adb-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493303, "uuid": "142f016a-515e-49d9-a223-963bda758205", "comment": "Malware payload (AgentTesla)", "value": "e764a59d041cc421fb7332b6a952ea83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493303, "uuid": "d9b19915-1805-4335-a897-8b12c96968c9", "comment": "Malware payload (AgentTesla)", "value": "375975eb0e0c7f839836bba0a22a71285660a062bda1605006d13c44ea169fa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493303, "uuid": "1e55c099-bfdd-4c1d-8853-932679b8c4f2", "comment": "Malware payload (AgentTesla)", "value": "9613e4eec147e3537dd6d7558a66f0712020d4c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493303, "uuid": "80a682d3-1702-4b96-9e76-4c40f215667e", "comment": "Malware payload (AgentTesla)", "value": "562f9e816963afb4145c95ae0133001ef67b8da40ec2b5148d63a9b2dc075aa9de15693d90e67b49323425ee9cc379cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493303, "uuid": "ffa6fd27-8eb3-463d-8646-e5c6162c5fb1", "value": "T160658F6596952B63CB8C2B1031FE3F3B27E3869E08087697DCF955176F7A0924A9F0C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493303, "uuid": "8deac4cd-f1c4-4274-8538-861c730306e5", "value": "24576:/f8SIXXZvY0/8Qmnn3Yz0aprSL4hU61+B++hnag95EuA67BUyH77v5EqWswKvcg+:kz0aprSL4hU61+B++hnag95vA67BUyHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493303, "uuid": "d0affd8a-db45-469b-9f93-7936c05847d0", "value": 1410731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493303, "uuid": "e4317a79-cbd8-4459-bbe9-ce02c4b89bd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493303, "uuid": "8967262b-874a-42fe-8e85-27c1a8e7fc70", "value": "Purchase Order - #CN-VWR-023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d9ba2b-0dcb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771530380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530380, "uuid": "56551b86-f3ae-4d3b-8f31-47195c828cab", "comment": "Malware payload (Mirai)", "value": "1e531449a08b14fc020894e9c4b820dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530380, "uuid": "00753e58-6b40-4dfd-8e29-0e3c2e44f159", "comment": "Malware payload (Mirai)", "value": "37740f721d00c41c0da7d2e83de5138baae8a834ae577a113590f03f8cf79c61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530380, "uuid": "8ec1bbc8-0648-4856-ab70-d0287f396980", "comment": "Malware payload (Mirai)", "value": "2e79033ae544a19c2c68f48fe7471ea1de0cd7d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530380, "uuid": "a71bb8e1-7682-470c-b548-29d521ed6b38", "comment": "Malware payload (Mirai)", "value": "60cef144c4f53cd39fca1382928dd02512b60bc7f51b6185addec195e14a9bb51a981e8aec6a4aba1fc6955acad813e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530380, "uuid": "6d83ad7c-5e00-496a-9320-c34e25d0de4f", "value": "T110F32B46EA418B13C0D61779B6DF424533239B64D3EB73069928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530380, "uuid": "9e3a38b2-2720-47ae-957e-281e5d31c05b", "value": "3072:LJeMLTeM9daJocazV9dk4MTLJ2VsAz6K9LHafM/9MvYdkl8:9xdaJocazL+4mJQs5KLHmM/9YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771530380, "uuid": "09755fa9-6d97-44e0-8127-4e98468396de", "value": 164552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771530380, "uuid": "1e57f82a-736c-4ff0-921a-a17082f0dc3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530380, "uuid": "7d0f72ac-4c2b-40d0-bd9f-1205198b0df1", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91aff9f2-0de9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771543224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543224, "uuid": "b132b638-7a6d-45dc-b386-cc5f092f890c", "comment": "Malware payload", "value": "1b3a9e68bb76e963680d8b196dff81cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543224, "uuid": "485834c9-7208-42cc-8873-37d1f08d192e", "comment": "Malware payload", "value": "388a0ed49bfce21840862df32c7ad0d7f5468b6a8d2152ac0c430271a7b7343d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543224, "uuid": "ebc199cd-d30c-40fd-913b-e3f4d553fbe4", "comment": "Malware payload", "value": "68b8b795de4c05d0d735bf2f21615ed2607f56b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543224, "uuid": "fde3d0e1-b2d4-4632-99be-085f770918f4", "comment": "Malware payload", "value": "e5923098b40ddbd3bbab0f27915f9b79196e53616602fb85e25724ab87aad09ebcc1863d59cca124a1ae4f5741e9b448", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543224, "uuid": "d1b5bf15-2209-482e-9047-a6fc34d993e4", "value": "T170D37C217290C033D8963574A9AAD7717ABD7822437950CBF3980ABE5F713C26FB8356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543224, "uuid": "6a5c4d78-2dba-421f-86ac-01065a21122a", "value": "9a3792aff0565a5387303270c11c4e6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543224, "uuid": "7a485e1e-39bd-4493-a709-0608714f4fb7", "value": "1536:PtUqfrn4e5Pm5qmzlKm0qdrGSGmmYAZB69axdeJtrgk6nZ5bliYX5zdh:FBfr4enqdrQmmYAjvWoblbX5zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771543224, "uuid": "b7b5d301-0db1-498c-9040-20d62e790f32", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771543224, "uuid": "c35731b8-8012-48e2-a9bc-5b6d97f3e835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543224, "uuid": "6ab461ba-8c12-4a4e-a394-db201f5dae2b", "value": "makefile_stage2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf258b4-0d7d-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771496935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771496935, "uuid": "951e7d4e-d51c-46e4-b35d-02345bd29d5c", "comment": "Malware payload (QuasarRAT)", "value": "21e452acb419fcf4fb59c1d9ca0159f0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771496935, "uuid": "efb807e8-6b9a-451c-aa90-63797f3eb30f", "comment": "Malware payload (QuasarRAT)", "value": "38cccab10ce21045978e13c751a14e5fb1ad232e81415428b1a8db4408a737ea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771496935, "uuid": "deb88863-0ca0-441e-b10f-8eeccedf1e7c", "comment": "Malware payload (QuasarRAT)", "value": "2335b8887120c51331f7d8947305d70ee1fb2157", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771496935, "uuid": "495f99fa-76f5-4aa8-80b0-ba488da8c758", "comment": "Malware payload (QuasarRAT)", "value": "c442ee0c11fc46f2112755e4dd53cf470742f24e1c81dd3dd411b501cdab8e66d578e57fd4eeb230404ba9aa15caaa45", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771496935, "uuid": "16a2c758-cde0-4c1d-90d0-1ed4ea4d9599", "value": "T1941623268EAD9D9F4A74129C185D0E0F27A08E405453C9DBB3D27CBFAB8FE05162B17D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771496935, "uuid": "a93e593e-bdbd-4719-a025-6bc041acb420", "value": "49152:KeyCel7yc5izojnp9dFZBEv2IBJD2dmzdSYvB535HZd00xTCpe:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771496935, "uuid": "b555cc13-f3a4-489c-a002-ed7b1965da25", "value": 4390963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771496935, "uuid": "90033559-2d9b-4eb3-a097-dacde8703f26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771496935, "uuid": "f26d4a32-052a-47c2-b71f-d8654be7ae6b", "value": "startup_196.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7883c9-0dd0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532344, "uuid": "90e70e27-446e-4425-b45b-5bc2d46046e8", "comment": "Malware payload (Mirai)", "value": "d3e9db5567d99ee8b44de239da41beb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532344, "uuid": "b4676fc2-9915-4814-ad06-d9cb6b8a9060", "comment": "Malware payload (Mirai)", "value": "3980186ee04c4350c5073d20b49ef0df95d310494fa826decc09353ea75893ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532344, "uuid": "bbff5b96-6ba5-4b55-ab69-fd2e3a8cfeab", "comment": "Malware payload (Mirai)", "value": "e9963fa5217825fcb3239ffc31de21cc1d6e0ca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532344, "uuid": "8bd814ef-7770-4ac7-a091-a161ac6ec8bd", "comment": "Malware payload (Mirai)", "value": "c7b8bc403a3258d8fecce4d4f1dc7e794f73da7c07fea49944a8970e06679a0f80f456f07a156ec2be5333d375e76d52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532344, "uuid": "121945c0-c086-4826-b3e6-22649c133b47", "value": "T1FE03E11CBD517E88C94DAF7A413D1E579B05FD50B9AA0A8C9718DDC0E71B84B3FC8468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532344, "uuid": "0c762e27-4903-4f9c-a476-82b1086afc20", "value": "768:BI7ijm1fv5uqOADqyvdhVxp69kjf1m2ezLZWTNdE:S4InRb7hfp6sm2dNdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532344, "uuid": "4dd9974f-f16c-4151-a1cf-5f7682f98aec", "value": 39392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532344, "uuid": "6d987a26-cc67-43b5-b5c7-6aa4bf4f0a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532344, "uuid": "a99e0576-73c2-4036-a946-55c0358f4b15", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a8006d-0db6-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771521080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521080, "uuid": "a292051e-63b5-4383-9c22-77d8bd4ca879", "comment": "Malware payload (RemcosRAT)", "value": "4657b7b40cafee55b245dce0b4a196c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521080, "uuid": "30d50833-fa61-418b-8cfb-b10eaf07ce3d", "comment": "Malware payload (RemcosRAT)", "value": "39e14f014df4ac914bb671ccb031c866d33d1068a603edf85cc0fe278371f917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521080, "uuid": "a78bc1d1-ecfe-4fd9-b376-5d06d07600d5", "comment": "Malware payload (RemcosRAT)", "value": "4fb609228ec90cb080f0150ab835426a91568d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521080, "uuid": "850f8c45-f012-4104-993a-ae16454ac0c0", "comment": "Malware payload (RemcosRAT)", "value": "b6caaab6214e77a49460858a82db53ac1df6eb43b3d1924d8addd683a440153674b77159d34d1abc4d3fbaebccc4385c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521080, "uuid": "2699e73a-0aaf-4f4b-b440-905fcb77fac0", "value": "T1DE94F197EB17A911C28985B3C9F188FAE7706C12E459083E3362FF1649359CECD1917E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521080, "uuid": "15496e20-1170-4f48-ad81-f47373d2d540", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521080, "uuid": "2f44ff68-24f1-4c2f-b53f-721a13e79cb2", "value": "12288:Dk8TgENBQgeK+89SjGe+hUYQ3tAonVL9/:ZBQgerzjGeqUY0Gw9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771521080, "uuid": "d23b092d-6485-441c-b1c6-f6c92f4cf264", "value": 444080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771521080, "uuid": "fe41e0c5-9ebf-4892-89f0-683a0c0bd6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521080, "uuid": "ce3f20f6-e652-4146-8b88-3f94731d2447", "value": "Pending Invoices payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7b6515-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771493235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493235, "uuid": "f4c9faaa-f888-4fac-ba9d-16d3553748c0", "comment": "Malware payload (VIPKeylogger)", "value": "850f2759d90b16728948aba14f4637b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493235, "uuid": "89a5e738-4778-4d84-b226-b6e277ebb6d9", "comment": "Malware payload (VIPKeylogger)", "value": "3a66ddf026693224e413eeec0fd09e403e2c4d90fbdc967a5715080a1ce3fad5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493235, "uuid": "fb6d6348-b426-432c-a717-6b81ab770527", "comment": "Malware payload (VIPKeylogger)", "value": "e3f72bf2f6401b5b9501b4dd11416da2e3e21b52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493235, "uuid": "f5111e05-1956-4ea6-a1ec-fb36455fb036", "comment": "Malware payload (VIPKeylogger)", "value": "ca5bddc5095147d6ae22b554935ffd8d365d4bb6f88af573d6031ccb28de3868f61c52601dfd08baf8001c7c5dabaccd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493235, "uuid": "1bdfb0ee-ed1c-4988-823c-c8c4f2fa2058", "value": "T1B435E5F020F7A0D39A641D19E538A4705E8990F1BE26327C7963EDCEE01673B3B49C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493235, "uuid": "8144eb91-83c6-4283-9c07-3acf91dc417c", "value": "3072:ecryPGUgz5HaiFL7i2n/jPwrn5bpBY0nBRY37LMS6mGzd/q4RqkOzqI8C7h7r:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493235, "uuid": "637f71ff-4f58-4556-9c21-f8398c83d1b5", "value": 1147886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493235, "uuid": "caea33a9-378d-4c2f-a842-ff25514286e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493235, "uuid": "c80ec3c6-efcd-4ae7-961d-36dc21fb194b", "value": "Purchase Order Feb 19 000985775.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c64c3b-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512168, "uuid": "fe3302e9-ccef-42c8-b416-9bca731454ae", "comment": "Malware payload (GCleaner)", "value": "c3b98ec56559171a0d3c2613599ea6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512168, "uuid": "4ec3536a-4870-40d4-a9e0-524ee07d02de", "comment": "Malware payload (GCleaner)", "value": "3aaa959cc379c4db47e470f821a379c8539db335017b98e54809506e4707c97b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512168, "uuid": "61b3fa0f-1cdc-4a30-b618-171b173d8a1f", "comment": "Malware payload (GCleaner)", "value": "50e47bda501cecb0d27176b3dea7322977634c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512168, "uuid": "ee6717ff-ed4b-40e5-a3d7-2da5f516080e", "comment": "Malware payload (GCleaner)", "value": "39ba88f197b8d4563ca50f822fa6d755c2e4a31226e44818c7bf8ff31c7e81980e604eff7fde0848c29de25fe7672f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512168, "uuid": "932edc5a-bbc4-42ff-93e7-524b56720387", "value": "T1B026D03B31BE8D95D5ED0536CDEF602AE8137A493A681CC79DDB28CB56332C1A0D8653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512168, "uuid": "453efad9-8545-46c3-b46a-65bf078e287f", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512168, "uuid": "cc409cd3-2f91-4193-b7bd-335fd9bd0646", "value": "98304:u9CexC4uNoCSSfoW0QIZnRHWKOVYw4JloZ4:uM4uCYVIZnFWK2l4Jlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512168, "uuid": "239df703-55ed-4cdf-8f5e-be40648f8a61", "value": 4659200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512168, "uuid": "4e8cb9f1-73e8-4e41-947d-538c5114db32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512168, "uuid": "d92ad7d1-489a-4772-808c-7b8a60d166e8", "value": "c3b98ec56559171a0d3c2613599ea6cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a7721e-0d30-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771463803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463803, "uuid": "c89ceea9-1c11-465c-815a-c4111f9e1043", "comment": "Malware payload (Mirai)", "value": "4d237b4edc24b89a536944c74636dc77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463803, "uuid": "e1637738-be58-4420-9250-2bb73f4bf474", "comment": "Malware payload (Mirai)", "value": "3c40dcd3f25e5eda1a32372e5e7b541973ee57c2bcfb2b7b191afca0a10ee957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463803, "uuid": "d81033e5-fe7b-4a08-ac7d-d35c63f11030", "comment": "Malware payload (Mirai)", "value": "3d70f256275f8a1268abeb2e8b208932a7861614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463803, "uuid": "4198d794-45f5-4e96-b1ab-82afaf0644e4", "comment": "Malware payload (Mirai)", "value": "78890e7d93755f77cc565c5e2b71e54f4b006442b9c3387e642808940db059649802fb93803c46cf55ff0638635dc520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463803, "uuid": "bd4e95c5-4aab-4fd4-b011-f6ffe11a529a", "value": "T1113319B51516F2BCE9E22078F40720F529530A1C3ADCE2D3B0930579FFB5B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463803, "uuid": "7e866a1f-fbac-42e2-9efd-c9f9737443c7", "value": "768:zMClhMqB0yBuKw3GoACzQyZRtlkABYxQhTUnRVww31:zF0vZ2oR9DtlksYi0os1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771463803, "uuid": "8060374d-dec6-4466-944c-5646bdcdfcff", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771463803, "uuid": "b2484d30-1f4c-4031-a0b5-0c514caca1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463803, "uuid": "ccf2a846-387e-4d9d-b41e-d50dcfe203a4", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dbddbe-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771493245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493245, "uuid": "660cac78-3c6b-4d93-96d7-abbe7770ee01", "comment": "Malware payload (PhantomStealer)", "value": "e21aa3887fd7ea4860c0269292d1d274", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493245, "uuid": "f586f1e2-ab78-40a2-93a9-8dfafa2b7c60", "comment": "Malware payload (PhantomStealer)", "value": "3c8a6b2e8bd5dd824b31418995b4489781edf3efae09ac35f535f6f1c54b0ff6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493245, "uuid": "970bee89-09b1-4471-bf27-4c4c0259b482", "comment": "Malware payload (PhantomStealer)", "value": "c83bbb8e2e8c2ccef3c22b8c6f28ac3dfc8603d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493245, "uuid": "6690ed3e-7b32-4d97-8d7b-6039274e5c0b", "comment": "Malware payload (PhantomStealer)", "value": "415f8dfd75783ecb18c8f4861b6eec61a72047d7c98c32d59494181f97ac022f95c35c7c3798c5c3f8f072bafa793b67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493245, "uuid": "e0938631-0b9e-4cfb-b8c0-a6a4215b8da6", "value": "T1D335EF045F1786B6803D11B5CDA7A69DDF7E38863ADBBA5BED404FA9C840E07D92087C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493245, "uuid": "0f1e34f9-046e-4593-bd11-4480512eb184", "value": "384:/i2iB6PYsli81OiCDi811iTiB8nVn5iD/OCqdAJberx5eSdiC5/z36j32s2nsCUY:0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493245, "uuid": "43f88cd2-36e7-4128-8b3f-26d84723a33b", "value": 1099062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493245, "uuid": "aabe632d-bb75-439c-9a9d-5c42f554568f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493245, "uuid": "c53d85cf-e5d3-4f4a-a500-17e41a9d59fa", "value": "scandoc123554.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6217c688-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512221, "uuid": "07873fbc-8cae-4610-8d94-7cac8cd7c198", "comment": "Malware payload", "value": "8246af214b2ca378c6f4702d9dca9505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512221, "uuid": "f9dfe6ad-1a70-4906-b7cf-a70c13c80a16", "comment": "Malware payload", "value": "3f57b23a70e4d8ec8f19b68e938f83c3153b10be13f1b486c67d146ea60facca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512221, "uuid": "33ec0c2a-a3ab-49d7-b9aa-cad695748256", "comment": "Malware payload", "value": "4314b15097e09cc7436b8835034150e3b47376c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512221, "uuid": "06e6d8e2-ed13-49f4-bc9f-dec7e63e0cbc", "comment": "Malware payload", "value": "4bdfcaadd8ef5293ebc968e3c141b6aff0fd994ecc760f749b6a1a7c4f9caed52ed0a9e44b1e67a65c7c57163fcc1c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512221, "uuid": "c7128681-7769-4092-8dad-86cf59e68b7a", "value": "T18B65121BB14DDB0FE5654AB43530E2B053A89FEBA012D742BAD6FDAF383929D19503C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512221, "uuid": "8eb82d99-8d47-4183-9289-048e9c3b3cb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512221, "uuid": "1fb44a91-d2cb-4e93-acd3-b7f01a9edc47", "value": "24576:zfg3Y/u5sqtSXZ0ppDoIVVTqkVpslHlz9QefLx+Gm/l33YTXSr/27:zaY/snSJipUMZfsfzi62lnYTXSr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512221, "uuid": "50b5028f-30a1-4ece-8b16-77ea8e7b5064", "value": 1484800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512221, "uuid": "666c87bd-4b16-4a24-8133-5858503d422a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512221, "uuid": "1326b64d-0860-4eef-974d-e4d02ee6f03e", "value": "IMG SCAN 2182026798376821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ddc51e-0d82-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771498938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498938, "uuid": "f5a6925c-8903-4b83-9097-39e97adc31c4", "comment": "Malware payload (SnakeKeylogger)", "value": "6ab7afc58d929007d2d14de4d00e0ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498938, "uuid": "db24ca3f-aad6-4966-8ed8-cbb9c9f8f688", "comment": "Malware payload (SnakeKeylogger)", "value": "3fdee37db1ff6a12e661722be3f41328fad0de6d6191663e00e4ba278e66c92c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498938, "uuid": "079c52a4-d120-4f9c-963e-f7214208386c", "comment": "Malware payload (SnakeKeylogger)", "value": "42c374eb656df9d04719bb5729ae28fe37b8ca81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498938, "uuid": "148a6fcc-9074-4220-9d3a-cdae6f41848d", "comment": "Malware payload (SnakeKeylogger)", "value": "f312f529a7fb51d73d258b5936cb75347398a7acccfe5e11ecfb83187545def3d43f2290993935f003b0f78e27d6bcb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498938, "uuid": "c14b494e-5f48-4bec-ac6d-2000c89e4c70", "value": "T10845BF0273C1C062FFAB92734F56F6115BBD79260123AA2F13981D7AB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498938, "uuid": "2a498e7a-0045-41c5-a007-9b2f406787ba", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498938, "uuid": "3130b8fe-dd8b-42c6-bd97-c1e6d5a77132", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1MAXDz9WdC9I1qiI90jgPe:uPVt/LZeJbInGiz9Z61qiA0jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771498938, "uuid": "555aa50e-c102-4fd1-a198-397305556e60", "value": 1219072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771498938, "uuid": "2db29782-30d2-4572-88aa-1e7758df9c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498938, "uuid": "447e6ee1-7335-4226-b217-920f989a5114", "value": "rCM-PO250126877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b641d816-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493464, "uuid": "1e1d1b9b-2a26-4565-91fa-d2ad1767a41a", "comment": "Malware payload (Formbook)", "value": "13e396bd67dc3d09f1a12514f340c0bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493464, "uuid": "5ffbf36a-f8db-422a-80db-b72c012b3435", "comment": "Malware payload (Formbook)", "value": "401582193a38c8a98689637d4dc84a2af40773de03164db3ab2eb48a3916aff2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493464, "uuid": "403cb897-e973-46fe-a446-23bb52129e4c", "comment": "Malware payload (Formbook)", "value": "ce54736408221bd6ce313ae1834ce2a76189efcf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493464, "uuid": "789abc5f-9c5d-412b-90cd-63e9539723a2", "comment": "Malware payload (Formbook)", "value": "11066e93e8cf0fa3b840f2c1e5a2ac30f4b63ddb45a7e992eb435d5ced6eb8a88f80165c8a81cc2341dd06ef0be18459", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493464, "uuid": "cc61a09c-30c3-434a-9c44-c1814b0675cc", "value": "T17555B08DE18E7726D48F4B1960FC570D47503AE5A97629060F377E0B9EEE381722B1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493464, "uuid": "52831008-8e71-4e1f-8518-06a0f83eb3dc", "value": "24576:PkC7uVEBvZZsv6xGp3NlsUHY8HA7oNhjViOJnvthK:PkCnZTGpdEgYwZhJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493464, "uuid": "49bc1b56-a734-4bbe-9d19-5cae4c97785d", "value": 1397895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493464, "uuid": "e8815fbd-d975-431d-8d38-71133424dea6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493464, "uuid": "31d780b3-d0ed-4a2c-a9a3-136166ac37b4", "value": "RFQ.Specicification.PO.NO.2026013.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089da8a5-0d36-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771466114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466114, "uuid": "1a0f60c2-1902-426a-887b-b5f8420ae057", "comment": "Malware payload", "value": "88c91a4c269d392630a8840bea0fc1d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466114, "uuid": "6f568333-bab7-41b2-901e-f467ad68650a", "comment": "Malware payload", "value": "41da9babfc9314663b1093cde26b51be006d4a50eba524e296e9195e012cb5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466114, "uuid": "a67f301b-b8ee-4cd8-9c85-f2ff767691f8", "comment": "Malware payload", "value": "a1803f499827151e2bd5f7b71dba0da6284fad27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466114, "uuid": "d9d0b297-6932-4771-89b1-5d187c863ea2", "comment": "Malware payload", "value": "02ba405d46c7e2e059bafc4af93ddf641f7b7177134e00f26ff5563429502ea73542b5f48b5a9c3578af43334e1f154d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466114, "uuid": "dcae1b65-0de6-4d5a-a008-3878325b0800", "value": "T100F3A45E6E218F7DF278873587F74A35E39923D623E1CA48D2ACD5101E6038E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466114, "uuid": "d6fc9a12-3055-479c-a126-6e7a3305ddb6", "value": "3072:mLHHUtlyy/2XF5Ud6THr1GNErR25MPgdgHK:An63/2XLkSHr1CElGogdQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771466114, "uuid": "96616a62-95bf-4e9d-8618-4d2e99887b0c", "value": 163740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771466114, "uuid": "3b8787f8-fd0d-47db-89b8-b1c3e9e368b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466114, "uuid": "64f41ecc-0d87-4973-a484-eb30bf514451", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6dfe56-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512161, "uuid": "2d9a459c-9a00-4851-8e4e-6d28815d3158", "comment": "Malware payload (GCleaner)", "value": "b8f60c68d169a7ab60cb652409cc7b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512161, "uuid": "bdd3e7e9-dd27-49f3-91a5-6f3476aa9804", "comment": "Malware payload (GCleaner)", "value": "41e61e2d3013fa31c29c0303cf8b569f8c2cfbca42a91f5f17b2f4e12c50f287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512161, "uuid": "c55443b0-2109-4657-99db-7925fe4bdf2a", "comment": "Malware payload (GCleaner)", "value": "e68c243827b0ccd03e6c3ea0f38e5b664055c9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512161, "uuid": "00bfd05d-ad12-4b20-a773-835c3d3a1705", "comment": "Malware payload (GCleaner)", "value": "9edb352752190d9bbfefd7b5569939159968467343c5f18cf543028a0b692f617b63153ae7778a94311e21c1603ea8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512161, "uuid": "cbb86d0f-3a0f-4198-a1e9-755fd781ad03", "value": "T17736BE16B4B1ECB4F9303EFDB8DA2D04CCD6A4542B2A1516F7A46CC40A4798DFE162DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512161, "uuid": "fb9f1bbb-6254-4285-8065-1c52bc0bc037", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512161, "uuid": "c04e21a9-7ba5-4f0b-af7b-38526c3ad2f7", "value": "49152:J9t9ub2BfvB3nG9bqc/HnhAh31QXQn0z5DtfUrZ/WmFW9iNLy7OTgGkvOu8:J9zuWXB29bqam91hnUWlr49iNJrkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512161, "uuid": "be85ede9-c3a8-47bf-a460-501f365f525e", "value": 5248512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512161, "uuid": "f27ff45d-760f-451b-86bc-16f32133e8cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512161, "uuid": "e2d6171f-ad73-4a2b-9ebc-44814d919437", "value": "b8f60c68d169a7ab60cb652409cc7b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb0344f-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771481882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481882, "uuid": "51f3f88b-f012-4e26-9801-6233840be63c", "comment": "Malware payload", "value": "a59147044723a98c53281db175cb6e6d", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481882, "uuid": "6772a96f-34dc-47d8-817c-28d558552388", "comment": "Malware payload", "value": "4410f324dca991979e4ae31c6c1656901c2b1ec1ba6b365455281ead88ed9946", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481882, "uuid": "b0e28aa5-8278-4d74-a710-31802305f878", "comment": "Malware payload", "value": "e6a445e39b07650870b51759e28c38f43cefe17d", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481882, "uuid": "87d81c3f-74d7-4792-97e6-dd3ed2529cbb", "comment": "Malware payload", "value": "61b0c5d6acec59ef6d547d5e2ba5b217746b0bed4c532e94e537659f3217499e0e8d3b303904469ce6300672bc7d953e", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481882, "uuid": "eb932a18-a89a-49e8-825d-cd9be90d5c00", "value": "T163C3E04B9C0D1446FA2962B8FE571E4D73561E6CFD17B1BE0A409EE07DA324A1F8E01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481882, "uuid": "7cc69312-2d3a-4398-a08e-9ae0bb1a424a", "value": "3072:3Vu7Cuqdaav46obpe+njhnkbPFWpj2QGR9Qdcz7GRAvGPlXC:FUCuqdaav0MohnKPcGCcMAvoXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481882, "uuid": "151572f2-e642-4eea-bfef-3483ea6a1381", "value": 118881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481882, "uuid": "4fa76470-9055-43d4-b515-a75afa9eabf9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481882, "uuid": "82462c54-8ea1-4f3e-8636-03d78b95f7fe", "value": "Product_item.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc441a9-0dc4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771527511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527511, "uuid": "6021ee6f-7450-43d8-ad91-a0e417a57be7", "comment": "Malware payload (Mirai)", "value": "cd15ea9c20a0c0515bef8910558f6f3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527511, "uuid": "31e04343-076d-4e87-bfdb-55a24b9c117b", "comment": "Malware payload (Mirai)", "value": "4520a16bc929314f4214b9f0fa9441fda74668fb0ed4e8f0c98aa8857170ab86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527511, "uuid": "da461ca2-1ca8-403b-9391-77c533660672", "comment": "Malware payload (Mirai)", "value": "cfd228afa5e2cecfed82bc3b28ad3bcdc5f74129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527511, "uuid": "17a9d16c-9772-4dc7-87c7-4d434f69e8c7", "comment": "Malware payload (Mirai)", "value": "4cdc954a669dba95b1ff9f410235b894463ad2f9ccd453000af1e36008cd9d8bdd5c1c777ebbde25997cc946614ac101", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527511, "uuid": "1a294a12-464d-475e-8254-a09dfb0cccbd", "value": "T16B03F1A4A16C8072E37038B6FC7F4211679600B8E9B63253254927F876ED5443AFEBF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527511, "uuid": "44d10ed7-7435-46c5-b56d-440ecb27ae9e", "value": "768:RJkCxONpdUz/WfhGOt+4toMfrb3mJf+sJOSHK9p/H/oRFpx9/Yq3Uir5G:UCcpCIBtzWMf3m55MfwRN9/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771527511, "uuid": "621f3ac8-15fa-4179-9050-aeae9a3ca780", "value": 39124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771527511, "uuid": "a468bc89-fd2f-45fc-aea3-038715f6bc9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527511, "uuid": "fc071623-ab81-4f33-875a-fa1dd86c0a6b", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8a859f-0d34-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771465584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465584, "uuid": "9e77b680-929f-48a5-8c73-45122c47d68e", "comment": "Malware payload (Mirai)", "value": "b89260a7b3e15d98861336d285880993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465584, "uuid": "d366642e-ba87-4077-a2b6-d88232411195", "comment": "Malware payload (Mirai)", "value": "4523165c9c78e89086acff14f16b660606ecea6daae833e39fb3983a8bf73f1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465584, "uuid": "3bb95164-7b4d-48ca-b367-9584270a3209", "comment": "Malware payload (Mirai)", "value": "189bfde9ee98fca5a0d53dd7f07f588e4238a60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465584, "uuid": "d3374e5c-e0eb-4dd8-a296-e5d8544dc300", "comment": "Malware payload (Mirai)", "value": "f6601187af33b84c8f7b239ff85d10f8e148fe581eaffa3b3f965aeee84ae3ee906f46746f10fe4d20dedd86155f0f1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771465584, "uuid": "7208690d-b89b-4e24-8bb0-f5adaf6c3f38", "value": "T1A1A3299ABC85C602C5E1A1F2FB1E51CD371643B8E3E67147CD18AB29674F8670E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771465584, "uuid": "09d1a14b-1168-4f53-b29b-b52f37aefeac", "value": "1536:E4I6S0ZNrv97r5f4tCxKpvq5cm2goCbqRWw5Wv2Db+R:E4I6lrV7SkxKpvq5co2RLM2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771465584, "uuid": "db2b4364-91b9-4a30-b2a7-cf82042e3f08", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771465584, "uuid": "2225024a-3173-45c1-a89f-ebc35ee09b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771465584, "uuid": "38134031-eca4-4b8f-ac98-623b0c464db3", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee926c48-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481962, "uuid": "273a45a3-5331-46f1-86af-1154ee9dbdda", "comment": "Malware payload (Mirai)", "value": "2f96ad4d6cf25228439475b597968b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481962, "uuid": "b462a419-56fc-41a2-8180-6b152a3651b6", "comment": "Malware payload (Mirai)", "value": "464888909fa2345914db16748cab6c5f10401cd6377ca187196779163c7f6f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481962, "uuid": "1a993a6b-3157-4fb3-9f10-ed40ef32fec0", "comment": "Malware payload (Mirai)", "value": "806b6ae9bca1b3585c40fdb3582f60f9bf0fa995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481962, "uuid": "7c8a4abb-9794-4002-bdd9-296b767d1f7d", "comment": "Malware payload (Mirai)", "value": "7eb04a2d7c6a345a516172e3822ded243f2c72048521f743d7d1a3a7ecd309fb606c8f33045fdffeccdbab1b277f61e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481962, "uuid": "cdb83982-1af8-4e89-912e-687a094149c1", "value": "T1C6B3B0C76160BABFF0656E3FC403CE16A6199FA019471B2D61BCFD905E3A3907292E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481962, "uuid": "7d368de3-1cb8-4398-880f-1583e725e554", "value": "3072:+riJneKsvUsUVU4SimTHMvM3HRxvhPeDUSC:+esvUJSlYseQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481962, "uuid": "93a601b1-c449-4a0a-b116-052ccd471c13", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481962, "uuid": "cd8d35a6-bf09-46fa-8c94-5d18a684fab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481962, "uuid": "c47e6dd8-fcf2-4b69-994f-53e2d386ed66", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cb77a9-0d8d-11f1-a129-42010a9c0007", "comment": "Malware payload (PromptSpy)", "timestamp": 1771503764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503764, "uuid": "673c258a-18d6-41c5-a4d3-0632cd6a830b", "comment": "Malware payload (PromptSpy)", "value": "3efebd8289652af8b3da8ff77acad36b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503764, "uuid": "24b75b92-1da1-42c7-9322-3d683cd8a061", "comment": "Malware payload (PromptSpy)", "value": "468eed1131e4b562ae32ff2734d9feb37c9b8e2097df05431867279614c8502a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503764, "uuid": "0a384779-3000-465f-8154-192af7a80075", "comment": "Malware payload (PromptSpy)", "value": "e60d12017d2da579df87368f5596a0244621ae86", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503764, "uuid": "21c380c4-1047-4ffd-a315-f25a95a5cd10", "comment": "Malware payload (PromptSpy)", "value": "8dfab8b60cbb52d137373dd87181c7859f8d645f915bfa084a124fd52e2bdaa18375e6e6afc5eb02f5300ebc521f5aa5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503764, "uuid": "772284f1-04b0-4766-97e0-625f7a0f9be4", "value": "T157F62342FB68AE2FC83740324C9B473566596C23C7568747E978372838B76F80E897D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503764, "uuid": "4a5f119d-358d-4432-a27d-6fe55e268161", "value": "393216:MWpb9cr+pfCFm/2i6UuCFInprEfvyrai74rv2OXSUbm7l5Hn9:MWpb6rGfMm/juCWnSfar/Mrv2amx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503764, "uuid": "b470612d-0b2c-4c90-9acb-222a3c8a3904", "value": 15831131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503764, "uuid": "290fd59d-6f77-421b-8348-14da9655d442", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503764, "uuid": "5ed0202b-a08b-426d-b4c8-56970ec6bc59", "value": "mgappc-1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a702d38-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771512235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512235, "uuid": "f56661ba-4a26-4081-a5c6-47f6b8092a8d", "comment": "Malware payload (Formbook)", "value": "b7f788156600e4377f4bed878382ffca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512235, "uuid": "bb0ef5a4-d47d-4b7b-9b0a-d3161dae8512", "comment": "Malware payload (Formbook)", "value": "470abd693bd0cf522e05d2c0167a34fff5c4574bf040bb324f4aea114b4c80fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512235, "uuid": "29428f56-066b-4b4f-803e-8638901cd53a", "comment": "Malware payload (Formbook)", "value": "161e1b8d8ada5dc730cf81623b5a8005484dd70f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512235, "uuid": "f9c09efa-1461-42f3-ad9e-ef13764eade6", "comment": "Malware payload (Formbook)", "value": "27626076cadc41635f2a21dcdf3379f81595da84862ba60fdb3fb426fcda4371abc1458a71b7e36d011f1ecbba95374d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512235, "uuid": "909431c2-4669-44ae-85fd-c5c2615ac6f6", "value": "T1763523762688C867E8D80BF685B2D33113F1DE8EA912D3069ECDBDDFB4A77424518346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512235, "uuid": "a41632df-9151-45b7-8561-b721a92c5275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512235, "uuid": "feb5b0e9-6488-4b58-9f2c-bab012d14d13", "value": "24576:2snguQC2NlPJcB0RsnPsSwQ/L+Zz7TiTxZs4yupSwj6doMVictf2:2sguCJcB0R3H2Uz/2s4LnmoMQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512235, "uuid": "f319439f-90fd-42fa-ad25-680af4c47309", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512235, "uuid": "11f2c98e-4a08-4e3a-ae02-4f12a009f7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512235, "uuid": "2bef2761-14f3-406d-abaa-6f14682358cd", "value": "Order 4888209491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8971600e-0dcb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771530326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530326, "uuid": "35dcf931-4b70-448a-88ec-875cdd3b360d", "comment": "Malware payload (Mirai)", "value": "01456a541fd62a7dfe5b3857926cd4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530326, "uuid": "0887a591-267b-48f7-a064-d785543a4bc4", "comment": "Malware payload (Mirai)", "value": "47bcd340be768a6e5a6d2e43151cc98ecc0dad885e25dc14092cdddcec3de4ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530326, "uuid": "5cd32e9d-0c4e-4926-92eb-7f3f4778c2f5", "comment": "Malware payload (Mirai)", "value": "64fac8976192bf83e92fb9071b62f8ebb5fa4661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530326, "uuid": "d6457f85-3609-4a50-93d0-60763c1d89a4", "comment": "Malware payload (Mirai)", "value": "7bb903a9391bbab006a054a989f8a3014ab5f41b4c7b3a078a7835b984de265ec1bf85b0efa5572f6037468564894471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530326, "uuid": "cd0f1688-58ae-47a1-8765-f528a5580c69", "value": "T10D53F103F240A733D190777CF8B8AE85E37F42F492A9E5A65302966C5B97001EDAC2F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530326, "uuid": "899b5ce3-44f9-490b-a054-42207e3edb85", "value": "1536:NhZNR6jqwQzbDe6/0IbjP0cuvLoBXPy4xVcKo:NhZPlDe6PnP6vLoBXPy4DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771530326, "uuid": "26715622-67e5-4214-b583-fb10b29ebe46", "value": 61324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771530326, "uuid": "1acf8477-8d84-4ff4-9746-ba5774450675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530326, "uuid": "6cc82625-960c-46d6-a6aa-84194b48a3c4", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e20a8cc-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493182, "uuid": "536a925d-95d2-4dbb-8b71-1ef190703b50", "comment": "Malware payload", "value": "ae576cc927c169866d93bbbea23c25ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493182, "uuid": "67668bd5-b29a-4f42-ab3c-c6e63a8ae06c", "comment": "Malware payload", "value": "49a886fc186f47f0c3a36c172d97dcd19f5f6d64f8c954d7ea77fd09cbc2c38f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493182, "uuid": "7c3d455e-bef3-45bb-a754-8bac4ec5ce46", "comment": "Malware payload", "value": "d2d848e31273a11904fc661db7c9cd1afc4d5663", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493182, "uuid": "b7689f56-8293-4067-8db1-52ec49b86461", "comment": "Malware payload", "value": "89ea7c219c65c8ce702ac05d34df059b46904076dbf7222cc5d423072081fdd287dc23bd508b5192f7e9dac62ef17ea9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493182, "uuid": "a7e1a88d-8189-4972-83c3-24e7b6468e1f", "value": "T19426AE199EC97DDC1ECE014F94AE2A0EBCD59E99F42B67C3721EBE636B35040254E40E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493182, "uuid": "ee0f316a-a090-49e1-9460-32a9aae7651e", "value": "49152:MMEmtqc76BQwW3PQMIsF7hpMh7K/wJ9J+BQMH6P+f5WN8aA+Kmmlr0NzxuHJgf0a:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493182, "uuid": "02e0ec1b-6f11-44cf-a582-b51a4487663f", "value": 4712310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493182, "uuid": "9d297f67-0f9d-4339-bf33-7f3f344de010", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493182, "uuid": "98ebba92-ecb7-4c91-b572-f1c946757b4e", "value": "Vessel Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026111a7-0d9a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771509054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509054, "uuid": "163c0f5d-a11e-4fad-b04a-8b5688cf67c4", "comment": "Malware payload (Mirai)", "value": "f66887bbddb17dc91003896a24a691f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509054, "uuid": "653ba32b-739e-429c-92fa-a12e0081ad9c", "comment": "Malware payload (Mirai)", "value": "4a0b5d01d557813e6f2d3cfd60834ea828e56f687d6a90f7cf5745fc0aeb8722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509054, "uuid": "47fcc09e-81b2-4147-b70f-9ae5b30d332b", "comment": "Malware payload (Mirai)", "value": "f06218e9c65c720853a7922948d9e2d719e707cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509054, "uuid": "c2f92750-e4b8-47e3-9b77-4dbad8fb9d81", "comment": "Malware payload (Mirai)", "value": "e6b64330f9acd6d6c3630d2defb6e885c56d1657b7c5e1f7a2cde17e405bed33d8e259475be612ca42e3bf6642771199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509054, "uuid": "9e332c9d-8de1-4a72-9f59-8f4d12bbe57c", "value": "T16BB30A9ABC458B10D5D565BAFF0E618D33134BB8E3FA7113DE149B2A638AC5B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509054, "uuid": "e247e904-4f04-4a02-9f69-3fedcd84a397", "value": "3072:pWBGHrTrk5xENjfCpuxSeuqd8cbMrOxj/thv8ZemOgQx+R3D:fkcmpoSeuqd8VrCj/th0eZga+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509054, "uuid": "fc91737e-2a99-45eb-a893-936924cefa3c", "value": 117996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509054, "uuid": "6cec0bab-dd5b-4e89-844e-d82e81fd5ee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509054, "uuid": "7c1a8d1c-6d61-4dee-9824-ca2fac8a3096", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3055aeff-0d9e-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771510849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510849, "uuid": "dd3ccd72-9e0f-43f7-bbd1-1af8163ece84", "comment": "Malware payload (SnakeKeylogger)", "value": "731f9d816a1c0596f07b23ab49b05110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510849, "uuid": "49acd0f0-0252-4ccd-8145-bcf7abe69fa4", "comment": "Malware payload (SnakeKeylogger)", "value": "4b7a405d2d1a9411a60f5316c9a77c64955683686aec9d2aa74527d177f6ada6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510849, "uuid": "170d157d-2711-425d-ba78-f507589f503b", "comment": "Malware payload (SnakeKeylogger)", "value": "71d9348ac33745340e96da0ee854de269f1101f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510849, "uuid": "7ccaa3cc-c2c0-45e9-bd9d-c5d2ce34e5f7", "comment": "Malware payload (SnakeKeylogger)", "value": "c69048fb401c32ee3637d2a16032b0b98679d94ba912b1eec689bd18015e8fb0db0624a53d0ff52fc74968dee9817cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510849, "uuid": "e5fb79dd-6323-4384-82d2-905f58628c88", "value": "T191E533029888EE65DE754072EC11CCA35AB0B931AC0EE9B9C385FA3D18767517F9790F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510849, "uuid": "018e3d39-7d99-42b0-9df1-1ec9b55921f0", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510849, "uuid": "9d3f7f7c-3ad1-4625-b985-9665f7f3e1a0", "value": "98304:ST5ne3yZ5GZE7nnoiztYZlpP9XfrmMwI:ST5ne3yZ5GZE7oiBYPp51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771510849, "uuid": "865b4177-6c26-48e8-af08-7f5e2dbfb50a", "value": 3222016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771510849, "uuid": "afacd60f-f7ee-4a9b-9537-4666a4a701c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510849, "uuid": "23e1407f-fcc5-4509-b79d-ec3aebce7893", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0152199d-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771484571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484571, "uuid": "03c075fc-c5b1-44f7-b790-b84ba07d67fd", "comment": "Malware payload", "value": "c9c7b10d4a5e7401ef02b01eebeb75fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484571, "uuid": "6a323494-316b-4b98-8a24-9bfc749cb2ab", "comment": "Malware payload", "value": "4bf63ad6c87c8e7461064c7a87dbde0d43bef07cec04e4794d00fc23df138a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484571, "uuid": "ed38b9a1-dd33-4a1f-b4d6-adf8ba4264a5", "comment": "Malware payload", "value": "dbb7791588ab2ff4f6a4d3ce7f93d77ff2052db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484571, "uuid": "7084624b-fcc9-4215-8ab9-522da3af6f3e", "comment": "Malware payload", "value": "90e6aa7f8f9f1384e9b6a38ee6c7b6134208f849bf81ab6d0425c5b37ae6628efb9a434eaacf18bf4b3810c6f8c66fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484571, "uuid": "0067d425-9a12-4068-b477-a747a9ce9ebb", "value": "T17311E5639B4A98F6C05C12B85A8BCBA935BF90340366A1270CCB413B75907AA699AB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484571, "uuid": "e1524d0f-89f0-4e12-a3e3-dc7b97e96b9a", "value": "12:e31GSGGM00/UH8DlOdF41oMEHDwUi8L2WdiHR:e31GSnSUcy41oMEjxi8L2WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484571, "uuid": "36cf2507-4e49-4269-bfa1-ab0058ea5e50", "value": 1089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484571, "uuid": "91544cc5-204c-471d-b150-2fd843f83100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484571, "uuid": "662f4b4c-c40d-4760-ae0e-cb8a721faa7c", "value": "c9c7b10d4a5e7401ef02b01eebeb75fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1656186a-0d94-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771506510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506510, "uuid": "d18c0fd9-9dac-43c2-97bb-2dce00cc2c37", "comment": "Malware payload", "value": "49f444ebd3e4f1463bc68649fcccdbfb", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506510, "uuid": "2856c994-3d00-4b56-9e94-dba31385d4f8", "comment": "Malware payload", "value": "4c40a11a1226f59ec7cd6b5348bf1cf36cff0c7d4006829f950d8269526bfdd4", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506510, "uuid": "0d36ca44-87ef-42d4-bfaf-5ac3cf695de8", "comment": "Malware payload", "value": "e902f7ee4cdc1370cad66039c65661a943212c62", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506510, "uuid": "a97b6c22-2616-418a-b709-be9961a03cd7", "comment": "Malware payload", "value": "bf88ff90fb237e237a2aa8414bce6c4e4eeb69c5b89a01195d555c1cae78f10c0c09baeec819f68afcae81278805ef8f", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771506510, "uuid": "bf31bcf2-5d98-4417-a72d-79b4b5993b1a", "value": "T13D183308BE22255EFE3D9430C5585274E7B0012945B29CF6892E22E335D3BCB5B79B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771506510, "uuid": "70ce5454-c3b5-4b51-ab70-43c16453b250", "value": "1572864:vYxI4xxtMhf2byZw25/L1eV01S2IaCWZDYt8OB/ZKd1CaQQhWWJoagF0dt3jSfDX:vKI4xIlRw2/I3025B/sd1CQh9OB+rEoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771506510, "uuid": "6c2215ca-2853-4b6e-a1c1-de169d945f82", "value": 90894190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771506510, "uuid": "67a2869c-2ca1-45e2-bc71-c57d8bfa55f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771506510, "uuid": "c105d425-6d08-44e5-a271-8d2414f5a3ff", "value": "320-zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e4d076-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493510, "uuid": "22d78d1f-ac9a-452d-bd39-6e5d778e30ce", "comment": "Malware payload", "value": "e372b31ed6c1999e6e01bf547bef477a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493510, "uuid": "be299bf2-b23a-4d26-8d4d-c5abe5b5f4fe", "comment": "Malware payload", "value": "4d122aff5120b17e8a9c05352daa3069865b92029598084a43a6aadd2cf3fc58", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493510, "uuid": "7e16766a-c770-487f-a979-16a75863d3f2", "comment": "Malware payload", "value": "3c9af9de55e5bff0d094b06e7c1ffa5e94a9385c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493510, "uuid": "e67077d9-6cd4-4a84-a399-500ccbfda76e", "comment": "Malware payload", "value": "1b14cdb8ad62b4a69f0723b5e2b420ae367a9a666d4b7e7944f65ed5770c7e2dffcb4c1a267836712fd3288519fd7bc7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493510, "uuid": "cf93a3f4-8475-448b-b07a-b505fb909ad1", "value": "T1BE4124141BF50318E6F39B79A8BAB3118976B865EE62CF8D0250618C64B1520F5B7F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493510, "uuid": "0bd06212-72af-4488-863c-047160913558", "value": "24:8Q/BHYVKVW0P+/CWqsU9s7BENV5yAoq3UMkWXUfpjAUfR+/E4I0arab/WlY:805a+sU9asV5yAoq3HvjyAIZabi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493510, "uuid": "fba7c78d-0ab2-4a5e-a339-28ebcc077851", "value": 2342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493510, "uuid": "e8c1bc5a-3060-4a4d-81b1-7840c9262268", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493510, "uuid": "76613be4-fc09-4b10-b03f-f865785ad277", "value": "PO 1013426.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365d7482-0d9f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771511288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771511288, "uuid": "c4381850-73eb-4efb-840d-69aad98194f8", "comment": "Malware payload", "value": "6831bda5207b811f281a722747ef9ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771511288, "uuid": "42c7f2ee-3f8a-48ae-9f21-12f5db8e3d3e", "comment": "Malware payload", "value": "4d15c4b79dd29233ab3b016f5e28186968ea291935608c5790d54803509f3b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771511288, "uuid": "53a3b508-0822-4ed5-82aa-81c864b86349", "comment": "Malware payload", "value": "a02de21aacf7379c3b940a6834133207cbbb72d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771511288, "uuid": "b8160753-ccaf-4f0d-87d8-bf9e03191e66", "comment": "Malware payload", "value": "98b32c1a1c1f737d3929d2104f2ed0aca5c1a3eeddc298ab249f61d26f278f132c91caa6de537c2d3b39e800e9a0eeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771511288, "uuid": "c569813f-b81a-44a3-aa25-80ae8726ce1f", "value": "T114F4D0193BAD42ABD914063188926626376F1C3E1F624497EFB8BF7D20324D142B59FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771511288, "uuid": "70985667-fa5e-48f9-86e2-df882d0bbb54", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771511288, "uuid": "c4bd3c42-3523-4624-99d7-45094c84f373", "value": "12288:toSWNT8C0lzrelZLOJaWSr2I68RBI77n4aJUuLisfubSWaXbj+m2yvLhQC+4bHyA:toS2T8LzrelZLOBSaI68Ry7MaJTtGbPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771511288, "uuid": "d79524a6-aa0c-4256-a90d-94da0b41693c", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771511288, "uuid": "e1985877-5ae2-4e2a-879b-af9b777ca1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771511288, "uuid": "1487ab9f-6642-4bd3-a64e-6713a7b82599", "value": "OfficeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b73a245-0deb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771543992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543992, "uuid": "55daad14-e252-4ddb-ad54-7d15873972d0", "comment": "Malware payload", "value": "ca283ca6cc137f52d64f757140084397", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543992, "uuid": "5a945829-46f3-4372-82ef-b0d45c24b0ca", "comment": "Malware payload", "value": "4dac8d22b9e438278b562eeb2afe99a455ddf7881c23bddfeae76df7fbf1b71c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543992, "uuid": "24c360a7-8bf0-4828-81b8-b61071e1030d", "comment": "Malware payload", "value": "789d75023ca43621ffe3bb90f311f0ec578df3ac", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543992, "uuid": "b1b141c0-18d6-412e-9c62-852c5aa428f9", "comment": "Malware payload", "value": "1aca03783ff9087e3e2f0ac64a88f4f3832a99583fc47127912ba4d00c81e806829ebe0d5a66357133cf827647329442", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543992, "uuid": "4406f3d9-551f-4e1e-b192-2d33a31a8ad4", "value": "T1A8552380BD00A746EA9786B55575D0981628BC86BF0BC4E7236E333C303D6B55BDB72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543992, "uuid": "dfef6fab-8b2a-4e64-ad6e-a024046bf287", "value": "24576:JOmSZ/NID0zLZi63OG1KF6+yl9efkZtusF2aFNrkzJdcis6p7zIOp9Hi2JnZw:gmy/z06eiKF1yv6WzydXoOp9HNR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771543992, "uuid": "92766a4d-4b34-4cff-8aa3-6e4f90c37de4", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771543992, "uuid": "122ff647-f566-4e00-b594-9383488c95b0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543992, "uuid": "bf8e1cc4-f258-44af-8444-97bce5f28753", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Doc.15898.23326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e238537-0d8c-11f1-a129-42010a9c0007", "comment": "Malware payload (PromptSpy)", "timestamp": 1771503221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503221, "uuid": "80b3f4a8-18bc-493a-a806-c287db051f37", "comment": "Malware payload (PromptSpy)", "value": "12609e847c88f2e88b54efdb81b5b154", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503221, "uuid": "38a73159-7810-43ea-abd6-80e84d1a07b8", "comment": "Malware payload (PromptSpy)", "value": "4ee3b09dd9a787ebbb02a637f8af192a7e91d4b7af1515d8e5c21e1233f0f1c7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503221, "uuid": "2c3ec0f2-3ec3-4495-957b-0554d42ac194", "comment": "Malware payload (PromptSpy)", "value": "c14e9b062ed28115ede096788f62b47a6ed841ac", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503221, "uuid": "7fb65e5b-17e8-46df-8e2e-a4dea8a7f363", "comment": "Malware payload (PromptSpy)", "value": "ba5366698da544ed0a17e3e167bda3b841be028be18e995f580a1456e1f80d8c8f38944eb354354e77ad61b52720cef2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503221, "uuid": "ee7db337-d3e3-4c49-982e-a5b3225de85f", "value": "T19336F1DBF7D8992FC87710B2C9AE52B126478C068B839F436D44361C697B2D41F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503221, "uuid": "24e52ae9-897f-4e6c-acd4-b42b71228709", "value": "98304:axa9OCCzwOVJqLGlvuVkqsK/+TuPcLdDFAyJXCqrVhnDd9UoTwrYk+A:4LO6qOvuVk6+TjyyDrVbo+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503221, "uuid": "39e0f5a3-17b8-48b9-9193-69bd6c0106c0", "value": 5148538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503221, "uuid": "df1fdb7f-aed0-403e-b7cb-dbdbed81f94c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503221, "uuid": "b08f9b8c-884a-4941-94d9-e9934439a12e", "value": "mgapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ead848-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512142, "uuid": "45e3f9fd-9bf3-4745-9bb6-5a017364c135", "comment": "Malware payload (GCleaner)", "value": "912715b87b9f499e20436e98272b49a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512142, "uuid": "9f7fd76e-3e51-4a8d-a345-c5df834d1329", "comment": "Malware payload (GCleaner)", "value": "4f9f3440b2512c194e0d993d20ff330f032f316f609a44845cfec56f18832b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512142, "uuid": "550690f8-0692-403c-ad13-59e1a11072db", "comment": "Malware payload (GCleaner)", "value": "af463b588b00e9335c3deaddc66c3346298eaab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512142, "uuid": "a93e77cd-ef3a-49a4-977c-ca239b255897", "comment": "Malware payload (GCleaner)", "value": "f82e022e51f724e115cc22735eac3a89e0c86b8f018595a3027cbe8bf4c4fd398d3067b55a60fd99c2f4ddf7065be6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512142, "uuid": "48cb18c5-93dd-4e82-afb9-c148b1a902d8", "value": "T1D806F11156F98F67DB35B7F9586E885C38657F017C20E8EF23B4990B46A81C0F9B81B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512142, "uuid": "b56f63fc-54df-4771-aad9-e5c9cc0ee15e", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512142, "uuid": "5d7585e3-2fe0-4f41-9cc8-a0a3d51091f4", "value": "98304:vH5kY7XyYmeWOXVY61rh0gOqKJ3YT8Ug2Ds:vXTyYmZYY6XHq3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512142, "uuid": "8efab100-5593-4c4c-97ee-a3b7bcd75a4b", "value": 3766272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512142, "uuid": "36d7bb55-ae5e-4261-90f8-3426d181a134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512142, "uuid": "188371d4-7315-4059-bb59-383f5e29d883", "value": "912715b87b9f499e20436e98272b49a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4dae45-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771512261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512261, "uuid": "d929ff4c-c8cb-48da-8909-53c0d0a670e4", "comment": "Malware payload (GuLoader)", "value": "21c4208fb8a4fcc3ffb290c77ca5e1d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512261, "uuid": "5581ac9b-43e8-4b93-aaf5-fe62d31a94b0", "comment": "Malware payload (GuLoader)", "value": "4fba78d5861a3d27b31a489a733da507646727f665999aa06336ed53dac5a687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512261, "uuid": "13156f64-0b40-4144-84c4-9c86e656a9bc", "comment": "Malware payload (GuLoader)", "value": "a7dd284e933435e7049222062c85ac3a6731a94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512261, "uuid": "ca6f6ff3-e9ac-448f-9fae-a8be68532fd2", "comment": "Malware payload (GuLoader)", "value": "218a9dc669d518fb059923196fb5356f013553628a365aa5482441ed39b1ecce84eaf5b90ac20c047825b10484373f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512261, "uuid": "16460108-b653-49da-8ffa-f0021fcc9748", "value": "T1BF73D0567270D4B3D57603704E7B677AAFF2F91111D09B472B10AB1E7C36682892F293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512261, "uuid": "ba83674f-cf07-4e35-af4a-1d19dd43bf49", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512261, "uuid": "1e9f687f-4cdf-4739-8e21-f06db5a35787", "value": "1536:5OBIW3oHu0fNJtuPBHotcd4Romu/TSbH5dvhLYIstNRcybW30AOn:5WIWYHxfvyH+cd459bHjvhLyN230A2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512261, "uuid": "91a90c54-7ba6-4190-820c-5f77fba82618", "value": 76137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512261, "uuid": "093fb3ca-23c2-4a30-b604-ae3e62c07713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512261, "uuid": "78b9e87c-8cb4-4575-8232-03041b483a66", "value": "Payment receipt.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50b81f8-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482295, "uuid": "c84e59f2-2399-43fa-ad83-12a7b7d7d862", "comment": "Malware payload (Mirai)", "value": "b05480148b958e0353233efaf756361e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482295, "uuid": "f1288732-4a53-42c1-a1d7-81d3bb5f268d", "comment": "Malware payload (Mirai)", "value": "51631493f1bd313825ce2fea50c4c3a910d270558fcbcb40420d97afdbf855a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482295, "uuid": "aabe8a84-5d55-4546-b316-f899f8b0d219", "comment": "Malware payload (Mirai)", "value": "ef860127c1cd94764645ffc9705745bb71d63cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482295, "uuid": "886db52b-c091-4e1e-bed5-3d2c54aef30d", "comment": "Malware payload (Mirai)", "value": "ac87c9b58b6daf82e51f71fc118846147c09ee311895f3beb1fe720f7b42b9b42487330bb3461de3ad69445c1482637d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482295, "uuid": "54549bec-2643-46be-88d9-ec0c2be0f948", "value": "T1A963026DA9397DDAED7836B53DDBAB54F42560598C8209008ADC039C3BED1AC1CDC89F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482295, "uuid": "3be649c6-cc6b-4adb-b668-c48727267497", "value": "1536:LPgojAKsG+WPnloa99o/fhTx3d6So261lClRAJx+N2x:LPgWkIRsfphd6SojcRAJx+N2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482295, "uuid": "7b4c0934-cf69-460a-9d57-54025060ccc8", "value": 71496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482295, "uuid": "d5389ee7-c6ec-4a86-9ab8-0084de923f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482295, "uuid": "9ab23aeb-e3a2-4c2b-bcad-fbc3c0ef628e", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa6347b-0dbb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771523357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523357, "uuid": "c0a4a33d-3f69-4b20-922d-6925b0faa677", "comment": "Malware payload", "value": "2174fd32718aa409ecfe8db248ca7423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523357, "uuid": "96a958eb-f5b8-4eed-ae0d-aa9a15fcd8a9", "comment": "Malware payload", "value": "51e02efca1d0b8d5303907a1af5afdbdada746fb428ee832ff4e44d685449b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523357, "uuid": "515b7241-0ac3-4917-9875-2b6d64a6c625", "comment": "Malware payload", "value": "ec4d8a76fb0d01c52c167c5568d3fa1e8cf4f941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523357, "uuid": "fe95df6a-dd75-4ef2-a32c-08d93fe41e8e", "comment": "Malware payload", "value": "2b38a49e3770d3be22cd5d49fb66f314877dc8193f66c177c741f8fd65b6bfb48d1d8e00fc0d56b20e4452b28bd0f528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523357, "uuid": "edd21a86-e3ab-49a1-8cca-65501d8cebce", "value": "T1C1D41ABDAC20E366F70D90BAE246D3534F2138410636A9A329BED7141246873DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523357, "uuid": "b5ec9957-55e5-4628-b157-5bc73a6a44e9", "value": "272da274133b3bd9f0a6f58d3842d526", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523357, "uuid": "9c55fe48-6709-4a43-b814-6e4de10ab6d8", "value": "12288:OrW8rSu9JOwZD6GIlgjfnI48z4He981xvO6qYO:O3rSu9JOwFdbjf2z4He98jO6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771523357, "uuid": "f399ee42-e8c7-41f3-9399-49c0d04b52c7", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771523357, "uuid": "485d89ee-efcc-44d5-a07e-78fd710d527f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523357, "uuid": "579fda37-3054-45f8-9f17-aba467b395e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ffc026-0dd0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532360, "uuid": "003b3a6b-2f39-4364-9731-81afbe7d396c", "comment": "Malware payload (Mirai)", "value": "8ec3a0e5a479ae821402c434edc53d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532360, "uuid": "63460934-deb3-4d41-8c48-550685d84079", "comment": "Malware payload (Mirai)", "value": "51e9de3469d0f7006943f10500652f9f5dc9e58532dccb5166094fce08800543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532360, "uuid": "41cea9fa-3589-4234-9063-2d7365b59750", "comment": "Malware payload (Mirai)", "value": "70abe21722a4cee88e711be9d5c71ef034ccc65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532360, "uuid": "a239cae0-5315-4944-820b-44bcdbb767c4", "comment": "Malware payload (Mirai)", "value": "c18b4b741e2e561a386ab622260dd3aabe70df3503b802dea740440c79e3a438d1f781ba5965a8803aeb0afb1bc40388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532360, "uuid": "67925947-da1f-48f2-bc93-aaa4cd52ec90", "value": "T183A3D605BB610FFBD86FCD3705A9070525CCA95B22B87B3A3674D828F54B65B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532360, "uuid": "ded734f1-1c48-46a0-a636-0a5a50fdcbca", "value": "1536:SEqlh+85nDx/e27yQKV7eb0GmMH2ZalK6eLJlMbSimlh//de:7mh+85ntrDm62JLgu/te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532360, "uuid": "ede4ac0d-9db3-4564-ab7a-b9c9ef3ebc9c", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532360, "uuid": "16bf86a9-ca2d-4779-9a8e-7aa32223abc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532360, "uuid": "6510ac8d-5556-4bca-8cbd-2b0143ab2caa", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1ada90-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493314, "uuid": "8859d682-ede0-439e-b4cc-1d0f34b7fc81", "comment": "Malware payload (Formbook)", "value": "b499c4c1dd87ba1fd2ea6ccfdf295965", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493314, "uuid": "b6797c5e-7676-4fc8-91b1-b37c18015796", "comment": "Malware payload (Formbook)", "value": "53b40a5a7eb1cbfc077d2b309fb7d9feeade6ee5ca1c4d466613d0f9e14748fe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493314, "uuid": "3e6e838c-f622-4d3c-9316-6921ad14db9f", "comment": "Malware payload (Formbook)", "value": "c979385ca6092e5ef198d59f59ac7b41dfb47cf7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493314, "uuid": "9afb5c2f-5e5a-4a53-98ad-e73c62590ef7", "comment": "Malware payload (Formbook)", "value": "09039bf56ae14a196710028c995b6c0df81788fbe4ce7dcdd1721a9bf681fffd9e5eca112cf6f4985f58f11e0a9bae1d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493314, "uuid": "f0d8b0cd-0d5c-4802-a4e2-c2850a442a7a", "value": "T1F055C009D86893C4ADE8C90AD1EE471A57D17D0CA212B2EC807BBCBD63B77067747399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493314, "uuid": "d3b715ae-8459-4d00-8138-bcfc31579408", "value": "24576:3g3HDCAuGWL6NTVlRn/XaFZ7oleMcPoEzVooo:wfVn/XaF5ogSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493314, "uuid": "401f6b8c-e0ee-415b-a87f-a4e341801b03", "value": 1389979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493314, "uuid": "d7b8ac5a-5524-4fea-9119-3f523df8f611", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493314, "uuid": "ea0e86a5-d42a-4a14-8ede-4df319f41c78", "value": "FT_2602194331187_attachment_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a721fc52-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771493439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493439, "uuid": "3a432780-96b3-4b93-af87-35b56e832e4c", "comment": "Malware payload (VIPKeylogger)", "value": "5eb02f8701045d0ecba5445efa7217e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493439, "uuid": "56bfe9dd-2cb2-4730-bb9c-581530d2e01b", "comment": "Malware payload (VIPKeylogger)", "value": "541dd733dcad82d1a71226ff3ef73991ede6756a731fb964b639f93d9761bfa5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493439, "uuid": "d817df06-c4e7-4db2-bced-159a0e772b36", "comment": "Malware payload (VIPKeylogger)", "value": "9df04f6c610a178db870e5df221bfd35f58295fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493439, "uuid": "5a9279f2-e6ca-4af0-8a01-1425abbc3a8b", "comment": "Malware payload (VIPKeylogger)", "value": "39fddb7f4717a47d31758bee9c30777755fb3e59fc297307c607f566639e680a9f2b6e9cc8d47bf71137353b2ac1ace8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493439, "uuid": "33a00620-e864-4b38-93e2-7720930200e8", "value": "T1CF45178009E2F8848A3DE90D891F7F6DCFA141C115F763DD92B15EEAC651EC8A618E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493439, "uuid": "f62dfa40-b96b-4378-9a83-a37a69c95c95", "value": "384:u777777777777777777777777777777777777777777777777777777777777779:lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493439, "uuid": "9a502bec-42f2-47f9-8347-c09fbf767d00", "value": 1195465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493439, "uuid": "fb365cd5-7b45-45fb-8a0f-5d223f37295d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493439, "uuid": "2147af1a-f50a-4174-9b28-6daa5378307d", "value": "Reservation Order List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136a932b-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493191, "uuid": "e6cdb078-43dd-49c3-81ac-1953730195d3", "comment": "Malware payload (AgentTesla)", "value": "81a3a439e535eca9caaaed5d186ddb75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493191, "uuid": "1ddf8c99-3b8e-4fe3-a288-bfebbc5c5338", "comment": "Malware payload (AgentTesla)", "value": "55258a04ee9404519f19ee0df7117757eeb879446720a76e51a08328ec06ba04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493191, "uuid": "590231e4-ab37-4d46-88ec-487a97918ed9", "comment": "Malware payload (AgentTesla)", "value": "e30655befc79d8f933eb9485b4362a2cf1b5fc32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493191, "uuid": "50f2fc2d-9717-42e3-b88f-079e1eaa4a16", "comment": "Malware payload (AgentTesla)", "value": "4ede868ad0c51f465c894a9bccca398ea39e22716bbae7e383df0e17eba4f14f507bf9e1c0f47e7e2a1d20b689b7c706", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493191, "uuid": "c37bcfa8-75ae-4c1f-bee8-60dfacc24062", "value": "T1EC658FAA38C01B57EB489151AAFD3A0D37F6CA7E58D6AA1BD6E27F0F0F716014F06405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493191, "uuid": "2e17a095-4423-4c1a-87c3-ccfdbbe4829c", "value": "12288:5KLkzrJYot0Gm3aGnulf/HAE8dXSp+fgFe69AWjccho:gL+reA7QLCe6zho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493191, "uuid": "3efc535b-55d6-4c34-9eed-7ab073b38295", "value": 1410607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493191, "uuid": "d93fb272-e232-49ae-8108-cdf1d0b7e5dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493191, "uuid": "c26c6cac-daad-49dd-8b72-29810a031c3d", "value": "Order_KD202508040246-1 .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138c1501-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512089, "uuid": "6ca4ae5e-6dde-474b-8c00-b942a1560a40", "comment": "Malware payload (GCleaner)", "value": "2ef1005ad9de1e05fcc1d6f6ad282a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512089, "uuid": "b480021e-3233-4ce7-b4f4-b05d4ea2761c", "comment": "Malware payload (GCleaner)", "value": "55d548d1a4de0cd463dadeb1f39fe842ff4c10396979d6568fac8b378763a7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512089, "uuid": "000085a1-f5a5-4a26-b6b8-4ed87a1c9aab", "comment": "Malware payload (GCleaner)", "value": "7a428a85593743438a642eae31335b4f8c34e9d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512089, "uuid": "227fbce0-0d58-4f10-a2db-fa3913a0bb7a", "comment": "Malware payload (GCleaner)", "value": "0a362615851ab987ccd8cc3052f708c2e70af1584bd380dc7edf8c5ca002baa795dfdd67e30e885e859840a79a157360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512089, "uuid": "006884d9-f742-446b-88f0-0e08e667d99c", "value": "T1C126DF661FF94DA2D2F7A27C847B61844817AF53D02638AD33EB39C70E58381799A533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512089, "uuid": "488261b0-2d8f-4b8f-bfdd-c0d13b67f475", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512089, "uuid": "56519cd6-b953-41b3-943e-20a87055ec97", "value": "98304:JEz3SksSn1GR/doDWZd77afZIPGBAJ5a6:JOzn+4WZdnaZ5Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512089, "uuid": "87131b47-03cc-460c-afa3-438fbc5a9691", "value": 4520960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512089, "uuid": "0d5b3d58-88fb-46ce-8ba4-d014c34d6e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512089, "uuid": "8a57cc24-90d7-4229-b51b-0b1f6ef59556", "value": "2ef1005ad9de1e05fcc1d6f6ad282a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7fdeeb-0d76-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493954, "uuid": "d360c2be-75fe-4de6-abd4-c4df468e5de2", "comment": "Malware payload (Formbook)", "value": "40087da7127d67e65d5a7be5f9bddc4b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493954, "uuid": "795fcb6b-47fe-47ec-b727-ee47fcc2830a", "comment": "Malware payload (Formbook)", "value": "57e497bf62138b926d4adab395e0ab64f9f1b606ff9219e0c004fcc5a8348f7a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493954, "uuid": "a0485e80-f4f8-47eb-a96e-82b72b21e681", "comment": "Malware payload (Formbook)", "value": "3cbd15503d110140d3e3b06c61161527e9fbde7e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493954, "uuid": "110d2d0c-ec32-445a-8b7e-86032e485a47", "comment": "Malware payload (Formbook)", "value": "a43c6b5f8dc02536fc9b6709f43aae7c2bb26743d21f8e19c8963f4ebc9cdf1c76b6ac9bcc34111b51840f9151785761", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493954, "uuid": "f39c455a-e65c-40b8-9110-b4001b8ec6b3", "value": "T164051297F60C96EED4BB1CB510F244A09488BCB18F16CB9B36C1F39EA8F1B541226F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493954, "uuid": "e5d7864e-c807-4b6e-906c-bab2c47b5c0b", "value": "12288:X2ps6BDjb64PtsiRXmlXdW2ps6BDjb64PtsiRXmlXdnkX84:X2ps6hi4PfwbW2ps6hi4PfwbI84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493954, "uuid": "55f3e91a-1d46-43f7-b66c-28b033fe320f", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493954, "uuid": "2f4d343d-33fc-48f0-aaca-1dda9f4ec6d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493954, "uuid": "0da72fdc-2d41-4372-a3ae-017bca9aaf75", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.7680.27625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434e05e2-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1771520759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520759, "uuid": "03dc68a0-5edd-48ea-bc63-d794db486523", "comment": "Malware payload (Loda)", "value": "074523ed9b787f0a00370669e990bd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520759, "uuid": "4e4283c9-be43-4181-854d-8b973c83d49d", "comment": "Malware payload (Loda)", "value": "5a4d7a965507ccd0e5f46bad16c6dd68fcb496229ba49b81cfea2b66e957fc35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520759, "uuid": "5148210c-c5ff-4a3f-922b-6257ef7a1598", "comment": "Malware payload (Loda)", "value": "87d3a954b2fe31e19e3170aeabe2764d84020b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520759, "uuid": "f5477e28-875b-45ed-b29b-770f1c96f54a", "comment": "Malware payload (Loda)", "value": "5d3cacd1490c8b6b9c5efbb291de5da37d9a55587ac984bdd844df725b472e7399eb99cfa2620c21fa25fff8d9e5895f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520759, "uuid": "981d3333-645f-4151-a9f3-0f3769e3a12f", "value": "T1E5C633991DCB00D6EAC21470DB2BABE723F694BA489D4C353AC9314170B2FB6B05F957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520759, "uuid": "f6294970-2c0e-440f-9330-01e1031baae8", "value": "4bb2436b569f68911a870608bbdf4781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520759, "uuid": "4772cb01-d48a-46f1-b9f7-cad6ccf10aff", "value": "196608:KveTf16AV+r3ONwruEwNds6YHNrPgYXVFDVdRXdAnl4GMNw6qVqfnJ79rFt5XI:KI1697OCyEwNFYHlgYF7dRNAnltMNw6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520759, "uuid": "419bbecb-f4b0-4dfd-87d5-ecb02d68eaad", "value": 11933696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520759, "uuid": "87a6138b-43bb-4333-a397-00bd40f9c9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520759, "uuid": "39480457-5f7c-4456-8a38-136989c0f11e", "value": "074523ed9b787f0a00370669e990bd6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c10f436-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493178, "uuid": "fea464e7-40fc-4a36-a330-4ea2cb766e94", "comment": "Malware payload (XWorm)", "value": "e00c3747637acaf4994a63150a10f420", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493178, "uuid": "e5ad4af8-ec81-46cb-8dd4-fd53155341fc", "comment": "Malware payload (XWorm)", "value": "5ad48cae2e227547db8574e918b3409c8458deb5b6a743015dde8ec820471c15", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493178, "uuid": "e8b8e6a6-b306-4b2c-aaf4-2a61be992761", "comment": "Malware payload (XWorm)", "value": "7f2a7560a96bfed44b87e9eafe42c93f70f2c07f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493178, "uuid": "5de8e30e-7d03-4490-a46d-3b6f2c28d310", "comment": "Malware payload (XWorm)", "value": "74ebf2565d287e31689dc60d9873d1c93656c7cebea9655ac849d546eeea8dbd085587147ab6495bccb5acb68f9afe0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493178, "uuid": "ec7d77ec-f9a4-47c9-b868-f40822466cbd", "value": "T1B4C4135BE3E85F99397673BAC0C5BA0BCD58D1126167627825318FCEC0FC2EA449C2B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493178, "uuid": "af9e1382-dcdf-4843-bfc4-ce67f247d358", "value": "96:ujSt3N/GJDFHNgKZB6PNUmAypx2a01tLw1rL1u+EP1gqdKWDdb82uS2:ujnyrIXdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493178, "uuid": "0ead8a26-bb73-42c8-9a10-1b3a79591d10", "value": 589387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493178, "uuid": "53840d7a-7404-41f2-8921-78a36d7d87f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493178, "uuid": "44a056cb-c9b5-4912-a3b7-bac42b5309eb", "value": "Confirmation of funds transfer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35d0ae2-0d93-11f1-a129-42010a9c0007", "comment": "Malware payload (XorDDoS)", "timestamp": 1771506451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506451, "uuid": "9a327d9b-03a0-4771-9767-dc86aa6534f1", "comment": "Malware payload (XorDDoS)", "value": "87b48cad3e05edc3a20bc65539c0cfc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506451, "uuid": "460c3ceb-600a-48c5-85a9-f26ae03f3529", "comment": "Malware payload (XorDDoS)", "value": "5b15e7a49f953e28a06ee8aa2d50811edd8566005117af2b0599d07bbd41d8d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506451, "uuid": "0cf2475d-a137-44a5-9359-0745c8a64239", "comment": "Malware payload (XorDDoS)", "value": "0651b6070b704df55893580a9e6871b69e353604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771506451, "uuid": "720cf5a4-d479-45da-b6a0-e32d20a308d3", "comment": "Malware payload (XorDDoS)", "value": "ec3124f0e2901284c8d604bcc18ee16e7482866b8ed026b84afdda62611f22e91a70375f4acbed0f8d55ad59d8f8bf51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771506451, "uuid": "6f2cfaa5-6913-40e1-a453-b0347f22f68c", "value": "T166C45C06F283A2F7D42705B0124BF7BF8620F63594129D9BB7989D5AB9338F12A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771506451, "uuid": "1cae26e1-5a1c-42cf-a980-d08272072b97", "value": "12288:VBPbw1CH/FwznbIU9sE8c8lqd49N94wT4JoqLLp6yWrk3:VBPWCH/eMU9Uc8gd49N94BJoqLL4ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771506451, "uuid": "b98a7bfc-026d-47e3-a111-4b0188472ed4", "value": 555272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771506451, "uuid": "f64e2e53-e209-473e-8209-306d46aeae07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771506451, "uuid": "4ad6d2ee-04a5-4419-ae57-1fa4fc56a1af", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d9a00c-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771521010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521010, "uuid": "eb451905-9a4f-4a3e-af43-7acc01381439", "comment": "Malware payload", "value": "d848ebf62f3f402f5f68c284ebcfff8d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521010, "uuid": "83c07b7b-27bf-41db-8d20-e667c0ad4fda", "comment": "Malware payload", "value": "5cf005635dacdbac517a8fd3cd3fdc70a8daa18f63b0a153718872cdafb2c0e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521010, "uuid": "d7b5e270-f721-4b2e-ac5c-3d4c7c34a09a", "comment": "Malware payload", "value": "8155b5f6861a8158b5e9f66638a2083304c7d373", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521010, "uuid": "2d92d3cd-8ed5-45c9-afa7-3413b00b5767", "comment": "Malware payload", "value": "2c6b5565c1805f69ef0196cac63ce8d0651afd4a0014d3174ed9a1aaaa22e47bf0c86467ac2be777c7f02759d5ed9fff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521010, "uuid": "10447b4e-ecf9-4809-9207-c5d851efa504", "value": "T1FF24F63375811FBFF81A13BBDEAB8CA545EF296026FC604AB1D4435496D6F10528E3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521010, "uuid": "72b00253-ebc3-425f-9fc2-c32b3b8ea737", "value": "bbca158c80e830144adecd426662d70f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521010, "uuid": "e8bc3685-5cb3-454e-b3f5-b62fc157cb4a", "value": "6144:3ordziKl4YTA5f4kEKdSgeHcrKSmXy/cPsY4hmAHj6B:34GK6YTA5f4a1eHcrKSmXy/cPsY4MADm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771521010, "uuid": "c89feada-59b0-4f8d-aa55-6e3fe0dea7c3", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771521010, "uuid": "d8d6d6f9-491a-43dd-818b-9a7c1f31be8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521010, "uuid": "fced9f57-4748-40cd-8a31-a144c361617f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb10253-0da6-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1771514574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514574, "uuid": "f1f66946-3727-45d4-8f5a-a6021a395394", "comment": "Malware payload (ConnectWise)", "value": "30dcf12d25ac3ef475fc6f31e6a03ddc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514574, "uuid": "f123faa1-a206-4f34-9c3b-e640acbccf53", "comment": "Malware payload (ConnectWise)", "value": "5da041b3f3efceaf8e49aee25177f1a9a1e2c1b869cf0d91de57fed8a8497c6a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514574, "uuid": "c5b76e57-fd68-4154-9c0f-168fef5b35bf", "comment": "Malware payload (ConnectWise)", "value": "3e3575de5d13ab44c949528c03e85e841c91149a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514574, "uuid": "0aec627a-53f0-46bc-bcf2-62552088ee04", "comment": "Malware payload (ConnectWise)", "value": "53e845687dc76a566f9c96bd8d46688926773e3e805148a7091a2fed06b868811e03f784789098a8469ad7eea4c05125", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514574, "uuid": "b6c2d64b-486e-4fdc-adf7-2e4541fac250", "value": "T1D5A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514574, "uuid": "0851b30a-d073-40b1-9e4c-9cb85b5b278f", "value": "196608:4KaLNkbgci4Q6KaLNkbgRKaLNkbg7KaLNkbg:eWgciHMWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771514574, "uuid": "7ff2af5e-07f8-4f7f-a899-7c2314a7c85a", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771514574, "uuid": "028eae66-b160-45f5-8022-52d3aa4fe167", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514574, "uuid": "fe04f13b-6ee3-4ba7-8d35-26e88477ab06", "value": "Quadrantmediaed.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664b422a-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512228, "uuid": "ce2101fa-f315-43a9-bad8-b5b2c594f8ab", "comment": "Malware payload", "value": "2bc2fa7483db36a7ac1875fa33e0c9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512228, "uuid": "b87400fa-acd3-47af-b2cc-4d42afc56e66", "comment": "Malware payload", "value": "5f0a941f00e9e3b315796bee692ae7576f8fdc5384abb7f39c5d4d98f539ed53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512228, "uuid": "8c0ce048-6022-46a0-81c6-09e62b3d6a3a", "comment": "Malware payload", "value": "51c43b04913e68cc56f7b1be0cc27f89d98a65d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512228, "uuid": "eb8a642b-cb2f-4dfb-aea1-3714a150569c", "comment": "Malware payload", "value": "544118e48a9bffd8a2902ee65b290f0898e4f50bf75535e4b06b79914e47de9c21ac7217f7d4241ace2344bea16b9cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512228, "uuid": "943d98b7-0bff-4c1f-95b2-7c218852de61", "value": "T1962502552B29DF02D0764FF00A72E3B50BB85F9DA911C3538EEABDEBB8397502C45192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512228, "uuid": "18999d9b-66f9-41f3-b1aa-daca6dc7a601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512228, "uuid": "f4e5c800-317b-4ef4-9658-4a336061c6a7", "value": "24576:Iqu2VhjPIM2pST0u1LqMOB0GED9dUziJCW3Ll/ZsJ:IeVhjPIt7gvXGED7JC+lGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512228, "uuid": "c35c51a4-4ca8-483a-bfcf-7e23c89972d1", "value": 1027080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512228, "uuid": "309c4def-eec8-432f-b908-2b1f78bb8e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512228, "uuid": "11c23a46-49a1-4a25-afe3-20370dd3ce19", "value": "new inquiries.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6823a008-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493333, "uuid": "b93e2fa6-7335-4e69-8075-5d7544ef5426", "comment": "Malware payload", "value": "e49fab0e96f9e1469aa627fd155e3e8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493333, "uuid": "d2018255-fa73-408a-bab6-ff1f11f04aed", "comment": "Malware payload", "value": "5fbad13c6c0e10338443f1658b280879627de36a5f0181639495679037e4f314", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493333, "uuid": "90ccacfd-43d9-459d-9caa-b9349d8e37d3", "comment": "Malware payload", "value": "eb64e751ea4fc9d6727765d601d64d5d963a71d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493333, "uuid": "0676cd47-f040-454a-9917-24d6568fa2fc", "comment": "Malware payload", "value": "a13186c11dcf37547e96ad045bed68753691eb58f9fd2c34bcc4b48f0e89061f31546d5062857d953fe239e331b7ab7c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493333, "uuid": "5d102ee6-2056-4d56-b0d5-bc77cdc97e50", "value": "T15DA274CD3DC2B166136A603B2A2FE46AF27B5C88F24CA594E9376554F494B08C863D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493333, "uuid": "4856a355-2c5b-4c5b-aae3-0bf379f969b9", "value": "384:P8H3/ngpcvwpYy00aoJav6T5thFOmF2HxckCOFwNcr8CWEhY:a3Jvw+UT32CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493333, "uuid": "1eb7ca7c-3556-4f23-a82c-ecbf028c0937", "value": 21885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493333, "uuid": "c21de44a-12e0-4eac-8b55-ef8b37b087ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493333, "uuid": "ac84eb64-c28d-4ef3-8df2-1e435f553481", "value": "528269279.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90cbcd3-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493576, "uuid": "5182b867-0d1d-4399-ad2f-e44b5f21aa09", "comment": "Malware payload (XWorm)", "value": "a8e8381952f93772606b9bca3b106e81", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493576, "uuid": "afc90cc5-d6fe-4f9d-a6ef-3441022fbabb", "comment": "Malware payload (XWorm)", "value": "5febd4631436b9d82e32d1ec19130c08157071d0fe8ef9389ac5a2ad73ac2085", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493576, "uuid": "56b464e9-dd63-47f1-bfec-c7f0c93bc455", "comment": "Malware payload (XWorm)", "value": "fede20cc9e712ef88f3813d48763985d6b1f5011", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493576, "uuid": "09b887a6-cbf4-4adc-9034-833fea956df8", "comment": "Malware payload (XWorm)", "value": "8bab9ab149d85cd2ebd9c14dc68c56700531d91795b70597e88dc68b0d2a35a8befcd0a306ddc2c991d6a05f123bf980", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493576, "uuid": "a78eff37-759b-4182-9579-aecea62cb639", "value": "T1254516854E10D683366ABF9D4DADACED3BD71836F940EF0F48159343A3BF224A56344A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493576, "uuid": "50e6edfd-beb9-459c-96d2-5ac02d2b925f", "value": "192:KsMSK8cPFPmSVrIWOgTQh8JGKVJXg7Sf2DuUx2rdP5q:Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493576, "uuid": "82995589-7306-414e-9b2b-410c96199a97", "value": 1242044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493576, "uuid": "0e3bfbe8-fc40-46fe-a228-00c90dcd57fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493576, "uuid": "dcec5f88-364f-41fc-8e58-cdd721791816", "value": "Draft BL AND DRAFT MR of abv vsl.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c6cc6a-0d9b-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771509573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509573, "uuid": "617c7455-5c9f-4742-82fa-2a468e6634b0", "comment": "Malware payload (SnakeKeylogger)", "value": "2dc307322e18b5ee42a2e8c801ca99c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509573, "uuid": "484a9b58-9540-4190-9f21-33c60d292569", "comment": "Malware payload (SnakeKeylogger)", "value": "602e7534f0deeb7d99942cf865cbdd5602946728ec7487319c8ae9dd7f4e4eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509573, "uuid": "94ff8801-f8b1-47e0-a43e-93a4e822f218", "comment": "Malware payload (SnakeKeylogger)", "value": "09ac213f32efa6eb87734eaa79e186ecdfb6f6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509573, "uuid": "03045cc3-183f-4722-a91c-52051235d0dc", "comment": "Malware payload (SnakeKeylogger)", "value": "15b1406e3ebb29b01e141fa9e10775eb2e277c7260087b004df355a4f6b1e09066e0fc818d7dd508b4b959c7051b4ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509573, "uuid": "6c11d9ed-8745-4f0f-8583-0425d7b2a0e1", "value": "T15044B70A7FE89810E2FF847392B69025C7BA746346699E2E56C1F8063A3D654DF03F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509573, "uuid": "04eeaf55-9382-4a54-b6e3-fdb7a667f72d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509573, "uuid": "3f5a29b5-ddcc-42df-884b-8784a6cca491", "value": "3072:Y4F7TBbsrPoByBvuBvYnXnanAn0nmnDCrW40wGgelUF24dCgR+Hapb4sbFbs02Zz:d0k/rlszapbzFgIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509573, "uuid": "df0a4f5d-1c43-4e4e-8b10-da1980b32e0e", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509573, "uuid": "a6d1243c-0f29-482d-a1bc-48b112bc93fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509573, "uuid": "995b616f-ddbc-4013-ba40-ed9cf7e4f970", "value": "arquivo_20260219120002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f1c629-0d2f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771463474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463474, "uuid": "70463f2e-e674-4531-95b8-0f15fe44fcf2", "comment": "Malware payload (Mirai)", "value": "91ca7bc2a9b6d68f7eb6386593751a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463474, "uuid": "08bc2536-c70c-41ef-a4d8-10e15ab63aad", "comment": "Malware payload (Mirai)", "value": "6050a7d8db8a41d37b07fef07289e4691af121d99348f5978ccca684ef727054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463474, "uuid": "e48bdeb5-2562-4cd7-91a2-b2cce70bf169", "comment": "Malware payload (Mirai)", "value": "b719117a0b2174896b48c040bbe434fc3a0e83af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463474, "uuid": "94e599ce-ff05-4eeb-94a0-79f1ac3815d1", "comment": "Malware payload (Mirai)", "value": "44ba233f7e624ebb00cae3aee46187acb63edd12326eaa7589f70a608d0c774c8147209b8518cd8a6a2159ab99b6f857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463474, "uuid": "1bdccab0-460d-403c-afa1-ff3401a6583d", "value": "T128B30A9ABC458B10D5D565BAFF0E618D33134BB8E3FA7113DE149B2A638AC5B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463474, "uuid": "f595b4c1-803f-428a-b421-e6b4cc6dddc1", "value": "3072:pWBGHrTrk5xENjfCpuxSeuqd82bMrOxj/thv8ZemOgQx+R3D:fkcmpoSeuqd8DrCj/th0eZga+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771463474, "uuid": "7fc71aeb-0f35-4a1e-9d2a-e8ec3aa0760a", "value": 117996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771463474, "uuid": "11a3ec82-46be-45d2-9ea7-06f000c81258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463474, "uuid": "75f3636c-bbc9-4b64-ac2c-95a026bef73f", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334f6352-0dce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771531470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531470, "uuid": "8031aa0d-07cb-4615-82a5-46207f3043c8", "comment": "Malware payload (Mirai)", "value": "af9bb520b3db1dcdd1893d4246b41074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531470, "uuid": "53489deb-42d4-4f3f-a4ac-31aaca795138", "comment": "Malware payload (Mirai)", "value": "608f6b10a4339eff601178ae11afe3af8e2c9a74b436ff5d893ddab012aa30f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531470, "uuid": "e16b20f8-f5f6-443e-b7d6-ebcdadc32452", "comment": "Malware payload (Mirai)", "value": "e6479f07d0a58bb0070524b65cb3c3e87fcc559b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531470, "uuid": "f0f513f3-1387-4990-a5e1-7a6ba154311c", "comment": "Malware payload (Mirai)", "value": "5a2ff50a43d63ae9fda33431eb9162bf4ea113a7467cec8807cbc7e929faff2750945b8936641779ec2e6f0aa0a7b3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531470, "uuid": "ab47700f-89fb-4fc0-80bf-d07f54b0492e", "value": "T164C36B73C8256FA8D664D1B4B0708F789B53A91182875FBE59B7C2B58043D9CFA093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531470, "uuid": "7ac70af2-7aaa-416e-b5e9-bd1d4791d3cf", "value": "1536:+KB/FzuKKZP0a0wAxxCcNSKlPhplgqKsI2oWF+LciW7s6D:+adzuN0pxxtNVlqqKEoWYLc57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531470, "uuid": "d1de82a1-670f-4a74-8847-e5618daa1693", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531470, "uuid": "cf7d51aa-3b35-496e-9e98-5b92b7bc0626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531470, "uuid": "87ada389-c7ba-46ba-8969-62dbbc2b8660", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78103831-0d6a-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771488635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488635, "uuid": "3d08fa68-df88-4336-a489-115c9ccf051f", "comment": "Malware payload (Formbook)", "value": "6184ebac0827ab9fc8a7383366ffec84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488635, "uuid": "bae54026-9c29-44ea-8291-3b93a067b5c5", "comment": "Malware payload (Formbook)", "value": "6095802613f5bd7c2189dd74f5a473872f7671e174d512f5f30d6475081f37b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488635, "uuid": "a68f84df-d8bd-45e3-8a72-105f2450fd77", "comment": "Malware payload (Formbook)", "value": "b06b535a8349502ee299446eebcaa289a379a249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488635, "uuid": "71541038-f7bc-4551-9cbd-6ba0df0e5015", "comment": "Malware payload (Formbook)", "value": "f4ab32f099128de88b2d824919f2b792ebe2c560e9bdf98b6df1a4fb5d300e788ac6772cfbf0cf9d603f6f8d6be77c0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488635, "uuid": "e95f3a55-9d8c-41a2-ab20-f7ddc91a3d15", "value": "T15325120C32D6CE17D4A64AB41B61F17627B06DCCA03AC20B5FD2BCEBB8767E41495297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488635, "uuid": "557c860c-ef7a-48e3-adf1-494258c77f17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488635, "uuid": "47199b56-08c5-4e42-9f5c-be02c058e5aa", "value": "24576:j/C/Y3CYs0DmyAA5JyANsAfqqhFRp3DZX2Sfv:j/CmSCm5AXyQGqxD2Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488635, "uuid": "915edfb1-6954-4df3-852c-67cbeff38ac6", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488635, "uuid": "c73c0680-b2b2-45dd-9fa0-7329550bef97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488635, "uuid": "cc9116ff-5332-4a74-a907-ea14ee2faa1d", "value": "PO#\u00a333344.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c02eda-0d64-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771486180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486180, "uuid": "47332a48-a509-4959-88bb-3158a18a3b30", "comment": "Malware payload", "value": "dac5d47f4a03a24daf5365157cffb90f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486180, "uuid": "6f9a67c2-97e0-4836-b2a1-8df26949e4b7", "comment": "Malware payload", "value": "61c91e5384b521daf85a8ab17c04b6c788cf9abfe4c4b92729fdbf5694a4d923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486180, "uuid": "8c18b322-ae37-4c12-ba17-faf279bbe961", "comment": "Malware payload", "value": "2006b57f75add6c732459fdfe1dd66c72da473ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486180, "uuid": "02967ce3-1521-418a-b516-eaa21ecc5ee7", "comment": "Malware payload", "value": "f37a1210e7f05236d8ba96294d125f3611b7fa5a332b47e85f23b004fcea024765eb19edd784a25ee5bc88e142cff707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486180, "uuid": "6d27b2b5-2002-4bd1-908a-d65d43d0cfc6", "value": "T139216356DD970F41CCC5D93BBF0F020A7A2E7239D3A226118E180E243B7BAC70677205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486180, "uuid": "e66b2ab2-3d0c-453e-951e-0ec8ef483577", "value": "24:1YGT3Nqe3ADr4TXCLFNSYg90Z/H3GBSpmnQuPSRqgw+XEcGv7OGK:1YGhk3JIz90BWBCJeszsqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771486180, "uuid": "72ff2929-79fa-408d-b357-e40aa4b3c77a", "value": 1183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771486180, "uuid": "71570eb4-9c3c-4981-b0b1-356599a8e347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486180, "uuid": "6962a93f-707f-4821-84cb-656e8e507b1d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188d5b2f-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771484610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484610, "uuid": "0bc0249e-c1ab-4123-809f-0143620c70b3", "comment": "Malware payload (Mirai)", "value": "fa7b9468bddeabf751d23ac30f8dc745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484610, "uuid": "847a8605-7599-40c5-91de-5fa8b2533f6c", "comment": "Malware payload (Mirai)", "value": "61db062f3ef27695b80c6bb8ceebe96b5dbe0872fa0e635b79108cd1d7c52628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484610, "uuid": "84d7ad36-b773-4e16-99f5-f3884d51b53a", "comment": "Malware payload (Mirai)", "value": "4646a1599f4612e13e301dbf4ec9936c541fe3c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484610, "uuid": "4b1146d9-9267-4f20-be84-425782657d7c", "comment": "Malware payload (Mirai)", "value": "1c6cea5d04380438420f96b8fdaed82997c09946509ca4cf8f152a8afad781b010a48ce02a9ce0999dc7c5036c44a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484610, "uuid": "b8d95a32-c9d9-48f3-a146-d40fc8a43aee", "value": "T135964B37B6A285DCC08BE1746A9FD5F3F920B4F40221206B27965A367F36E900F6D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484610, "uuid": "d5ad5878-6f7e-4692-9c91-56ffaf723568", "value": "196608:sNlusYpHZPaU8ZlgoHOdWPV8ZUIh/KrUb+Hs:sNlu/xaU299Ih/KrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484610, "uuid": "e9d9467e-1f6f-4289-8e14-848b4477d1a3", "value": 9430488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484610, "uuid": "d2858053-aa5c-4813-a6e4-84eb33bae9e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484610, "uuid": "2ee5b5cf-fa9b-4368-9806-2377532d8a03", "value": "syst3md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab309a2-0deb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771543991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543991, "uuid": "f1d078ce-3359-4c19-a0b8-cf55bca0825e", "comment": "Malware payload", "value": "2d57a0159b36b50e7344b539a9e17d69", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543991, "uuid": "d9650e52-6ec5-4282-a001-71e74aedb68e", "comment": "Malware payload", "value": "6319f6a23108a7a6b85a2527f7325bce92fdf7087aaa2ff2e917b99f9e6efe49", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543991, "uuid": "6ee3e610-7b8d-4459-ad24-b7a77192d905", "comment": "Malware payload", "value": "614e88b7eff5cd7dc05f8b0d5cdefd4c61c6c3cd", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543991, "uuid": "5264c326-c8e8-4034-8b48-08691b8a41bb", "comment": "Malware payload", "value": "1db56c138e6767322a55b00e8423f2906c132f400e88690199fa826f7c6cead565e3be676c4de469e0b89730e9e8bbe3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543991, "uuid": "440eeeeb-849e-42fd-877f-e3491340c505", "value": "T1609422B21B0D40FCE2761D3E1367501A81C8B879CF8BBB46B5D6A20B7C562DC17E8A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543991, "uuid": "70cc8d56-f42f-4e59-b418-5aea8209cb62", "value": "6144:iTsb8uYotDj9ntfmKwc31ku22EGW6sVkuFaMdZoxcYLV7IY43Gsv7I:iTpupDjb64Ptsi4oIj3f7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771543991, "uuid": "3a2e0a07-7d26-4b03-a9e5-96fd4266f01a", "value": 420076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771543991, "uuid": "64429ad1-7b3b-427d-bca5-d15ab5189bbd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543991, "uuid": "db1189e7-544d-40e4-9dab-47792f7db440", "value": "SecuriteInfo.com.Trojan.GenericKD.79422209.32399.6481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76431a83-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771512255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512255, "uuid": "a942d226-3481-41fb-9689-ed99a52c3d80", "comment": "Malware payload (GuLoader)", "value": "afc0a56337a40e291b9523136bc8925f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512255, "uuid": "c404b9a0-d811-4c2e-a7f5-a3b55b5a8a1d", "comment": "Malware payload (GuLoader)", "value": "631ed408b2d77aa9b5054c2821bb99e67af94f337b17920700de4ef64e290cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512255, "uuid": "55254f5f-09a4-413f-a308-60f4d736910c", "comment": "Malware payload (GuLoader)", "value": "4b1b47a8a757b2835b0986e120177905c06b476f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512255, "uuid": "06754e8b-24e1-43b6-83ef-3769e7d1cddf", "comment": "Malware payload (GuLoader)", "value": "7d165ffaaa17ed4334bb4e220545ff6df6ea9d05edcd568e817703088be87b96df7ae3bda29c7a86c0333ca7c7a6e5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512255, "uuid": "62ad30f5-15bc-40cd-be7d-bd41629dad37", "value": "T1BC3412E1A260D0F7D3738BF05E720B77ABB9FE1452918A832745BB7E7877640460E642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512255, "uuid": "9c4fc3e5-a9af-4d88-9f75-20c9f58f3e4a", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512255, "uuid": "b7cdcfc8-d75d-468a-93f5-4508888dac31", "value": "6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/dH:tO0PESSK6xJQJTnxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512255, "uuid": "1c6ecd6d-f362-4541-afcc-6c632c19d88c", "value": 230419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512255, "uuid": "df596583-8168-446b-a03b-cd61df68fcf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512255, "uuid": "b94c5093-f758-4368-99da-a305d97c8988", "value": "Payment receipt (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fc39ed-0d36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771466345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466345, "uuid": "c238913f-2195-4fb8-aa1b-0abf701332f0", "comment": "Malware payload (Mirai)", "value": "eaa298689f6bfb2ee53586f77e87893b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466345, "uuid": "86c40fa1-fce6-48b0-bfe6-c0f0702ac44e", "comment": "Malware payload (Mirai)", "value": "64b1dda6ef014880695645b59230d3ae68d4c7562b189971f6fdb14ac29d95f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466345, "uuid": "cf001267-145f-4a18-a732-bf0d8e48fe31", "comment": "Malware payload (Mirai)", "value": "802af010c426cd7432f7c1996da290be49098523", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466345, "uuid": "8bba1b09-dc07-4c03-9297-773a2c0b7b2a", "comment": "Malware payload (Mirai)", "value": "63d28bc21447fd1138f4bcfaea338e3c2dbd7859837831b75ced0d54519b404957a7bb7f0aa2f9a4b87216132a2db3a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466345, "uuid": "e0cf0fdf-1790-403d-8968-f807353fe970", "value": "T1F81349C59A43C0F1EC1112F110779B519F72A436AA79FB47E7A93A32FC02B1196173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466345, "uuid": "5120e9a7-7c3f-44c0-a66d-ac13515cf8df", "value": "768:x73jOIDzzrq7WiEu+RiUjreAEx63a7x2Uq1z7yvEdTpKMxn:FjOAzwvEuP4aAEgwvkWItKKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771466345, "uuid": "b841f4e7-7a4a-4460-b986-6558f53a175f", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771466345, "uuid": "914cf3f7-3571-4e22-bc2f-1c859e891027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466345, "uuid": "170857b8-4d62-472f-970c-8469a5005d99", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5c9a56-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771520826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520826, "uuid": "f12a49e8-83ad-4690-b2cb-6385e848ce7a", "comment": "Malware payload", "value": "8bc91ad6b9f122712139b36873545550", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520826, "uuid": "d88a03c5-9f8c-425e-970e-628d45c99f44", "comment": "Malware payload", "value": "652df9c24dcf0110dfcf26547cb1b60da7a52773c6959cb227e72dfdf3bd6e84", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520826, "uuid": "e9c90a0f-f1bf-4656-ba8b-53d74bd6a8a0", "comment": "Malware payload", "value": "ae3da9deaceca79ee52d76fc492256038c5ec92d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520826, "uuid": "f4965ba5-1129-4298-ada6-fd868f8f5217", "comment": "Malware payload", "value": "5018b2faf891236bb3e688f7a91ffe31085cec09fd0bc50206d394c5f984c678d87c0be1500402843054383cbb581643", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520826, "uuid": "97aa9e03-0ab6-4a88-a5eb-4b28ee215c04", "value": "T1D775124C6FE5DB36C01D34F50EE3D1C5016E6F98A29409436209BF86EC776A226D2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520826, "uuid": "e8c06875-a66e-455e-83f0-6cb3b4a789fd", "value": "24576:/bk3+nYPW7GNZEghkzVVncaQjDN3bk3+nYPW7GOVibF7CGs6i1JHav6:/QqAW78Eghk5VraQqAW7Z057CX9Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520826, "uuid": "fe8b6720-e32d-433d-9374-3b09906ef7b6", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520826, "uuid": "92d3d6e0-ba6c-44eb-b714-3b949fb40375", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520826, "uuid": "493fb6fb-1c30-4045-8e37-988afe59abc8", "value": "Qiym\u0259t t\u0259klifi - Kovrolitl\u0259rin v\u0259 fasad \u015f\u00fc\u015f\u0259l\u0259rin yuyulmas\u0131 xidm\u0259tinin sat\u0131n al\u0131nmas\u0131.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0418f4ab-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512063, "uuid": "ac6750a3-1ebf-41f3-8a2c-8525e11f8293", "comment": "Malware payload (GCleaner)", "value": "0c8710d2a6d5d601e048bdf4c6a7aaf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512063, "uuid": "2cef9e02-c7f8-4701-a517-56d3513e02f2", "comment": "Malware payload (GCleaner)", "value": "65ec1e7a9d19d5ca5f27cc04c6fe2da5b876bd29d548ac38f451b658ea16b6c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512063, "uuid": "6d0dd47b-8154-48d1-a9f2-bc43966b43ed", "comment": "Malware payload (GCleaner)", "value": "4693121e46533e82d2db5d7bcc88b1b2e98a0e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512063, "uuid": "db96fb0f-298f-426c-8236-c33e6909d63e", "comment": "Malware payload (GCleaner)", "value": "4cb5d8e7350ad4ecb94f951414a59393eee537e9f265b9762acd784c9c8026e56c099ff25978bfa303224f24dc95c692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512063, "uuid": "941accff-e19f-49d3-a6b6-343f05da558b", "value": "T1C556E17AB36A5B21F3BEE13DEE654C0EB435F1AE112D4819276818E046376C4E078F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512063, "uuid": "74384015-e57a-4251-a6ef-1c65cbc5165b", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512063, "uuid": "4dcc4b2f-1fb2-4076-89ef-5f8c7b64531b", "value": "98304:RH5aaLuK36WTGuD5/5W5Rv35MdJkoV0eV1iMiOsTKIE3M/+cLg8SY30xgNqQ:RHaEHfF/5uRReJim1OE3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512063, "uuid": "6f9fa579-7855-4acc-9ecb-1a39db91d40c", "value": 6374400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512063, "uuid": "4fb1a1b1-67e2-4fd6-96a6-0f1180276efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512063, "uuid": "6d03a41a-e738-4b80-b6fe-29568c9e767f", "value": "0c8710d2a6d5d601e048bdf4c6a7aaf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e3f1fc-0db6-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771521142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521142, "uuid": "54904306-9ef2-4936-ae46-c422299ae56d", "comment": "Malware payload (PhantomStealer)", "value": "3ce113a9cf115afc5100ce9fbb13bb0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521142, "uuid": "5a3c1b1c-5a0f-4817-b272-5804c229d6ed", "comment": "Malware payload (PhantomStealer)", "value": "65f94c845faaa3a2a639f2284fa7f67d911441d618878d7eca5d794c9699dd4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521142, "uuid": "8853824c-6065-4354-841f-b05e185d106f", "comment": "Malware payload (PhantomStealer)", "value": "ba62256ceecf701d420ddeb68cfd8471700a3228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521142, "uuid": "fab2f9a4-8b9c-4624-bcf1-633c5f9e0242", "comment": "Malware payload (PhantomStealer)", "value": "733357c81739342327c5768e55194c3c1121c458dada200c51e06c2c0e79fcf7fb42b01c7277d8a052d88a813e0e6def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521142, "uuid": "dfcf90fa-6e72-49f2-9082-ac9af6d45839", "value": "T10975D0027391C062FFAB91334F96F6115BBC6A660123A62F13981DB9FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521142, "uuid": "cbf0abe5-0df7-43c8-8995-cebd1b44f71b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521142, "uuid": "4db205b8-fe8a-4568-9145-fdba7d5bcb14", "value": "24576:p5EmXFtKaL4/oFe5T9yyXYfP1ijXdaaYdPEkUCOhl4t9Bg7aSEn:pPVt/LZeJbInQRaaOPEjCOKnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771521142, "uuid": "3885cc0d-951b-4752-ad26-793aae5bfd97", "value": 1673216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771521142, "uuid": "c363b566-a17c-4d05-9ef2-abc74c17250f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521142, "uuid": "9ddd20b4-cbd8-4f5a-8d0e-b6269009dfd9", "value": "PO#367328911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea013b6-0d7e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771497075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497075, "uuid": "a014a010-fb4f-4acf-be4e-98dfdb1848a6", "comment": "Malware payload", "value": "0dbc4afc0d376420f7ce1d8da2614e7d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497075, "uuid": "6480dcfd-1cfc-4b5c-9692-6da41911c162", "comment": "Malware payload", "value": "670de8be109f96fb05b48d361f5d542a4697794a89826ece05b3420cd83fa33c", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497075, "uuid": "7c175512-5c18-4b33-80fc-cf5f61571ff8", "comment": "Malware payload", "value": "321e45d8ff7cf40bc8d60c5fee3ae7572dc33451", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497075, "uuid": "cdbbb21b-5e32-4660-a187-1b57bdff3c12", "comment": "Malware payload", "value": "ce61e08fe19c7c4f871efb6ed07e1730c4c9462a5f385e6e21af13edafa05cffe9967ec3251b5dd48867bb3903876324", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497075, "uuid": "8ea97421-b989-4bba-9573-b99e293baf36", "value": "T17D411B986C3CF64626555FF5460F19671F50BC908FA06E0131C5B4ACA14C46787576CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497075, "uuid": "1d8186f7-598e-4416-9ded-879bb9d7fb7e", "value": "48:ZSw9feJ/mUMxs/qwtAZTOhmC7Ie3cdzn2llGInu9qKJDkVnreiv+un/7C9U/Eo:ZSefe/XQsqwtAZqhmCDMGl9u9qKJDATR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771497075, "uuid": "b3e7db34-ba37-447f-9c1e-b0eb7f870974", "value": 2340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771497075, "uuid": "4a1ba65e-7e17-46e0-b468-44576f205cad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497075, "uuid": "973752f1-b96f-41b7-b25b-f889aa03403a", "value": "nBOQ__26_Supply_C.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe13191b-0d55-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771479841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479841, "uuid": "5d25025f-36e6-485a-a6ea-bc5125dfabae", "comment": "Malware payload (Mirai)", "value": "5398b89d848c721ed8d32dba876982db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479841, "uuid": "ea6fe117-4181-4d23-9eec-309b29244958", "comment": "Malware payload (Mirai)", "value": "677faac509d3aa85d86329e89c90088d53d837e96a1fcbaf4871914166f985d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479841, "uuid": "a3adca1e-7384-4f84-b8a8-a458d7ca36d1", "comment": "Malware payload (Mirai)", "value": "2cb73ff827af62c1c6be1005caa5bfa3573bcbd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479841, "uuid": "696c5206-f3d0-49c3-968c-3395ebf5a422", "comment": "Malware payload (Mirai)", "value": "f969e46e116dd3454d07390fe39c0778b52ee1aa8a766171eeded4783f72f78cc3407cd0ce14c431197f6704f729da1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771479841, "uuid": "e63f9cfb-0505-4beb-8fd1-77261611b300", "value": "T13173024E77AF5FD8D7506EB827D5A38CA901478AB76502058ADD521EF4343B0EC085FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771479841, "uuid": "c0266092-8dec-455a-9633-3d49b9864363", "value": "1536:1RAW7+UVjhFiN9VqzbPnQks+2jhsK/5DPUmLHMXMMQorV7:1mW77BqNDqXQy29jDPUMHMXMMQSV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771479841, "uuid": "92e4bfc4-5ca2-41f3-b14c-df327ed9a114", "value": 76176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771479841, "uuid": "671c9a82-fe8a-4561-af12-85e8897eabc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771479841, "uuid": "db227d6e-73c6-4f0b-999e-0134e823e385", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8a56e5-0dcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771531295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531295, "uuid": "5515d6fd-a28a-4a2c-894b-9d3b6a9fe24a", "comment": "Malware payload", "value": "79baba439c50d04b0da5d15659d8a5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531295, "uuid": "f8b2caec-e969-4ade-bef5-63b7ccf95862", "comment": "Malware payload", "value": "6aaa0c6c1b48b1898188c23db8a57ed9f166b7167570bf174e89a2d3fb4a2ded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531295, "uuid": "f306d060-e27a-4b70-ab12-a43abf95a6c9", "comment": "Malware payload", "value": "d9e0c1c2d8b2ce3540d2e6cafbec555c9f8b37e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531295, "uuid": "3cfd0ead-6f16-4e4f-9dfc-cdab987c15ae", "comment": "Malware payload", "value": "edc0e294beb4dca4444e0040314f9faf041e6b4f1aca556fe3a4312807c7fdcf5f55047aaa29c3c5b7e0d248418131cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531295, "uuid": "f0de234a-ad34-48fb-91b9-8ac0f3f9ba5e", "value": "T16C045B25E651E07BE4D340FAD2E6C7B9B6686F30034420DBE3D0ADEA63391E5B63154B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531295, "uuid": "e0a114d3-aca1-4c06-9660-13338a0c9327", "value": "a440b9508b1bc26bafce7157c2aa2e40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531295, "uuid": "169879ca-0343-4c75-b56e-b536dd4227e5", "value": "1536:n4VNhRs2dQAHyN+R9GVYQ7608WL2t8fV9a3sQdtKq:KhR5QAHys3kYQ7p8WQ8f+tKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531295, "uuid": "14bca04a-0db5-4c5e-b674-e0bbc626ad3f", "value": 176200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531295, "uuid": "93b0dae4-eda5-4ced-84bb-e5abdbfa0f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531295, "uuid": "889c130b-b7f2-4549-883b-a27f6a9cf5a5", "value": "Makefile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eea8676-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771484647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484647, "uuid": "8edc1020-8a41-4161-a343-d40e79dde877", "comment": "Malware payload", "value": "a44b38b59f49557aa3e331afb2cc4b73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484647, "uuid": "748c9f2e-1012-4804-99f7-65e427a5db0d", "comment": "Malware payload", "value": "6b100937b0b5857e4edc1a2a3477e683598e042f1c498ec145fb568239d72ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484647, "uuid": "d71c61e1-f042-46b3-802e-cb8be2a43bd3", "comment": "Malware payload", "value": "c4a813671e5b9f53622bf9f1074651a2156a7b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484647, "uuid": "82b25cb9-1678-41dd-bdcf-a701e112da59", "comment": "Malware payload", "value": "e70cf20cb664ea2aa554627644820bdb719e8011bd712be261c86e2433d92e2bce0cb1994ba5113c8f20207aed006508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484647, "uuid": "23d68711-70c4-40b8-934f-c24ec112f64c", "value": "T10CF44B30B640D03FE5F309B5A42C97AA611ABE3217A558C7B3C41F6E56B81D19E32F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484647, "uuid": "fccf44f7-57cb-4be0-b43f-c3ae839262a3", "value": "b49abf9ac0d8ff78fc424d0e1b30e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484647, "uuid": "11881291-5e49-4c18-901b-498617f96e21", "value": "12288:pSOEJw4ZsJFJcaBJ71LrKsfUcCBaUalmrMJBAJF0NS3E5VNcQlyRlSR5AX:ppEJw4ix98rZgJBAJF04UDNcsyRlSR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484647, "uuid": "db36ebee-cb02-4c55-922c-2aa67a517e53", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484647, "uuid": "102ae8c0-4fdf-45c9-a479-67f4f671af57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484647, "uuid": "192a679f-78a4-4843-ba9a-6558d21d0a8c", "value": "a44b38b59f49557aa3e331afb2cc4b73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f392c09-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512323, "uuid": "6e9f4fac-2d2d-4070-9519-481184f5a06c", "comment": "Malware payload", "value": "73826695b43c4148b7f7a305a54cd52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512323, "uuid": "558c8799-091e-450c-bfd3-7a170bbc60b9", "comment": "Malware payload", "value": "6cfbe449260364f1b5d2044e27237d6ee0cdb3a96634982b8704039a2f5baf81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512323, "uuid": "da47c063-0426-4f08-ad72-3e033f7875be", "comment": "Malware payload", "value": "4d0c9455d143cf8ccde3ad3ac951924d4db43713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512323, "uuid": "a196a27e-77a0-44a6-9d98-97f6acfc4600", "comment": "Malware payload", "value": "66461cc20bf7c7297f3da436ff70f4698a75b8fbdd0a5296e6e489f49ca825fb8ea4932f5b7a6bc7391319486022f2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512323, "uuid": "21debd17-2bd1-4b20-b086-af9e55106cef", "value": "T1E45512141719DE03C4BA4FB05AB1C2751FF85E8AA911D323CFF6AEDB783A3506949293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512323, "uuid": "a69b6307-c79a-45b8-85e5-3964b968725b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512323, "uuid": "8afaa42f-ca30-4e4a-9566-7b373c691afe", "value": "24576:pqu2VRoVWSxERhZMJth374+a3+b4oXGZhXrXtpZGDopGUcRaT/3hz6WM:peVRoVHHL4drWErzgooUcq/3d6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512323, "uuid": "5ac46542-678f-4a22-b954-7c11b7c01ba2", "value": 1340424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512323, "uuid": "4025c790-75fc-4093-897e-8cab06008df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512323, "uuid": "5061e093-9c16-4c69-8860-80c9e3fbc856", "value": "y0LaQWFmGxT2Fmm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fce318-0d6a-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771488628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488628, "uuid": "05b29d77-994f-457b-92b5-ac162949a826", "comment": "Malware payload (PhantomStealer)", "value": "cc2dad4b99145d5b408af0f19722fe8b", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488628, "uuid": "b31b3efa-426d-4b12-b6ca-e668c8b50ec6", "comment": "Malware payload (PhantomStealer)", "value": "6e73cf5d5bdd43ed761efdbc9fa1d9108fd4d994bc5a95bc9828392e23deebd4", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488628, "uuid": "6340ac3b-7319-4adc-be9d-587ebdaea7e1", "comment": "Malware payload (PhantomStealer)", "value": "a6ef161042eff13f374ecaa55342a7229ece987f", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488628, "uuid": "cf64c5ad-fdc5-4a78-aa97-6542dad6239f", "comment": "Malware payload (PhantomStealer)", "value": "b559e42224aa6270e436a11b132df37b5a4538b948af336e46a9f46207f6640e9c1d444ceaca541713b1ede51f1dda27", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488628, "uuid": "8dbe8fc8-9029-4f8a-a5bb-0f129c4f21c2", "value": "T1E826CF0E29C85F08C96849A06576D31FB2305C97C9AADA0DEF737C3159D71F8AB6F184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488628, "uuid": "f74a4caf-5c57-4e84-abc5-2122cd10a439", "value": "49152:oVWBGNJulPjZs+mIy1xcDq2jGD9co2YEWpizqZHM1TjLEUXxUAORN5vS:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488628, "uuid": "d2928f84-7fb0-48ec-b37d-a937f12844c1", "value": 4705831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488628, "uuid": "5bdfc250-9998-4c0c-acd3-a08ec77be953", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488628, "uuid": "47d4d590-fcbd-4809-87b8-74a2a382ae66", "value": "Dekont 20261902_ xxx970990000000000000000009000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f402b74-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512109, "uuid": "6ac8d65f-8a8e-480a-83ca-6533bdf17b63", "comment": "Malware payload (GCleaner)", "value": "42c459c13876919c5966c799bfb14402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512109, "uuid": "52fb7d85-19d9-4b16-9da1-2f69b074a91d", "comment": "Malware payload (GCleaner)", "value": "6e9e6a89dedd34977f3689945341ac2d6f909d03bd66a4faf1e3ccf882690a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512109, "uuid": "9be25d42-51cb-424a-8816-0405eeedec46", "comment": "Malware payload (GCleaner)", "value": "141ab1818fd2ffa7a65677813f3c5277d4725e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512109, "uuid": "1e2c9641-5352-484c-a33c-80860c6cf08f", "comment": "Malware payload (GCleaner)", "value": "242fcbe00e79d90d704a60e73dbec67e7a282530300d570e74b75df0854696ce94ee0a065bea02208e3420bd923168dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512109, "uuid": "33cf05e2-37a3-4d46-81a6-fdf6118b9867", "value": "T19516DFC362EB1961D56FAD3727578BFCF827692508BC38456FE049C4CBA8B0071716AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512109, "uuid": "c80f92ec-f0d5-4335-b1d9-bdfe43fda876", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512109, "uuid": "53d2bcbd-11a0-4506-b669-ac3d5de9a4fc", "value": "98304:E9CexZjITBipDalhU3I0Jsc0G+u5o+qI3G:EYBipOM3I0Jfo+zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512109, "uuid": "e017af4b-f278-4818-bac0-2115cf757886", "value": 4343808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512109, "uuid": "f7f72b7d-5418-4c24-9dd7-331e64e2a290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512109, "uuid": "5b26cd6f-86e0-425f-ad97-bacee96334bd", "value": "42c459c13876919c5966c799bfb14402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e1cc87-0dd1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532729, "uuid": "895d1395-5471-4809-bd6a-dfff48e846fc", "comment": "Malware payload (Mirai)", "value": "41ebd6135a2ed3b61035e5a93984aaaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532729, "uuid": "877d0e0c-e47f-4879-b3e2-2ad367ec1dad", "comment": "Malware payload (Mirai)", "value": "6fd492d75ce07d99f1ebb6b1102debdf4d06a7c424470eae81ab90d4f1872785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532729, "uuid": "efa5d4b5-22c9-4ec0-8adc-63563244596a", "comment": "Malware payload (Mirai)", "value": "92bf8b1d86744c67df9e8be66aae1faecce3379c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532729, "uuid": "fa985b68-2c96-47f3-80e8-9b484514b400", "comment": "Malware payload (Mirai)", "value": "aff5761c2da10db1c7ea6dc18aa9ca49ce9f1e9f1cbec74e6db8e03649a20c2cde1bc7ce9d0215e634157319a4b5efa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532729, "uuid": "00d97be0-1231-48dc-a20c-41c3af1257af", "value": "T11DA3B81E6E21CFBDF768873047B78E25A75833D62BE1D685E19CD6001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532729, "uuid": "7550372f-4de6-4eea-9f3d-b7dee1f4b16b", "value": "1536:7ormXJ/g4UtU+3wGFjGIa4xwElvFF8yVeYUUWTiW/xaC:cMJ/g4mUIwGFjFxwElvD8yQi4aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532729, "uuid": "c9f89535-6b25-454e-9ddf-dcd514b23c02", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532729, "uuid": "c151b7f9-5267-43c1-a8cd-ed8f3205f4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532729, "uuid": "a57936d6-b6c2-46a4-925a-cbd78ef98b97", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59a4864-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771493436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493436, "uuid": "8c8cedd6-67c4-4b7f-96ab-338e2f1f66a7", "comment": "Malware payload (PhantomStealer)", "value": "c64b165638e3fd25b0ba9afd1b11bff8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493436, "uuid": "e85fa58f-294d-4096-a01f-fc974c27a0c3", "comment": "Malware payload (PhantomStealer)", "value": "708e0aeae04e04ef9887e3f51c5c01860f4398167cd39202a269456667f636ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493436, "uuid": "b2f5c0cf-ae7e-4604-99b7-bea98d9d61d1", "comment": "Malware payload (PhantomStealer)", "value": "fd303e61831562f0158a44b91dc370f250b7e77c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493436, "uuid": "305030de-be29-4c93-ad39-d489e67e4db7", "comment": "Malware payload (PhantomStealer)", "value": "1126c9c0bf053aaa9675fcf474ae520ca5286a69e866be1c4105264b273be34a4a4de924e52aba1f09281667ff7ba1f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493436, "uuid": "7502236a-9900-4a80-bc15-8de8c54a1bc0", "value": "T15B8407B0DA1001778F87BB8CBCA50660C66DD325866709A0F6D9CB0D950EDECF77962B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493436, "uuid": "0239919a-8389-407f-bf10-5042e771671b", "value": "12288:aebFi4GTMF2ilvtQjEjCIXDN11qlo/qujElTal7TiDffIl:3bFi4GTMF2STjCIXDN11qlo/qujElTWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493436, "uuid": "50cc564e-fe65-4d85-a38b-ee47e722629f", "value": 396826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493436, "uuid": "efb36ebf-663d-4c47-b3c6-c34b4cadf670", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493436, "uuid": "0eb13902-6a84-454f-9ec1-503e7f3c3c28", "value": "justificante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08eb7a27-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493173, "uuid": "d2cf4f6a-6328-4bb6-bbb2-be2d1d4f9371", "comment": "Malware payload", "value": "229e9b9c8a91b6e992d91d5494f10386", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493173, "uuid": "c3d1671f-b7ed-40fc-964f-8612e749d984", "comment": "Malware payload", "value": "70a6364c29542d12d6127da18169ad07ac86b34b4c09a481b6a6fd160f2be337", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493173, "uuid": "3aac5400-582c-4178-bc66-b28eb302ae2e", "comment": "Malware payload", "value": "214b74678bafd3a1ea24272ca97cb9af7e48c43b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493173, "uuid": "d072a24a-a69e-4078-8078-34ac9c3e89c1", "comment": "Malware payload", "value": "d7163f039df5b31ee1f09666dd1b59385ea1bbb54ab6500e44156204202f825fbf4e65bc50a39517b38ba6f48cda9a3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493173, "uuid": "ed11829a-7a83-4d74-9eb6-d00962a0f804", "value": "T18AF2B4CDF0C3B0744657BDA2393FF69AEA6F8F0066898050D2565DA8FC2D71DC826DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493173, "uuid": "3917bb29-151a-4700-a862-3aa0af3e2f66", "value": "384:nEHVCObkQ2FmRNlT2VzrF80l8Cddst+mzEWg8R1Jw1eGowtgWeyV7WyVgsYw3kkV:nEVSUXlTGt8XCd2+pT1HmH4kDcKrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493173, "uuid": "9095df57-81fe-41f8-ae77-3e329bc24997", "value": 34952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493173, "uuid": "be6cc684-bfed-40e1-843a-e53411d6ea8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493173, "uuid": "a123fd68-b6c2-4909-a075-e77bc659dc8f", "value": "Drawings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f715ec-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771493544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493544, "uuid": "c4a1790a-e288-489a-bdd8-7eedfa5328fd", "comment": "Malware payload (VIPKeylogger)", "value": "c75155af217c67f5ba2a0feaecfae6fc", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493544, "uuid": "07f9fff9-ec82-4354-a1d0-d35cf7f0a780", "comment": "Malware payload (VIPKeylogger)", "value": "714e0f6fffc3b8adca5a1725319f8c8d086847e5e203ca2561c42fc55378bd8a", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493544, "uuid": "aafb2419-dd81-478e-b549-9944282846af", "comment": "Malware payload (VIPKeylogger)", "value": "cbeabb6b559b7cfc0248579714c586bd9697cf02", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493544, "uuid": "dde196a4-64d0-4cd4-b098-ccc3addf747e", "comment": "Malware payload (VIPKeylogger)", "value": "4ce021a78c31cd80c30498ea27a59d401900fda67ac7c2c19b55ddb8ee41306351507e33054606c4a94cbc2aabacc326", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493544, "uuid": "8303e2a5-5c06-4bb5-8626-1509bb5793f3", "value": "T103837274294C45EB2493EAB4B088A7E3FE6C0A5C8FFD664F525087DA163EA8735C35C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493544, "uuid": "c6c3e103-d790-4af7-abbd-d768818a0c36", "value": "768:5Y/tzziYW5AdBJZRTmdJygzhOsQpPZUjtunEFTklUXDut4Zy0c33:5cViYW5Ar3RidJygzhaUDFgUXCIy0c33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493544, "uuid": "0e5e01d9-6193-426e-a945-adbed04242fc", "value": 84989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493544, "uuid": "4221288a-13ab-4083-890a-fdd0613b5052", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493544, "uuid": "014f7e4e-4d6f-44df-8687-3b66fd48a5c5", "value": "ENQ-4503-RLVG-9-AN-0503-003-R1-DD.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cb8ffe-0d63-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771485653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485653, "uuid": "659532e2-a06a-4dbf-ab1e-d67fdb11195b", "comment": "Malware payload (Mirai)", "value": "ae565f3a90a40298983640683069d193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485653, "uuid": "246e3c05-7883-4e6b-bdca-46d089bb9daf", "comment": "Malware payload (Mirai)", "value": "72a09f402cb1a967cbdd10f3fe48e9dc25c1747dbcbbbd604afa58e7f447ca4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485653, "uuid": "2555721a-c828-4c0a-880e-681a88b1c26f", "comment": "Malware payload (Mirai)", "value": "af519feef521676755c6bf3fe06086139bfd311b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485653, "uuid": "52a5addc-4284-488d-9e0b-44cd8455f48f", "comment": "Malware payload (Mirai)", "value": "79477aade654bf19ec411fc695893a88e574979b28bd2dea6d797027af6d21ffb7325689f77b5a907f159fe73b541b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485653, "uuid": "1a805830-6a6f-46c8-bea3-c4b682f0446f", "value": "T1FB5302B026D2EB66E0971F73433A9EC34CDBA80AF2615BF1119254E64443969FF6C0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485653, "uuid": "3fbec696-ecd0-4719-881e-770808e9dcfa", "value": "1536:H9u9PHRRj0TTJ4kh4Lz5sLhqdg2ILkg4azHKP:H9gxx885sLhqdgnLGazHKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771485653, "uuid": "d64215da-2134-40e6-a838-3d1d9e25f820", "value": 61596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771485653, "uuid": "6362e5b1-8b41-4f79-9fea-eb2c634528cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485653, "uuid": "91507fec-ad0f-4de3-9bc1-c4bb20498600", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e1f248-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1771493571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493571, "uuid": "6378997a-cf94-4962-9ac3-f8648f4efa42", "comment": "Malware payload (PureLogsStealer)", "value": "5deb686633a3ba12094f36b801a2aa3e", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493571, "uuid": "1b89eb73-2cdf-4b8a-abac-fa61719e63c4", "comment": "Malware payload (PureLogsStealer)", "value": "737b8e1a4e4a0b9c68feeb9850189e8f5a154e44ea6c41054cab13a5ef795ad2", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493571, "uuid": "326b4341-e696-4a40-9fc3-ca318900ad67", "comment": "Malware payload (PureLogsStealer)", "value": "0cdea76ddc3e36b583fe0c1b8975fa24db3efde6", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493571, "uuid": "df9bdae8-366f-43f2-85f5-ee77af5114d9", "comment": "Malware payload (PureLogsStealer)", "value": "6be35c4243d6b4bab8716ac7ae9bdfc9362c571e08d864571598b964c6daa03281f0940591d4b134d45536a12e91a73c", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493571, "uuid": "f708891d-67ae-4f2f-9f04-4206e12c9210", "value": "T18535EF1D075C5C69C1F3E7E29C58FA26238AA45A238C85E79F498DD9344D3E3A38FD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493571, "uuid": "13b5be9e-89fc-402d-8947-1354f1f6ca10", "value": "384:MapkojuoTSmM1n3gK9MoevL6GvLwzgzDiKOP3u3MW1:sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493571, "uuid": "7dfa0d21-617c-4426-9dec-60a59cc15581", "value": 1119794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493571, "uuid": "e2f1329a-5fb0-4e52-a158-09ccf29c73de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493571, "uuid": "ecc40912-4970-4694-ab8d-10b464e98351", "value": "Resolucion_Devolucion_2025_Folio_458921.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c872212-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771520801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520801, "uuid": "4bc38130-586b-4aa6-9891-d57d8a5fba05", "comment": "Malware payload (RemcosRAT)", "value": "b7ae5ba79e53ead8717b9f224cc48192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520801, "uuid": "cbeac742-53f3-4063-a062-479085b11c17", "comment": "Malware payload (RemcosRAT)", "value": "73b8f80db93983c804bb8d8b2eb7beb1c11b2adb3564697ac3c5f340f502d578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520801, "uuid": "da8c53cb-25ab-4733-8016-a84f842256da", "comment": "Malware payload (RemcosRAT)", "value": "8392af2eb14120a2142ce96c5f0fb7f871d35fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520801, "uuid": "3a2666cd-4e79-48d6-a68c-5c5415512d2e", "comment": "Malware payload (RemcosRAT)", "value": "55101e79a0049e6321c215a0861f752f58b06b65c8fa32c0c6b703ff6fc330327efce830c0b80cf70853e4296fa2a7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520801, "uuid": "a62b8438-e633-45da-99ca-2528686ca314", "value": "T1FDD45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520801, "uuid": "050e4ceb-d79c-46ec-b7d7-00a4912783da", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520801, "uuid": "e1bb662c-9ef6-4860-8d75-b94ad1b7fadc", "value": "12288:wSGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr:9GuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520801, "uuid": "b292e2e8-4753-4eb9-befb-7b1cbaeac3a7", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520801, "uuid": "b04162d9-5835-405a-a8bd-4107ec407978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520801, "uuid": "023d024c-8e90-4d92-b4aa-09547dda69cd", "value": "x73b8f80db93983c804bb8d8b2eb7beb1c11b2adb3564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2969a23-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493485, "uuid": "7e9f5426-c082-4990-a38c-5018ed0b8fb1", "comment": "Malware payload (Formbook)", "value": "aa1b0f0dce509903f41fba4edb853579", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493485, "uuid": "9ce428be-68ee-46e8-ae2d-4fda8c43db1a", "comment": "Malware payload (Formbook)", "value": "75c48a036defda95b81b0f62759558070ee9e3432f694752c6ef50ca59595d08", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493485, "uuid": "17d8457e-2c94-4821-b66b-a7ebcd939f87", "comment": "Malware payload (Formbook)", "value": "7bc9e8fcc15d4eaac148d1a95f5ffb4e4359b2fd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493485, "uuid": "34dd2a00-d54e-4223-8622-972d86efbced", "comment": "Malware payload (Formbook)", "value": "210047743869ffc11940c2e9e75ee519f609585f5f1998b7dcd0cded75d3004fdbff43d24d9061fd04d63c66ec66f55f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493485, "uuid": "4cdd0e47-b787-4379-af9c-30847c67d913", "value": "T11355BF58C88432989DA78D4DC0FD659F37E87F4DC8A2A4BCF8197E97A73B21493012D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493485, "uuid": "08509fb3-be33-4818-b390-704c40550c96", "value": "24576:87FHdy9OyP0Ca3WbhqMDElCdX/5JJX5vUjYh4YpYYeSh9/OH8uRiaM:IutVF9fuRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493485, "uuid": "1d2a22d6-1b2d-48e4-b170-c6f460c3c871", "value": 1397603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493485, "uuid": "b6d47337-fb93-4fe1-9a0c-239591a62730", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493485, "uuid": "4db6538a-42fc-4fa4-b3d8-c25efbbafa29", "value": "FT_2602184331187_attachment_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2ffa47-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493476, "uuid": "00d6a0b0-8b08-4b66-96e9-1d4bec4a12b9", "comment": "Malware payload", "value": "099b424a3a9c63952a8b3afbdd9d014e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493476, "uuid": "1a178057-6957-4cf5-88d9-0c34448e4239", "comment": "Malware payload", "value": "75e0ea674cde2199be6271e039d24ae7c51f7e2fccf8a414cd53aea7c44dc3e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493476, "uuid": "2204ba99-f13e-4051-a1d2-f7d732b6195c", "comment": "Malware payload", "value": "dc40755518b06c62e7281c7de90244f43577586d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493476, "uuid": "ec921f50-2b93-426f-96c0-732cb7baf0f3", "comment": "Malware payload", "value": "55adea35f21e6b3ffd4949da32699b440a57d82cae5fe2b51a996db2aab6e4444ea8ea7693477ef33d7f07cc7f3765ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493476, "uuid": "3c9f0141-c678-45c3-a265-b182a2d425cf", "value": "T15D351814AFA3359F46E4011409B9A3C8DB1D8B462C4D9D34AB17C2FEEF137845E86BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493476, "uuid": "8401edd3-acd4-4d67-80bf-b4983bccedba", "value": "384:WVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVu:tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493476, "uuid": "0f329d1e-f861-474a-9d05-581701c77397", "value": 1101712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493476, "uuid": "08c99a15-259a-4595-bdef-b47a109bfd03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493476, "uuid": "249627e5-6332-4ce4-a4fd-023a23c518d9", "value": "PLA\u0106ANJE 80800.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63769625-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481729, "uuid": "ab490109-4272-4508-9ae7-9559e055ff97", "comment": "Malware payload (Mirai)", "value": "50e90eff1ea06e991cc48e8a8c209186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481729, "uuid": "2f124c03-12ef-4a05-8c14-33820cfebdd6", "comment": "Malware payload (Mirai)", "value": "76481efbf8d3bcec61d4218ed1ed8152e2d1eae44fe1771e1a059fb51db13a80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481729, "uuid": "a355e676-6e38-4875-b6b9-a77d3630d13f", "comment": "Malware payload (Mirai)", "value": "f611e77d943a1c13a4a8e9b45cf915d31d80dbd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481729, "uuid": "39f8004f-7faf-463c-854b-4a023d33c478", "comment": "Malware payload (Mirai)", "value": "8a3691f15f6fa8e31a8a1f13c8fbc5d7c7cca8abb92563d2a42f37cf4d0626190c0e296ef55f3568bb5ca329919acfdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481729, "uuid": "c164d9cd-6fd7-454a-9582-6200b8478b6f", "value": "T1E4D35B0E79D230FCC687D170926E9F61EA36B46C02183DBB9382BE711937DE05E15E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481729, "uuid": "9f7396d5-c507-4d32-950d-062f45f90711", "value": "3072:YE3kaPrmoLwun0s2ZCYivF0UPuHwn5Gmbc8xYw1e:B0aFLwuni0uHi5dbVt1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481729, "uuid": "edb1604f-daab-4ce8-8888-233f9fa37e46", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481729, "uuid": "15ea307e-aa7f-4830-93ef-a06af1d39ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481729, "uuid": "6b97c269-ab4d-40b5-af3a-6acdff5692bf", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525ca201-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493296, "uuid": "a28f16e5-2e58-4186-92eb-233ac5a1fc07", "comment": "Malware payload (Formbook)", "value": "7a3f50e94ec8220336b09d1bd8262324", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493296, "uuid": "fa2bc037-9482-4373-af5b-602e6f015a58", "comment": "Malware payload (Formbook)", "value": "77a5feee7953e00f11442a1d65afd8350970dfa373b266140428e0c937001777", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493296, "uuid": "ff265c68-be67-46bf-964a-7cead198ac6a", "comment": "Malware payload (Formbook)", "value": "46f130fd8e83a70c1ae1e3e3ebf7ddeacc1b6daf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493296, "uuid": "bc8213d1-7140-401b-8648-e360be4426c5", "comment": "Malware payload (Formbook)", "value": "ca542d6e85a301c3c7eaedf81c3aae028d9b64d857b0d06cd775209670bc295cd8f3fae383b10069314e1e5c15ebfe15", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493296, "uuid": "9f7f3b3d-0452-4bc4-b4e7-fb3e396111d2", "value": "T1D1F2EED2F97CB7E4C9879C00EF36D7F907694C120D286D5AAA5184BDB9A24F7D02EC90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493296, "uuid": "8a8e6a35-8ab5-4d9c-b136-561fda9c1801", "value": "384:CUl/T0G91l4MwFU0OiJHev85gsDzG4W+UttSVCyOQ53vRpCQ46gxiNdROYoh:aDhOPyOXlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493296, "uuid": "f65a1abe-6f57-4250-a4ba-aff24cf9d6bc", "value": 37094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493296, "uuid": "aa275a31-f035-4711-816c-eeb325e66205", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493296, "uuid": "180affd4-8b2a-4a2e-8238-282e0482142c", "value": "freshone.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7d95c0-0d9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771510787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510787, "uuid": "69662ffd-8c01-42d6-be99-a7897a264e21", "comment": "Malware payload (Formbook)", "value": "41e8f429d524ddf91c9166e5be06881a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510787, "uuid": "15b0a6ec-7eb6-4f82-91dd-83f97d99c6a7", "comment": "Malware payload (Formbook)", "value": "7826cba41af49ea8bb9df841980036527414f9f693611136579460299d6e9f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510787, "uuid": "900ce7a8-ebbc-4e38-9ccd-217e8368c398", "comment": "Malware payload (Formbook)", "value": "78a357947daef5f92b1adc17c7e32a760ce5fc58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510787, "uuid": "5dbaf42e-9a36-4c61-b8a5-3e2a353a5628", "comment": "Malware payload (Formbook)", "value": "963b7087a75cf3e9d8a3273b25fb43c2c32ab8226ed2c349f358921944b96e8429db0b253461ca5706343ab39899a190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510787, "uuid": "df76f0f7-6cec-4e0b-94c3-740589a662e2", "value": "T1F325120872A9E903C0E64F745731F239A7B01E8D6426D2078FD2BCDB787A7E558857CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510787, "uuid": "f18c730c-317c-4cb8-89d8-62515a7641f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510787, "uuid": "29ff179d-0575-4ca4-8775-9e5cd106f360", "value": "24576:I/IAYxXA0qb58bQtWqjiE/039GAkGZWsDgqW5L/0cVwIiCrhA:I/IAd0qbqUnWE/039GAkdskqvarK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771510787, "uuid": "a71a48a2-7c89-41b7-9e4b-bfff43c2001d", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771510787, "uuid": "848c68ac-c252-4f12-9f73-834569ae6c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510787, "uuid": "32f3494d-ff38-43a4-865e-bbc6d6b6a511", "value": "DNE251074547 DNE2512163164Penavico Shenzhen Logistics Ltd.cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f089ba7-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482929, "uuid": "49823ee7-85e5-469f-8649-e04342408cfc", "comment": "Malware payload (Mirai)", "value": "fb214ea3642803ee883474d0b37cbe12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482929, "uuid": "0455bc12-0bc1-4477-a9a3-706c1460b209", "comment": "Malware payload (Mirai)", "value": "78ac7cc847ef1fa2b5acf120ed93dade866c2b5eb402a93ee87cbf32c33b0691", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482929, "uuid": "da7f545a-9b85-44ee-af48-4f2b41a0d1f7", "comment": "Malware payload (Mirai)", "value": "32dee37250dabbab35262034cede1ce1dd8adf27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482929, "uuid": "ffb3105e-aec8-42bd-bc54-9a08d9454e44", "comment": "Malware payload (Mirai)", "value": "c2b43b2bcd4e972dec288e0adcd688c02cf3790964ca544af0495e8ab2c58a56cb3533480c7c38e62a079177621809a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482929, "uuid": "0d88261e-d411-44f8-8189-97fbd736366b", "value": "T103F33B07B7118FB1C368D67009B3CB67A6E626A216E1D985E76DCD107B2435C6C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482929, "uuid": "1a6640d8-e688-4006-9820-909eca9e290b", "value": "3072:BhJeZetf5kOFkSG/7LTdLmrLWaJfV0PZJox7m1W9xp57T0vz/7K9faN:7J0yf5kfl7LRLmnWSV0PwkWp58mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482929, "uuid": "b088f372-8231-45d9-bb56-9a67a1eaac13", "value": 170728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482929, "uuid": "bd5831ff-105e-4c10-9fe5-e6d2f875f7b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482929, "uuid": "e270259b-0630-454d-91cb-81bac190e865", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d41ad96-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771520910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520910, "uuid": "c81b018c-9488-4489-ac4b-d50fa1252446", "comment": "Malware payload", "value": "ec614183c1571ecad8656d40599e0497", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520910, "uuid": "51d792da-fa6e-43e3-b84c-74179913bf75", "comment": "Malware payload", "value": "7b9c8440d3ab61443693cfbcfa918e8482de2e22357437f956e49db305b20302", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520910, "uuid": "e17f9e50-bcca-4203-ae32-128752c3431d", "comment": "Malware payload", "value": "d9125b233927df7b1c497def61d92adb49d91c28", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520910, "uuid": "340b1435-6656-428c-abe3-666ecd346028", "comment": "Malware payload", "value": "62d792568bf6e95d2a4214a4aeeb05936bc0cbfd3866d0bd1d11aaa32c69f21f26e52de8a84a1428313d80bc5e87ad9a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520910, "uuid": "d9d09bbe-c8de-468b-85f2-64640694a277", "value": "T13561C95A363BF6D1F72BEDC44569914C0927CBCE700849C2F1ACB6E99043A64125C4EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520910, "uuid": "c306eb02-0087-462e-be91-33c9520590fe", "value": "96:brvoTBf9rQxY7FBPSXdfr5mZqJ0J9EoIyCC:vUf1OZ9xe7EoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520910, "uuid": "2d363583-b7ee-4ccc-9c78-07004140a894", "value": 3433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520910, "uuid": "7133d557-7eeb-4969-9f05-98361deff1ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520910, "uuid": "7cd8796d-cdfb-421a-bfba-cc7efc8c12fc", "value": "BOQ & Supply Commerical T&C Hindalco Industries Limited.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04efa78-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493508, "uuid": "98801cbb-472f-4a32-aba1-d47097933beb", "comment": "Malware payload", "value": "46e954c0bbb064f11964e352ba5a5b83", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493508, "uuid": "4328374b-8aa2-408f-8ff6-f733a74f24b7", "comment": "Malware payload", "value": "7be7803b3e8cfe027d3c470a3340183430b34a957dce6ac087f23e7f2ff27a60", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493508, "uuid": "0882ccb7-a3c8-4c0e-bc5a-fb78a2c718fc", "comment": "Malware payload", "value": "18a648d843d7291c5627c3fc286a0ac0e6242e4d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493508, "uuid": "ff9da142-3a18-4d1d-80f9-4d0f037ab919", "comment": "Malware payload", "value": "68e490e322a7e2bb889ceb284b8b3b59610ecc3b26ea5a6b16ec136afcd6906a7167f2517e8ae36c00eee9288fbaae30", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493508, "uuid": "986a0d45-02cc-40b5-930f-85e24976c5f8", "value": "T1C44100121BD60724E2F94A35ACBBA711A9A93D09EF068E2E0081A35858916089869F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493508, "uuid": "588ac3c1-92fe-4919-bd59-95d716439cf9", "value": "24:8pVJbLDOS/RxUawAgqHSy9oBerUMkWI9wCc5QgkgVBS9ZmT:8pzDbYqUy+erHypgkgVw9ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493508, "uuid": "c25b2eb2-080a-4f33-ab6e-ae45a5dce2fa", "value": 1997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493508, "uuid": "4ec5b925-23bd-47f4-bb7a-018014b80124", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493508, "uuid": "ed87d2e1-c3ed-4715-a949-57219acdd9f1", "value": "Document.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3209e90f-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493242, "uuid": "6b75570f-6a06-4c66-8fdf-352ee63e89d1", "comment": "Malware payload (Formbook)", "value": "97c09a5803f41c28cc108ffde6118df7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493242, "uuid": "54d013b0-e48f-4e1e-ac29-17efe9a9c356", "comment": "Malware payload (Formbook)", "value": "7dc43dd2a6fadffed4c53082a65336a3ff8644156a74a50c89345b5b76363b49", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493242, "uuid": "1f9bc2b7-725f-4b91-90a4-a5ba7b634513", "comment": "Malware payload (Formbook)", "value": "d368e6426ad7ba1e0542caac386b8573c03fc2dd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493242, "uuid": "d42da8cf-023c-4332-9fb6-64de40eeea7e", "comment": "Malware payload (Formbook)", "value": "22ed4c816f43dba56cd91499025afee0530ea9bcfcfd163013c123117d7cacf08c84b172b4ab532898bd5d920dbb1743", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493242, "uuid": "ad1b7c2a-9885-43d0-9ddb-e14d987e0442", "value": "T198E2768D3FD6F1E91762607B291FB12AF12F8CC075CD8059E966A1C4BA74308D875ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493242, "uuid": "d8b27a3c-bfc0-48d6-ae89-7aa6f7357482", "value": "768:PA6uN3jeLM3HZt840ir95+sOY96kOXM6AXD:PLk3iLM3HZ64p9IY923AXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493242, "uuid": "fe996366-b74f-4a7c-b085-f18bc99967db", "value": 32003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493242, "uuid": "51908ea5-2836-4650-8ab6-d1dfecaff196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493242, "uuid": "dca1eccb-3111-4a26-aceb-f433384d033e", "value": "PaymentConfirmationSwift.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8d12d4-0dc4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771527509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527509, "uuid": "3e271f3e-47ca-4f9f-9eea-8e3a6ad94ccf", "comment": "Malware payload (Mirai)", "value": "cc357498e30c6dd248eef13d2797add0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527509, "uuid": "c872b157-027b-4051-b906-b15062871680", "comment": "Malware payload (Mirai)", "value": "7dfa679882089d1599cf8fc60e46febf7794fce578761031b8c6e39a51ef6bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527509, "uuid": "1823c3bb-6a13-4d6c-8b75-f32025800b76", "comment": "Malware payload (Mirai)", "value": "a5b29a4c76a042a9fb434c0f292480f62493307a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527509, "uuid": "9d42117e-6fd8-4ac2-b67c-dddb3f2de191", "comment": "Malware payload (Mirai)", "value": "4b5619eb3c409f14317738bb19fa1df257bc21ad9376f0016dc3fe4f7fb925c7f0f53639d142e57053cd0576b03e7c76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527509, "uuid": "c2fc2d35-23ce-421d-9b83-006f4104ed3b", "value": "T184934AC4E683D4F1EC5705B55137F3369732E436102EEA47D369AD36ECA2950DA0B3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527509, "uuid": "bbeea952-d7b3-4531-8923-d3aecbe69960", "value": "1536:5jjgcjCiP5qc0iY9pPJzJr1CXAiPq7R8TSmvzNosjq9KQvOTSTflHUI1:5vZjCiP5dFYjJzJABPEsSmvBjK/O+TZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771527509, "uuid": "5393d0af-09d0-489b-a566-a6bb0d57b31f", "value": 94252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771527509, "uuid": "a002c9bf-1c1a-4665-8685-e29bda5a2907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527509, "uuid": "eef43987-38e6-4c92-ac09-1fc40976e174", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8712680-0d8a-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771502568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502568, "uuid": "dd7e74ac-6f1e-4274-9c92-bc534b5a0be3", "comment": "Malware payload (SantaStealer)", "value": "c7151afbf872966bfea591cb0c62179e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502568, "uuid": "1cd85664-8e8d-43ba-aed5-bccb453c30fc", "comment": "Malware payload (SantaStealer)", "value": "818b77fb265dfcf1a8ad5628c89dda07da50bb4623b1eef322178ef2a964b93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502568, "uuid": "2388f0d4-44b5-46a7-aff5-a356cd6c3f4e", "comment": "Malware payload (SantaStealer)", "value": "257960d0ed1ed61e4581e9b901c19703c91d85d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502568, "uuid": "9edff6be-88d6-4b84-88cc-2a803881c1da", "comment": "Malware payload (SantaStealer)", "value": "5a744fbc045a59a6f95b08fea048db9962babe7aa98805c477e53e42c3633508e3cd5cde09c4fa89db2e13721599a4d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502568, "uuid": "6ffb70c8-eab0-4b97-ae5d-80a860fb08e8", "value": "T120D53302AD7534FBC45763B78CAF0922D261FBA88C1629BEF1FD41B09E8544C2D857B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502568, "uuid": "aa7cad42-d25f-45d0-9bcd-d919deecba4a", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502568, "uuid": "9dc59f7e-ae67-4642-ace2-4936464f4713", "value": "49152:pf3Nb2YGsHjT+pMMx6Tp3hy8Y5CKc8PQSKqKB48CjLmZRgYnfPBfG:FLhnOedI+AmLVPBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502568, "uuid": "6603fc9a-9ffa-4d35-a37d-3b9ed09f22cc", "value": 2959872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502568, "uuid": "c9d3ebf8-3716-4868-ad42-4c15e388cc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502568, "uuid": "412aa1d4-a556-4ded-8f5f-2c0a619b0597", "value": "818b77fb265dfcf1a8ad5628c89dda07da50bb4623b1eef322178ef2a964b93d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99c64f5-0d36-11f1-a129-42010a9c0007", "comment": "Malware payload (SilverFox)", "timestamp": 1771466519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466519, "uuid": "dcf3a11e-18e6-4bee-80e9-ed462e6f5f4c", "comment": "Malware payload (SilverFox)", "value": "b8903c8f2d88bb245d91adbdc62136fc", "object_relation": "md5", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466519, "uuid": "e82e2309-43cb-4e63-969a-9f30238ab72f", "comment": "Malware payload (SilverFox)", "value": "822681e669666fe00b0dc735971d0f1891da3d7ae39f290a1e34365d28490fd7", "object_relation": "sha256", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466519, "uuid": "8882ac29-2333-441f-9721-b32e7de55b71", "comment": "Malware payload (SilverFox)", "value": "8f9ba3e1dc98128e4993a2ab734c2f4e1f3e1286", "object_relation": "sha1", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466519, "uuid": "9effee49-6cee-4f4e-a6df-583dfa55e399", "comment": "Malware payload (SilverFox)", "value": "df44904c266a9f9e013db9092cb1cade1ce66aca4e720e07c068a5ea1b4048004d7894180095b513feb1ad53c551c60f", "object_relation": "sha3-384", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466519, "uuid": "ab1d3e01-5c72-4807-aa01-09c7713c2cba", "value": "T1AE183321B2766DD5DA2FA7BFA0B45FC940306CE0731BD66B63787BF186B1A422171903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466519, "uuid": "ccecc36e-0a00-4d15-b166-b64d47220c02", "value": "1572864:gcE3lDTM3UKWGRvu/ToZI9kRdGtFYHHF5EJXR5/zRlNqwxYa3f9:gcE1n0xWhr+141ThzR7XYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771466519, "uuid": "2728f613-1bf4-4377-ad30-84f89c1c32ce", "value": 90307072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771466519, "uuid": "8db909a1-3717-4dff-a3e3-5d4358765882", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466519, "uuid": "2d7d4b1e-9dbd-431f-abf1-8583cf66524e", "value": "Clash.for.Windows.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea83acdf-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493552, "uuid": "40f21315-2c33-4a7e-a312-d5a390d930ee", "comment": "Malware payload (XWorm)", "value": "3a5de3b55a062f2d532f57571405d268", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493552, "uuid": "03fc0301-67e0-4659-91ca-fb809304fc2a", "comment": "Malware payload (XWorm)", "value": "8229a6bb5e55b8864c2c4efbb395daec65f09b668c24474fd13c717568bd65be", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493552, "uuid": "caddb280-d9d5-4657-a7b2-395707c12055", "comment": "Malware payload (XWorm)", "value": "428273463c9ad8e4e889561c46be98ea7199c10a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493552, "uuid": "5df2f914-9ab5-4aed-b743-ebc45cd316fa", "comment": "Malware payload (XWorm)", "value": "fdb8ef4b05349aadd8d9c74af6ce48b12b73791bf20f02295b9834fcd13e9b2d64e7e86f94641115d39290c8dda2a2a4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493552, "uuid": "1dbd8f63-e3b5-4ba2-89a6-37a7bfc0694b", "value": "T13A45FD6BA60F57DCA77A3E90C5F07A6339701131B2389C4C3E3D1A0D6EA695276B24DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493552, "uuid": "05905ab2-505f-44c1-b0be-72bd30bf34a8", "value": "192:A/I8IrN9rLySI/DTlmdjYjL3q3rjlpd9jlxfALKkkCYthuCq8RrylvdB:zIPl7jkfdNiKkkCYthuCq8RryR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493552, "uuid": "be0b916c-c2b5-415b-b4ea-ce5629c000aa", "value": 1245800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493552, "uuid": "5f5652bf-c953-4b34-bb1f-05fab92c18bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493552, "uuid": "a504db8d-3b17-4baa-9984-29f8a45532ed", "value": "SOLICITUD DE COTIZACI\u00d3N QTN.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca58c4b-0d7e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771497287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497287, "uuid": "9a30448a-ad36-4904-be40-db8c8160bc6b", "comment": "Malware payload", "value": "36aebf555fc1a700cb934596de4eb656", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497287, "uuid": "57859567-9a70-450b-900d-4d2b05dc9baa", "comment": "Malware payload", "value": "828023ad693b8fa244f4dfabf21e4478c988428cce35f31356c381476e0eb677", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497287, "uuid": "b46dd204-1a73-4bab-9c53-d89c695137e2", "comment": "Malware payload", "value": "7bd5d89065b3d8c3dbcb31f19f54959ac4788927", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497287, "uuid": "179ef3ee-f0ef-46c4-bd4a-c4b2723ebc10", "comment": "Malware payload", "value": "d4e79c09996450d3c2808072d369c83efb23541ff3e96af5c7907fb1f76883ab9eb2fab0fae4527f67996cb5d0ec4c1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497287, "uuid": "f2bd4178-9fd5-43e7-a0dc-74fb733e0087", "value": "T12243C654A3E47A2813865BFB3B1360D2E4460419BD89480FF5A4BF2D6C6A72AF5FCC74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497287, "uuid": "b4584016-fa7c-40f5-b8a8-ce05ab29586a", "value": "1536:ULqOSCHJRG0sDwVNHdMCo7E7oj/KNRE6mlXLDFyz9:ULqOBpI0s0VNHdMCo7g6/KN9GfY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771497287, "uuid": "c55081ff-5e1b-4fc1-849a-a7d2ec1e9262", "value": 55665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771497287, "uuid": "78c2c7a2-c50a-4317-aebd-42bc804c84ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497287, "uuid": "0fa9a135-7d49-4a26-a6ef-8dbbb38e47af", "value": "Os6wXD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd86dcd-0dbc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771523781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523781, "uuid": "78c285fd-9351-4822-8203-1e12b2fe45ba", "comment": "Malware payload (Mirai)", "value": "443e524b99405f951ee04bceb7aa5ffa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523781, "uuid": "95105b1e-6d07-498a-b150-a6df3e0317ca", "comment": "Malware payload (Mirai)", "value": "83246c081a0f86e0dddd62f5140a87f1331eb375e9ef8b331d53204a4a0bd046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523781, "uuid": "81a6bc1f-3a65-49f4-90bc-de8b0998f237", "comment": "Malware payload (Mirai)", "value": "5ae935057c8fde53e80777ec36a6b1dadfbb5501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523781, "uuid": "792631cb-250c-4c35-a681-4fdc4fc90e8d", "comment": "Malware payload (Mirai)", "value": "1904df715b703775fd50167049aacfc41d627746e4c23583fe468c0c7f292cc1cc7c2991a0b24bcc1723259b2bc3e081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523781, "uuid": "d5a4a80b-fb09-4b84-a036-f90de076da95", "value": "T168734C02731C0E47D1635AF02A3F23E193EFA9A021F4FA88651F9B469275E365186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523781, "uuid": "b0d0dba8-2527-465d-9ff5-175cac4e93ce", "value": "1536:46Jn7qPpYi+W7jqsKTYAvUM0nKI9jYRv3FCAf4/bJJ:r8L2DonKIxYzIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771523781, "uuid": "2606b15c-6013-4ee5-9109-22bcf42f1752", "value": 79844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771523781, "uuid": "758a1b35-a089-4223-947b-d21962b7c589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523781, "uuid": "ed03cbeb-0687-4466-aa81-ae15fc77ac02", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f1ce93-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482298, "uuid": "5921daf3-e1b6-4e37-91d1-7670f468d32e", "comment": "Malware payload (Mirai)", "value": "13728c9854fa201c43afccfc5788a4ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482298, "uuid": "2dc63eea-f70f-4f66-96cf-d35081862140", "comment": "Malware payload (Mirai)", "value": "8351ebf92972f95fd9303982116470bd229f01e2559848df60bb1e508b7af3b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482298, "uuid": "17f9e873-fac4-48ae-b24b-8c0d53142854", "comment": "Malware payload (Mirai)", "value": "1ffd1e469425be2d1df2cb2f16fb2b09c52668eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482298, "uuid": "27793f3d-c764-45e1-bdb5-eb2927bd912b", "comment": "Malware payload (Mirai)", "value": "be20a4d3817f45a021dce46c9f17c4712b59ee315b8732f96989bc48c869fc19aa5585067a6627cf0cb71266c1821aa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482298, "uuid": "2760c10d-a5e2-4e76-b698-9f6d44705bc9", "value": "T11CC3F184FB22A991D0A306F9A4C04AC383606E76CFA313080299F678397DDFB1F65DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482298, "uuid": "c27f1eab-4a71-49ed-acdd-16f6c14a033d", "value": "3072:4B9LzLeoodMoLnyXdOZmK7FqSgMCPgHaTRxXXMMTnI:0LzL2V2oVFqxMCZxHxTnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482298, "uuid": "1c6d516f-56d3-4f64-a243-681d2e30690f", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482298, "uuid": "dd465e90-aa6e-40f1-a438-03d2e3224f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482298, "uuid": "74a2edd2-810d-42d9-b68f-b54169ba4c00", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c5b429-0d74-11f1-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1771493039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493039, "uuid": "cadbdcb8-67fe-44f3-9d8c-3f8bfab3ce5e", "comment": "Malware payload (STRRAT)", "value": "6707d380ba2ca0da27fcb0ccc897f1e9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493039, "uuid": "8ed438a0-cff6-445d-8af5-c024fa72b8a7", "comment": "Malware payload (STRRAT)", "value": "841da922232f24b41803fd12164cf488a8749dd6a29b210a6bc432d0591146f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493039, "uuid": "8007a47d-c95d-44cc-8daa-e9b7c63edf54", "comment": "Malware payload (STRRAT)", "value": "13fdb2744ceb84e1b64570c92cc9ac078e784640", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493039, "uuid": "a7be5ffa-4575-45ea-b608-e32ad516ab5f", "comment": "Malware payload (STRRAT)", "value": "a1dceaf49618e0990028f4f5221c0517f7f41b1e7a697c1fdbeca3b387f3a048ee8ab909607c15f2110d66a84e5c3637", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493039, "uuid": "1dc7d2e3-5092-4f5b-816b-84cb8f87c375", "value": "T1D10422124D333EBBDE08337590A77D1A19A0AEE914A5F1CFE1536CE07B3E8C095AB509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493039, "uuid": "58bf60f9-05e4-4460-8e5d-b4cefce0e760", "value": "3072:OJEYSTJmdZp/YbjthfliO5lZwTUL4x2jmq0Xh5/Fv23eH2AjC3wVnYBYVLuWKbfM:vml/YH9VffjmhhGnsC3rSsbfVgP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493039, "uuid": "b0c32331-26f3-475a-8bc2-330e21bacd7e", "value": 189917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493039, "uuid": "6baff61c-eb2f-47f6-85d6-ef5b920e56c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493039, "uuid": "8f7113f6-6a50-4934-9c9f-0c92637492fa", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881373c0-0d39-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771467617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771467617, "uuid": "98a2dca8-7d24-40f1-8994-9a72590dc757", "comment": "Malware payload (Mirai)", "value": "4e5e21ad42e6f670552a86c969e1b901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771467617, "uuid": "e20fcbc4-16c0-439d-8024-a363c760dbab", "comment": "Malware payload (Mirai)", "value": "846fb199ef7b14be2b0f3fa419fdf4190f582bfbfacd7447d1f1cfbc51f5d8e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771467617, "uuid": "e42705bb-a81e-488a-b2a8-a9e29bbc4b34", "comment": "Malware payload (Mirai)", "value": "a5f12f42f0fd2fd83b53e9c0fd815289d0232ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771467617, "uuid": "f4da93d7-8d2d-46d4-9f73-48fca2a685ce", "comment": "Malware payload (Mirai)", "value": "ea3992b1ab208835b8f3741b06db2673992c88299109e90967c587bba9615f8696714d5813cb95002f327b3017f2e580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771467617, "uuid": "0e24687f-7ab0-415d-ae63-94150087e02d", "value": "T1C4131742B3180547D5631EB0353F47E0E7ABAE8122E4F288760F9B4DC171E77A946E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771467617, "uuid": "417e6ab5-7298-423c-86ae-64d93da63382", "value": "768:TuZQBal6xzFogyxBvDMTccDP1UqI9XFPTMWy6/janpyvsM73V+Otauo:T0UFogW5DMT3DyqWPwWy3nYx73V+uaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771467617, "uuid": "9b9c1c2e-c921-4498-a0ae-33e028d77a2c", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771467617, "uuid": "ad9d7283-e148-47ad-8209-467ac437aa13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771467617, "uuid": "1cbac1eb-aaeb-4107-ad16-a7c7e88f1884", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2bcf1e-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771520779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520779, "uuid": "ab25a4c6-0e04-4bdd-86c1-6d08b14f0785", "comment": "Malware payload (RemcosRAT)", "value": "28e67f65ee8f4db1b81a11a224197ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520779, "uuid": "ec3bbcb4-0860-4f4c-83a8-2f5f0b66eae6", "comment": "Malware payload (RemcosRAT)", "value": "84eaa8ef44fa7e70ee018bca52e1d89ee3d1916b2c8435647bcb6e7508422cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520779, "uuid": "2a2f27db-9ee9-4b4d-bbb8-7764ba722439", "comment": "Malware payload (RemcosRAT)", "value": "489fcc0f337328b081ada68563b1d66795e15fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520779, "uuid": "2e30dcb2-4d42-4f9b-bc2f-c1c9e67bd8cd", "comment": "Malware payload (RemcosRAT)", "value": "575f1f5e428aac4382203ddc21f9c137bf78ce416997bc87caaa0dcab37575406adf34a1738af31f60ae24474d1d4d2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520779, "uuid": "cd32935b-6afa-483f-abe1-595e6cc68ae0", "value": "T186B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520779, "uuid": "ae096559-dd25-4485-abc6-e8882a0a5249", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520779, "uuid": "53d32ae0-ac10-41f2-a920-a4ae4cdeba67", "value": "6144:0XEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBcey:2ENlHV9FGeDWv3jADnyYiCNrsPZls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520779, "uuid": "152c601e-6b99-4181-9aee-457115a48aa3", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520779, "uuid": "882dfcb9-795c-4038-b861-d3a27c70d3ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520779, "uuid": "66b3eb15-a4b5-4986-8717-a7b2d4f13a03", "value": "84eaa8ef44fa7e70ee018bca52e1d89ee3d1916b2c843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f74ea0-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771493492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493492, "uuid": "610842cb-12a0-4771-8fe0-3e4301ff19b2", "comment": "Malware payload (RemcosRAT)", "value": "e39bf7d7128f4b3c4294468f00a44cb3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493492, "uuid": "9b68fe41-de9a-4cd3-9256-19626c4ac27c", "comment": "Malware payload (RemcosRAT)", "value": "8525b565eadc2d91f3004c0b0ec7b0d681073fd014a036c40e1c886ae318a304", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493492, "uuid": "568981cd-9a7a-463e-a22e-9f0a82c03d71", "comment": "Malware payload (RemcosRAT)", "value": "45c2c8831fc7a8f4ecd5d928411d5e1bced43e4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493492, "uuid": "d6b0dec6-8db1-4535-8daa-117682d74e18", "comment": "Malware payload (RemcosRAT)", "value": "f3d7dd7b114a8aefb1ee6f5c9bd99e6980069971809eebacc12366a59ec69949f9b0304fa499c58e91ba165978314120", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493492, "uuid": "2b4c7754-d134-470d-a818-f857060dc559", "value": "T1BFE5AF0156DC3FE8EFD6020DA176411FA3B1064B669E701FED7399C35EF2A2304A76A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493492, "uuid": "facde9a2-6e16-4f14-ae19-cbd2f16add62", "value": "24576:fwy8IO+pHCIgxGv5/sdLzDtAOWXdz3A8iVlGh3R1TZUR+HB78aNSAd+oTNF7T5:JvDiCPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493492, "uuid": "95aa97e8-02c8-43e3-afba-9d61f97a2066", "value": 3219319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493492, "uuid": "08825077-db20-4326-8c66-375c91e27242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493492, "uuid": "b08b7098-9e5b-4cc6-838a-8ba154c58ce8", "value": "ME38574673773566573753592459007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f72177-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771484603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484603, "uuid": "5d2ccfea-b7ac-4a38-9f98-4fa0af73edf9", "comment": "Malware payload (Mirai)", "value": "1398aba22dcfa5b291888ac4e5ed4c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484603, "uuid": "93cb49d1-55b4-4aec-9c03-7e0e3aaa4156", "comment": "Malware payload (Mirai)", "value": "85d84e358cadd9d7e099769e126ba16e16f9b080769d525144f58b2804096281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484603, "uuid": "3d114f5d-0d6d-4b4e-ae6d-c3e2993038c5", "comment": "Malware payload (Mirai)", "value": "92f18679311526e3b51fd0d233be4523f156ecba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484603, "uuid": "3f3b34d9-b4d2-4b27-ab30-8dc824005ace", "comment": "Malware payload (Mirai)", "value": "99a97eaec6ab0774460fcf1835c923d835b4d03ce42b442585639cad7a2fb233ba0b78af55730613562201c605934fb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484603, "uuid": "0cc162a9-11ff-49ac-997f-1f33702a67d4", "value": "T18ED3D021E5005DA1DC221AB938BA86BC0710EF7407D652C6FFFFE95A6477DD434AE2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484603, "uuid": "06040e4a-4d42-461e-b37f-b4c22d2aed2e", "value": "3072:qTivk3dUGX3ymeU4DVcQ8xrmfHD7qoYhQAPBr:qes7CmeU4RlL7zYhxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484603, "uuid": "3a0757da-b41b-4ed5-9dce-8b8ca7d63fbb", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484603, "uuid": "b236ff4a-5f31-49f0-a529-17faf0f45b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484603, "uuid": "01686991-0dbf-4318-b1b0-ab4760d712f9", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88307dd8-0d6f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771490810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771490810, "uuid": "dee83c20-4015-4297-be7d-0ba965260db4", "comment": "Malware payload", "value": "03885f41252e3c473faf78c1dba44bb4", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771490810, "uuid": "8cbef5bd-7e31-43eb-946e-22923df6b64c", "comment": "Malware payload", "value": "8666021b0299340d8211e09f256ee0d1634c21e37429e46f39d0ec006fc4f670", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771490810, "uuid": "00daefeb-4d0c-443a-9ac4-fb3a64ea11df", "comment": "Malware payload", "value": "4383a9846810b84ee415dfed24f1f95f06c997c9", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771490810, "uuid": "2c9f8402-6d4d-4970-a2ea-3de350f2fb44", "comment": "Malware payload", "value": "ab1aa1f1ac699bb751a6e861fa8efea7384843032739a9877203f127eb11aa4f392753ae132a233cd3e8a4ec16fa231f", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771490810, "uuid": "021b211a-d6e0-4e29-92d7-1ded9bcb3dde", "value": "T1459523981318D923C56A0BB85660F3745BB40EDE6962D317BFCEFCDB7BA93A010D1285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771490810, "uuid": "1968d2ac-93a7-4f5e-bda5-47e141df99ec", "value": "49152:aEnX/DkzLLA/1dnRThDiCtDdu8XPONqF0Vtx6:aEnX/kkl5Dd3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771490810, "uuid": "6490772e-3c74-43be-a0b3-c28d19679704", "value": 1994752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771490810, "uuid": "6308f296-bdd2-48bc-af32-887673045067", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771490810, "uuid": "31c6b93c-7fed-44c2-a888-5ff04319e512", "value": "WhatsApp_k\u00e9p_2026-02-19.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ccdbfd-0db0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771518619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518619, "uuid": "34be82ea-a09d-400e-873e-a01afb541acb", "comment": "Malware payload", "value": "2da7ffde2967c79087e696a461a8de06", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518619, "uuid": "1cabbf57-601d-49bc-8619-cd94f85e694c", "comment": "Malware payload", "value": "86c9fa7966058bd74f4507ea9cf7ed0640ac83e47962c4d3ac1458dbeb322b82", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518619, "uuid": "8dfaf616-cf50-474b-8ca5-9ad2695c423d", "comment": "Malware payload", "value": "056aca943ed8c7908be6d263a11259ca1acd3718", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518619, "uuid": "2f394c68-6304-4152-a38c-1cd1049536d3", "comment": "Malware payload", "value": "ed2e145ee9ff250b543f8930bd033a9d1459e1bea0fb90c04471254e5771c436f0513ff52b1df0e1a25ee8413314c0f9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771518619, "uuid": "bc6d6309-e951-43e5-99cf-6d81a383cd53", "value": "T19871D6F17D1F43A1812A9B567E06C88DAE3A3865E081044D469DC46108AEDE3C6AED9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771518619, "uuid": "ab6f9ad7-e704-43f3-a4ff-7e0a4d6e8d05", "value": "48:bLs9FopKEtqjps94FK39eGcPStHxRQoS/V55J8YY1lcfiKqELUbRlxK9E:bLV5ms9D0DPSt1y55J8/QUbR2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771518619, "uuid": "2c35bef0-c3dd-4651-a0e1-84fa7e68f4fa", "value": 3808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771518619, "uuid": "05e5119b-194e-4fc6-8a0d-cd5d02335935", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771518619, "uuid": "cfc2e32e-7034-4fb2-82f5-a788e0ea03b5", "value": "rBOQSupplyComme.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad90989b-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771484860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484860, "uuid": "940bfff9-c8ab-48e7-98ad-bfad0d50410d", "comment": "Malware payload (AsyncRAT)", "value": "fb34247c424711893ab8897222f11770", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484860, "uuid": "a2e36fb6-d997-4445-8adc-201727c06e80", "comment": "Malware payload (AsyncRAT)", "value": "896742f42a04bbb043d94432df7bb8f01cf278116c27d01a753db4495ee5532c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484860, "uuid": "f47d6a52-faca-4a11-87f5-601249686eca", "comment": "Malware payload (AsyncRAT)", "value": "9ba1edbfd26728af6338f65b9b13d58ac6958e4c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484860, "uuid": "28610110-dfe5-42f5-8ead-b56ccc8c3693", "comment": "Malware payload (AsyncRAT)", "value": "7bc55758ce571f6feabe79a260799f03f3f459ba6f023223b52c6ba4f7ad60887ff7dc713e3c91781c11c8853312c5f8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484860, "uuid": "3d597fd5-99e9-42f3-8525-1b3965d9a915", "value": "T1BB76127DB07C5C40E7D694569286B0EC8E6C1996F32B0AABF470C3DEC661ECCE16E851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484860, "uuid": "ce4a8788-acaf-4c53-b989-486dbf4ab4d8", "value": "768:jZbTzJm5bjT8tVTU3VT9z1CmNdSfcv1h3vWHP9uCoY8ZaV+vS6pZjQslNzdxHQSP:jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484860, "uuid": "eb4c4e75-66e8-4fb4-b790-93ce0425f435", "value": 7652020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484860, "uuid": "796447f4-f13f-469e-aec1-313feedc07e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484860, "uuid": "d80faab2-9a64-46dd-a3cb-935687c6fcaf", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c7c647-0d35-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771465863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465863, "uuid": "ffd1c686-e1e0-4447-86d4-fea3e2f5e4f5", "comment": "Malware payload (Mirai)", "value": "faecef4748ad176736c1da6979a1db3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465863, "uuid": "f905553f-a844-4dc2-8c47-ee27db4adce3", "comment": "Malware payload (Mirai)", "value": "8a669e6c2680886177f083ca7a3a7814199ba318d4861fe44014ab81838ab605", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465863, "uuid": "70c14f6c-c027-4eec-b613-f8c472793d80", "comment": "Malware payload (Mirai)", "value": "8d84c702e8edcb62176bd4bc6842cba1615ee968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771465863, "uuid": "c9d7dbb5-df5b-4a08-803b-8e83bf998fef", "comment": "Malware payload (Mirai)", "value": "5d5e47a62d8f844355178423271f184b309cab474b7c16bd6c023689231889bfacc6b869fda3e4058b4529944211119b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771465863, "uuid": "fe949b35-7842-4bc3-a5b9-1212ea50e8d8", "value": "T117039E53C93A2D94C63985B4F8219B7E2B53E949A5936FD6D826C274C003F9CFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771465863, "uuid": "7847496a-5dce-4a9f-843d-2ad5d0fb9ca0", "value": "768:iTUc2eBs3+EuYG6TKjj53iGf/AER9AKblZ3ay3VJ5egoS6VnYUvC5YMy3:4D3BsOEw5JLRQS2rCje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771465863, "uuid": "e27a4254-97b2-4daa-81cc-86bb8dfddef1", "value": 39908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771465863, "uuid": "9ee20876-b962-4e99-bf70-240356deea94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771465863, "uuid": "02d3dfbd-0301-434a-9a2d-49ee6e4789a9", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938948af-0d80-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771498130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498130, "uuid": "1667eaf1-1ba7-4e2f-9211-27335854f460", "comment": "Malware payload (DonutLoader)", "value": "2ab73f923615240df6584c525d9ed8fe", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498130, "uuid": "f3f385fc-5dde-4688-be88-64e6c10fe766", "comment": "Malware payload (DonutLoader)", "value": "8b7251a0a5c170b55af5c68107fded3c46ae02ba8d45ee16dfff0a7fa5a57fa1", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498130, "uuid": "4a61e289-b745-4b71-ba33-62b3033da2eb", "comment": "Malware payload (DonutLoader)", "value": "41f938e11d350b254f95433638f89f9ca09c8cda", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498130, "uuid": "014c08ba-37be-46df-8280-f942fa1a7360", "comment": "Malware payload (DonutLoader)", "value": "8fca1ee352ab250554c0b6b0ed14014d4db5f4fce504305d45ed3bc427a3474c276b21a8aabfce61c2564f438a72ac5c", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498130, "uuid": "14b75cef-b2d5-40c8-be82-d8f452d8224c", "value": "T1AF21A7A9500F2765C41423B046E3080E75F3A99B6BB7C387AAD710F2F4CA564451D717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498130, "uuid": "627a0451-06d0-4031-bf65-4907e62f016b", "value": "24:91PWVbU+kS+zpbnMpri8CreFFe53wd5QZRZubPZrJzwKZYm75tl:9RkAwgMe53CSP6Rvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771498130, "uuid": "d77839ea-f8e2-46ab-af81-a58e3e288f14", "value": 1226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771498130, "uuid": "8168aa75-48ac-4b67-abc4-1a0c433c761c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498130, "uuid": "e399774c-b545-4a06-b709-ac24d4b89e0c", "value": "PROJECT_DRAWING_PLAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e93111b-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771512295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512295, "uuid": "49df33d0-0988-44d2-9f12-256ba28b70c1", "comment": "Malware payload (Formbook)", "value": "9ddd0f781a7c3e4620eb2c9846a303ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512295, "uuid": "65d27b5c-1491-4c87-8985-68241adff57e", "comment": "Malware payload (Formbook)", "value": "8c440039311d8f01c2a626dbb4f55bff11042f2f610306771d367b36adaa1b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512295, "uuid": "1da6459c-7dea-4db4-90d6-7e1bb5ea67c2", "comment": "Malware payload (Formbook)", "value": "b8b1444ffb91963e527fddee6e57ff81131b49a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512295, "uuid": "43b9bc28-5c2a-487e-9f38-121d95e4ff14", "comment": "Malware payload (Formbook)", "value": "0b4070fad60a67d81be12d6cf4f47f68e6964871ff90aea20f0009e069c540ec3ac78a01c4ddd8701b57b30cc089f3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512295, "uuid": "d81c369f-d10a-4889-b81e-217047417256", "value": "T1ED152280A6D4D4D6EB0506B664339AFA6F465D3849A0D54B37F83F2B38B7383583B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512295, "uuid": "7fdb2149-cffe-468a-8348-a889db41d5c0", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512295, "uuid": "0c6d5fee-0cfd-4ee7-84f5-f71ae4e3853c", "value": "24576:dadWcJwBvFlf21m1Lqw3Gpw9vCkAFmQS7SLBj2faqN0:AWcJwt1Lqw3gwgk0TSWLBafG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512295, "uuid": "f56b3e9a-bd92-46c2-acbf-06308c21d21d", "value": 897590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512295, "uuid": "fd412af6-d51e-4d75-90f2-561af9af78e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512295, "uuid": "c399e8bf-d461-4fe9-8162-fa2aa690be21", "value": "Scan117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bb6068-0da6-11f1-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1771514582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514582, "uuid": "dad46a7e-23d2-4eb1-9551-d618204b782d", "comment": "Malware payload (DattoRMM)", "value": "e0c8b8448d94af254126b4542ea7c092", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514582, "uuid": "a99b4f99-b57d-4c23-9732-b29880ff0e86", "comment": "Malware payload (DattoRMM)", "value": "8e14f19b98f33f3c87de11125898310f565de86782bf82f073514be6e1ce56c9", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514582, "uuid": "f46ef13a-6f74-45cf-9fb8-08a7fafc67ba", "comment": "Malware payload (DattoRMM)", "value": "57c82ac843ec0d6390a8d87b6824c3079a7295fe", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514582, "uuid": "27bd12a2-b69c-4f17-bcd2-9fe6cbd97482", "comment": "Malware payload (DattoRMM)", "value": "b1a07ba0170f02a7003f8f5018db875d96c3feedec80c5e3b7138b0d649b38480f011530abc7c96583798cc00e4d2158", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514582, "uuid": "1df76ad8-361a-4053-b5d1-22aa88e9670a", "value": "T10AB63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514582, "uuid": "712888da-625e-4f26-a07f-3a2d66814eac", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514582, "uuid": "cfb7e5dd-7f25-4be4-823b-78fffc7e2f12", "value": "196608:EaZk+wfP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:2nOmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771514582, "uuid": "d35c619a-523d-4141-afbd-798abf7611b9", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771514582, "uuid": "389d260b-bee0-42c8-95e4-70e0eb6b6c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514582, "uuid": "51efa6ba-0d38-49e6-b4e6-88f5d77e0de0", "value": "play_Rec-Now.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ff8241-0dc9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771529353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529353, "uuid": "4843c69c-7911-469e-90c3-ffe2182bf2b8", "comment": "Malware payload (Mirai)", "value": "7af8fdf960590d05466232a1445624b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529353, "uuid": "0fb85a4b-5f51-4646-b07c-e99404c8df1a", "comment": "Malware payload (Mirai)", "value": "8e508cf8346d3cba5406802aaae5b73a368f976f7888aef45535bed62fc769aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529353, "uuid": "106337a7-1005-4bbc-98c9-bfe148479aa1", "comment": "Malware payload (Mirai)", "value": "05f58b2b64b688c4d0f31b97c1335bca052af741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529353, "uuid": "2321d73d-d988-4c5d-b0d7-2e67b6907883", "comment": "Malware payload (Mirai)", "value": "28df8ee2b6bc3993b19b9faacf547abc0917ea761f7c06fc04703a1051089f5d2048224401712b35aebbdf89449b3c19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529353, "uuid": "aefaa897-31c5-47d8-a43f-e082b6e59594", "value": "T155E3F946F8819B12D5D111BEFE1E128E33231B78E2DF72129D246F64778A9BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529353, "uuid": "7bb6b7d6-c6af-44b8-9ddd-5778fa112b02", "value": "3072:HjxHwLUhXM97XM/X74baR8uiJKrdCtbY:HjVwLKq7XqX7Wa5TdCtbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529353, "uuid": "b942c464-ddc2-4907-ab8b-aae13fc14272", "value": 147388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529353, "uuid": "c75e516f-95ff-4bec-a18f-d5cb67016992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529353, "uuid": "4f50bd2d-2ca6-46e6-8536-dd323f1dc3a2", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619722d3-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481726, "uuid": "ae56d1e6-9d00-41d7-83d6-18e2189b4018", "comment": "Malware payload (Mirai)", "value": "48cbbdbb1d6ea42748ce5f3226e4769b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481726, "uuid": "e214dde8-27a0-4afa-a8bd-04e189558a9c", "comment": "Malware payload (Mirai)", "value": "8fb663eb8f22939bc3ace17f429228e872e764c48214e14f83ed7f454c522a45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481726, "uuid": "a122b625-1de3-4345-9ce5-8756090057f5", "comment": "Malware payload (Mirai)", "value": "598995add16af0d2c75bfa59a3471aafb3bbca46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481726, "uuid": "bc3e5c65-06ff-4d3a-bdbb-eb277abe8caa", "comment": "Malware payload (Mirai)", "value": "31ee05bbea4aa0bdb8424fab7a00405f392a8682d5a71273d8868594c1b7e8fdd006ba7b037f6bd3f2e0f5817fed4610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481726, "uuid": "26b2182d-1e02-4a78-9cea-96edaea2298f", "value": "T125C36B82EAA2D0F0E68701B01557F3E68931E6305426CDD6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481726, "uuid": "b8bda057-a746-4a91-b900-2b1862596674", "value": "1536:sXQeueF+9EPFdkQv9c9ksgFUMte4MALN5QoT5jzVXDEbrQweyGaEgpkzSIBKcpx8:yQcFMENqQVckSSjMdoTjXDErOyPp3S+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481726, "uuid": "c096fe1b-422b-451d-9ad7-184ba31fa76e", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481726, "uuid": "922ad112-1046-4474-bcdb-9a32d8f32b99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481726, "uuid": "d59bcf95-0f03-45b2-a965-e773c1e6f799", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54571a83-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493300, "uuid": "0912e94c-6c75-4b58-b149-edf35652e99e", "comment": "Malware payload (Formbook)", "value": "867554b178a52b3eed78feecc233b722", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493300, "uuid": "3374e536-2cdf-4563-abc0-92d9d8a72680", "comment": "Malware payload (Formbook)", "value": "8fef58139d9a80fcfac40106e85eb08c1a5b632b8b5b40b94402ba88b8e30e28", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493300, "uuid": "00f9df1c-98a9-47be-b561-e12ca3804363", "comment": "Malware payload (Formbook)", "value": "9fea9304e099858cd057d22ff6572feef9c848a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493300, "uuid": "d1d0e78f-9471-43aa-94b8-ce8cc98cdeeb", "comment": "Malware payload (Formbook)", "value": "c1133a1a11fd4601ad273805bf38cfe6f72dc57df044b8f8e30b93c400f4b4424559643d590f5203e670d52075227958", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493300, "uuid": "6703b0e5-ba91-45d5-a986-2664a61dac13", "value": "T11795C01597C837A0D00C79A9D1BF365A1A20A5CAF0F2BB047B95FF68EF36348954BD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493300, "uuid": "4eb87cdf-8050-419e-8b09-b253a2c9ed2d", "value": "24576:3pNEs4EPzDfQT6/jWUrsw5i9PoHS0j9OTn/R3wdS8h7lYbNi9AIPZP+iG:3vQAHsXAHrj9Qws8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493300, "uuid": "df73fc33-0023-47d0-8501-09a8751ae0c9", "value": 2045183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493300, "uuid": "9df87fab-3a04-405c-b851-572d3b236f73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493300, "uuid": "c3f6250c-7bf8-4119-b14b-3a7e6e62c7a0", "value": "Proof of Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f87333c-0db6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771521182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521182, "uuid": "d1e4a0cf-2873-4ee1-8714-af5447716cde", "comment": "Malware payload", "value": "67c645894d6bddfe5efd015f99ca89d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521182, "uuid": "8c53302c-4afd-4868-8e1c-eb5dd8156a48", "comment": "Malware payload", "value": "90b833f7bd936136e2c49f592ae0f6b237bb71dff760bc05516fb0f7c1f9ba38", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521182, "uuid": "122f861b-86a6-4df8-b5eb-0178dc9b1795", "comment": "Malware payload", "value": "25ad538e887a07e074d02ea800ce45bcfe61bb22", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771521182, "uuid": "dcf19c25-c499-4afd-9935-2e390b7c6fb6", "comment": "Malware payload", "value": "b3627d1303a934011d6c53762c5ef1e22202c2da0740194fea8a9ca1f663ad364a1bbcd3c2ca33875ba335abbff37ed2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521182, "uuid": "7ff51e26-b3f1-4643-82bd-702cc4972295", "value": "T1042508C1E3365AE42DC0C08601BDF9DCFDA5588AEB4A62DCAD12F4DEE05ED9E25D4930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521182, "uuid": "45cb3c21-34ff-463f-8cb7-220ef4f82090", "value": "384:R+rl8ttoSHBICCZ9Kb7QGBryAdiGLf/6wxXL:lXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771521182, "uuid": "476573fe-83b4-4cad-9426-68694cff3bbb", "value": 1044003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771521182, "uuid": "e147b987-5ca4-4ac2-a80c-982424538b08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771521182, "uuid": "a65f7aaa-85be-4087-8fe3-e9c4f5e6f2d0", "value": "Confirmation of funds transfer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104cc36d-0d2e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771462691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462691, "uuid": "16b49946-c6a2-45cc-bf26-f032d0ac527d", "comment": "Malware payload (Mirai)", "value": "5727afd752c2ceaa752382523089dd36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462691, "uuid": "02c1558b-799e-4772-8985-afa5f5742cfa", "comment": "Malware payload (Mirai)", "value": "917f193eace691f1778957bf937bc4252a18f8e2b9a9ddd72399bc689fa786f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462691, "uuid": "266eaf76-e139-4519-8f57-eab0ff0608b4", "comment": "Malware payload (Mirai)", "value": "9ba911a5416011066be38fe471bdb5b3795b9d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462691, "uuid": "3e9b7955-567d-47ee-9a9c-9cea314d400e", "comment": "Malware payload (Mirai)", "value": "14ddc27cff60af13b82780ad77b49b49471bd4b10add10411b15f6c3b25b96d899f31113e8e004911957a13526cf16a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462691, "uuid": "0d91f45e-fd80-4f81-89bd-0a918ad11e0c", "value": "T1F6133A92B401AD7DF85EE73EC0930A09F131A79511821A3763A3FD776C322A85D76E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462691, "uuid": "6503d49d-58a1-47d2-85ec-8873614d8168", "value": "768:0xqFTD4t0MoBjFEWEw0Cmk+3oC6WluD811JtTRHGtHwl5bsW71:COaWV+WLHVs6WkD811bRHGtwlXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771462691, "uuid": "97830748-3aa1-4165-991b-bac67e552ae5", "value": 45516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771462691, "uuid": "fef16f65-0613-4b16-bcd4-804af5106a99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462691, "uuid": "03ece462-a35a-4e6d-b4b5-3d4a472927c0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820a93a0-0db0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771518717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518717, "uuid": "bc5187af-02a5-4889-8902-0b8f890b837d", "comment": "Malware payload", "value": "9a4f29e28c0adc5243cc16a6de128db8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518717, "uuid": "907d858d-217d-4a6f-b3c6-036e9663327f", "comment": "Malware payload", "value": "91f73df83738ba273840a0378f9d2b9e196c2ac41f1d2f66bf653a33297e1334", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518717, "uuid": "12b31e52-016f-4937-8264-8bd86a2f2e31", "comment": "Malware payload", "value": "1a310b935abb19dab281f992cf534200889de94e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771518717, "uuid": "3fae5ac4-655e-425f-91f2-1643ca86161d", "comment": "Malware payload", "value": "1a7ff09dffe70be136cf8d1e65c5cd879013cf5a9ca0c24dc3e7b517971a86385c5a512bcd4a648b58d01ca63c6f391a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771518717, "uuid": "af4e5a71-8cb4-4aa2-89a5-61de068435ec", "value": "T1AF41632D9531EDA80BCF79E4586B780515B97F1356606F10FB8C1CEAAB40290FB2664C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771518717, "uuid": "ec614284-7a44-4968-a67b-393612cb30ee", "value": "48:Suqz97pn7HVC1Im4AolihpPnNp0ExBgP3BB3e2IXWlt+MNu:SD17HV4ImFgijPnBgPxBOBaxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771518717, "uuid": "7f408a85-2f08-4250-90c8-662eca66d57d", "value": 1968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771518717, "uuid": "50cc113f-2c96-40d5-a96d-6960edee4682", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771518717, "uuid": "01c124f1-7342-4ae2-b303-bbd1c020ef25", "value": "allegato.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3dc92e-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512187, "uuid": "aa6165bb-3621-4929-8ca0-76d4dfc92e3a", "comment": "Malware payload (GCleaner)", "value": "e55420605d7fd3b00f17bbfaed8f73c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512187, "uuid": "b1c9f9da-f7e8-4af8-b07a-d6a5bfc7dd93", "comment": "Malware payload (GCleaner)", "value": "92ecceb3cc69a7118279d2595114dac0c4915235320042add23f28e51e214480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512187, "uuid": "0be98094-b74c-4f31-88a5-a34787050951", "comment": "Malware payload (GCleaner)", "value": "4249af119d052a06bf0dfdb65fa226ec51908b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512187, "uuid": "518bed0a-2a5c-42ae-96d2-fa1025cf45f4", "comment": "Malware payload (GCleaner)", "value": "f245767c6e09f533625d6a5f7584f281bfaae60a512f36038b584eaea1c18098fafee0f1d477497702ba5aa17fe27cbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512187, "uuid": "6f7bd81b-9952-464e-8910-bd5b68ae2d2e", "value": "T171E48F21E7D0B737E1625EF89C5B62AD9425FE812938744E2BEC1DCC9FE93813426253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512187, "uuid": "4ffe0e62-cd71-4570-a558-0a727366642a", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512187, "uuid": "fed5b210-48ec-4b39-9edd-519cdfce3123", "value": "12288:bQ8mJu5T0Ns+MD77lUjVM+okTwjGFzVTWcNlwFwO:sJFNhu7lKtoks8zVLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512187, "uuid": "63689318-3baf-4b8c-b0e5-7383a19a54d8", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512187, "uuid": "b98ec87f-ec98-467c-8bae-50a8853be0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512187, "uuid": "afea9cd9-cae0-4d32-94fa-22a0b129edbd", "value": "e55420605d7fd3b00f17bbfaed8f73c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881b82a3-0d2e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771462892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462892, "uuid": "8725e8a6-1344-4902-ab7f-23bd0f4f153a", "comment": "Malware payload (Mirai)", "value": "a2d6f924258ed138434c4720e09ad545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462892, "uuid": "60d6a6e2-bda1-4454-a897-667f583ada02", "comment": "Malware payload (Mirai)", "value": "9393ddf5ecb9939dd3ce2ce99372f374fd65b7a6ed4bd4d844e922a507b2866e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462892, "uuid": "600426d0-376b-4cd3-90af-c2555036bbc6", "comment": "Malware payload (Mirai)", "value": "29536874f82ae5feb76172b2d7cf208514af81f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462892, "uuid": "01fed9bc-4139-4777-a37a-92df2731a460", "comment": "Malware payload (Mirai)", "value": "b863d721a24e2c8068c345560103b5e602e616412df96e08b514a1b3c56517faeb4f2c0652775f747277ae9bb821d9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462892, "uuid": "98d42999-9f27-4c03-9f35-eb389abca8ff", "value": "T125B35B17F4C194FDC8DAD2748BDFA216E972F06A2229B25E27D05F263E5EE201B1D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462892, "uuid": "67a5648d-3a1f-434a-9fbb-a712527fbf63", "value": "3072:DjuZiQepkkJS5tQhRp+A4OMN4ORKiFl3cNLNkDkFnGm4VHsOgdXEJXJ:OZiQejbhn+A4OMN4ORKiLsHkDkFl7dX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771462892, "uuid": "7e7ff287-9e70-44f9-ad57-01f081cf19bb", "value": 109096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771462892, "uuid": "a5f11f86-15a5-4f16-ac0c-bd1e2acfc479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462892, "uuid": "578532fa-8d57-46b6-9d42-42341aeb5d04", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5720387-0d37-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771466807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466807, "uuid": "96dbfc34-5677-4978-a36d-58f658b8cc20", "comment": "Malware payload (ValleyRAT)", "value": "67b19626e57f79daafde2769d52b6395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466807, "uuid": "a7f763ee-f6e3-4cf0-9c86-fd31d33e6d9b", "comment": "Malware payload (ValleyRAT)", "value": "93dc23aac6771621ff743b5c17e3550532df31dcc576b06090fe1a3342060910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466807, "uuid": "06a842fb-f5a3-4b9a-9fb9-84354301918a", "comment": "Malware payload (ValleyRAT)", "value": "71c76356eba3baf5166c8cf5cc3093ffa202ac2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466807, "uuid": "7c654e03-dd22-427d-b4ae-634460fbeb31", "comment": "Malware payload (ValleyRAT)", "value": "586fc35c34b6a994b65138f42f37da9043844ea669b99aa2c3fdfdc5a21a9a045308f711eb52976a71a4732c82015d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466807, "uuid": "4bfbd972-78eb-470c-aefe-292d59a8334b", "value": "T153283351AE020443E556ACF4EE9B8931C296596EEB2C0707D521BC2FF3FD30A6A8F517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466807, "uuid": "b3355498-1bff-486e-8f4e-0e194ad30103", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466807, "uuid": "3623f314-b496-464f-817f-d10496affe83", "value": "1572864:XUwReIy6GxteMYZJ79sae9eBO0bJJ6fC5g6JS6MhfcTjvG1XFOvsOktCDQdHW:khK4tkPZFeWBJJ1BShUTmLOPDs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771466807, "uuid": "d3517804-04ec-46b9-acd5-b7983f884bea", "value": 93788269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771466807, "uuid": "b501aa5f-7753-4377-9cfc-556ec86b581d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466807, "uuid": "e862ee5b-0758-4121-a433-0cb74b5f398c", "value": "clash0.20.39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c9b41e-0d97-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771507987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507987, "uuid": "984f3207-041c-4468-af77-f4a25a0f563f", "comment": "Malware payload", "value": "c7a796090f861078921ece931e014368", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507987, "uuid": "9099732c-487a-49ab-86ab-fd0746b2d392", "comment": "Malware payload", "value": "94b6a8c5a5a9569b073f56ccaf56bded9dd3f00ce619369142ce16a492f9ac9e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507987, "uuid": "86623ff0-c03f-4ae7-8369-4b54e43feb23", "comment": "Malware payload", "value": "cf884fc59242b046723b8cc966bf716d80392b9c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507987, "uuid": "d7ed9be2-763c-4164-887e-df56decc59a6", "comment": "Malware payload", "value": "ab42e3e59c12c3e133d78ccfb10acc30dd093f45ae4e5e2aee6edbe598767eaa69cb8366adae46e8139231be7c65d92d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771507987, "uuid": "3f63d0f6-d2ce-4d1b-bcd7-4d51c75fefd8", "value": "T191762343FBC84839FCF783358B7A562661164C97C3539287A854763D68B7AC08BC6BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771507987, "uuid": "ffd4c3fc-9c5d-4fe2-b05a-3195e1606234", "value": "196608:rHpyqusSefCylu4Jx0HloVDy564BrSXaqRz:rJyqhfflXwaDy56GSX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771507987, "uuid": "88fee7b3-38cb-49e7-aaf1-48fc1ecace09", "value": 7573236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771507987, "uuid": "2c4b30f1-2a50-4a08-a00e-718c17b47956", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771507987, "uuid": "c8479ffe-1d5a-4fc4-9e9f-f2468dc3c2fa", "value": "94b6a8c5a5a9569b073f56ccaf56bded9dd3f00ce619369142ce16a492f9ac9e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28de99d-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771483150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483150, "uuid": "bfb7cf5d-31dd-49fa-ab4d-c6abf7055225", "comment": "Malware payload (Mirai)", "value": "7be76bd83605a0e59fd17c43fbe3a63d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483150, "uuid": "c8e8b261-384d-4a0e-b43c-456f3569b844", "comment": "Malware payload (Mirai)", "value": "94bc1f19bef7fad473aa0324c6fad470554bcdd1dd54b67b6315cec73dd08cfb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483150, "uuid": "34d1881d-1076-4aef-a717-457aaf9a2007", "comment": "Malware payload (Mirai)", "value": "62d1f8226a83eb7cf0e7195a2214e1fb117d6675", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483150, "uuid": "88a9d5f9-15b9-4d41-b541-a2ddcdcf168d", "comment": "Malware payload (Mirai)", "value": "0a1656ce611e794e758bbfe46f4dfb56341519abba0ba5c51a362ae957d2aba532b28fb4f87466ef3c55f9c35543d8bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483150, "uuid": "32f680c4-3d65-44e7-be2b-de33aec6fb94", "value": "T17021E28396227D793CC9415DA6AB405A6046432F056B7FA874969D772F0C540F174BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483150, "uuid": "62106f74-508a-44c7-a75e-f050b7428dee", "value": "24:VUeYj+H1IDMK9CFdYhEnHQBYdm+oWdkWRIXaMY29I5RwARi93ADQZaZl1cSRs/:VUeYj+H1IDMK9CnYhEvR2WRIqMNmwuiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771483150, "uuid": "e3c22d5f-1224-4324-9500-aa06f265a433", "value": 1247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771483150, "uuid": "3019f573-fc8f-4ec6-8cb4-21dd8a042b3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483150, "uuid": "ca83dd31-bd02-4012-b5c3-f2b1a678a417", "value": "check1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afe9ee1-0dd1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532690, "uuid": "90d1ac44-0683-463d-b5a8-7fc2c172b741", "comment": "Malware payload (Mirai)", "value": "7b7d5557bf5fd3f6577d669c9d1a8841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532690, "uuid": "afb7de0d-206c-4ea1-8c0e-80487d19dc57", "comment": "Malware payload (Mirai)", "value": "94d820d4a2ce0f04ff0c27d318020629a255b7b8fb79697a785c3b65a4173f8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532690, "uuid": "05ae4df6-9034-4a1d-8148-dc4a65a916c6", "comment": "Malware payload (Mirai)", "value": "dd9b09ce7223e3d47fb6a875091bf1814b67a05d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532690, "uuid": "1f0584d7-6413-46c0-bc16-6b470a491bfa", "comment": "Malware payload (Mirai)", "value": "0fc54f987c7de8478eff368e68418f45c224600b64c210b42d0c836f555a6be396fed86e983079578a3a36f007cdaa4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532690, "uuid": "a86af65f-1501-48a9-b6b9-efd85d40b256", "value": "T14103F1BE161226FEDA3060F416AA07520E350FBB96037D86BE49D8DBDB054BD385B2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532690, "uuid": "f3f4ea04-366d-41db-aa8d-dfa53d670787", "value": "768:WcsS6Wpmd6VVnYDifnNtPEpqYcdGMpUpRM/xsJgGlzDpuWG:WjS60md6nYmPNGqrMHptVEWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532690, "uuid": "497c9fda-57e5-4015-8dbe-c52455605cd1", "value": 38384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532690, "uuid": "87302bbe-d18a-444e-ae92-19549ae142d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532690, "uuid": "1081e16b-1912-4df5-bfcf-3c3feaeccdff", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b63859f-0dc4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771527108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527108, "uuid": "01a069ea-2592-458e-8ead-341e743a309b", "comment": "Malware payload", "value": "8479c27a222ecda1518001d67938f4e6", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527108, "uuid": "c64d1e48-a894-4e14-b98b-c9fd3f0be646", "comment": "Malware payload", "value": "967de4942865d63591bd38a68962db60ba9b597b12eca395c373c3709cc4ade1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527108, "uuid": "cebe7b4d-bcf9-42cb-ac5a-ca77a10b31b2", "comment": "Malware payload", "value": "7ee0ce430cb3018d52e25582a9453275676ed643", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527108, "uuid": "d24740f3-bc70-4bfd-a28c-a07ba56ffa6a", "comment": "Malware payload", "value": "dafc7516385b7c32667619b4a5b084441b1a91fdc271b5f71b2c9b427a6b448afde758fab84148a933cfeac2d2b24910", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527108, "uuid": "c54ffac0-eb32-4023-a4a5-0cc65257bf23", "value": "T11D53AF64081DA4B442152C783194BBA73B50F2DFD9CD7F0794932EF46F8598A8789FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527108, "uuid": "aa200a66-f4b5-4e2d-b968-39995c655df2", "value": "1536:GDxn6/yMzOOOOOOPiiiOxHxHWmeeeeeeeeeLRKRKRKRKRKRKRmx1nnnnpQ4f4f4J:GDxn6aMJiiiOR23RKRKRKRKRKRKReTQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771527108, "uuid": "2dfd60f6-c2e3-48fc-8f36-36d965d215bb", "value": 63534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771527108, "uuid": "803f0e04-11d3-43db-87a2-82072c18aa4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527108, "uuid": "2bfff7e0-732e-46d2-bd3f-4d8d322afb19", "value": "\u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0430_1_17_9_1300_18.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af0ba27-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512316, "uuid": "a6d3318d-b4c7-40b7-beea-92b5264b7fe1", "comment": "Malware payload", "value": "4257336fc7382036b7354564a7c2e73f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512316, "uuid": "59c1c57a-a4c6-497c-9133-fb840721ee24", "comment": "Malware payload", "value": "9843f5987f4cc3ecb4dc341853be6549567da44e273162a36841020464cd9258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512316, "uuid": "af815b4d-6079-4890-984a-6b9144447a25", "comment": "Malware payload", "value": "ec3dfe9afc7869230012718881a3af79f3a00ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512316, "uuid": "01e010d0-f501-4b56-a3f7-6fdae42fc9d3", "comment": "Malware payload", "value": "9bf1ad88a5547e172c4e379524e8e0de6efebf6a1fc3558f62efcb0d91a08ab781ec16f71ba5b072ae77b7265adc4d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512316, "uuid": "5621575a-3644-4ed0-a6c5-f77716767375", "value": "T13765223026AECD53DAA91BFA0570E3342BB19E1E7512D3126ED96DEBBC937814C44723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512316, "uuid": "d285458a-62ca-4b3e-8776-f36657198652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512316, "uuid": "b7e27a48-823e-4cc2-aae1-a8e142f1438a", "value": "24576:/zHAguQBLQUJrSYmKjpjSlmU+M1SrlzeDjFuBdZ0G9xIRBwNzdNIVictIvw:/zHluYLQ4rXRkk3sSrhKJxqzdNIQcSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512316, "uuid": "429036e9-6453-4353-b7b5-6897bed3f520", "value": 1452032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512316, "uuid": "9df2874a-b51c-42e4-9427-ddf9f6cc0cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512316, "uuid": "d1472e8d-6b91-473c-99b0-b8b3b84044b1", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4272d85f-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771520758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520758, "uuid": "dad14304-43ea-4a29-96da-cedb68b7b1e3", "comment": "Malware payload", "value": "d03d4701d6f84977ac04e4d59969235f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520758, "uuid": "e04ea037-7f15-46dd-9182-00993bc4b238", "comment": "Malware payload", "value": "99153d397a39d5955c7e02d502b0b9a0abd98203f2dda34b4506d779ecd5547b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520758, "uuid": "fd46e6ae-ab67-452b-bb9e-ee8579a80626", "comment": "Malware payload", "value": "5cfb0558865992f205633481b5e0da543b7f6ffb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520758, "uuid": "bdb028bf-1e54-48f8-8173-753873317397", "comment": "Malware payload", "value": "a74790b30276ae634702d9b3b65c46d9e3a99fd9a587385ef6630dfc187c563ddd80f0e1985a856601ffacffd630076b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520758, "uuid": "33c134b9-6344-4844-90f4-593c0efae30e", "value": "T1ED4515EB1E97182485CCC690D986194345219EB4BA695D8FC8C085C6BD48EFDFEDF238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520758, "uuid": "fd82612d-36ba-4cda-a6cf-59d47c1619e1", "value": "384:veHnJ0H3DWD1jQnMaD4j3a+SDrIQ95nZJWS1IY/SZQibbO4/sm+d2Lj0cQD:o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520758, "uuid": "ffc827db-1759-4831-a978-a6a9665e6f2b", "value": 1223194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520758, "uuid": "9915b6c4-6e7f-45e7-94c5-9fba84388885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520758, "uuid": "81e0dcc5-5bcd-4113-9db2-1f93e4375cfe", "value": "SAS28455.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8ec908-0d5c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482608, "uuid": "0fc7270d-7f7c-4fb5-a9a0-9fb2be062d12", "comment": "Malware payload (Mirai)", "value": "86cf33f39d81a41b88d71659791fa5b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482608, "uuid": "5acb6fed-8895-4907-9e57-d6bcbffdfd79", "comment": "Malware payload (Mirai)", "value": "9921100fc03f2e3bfe52266d43003e520c3d141823220c60bc137f4500da51f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482608, "uuid": "57d33ab9-b026-4898-920a-3019b923d78d", "comment": "Malware payload (Mirai)", "value": "e1772858395bbcf09e0297c4a711335a90fa1d15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482608, "uuid": "fdd8d6b0-3439-4da5-9e57-74b9556643ca", "comment": "Malware payload (Mirai)", "value": "e72fc5e94174d6f07b2b64e7080c14ebb6ba401c336a2e977dc80e753876aeab7186bda1dd4c6f8dc6e53a969183b106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482608, "uuid": "44718d48-8009-4b7a-93b3-d86380474366", "value": "T197D3D032E0056CA0CC111AB838775A7C1344DEB806E55283EFBFE5AE647BD9479EDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482608, "uuid": "4aab3e8c-05ee-4a94-9634-2c027b52b00f", "value": "3072:ZUPvxhgOkU4Bj6QGZc7He7HMo2N7v9GBdqNO4gY3Z1:ZUPvxmLIciDMok8ngO4hp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482608, "uuid": "bfd34bc2-4096-4e38-80ac-565a5c2616d1", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482608, "uuid": "2808d5d4-3bea-4149-98b6-73fb118fe964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482608, "uuid": "dc74e5a3-8b9e-4dae-85c3-dc37cbaf11ad", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed605e7e-0da3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771513313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513313, "uuid": "35e272d4-45ab-4139-98ca-ea99ef778d09", "comment": "Malware payload", "value": "fb534550bfa5eb950e497529fc7f3191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513313, "uuid": "560d3392-eac1-403d-aa15-5e3ab1f8d23e", "comment": "Malware payload", "value": "9c754b738327c6c2a6da34689cd320de4c605a917d5e220381f740754c2e4607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513313, "uuid": "95817d11-4f64-498b-aefd-c1e4be5ee76e", "comment": "Malware payload", "value": "3a2d52ac991e4f24e88812bbc9786ab59a12eed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513313, "uuid": "b53ca03f-2fe6-4c73-913d-844640103a3a", "comment": "Malware payload", "value": "d687aa7de415b8e7800aec9525412b8538ec6fc412e9d55041c1cb6284b9d6f338aaebb9ad118e382bad376df247c11d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513313, "uuid": "ef2f0bb6-aba5-4803-833c-68fb522d30c5", "value": "T146E5E637E66A71D4D0BAC038E9866D1BF92070AA43307FD755914D960BA6FE0AB3D7C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513313, "uuid": "492edfc8-52af-431a-8c81-62bc103496e0", "value": "8454cfab442193a9424c86c29a48e816", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513313, "uuid": "32fdff33-34e8-42b9-a9be-ed0ec37649a5", "value": "49152:6vUnvlG9mhBHmmYp065NReVAtGydhpumdW:yOk571dhpBdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771513313, "uuid": "e9de3854-d7c6-4e43-89ec-56d627cff664", "value": 3121152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771513313, "uuid": "83b47f7b-d2d0-4c4c-9cbe-e698c3cbc429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513313, "uuid": "123e43fb-9679-4ff3-bd2c-2669db585c18", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c1ddd8-0d68-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771487608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487608, "uuid": "f3713500-e540-4a44-8a1d-ed77c9d3fad8", "comment": "Malware payload (Mirai)", "value": "86b48246188d6922b0dc4de3fd70ef8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487608, "uuid": "8c7d3c10-f745-45c0-adc2-fe227f681404", "comment": "Malware payload (Mirai)", "value": "9d19d39c7c4e72ca4d80c67823baa5d76a9acb70644f2dd5175694ebdfdf3983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487608, "uuid": "49894da8-409c-4098-906e-565461a8d128", "comment": "Malware payload (Mirai)", "value": "b4c21b486fd2888eb87e04692f458adda15e3a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487608, "uuid": "dc76441a-82b6-43f7-adc5-ae2339271550", "comment": "Malware payload (Mirai)", "value": "541617ea8c7d5c527babda7c55c5fbb15c6e8dddeabe97af81db6fc0e3af5a0c79f639d5720e01318d8f621bbec6ef32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771487608, "uuid": "1bfdd1fc-4c30-4bb4-83b6-488c77b55b19", "value": "T10BD30B45F8814B12D5C111BAFE1E124E37131BBCE2DE72129D246F647B8A9BF0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771487608, "uuid": "446a7b53-99f7-46e4-a85a-2fad5c3e118c", "value": "3072:6qexN6NdUHZD+iX9EZfdza8VHBZDM5iOuLr:TexNOd40iXiZfZaoA5iOuLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771487608, "uuid": "6b6c1965-208e-416a-9ab3-d3f1db500cf8", "value": 138544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771487608, "uuid": "0efec405-5d79-4711-90bb-e84ce1d6a83c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771487608, "uuid": "500148f4-a0e0-4561-856c-7859b60ccdea", "value": "odin.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c352ebf-0deb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771543994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543994, "uuid": "7560ffd1-3e9f-484a-a246-ff6fa16109d1", "comment": "Malware payload", "value": "281cf547456d2ae8766450c6fe7ecc62", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543994, "uuid": "c6ea3bb3-10b9-4b6d-9e6d-258ae374eef3", "comment": "Malware payload", "value": "9e0e6fbe349153df46e7f5704ce08e5a22ee52cf6aba99697d5b11413f142ffc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543994, "uuid": "f82faee5-8d7f-4a64-908d-b14409e9e37a", "comment": "Malware payload", "value": "8e2fa5ce009e274840fc9b91b26f45d0e4c87516", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771543994, "uuid": "15524620-c16e-4547-aad8-630b7236cba3", "comment": "Malware payload", "value": "a9d9d8c743002c6b1ffe73ec52198d2bc30b73fda781e3f10c051efba44913e871e9ae98af7cb0d28d9b42250c1f3ff2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543994, "uuid": "6096ecd2-7bc5-4a59-a044-da5a3b00932f", "value": "T119D423B1378A89EEE2265D3D06E2505B418CFC61DF9BEB4372C5730F38767A80664B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543994, "uuid": "d4817a2d-9969-4d41-90b1-1f5e1ab18a31", "value": "12288:uTpupDjb64Ptsi4oIj3f7kcxnLJMpmLUUO6:uFuJi4PfR47NMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771543994, "uuid": "f03d0eb9-025c-42b7-a1f9-1737b293f0ca", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771543994, "uuid": "6168e51c-7888-4135-944a-6e16d71c275d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771543994, "uuid": "387049c1-850d-4282-922e-5a37ba7b539e", "value": "SecuriteInfo.com.Trojan.GenericKD.79422209.22435.20742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2518f4-0dbc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771523732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523732, "uuid": "b2eabc2b-0fc9-499a-b0a4-3789f16eeb01", "comment": "Malware payload (Mirai)", "value": "3b368d0391b5d08a41045f1fa46e8fd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523732, "uuid": "f09cad78-b7db-4281-92b8-4732da55ff3e", "comment": "Malware payload (Mirai)", "value": "9e84d6dd666f2a8cf5071358d30c159925f85e1231e446cdb7818bd7ddff5ad2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523732, "uuid": "ab6f1232-af3e-4b18-bb38-f3845d754b28", "comment": "Malware payload (Mirai)", "value": "7a1caac7e0b14c7cc14da22338478f89f2a082f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771523732, "uuid": "32c8ee92-8395-474f-9cc0-4f9385d622cc", "comment": "Malware payload (Mirai)", "value": "ee5e3cbd6d379decb309e1929035e9ee05459ea98fa0c0376e6e2e482fcc05962e73bca508646258e6f85ce36fb0b481", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523732, "uuid": "456e618a-529a-4100-8883-13d4126b33c2", "value": "T16AF2D164C1E9AA81EEFE9CA20CD642C33F65DA85BC33CD5979449F02EA02053579EC9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523732, "uuid": "230c7b14-a6cc-44e2-b959-15115ee7fd63", "value": "768:UfnHNw10bcZpWKJo5A0k7gK6VoMAGP2b7PM84uVcqgw0X7JkmWx:UxwZpu5A0k7grVoBhb7PM84u+qgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771523732, "uuid": "2018ebf3-7e8c-401b-a1e2-c5df69578ec3", "value": 35808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771523732, "uuid": "027e6ea6-4f75-43e2-9457-6850948c1fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771523732, "uuid": "6a18809b-b575-43b0-9c14-639a75ef2564", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de097984-0dda-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771536910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771536910, "uuid": "a5595858-eb52-47d0-8ce7-1a7f65b6af06", "comment": "Malware payload", "value": "e736a1031dc276f4a11bae117af77a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771536910, "uuid": "b07c6d70-f765-4712-b275-7ad8395c5dba", "comment": "Malware payload", "value": "9ea0b342f8074e48a115a001ec4d04da500ae2c39824dd6c33f0d3375843b185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771536910, "uuid": "b9372995-c68e-4951-9859-3a8fee162e90", "comment": "Malware payload", "value": "f3e0f5c0952f2edf15421620375ca7ab4524261c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771536910, "uuid": "31f53073-c50d-4374-bf2c-4e9341b0cdc0", "comment": "Malware payload", "value": "3b48bdb24b45cb9564cae8b03a1e0bf39b5d1be3faf584382c8193371f9e5a9c0fdc38ca9f26b40dc35936cfeb98a9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771536910, "uuid": "2bf24345-9b97-4d42-82b5-8ffb7e0f5995", "value": "T1EE95AE0AF3942698D65BD931CA17AF3AC3B1B4520775A2CB2E94CB151EB3BD15F3A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771536910, "uuid": "d3764c4e-6852-4f92-ba63-c38d83e9f318", "value": "19a837f4bed1c05adc456aafe7eee905", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771536910, "uuid": "eb76daf8-edab-47ba-b6a5-46ca2146a736", "value": "24576:gXya+pSSDNNb7teFfnxywsfbWNBUJgXIv1V8P2ijBop3F8v:hHASDbgFfnxyws6AJUIv1Voop3F8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771536910, "uuid": "aa38088a-4321-4394-afc4-5b6b59369046", "value": 1998336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771536910, "uuid": "0d2a132e-96bf-4e61-acb9-80ee75f73de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771536910, "uuid": "44f7a3b8-b035-4985-8ab1-1e889dd5aa2f", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a66fd97-0d2f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771463191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463191, "uuid": "f7b79bd8-454c-4eba-a98d-e6d954ac4cdd", "comment": "Malware payload (Mirai)", "value": "2c3a7d3cadca18d5263d670ec0ae08b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463191, "uuid": "5d794d4c-14e8-47bc-b89b-97e5c15fc852", "comment": "Malware payload (Mirai)", "value": "a0e8e485da7f4bba21b8ea1db82b6b97a834825744cd331e346967ef75f44ffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463191, "uuid": "761c03b9-75af-470f-a86a-67befca6108b", "comment": "Malware payload (Mirai)", "value": "ff4b1465ea4548c663eb3bf7878a78d7db9612d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463191, "uuid": "eadad719-a5a2-4e7a-8939-ddf305ac5c3e", "comment": "Malware payload (Mirai)", "value": "dfc97eb383224d0fffab78e17626786396e30625a357da8b126acdb418228b8d58a4e0b3dab5b6151a66425e2a3ae607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463191, "uuid": "61654814-04c8-47d5-b6d3-ff29de4f1ff2", "value": "T18A2329035491C0FDC955C270AB3FA636C922F47E123AB59D73E0BE226E4AE311F5A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463191, "uuid": "99c970f1-abcb-4e6f-809e-579b8ec0fdf0", "value": "768:FkrR8ysZAY+OGZZRw4xSwPtKOoTvHjKRDACGyjltp4B6gC:6d8y2+OOJy7DckCGyp4B6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771463191, "uuid": "93bcfca3-fe1e-4ba9-9301-c973a2af3400", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771463191, "uuid": "0415e137-f77a-4fad-ad33-19006125b6b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463191, "uuid": "75a8a5bb-8a82-4e59-a105-d2483d3304bc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb72d75-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481669, "uuid": "1dd8e64c-be67-4ef7-b3b4-0b3878ca6c11", "comment": "Malware payload (Mirai)", "value": "e571696984d56bc72b4bd57d3aed8c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481669, "uuid": "e1ffe303-1816-4ff8-9a17-665c0e9226eb", "comment": "Malware payload (Mirai)", "value": "a1280e9fe508b74c312659a61c6b2421438c4311aa2daf5805dbf9b8ff418fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481669, "uuid": "d2e71ab9-5da7-4306-9b75-b31831469f98", "comment": "Malware payload (Mirai)", "value": "9b47d9d95978f018eca3d1783361bfd184251249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481669, "uuid": "73e42531-2873-47a5-ba65-4eb3080e46d0", "comment": "Malware payload (Mirai)", "value": "c2a1927d58aafd2c251040944aee229be9d322b9d4274fa7822e601bc33219283c8e9603e46f906d054ebf1bb3a6272b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481669, "uuid": "d7760050-29a0-456e-96c8-2305cd7155a0", "value": "T166530247224C8F4CDEF3C933354D1BE22569E274AF60825FAAD28FE44A56416DF2414B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481669, "uuid": "be805afb-a6f5-4170-bf6f-6320a805baa5", "value": "1536:ks2USrLN4kO8I7k0DarypiDTK56t/nVv06AQA:k3rLNBO86kUcyp2h0tQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481669, "uuid": "c1e876ca-4ce3-48a2-b540-36c799fe4a43", "value": 65552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481669, "uuid": "bf11ef6c-9ef0-4067-a582-bcbee0744590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481669, "uuid": "5c84477d-12a9-42ea-a270-a2e9540db892", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761a79fd-0dc5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771527716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527716, "uuid": "d53faf38-4be8-427b-924e-d0cacd1616cf", "comment": "Malware payload (Mirai)", "value": "c1a93f89c85beb7b8c3b66857552e4f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527716, "uuid": "74c4d9de-82f8-458d-8fc7-3cc3c43e47f6", "comment": "Malware payload (Mirai)", "value": "a362ed0bbc52ee4d2a8c23917f7fcb0c4e355a8343c77bbea98b16da41a460b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527716, "uuid": "7b630dc2-0bf5-424b-8d52-b79561643ebc", "comment": "Malware payload (Mirai)", "value": "f71c688bb53ba14de1d5e59f19b8ce73ca9ad9cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771527716, "uuid": "be306b70-2d6a-41c5-8d1c-2fd5f41171c1", "comment": "Malware payload (Mirai)", "value": "e67adfba586b22b2bc36af1a8065369e5d3e9a867403bb5f53409f0e693cab67700c2a95695dc693d9969306a17c3abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527716, "uuid": "a404856c-8ec7-495c-9ba1-54a05f8039eb", "value": "T1A304961E6F228F6EF668873447B74925A75C23DA27E1D644E1ACC1106F6038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527716, "uuid": "c0ec6fe7-286d-49f1-bfad-a1ddc6ef76a9", "value": "3072:T3RrmXukWq9fy1GFAIN16GsvgaadWf7b/:T3F6H9q1tHGzaakf7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771527716, "uuid": "cc3b7c39-d208-4736-aee3-ffa5524b1934", "value": 181860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771527716, "uuid": "79b53ce8-8dd1-409a-a2b0-5dd4892454c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771527716, "uuid": "a75dc60e-d1f8-4b80-a1cb-eaa6dd2b6cf8", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fb06c4-0d74-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493053, "uuid": "9d293441-83e8-4388-a319-e80b7624e32e", "comment": "Malware payload", "value": "d22473aec71d2fd62a64a19ea3498155", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493053, "uuid": "b2a2dc41-0e15-4e4f-8dec-79d0a29e5482", "comment": "Malware payload", "value": "a3a2fd6800a5e6033679ae4975c40dfb38bac6a9152b81447361724ca32b631c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493053, "uuid": "47dbb92b-4cec-4634-a4a3-48af4fc668b6", "comment": "Malware payload", "value": "7a204569c9857cb4e8289c00c1132124ff6083db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493053, "uuid": "d9ce9d78-e6df-4095-843d-f48a40736178", "comment": "Malware payload", "value": "e032bf72b1cc6fb6c51e5e032a325f4d8efc382a5c4c712796023420f7f6a0715e9144295213def1a279bcf7eba79f0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493053, "uuid": "53b580bb-a9f6-4e32-a1ae-a720c01eb38e", "value": "T1F7A275CD3DC2B166136A603B2A2FE46AF27B5C88F64CA594E9376554F494B08C863D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493053, "uuid": "496895d2-ad90-4315-a052-98106cf8c047", "value": "384:P8H3/ngpSvwpYy00aoJav6T5thFOmF2HxckCOFwNcr8CWEhY:a3fvw+UT32CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493053, "uuid": "76a98b02-c4f8-4476-8c58-4816973ab2af", "value": 21967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493053, "uuid": "f8812844-17e3-43c2-ab69-07a72d48ba2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493053, "uuid": "ae24c6ad-7866-4cdd-8cf3-bec08fb9955a", "value": "payment advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f924b5-0dc8-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1771529115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529115, "uuid": "38aef9ef-cc7c-4223-ba9c-4ae2249f3267", "comment": "Malware payload (NetSupport)", "value": "0f9fc0aaa3ac832342ec86e1b36f3d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529115, "uuid": "fc77f812-28de-4080-982e-9ab448c44cc4", "comment": "Malware payload (NetSupport)", "value": "a3af482970636cd675b027584c927af8cd33cc6fa09842fc3ac7c41ca8b6474b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529115, "uuid": "40bc93a9-c888-4467-a64b-7825c9666e8a", "comment": "Malware payload (NetSupport)", "value": "e79af211cbdf88fec48450ed3431d7be7861abb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529115, "uuid": "414305c5-583b-4a00-b66b-c36c80237d90", "comment": "Malware payload (NetSupport)", "value": "384907d8cad5da61ce78ab89b6a225f2eddf1f51eadc133effad9ce0ae55bc298c91f10c12f47bb69a55d29bca048510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529115, "uuid": "9d8ba375-bd49-42af-89ab-0b254a990f39", "value": "T18BD633A0A6E821EBF9EED33DC8618991C99675772B49C083D3F8D5A12C733C4693E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529115, "uuid": "62de2539-f298-4657-82e0-eb9f20fe9e88", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529115, "uuid": "8fecfed5-9d08-4968-8c12-45e5c380b30b", "value": "196608:r14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorcBurH/P/XRLSq2KKeF:r14FSsFl7dCR1C99/LkuRBuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529115, "uuid": "8230207e-955d-497f-96d4-7ba5262df97e", "value": 13412451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529115, "uuid": "9a3ed310-62f7-493b-a8f7-7912a7ed0f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529115, "uuid": "8867bab7-edd2-452d-93e8-7b338fc668e1", "value": "0f9fc0aaa3ac832342ec86e1b36f3d81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d63c08-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771520755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520755, "uuid": "beb85039-64b1-4b6d-afd3-e8e74664c783", "comment": "Malware payload", "value": "bc1dcd73e1a2382b34a9d697baff3d4f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520755, "uuid": "0790cc10-cac6-42e8-a22b-5969639d8f1d", "comment": "Malware payload", "value": "a4afd28dbccd565f54c924e4332f5d64ea7dc3e2e177ee0392a757505173c971", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520755, "uuid": "48008eeb-8641-4bb9-9178-31eb1048518b", "comment": "Malware payload", "value": "2f87894116bf28b98e434c4bdcb6ce827daef7ff", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520755, "uuid": "f5ed851c-b6e4-4b05-bde3-949b36ab7aa4", "comment": "Malware payload", "value": "4d978901dcaa45a0743f4627ce12bf58d4fbb2788b61687040fa4455f6b74a515a275d53a4f65806cefecefdc43a0a2c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520755, "uuid": "c57b0d77-5d3e-4ec6-bff9-fdc32f189d80", "value": "T120B25B353F0893FF41D6E1549B23E85C7E603E7E9918B2EAB3D22BDB0698840EC52571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520755, "uuid": "e9b856ea-c69f-41a4-b101-4cccc9a2b638", "value": "384:4s+dgA5KewYiv1lcQTDemOVlU/eAxrmTqy0wFA/JJ13c:4ngZpY8MQngVkegQqEA/JJ5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520755, "uuid": "b184dad1-6c62-4593-b59e-2d617c25c018", "value": 25218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520755, "uuid": "120dbd4b-b9dc-4867-9b20-503ab2b94a4e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520755, "uuid": "df469ce1-7aa0-4194-b896-b188398867b3", "value": "combrobante-swift.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfbeeaf-0d62-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771485152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485152, "uuid": "e88b9719-b0d0-4056-b5e8-17aedf6966a9", "comment": "Malware payload (Mirai)", "value": "fc76d82bc03f5ce08e713072c33a460b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485152, "uuid": "376ffbfc-56b0-463a-8bc1-b8ce56f202c2", "comment": "Malware payload (Mirai)", "value": "a67d5d7e45774458721fe852c65ab9e772ebd98a26a4ac7ddfbd059bc452710a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485152, "uuid": "2ba22106-70af-439e-bef1-57e1832a67e3", "comment": "Malware payload (Mirai)", "value": "f4f1f1669dabecaa0aacb36bfb6fcdd6fd2db900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771485152, "uuid": "b48a02ef-8a04-4661-acc9-dba42a97b341", "comment": "Malware payload (Mirai)", "value": "77b1c961d0dc030058701c90c0ea6ac18016769cb1dc82084a0f839e9fcfded1b608e7789c4fa0d06fa3c617c1e17799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485152, "uuid": "d220dcb1-dd37-4c7a-b67a-32b2b654f5c3", "value": "T1BCC32A57B992DB11D5C311BAFAAE524933132FB8E3ED7202CD206F6067464EB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485152, "uuid": "cbcd821e-8bb1-48bd-8986-04ef83848b4d", "value": "3072:ryjI+MsFeg1HLLqeSEj43lZFpafs+uPi4r1rlpVX:KI+MsrLLYEj4VZ7ak04rTpVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771485152, "uuid": "9c2c5b3a-646c-4fd2-be19-7ef4d3a742e1", "value": 125976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771485152, "uuid": "e98cc6e8-b4d4-41b6-b60b-b3b08833d02e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771485152, "uuid": "9f6bcb9c-e655-4c27-971f-4d3cf01518f9", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176761d9-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512095, "uuid": "851aa323-acf0-4d39-8965-0a9929cd479a", "comment": "Malware payload (GCleaner)", "value": "3dba3c311081de68b6af398972931d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512095, "uuid": "70521186-e685-41ae-a9c8-7c78f6c9add4", "comment": "Malware payload (GCleaner)", "value": "a69760d388fe5026df7da5b98dec7bad887b48913bac2225729b42df094caac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512095, "uuid": "88ce3421-4a3b-4ba4-a377-93bb1da909aa", "comment": "Malware payload (GCleaner)", "value": "1ca00c805f0015f22c6e88fc6f460c645fb05f89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512095, "uuid": "98fb7149-a2e6-4e99-9378-087c2da9fabe", "comment": "Malware payload (GCleaner)", "value": "cf25f1eab4978f37c428edc6894f22fae002b9967344bd360b57d3279561eeb283297e60bec92b92a32780042bb07ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512095, "uuid": "84cf8e8a-33a3-4e83-ac0c-7c463b883c16", "value": "T1FF16E017A7AC968EC9DD3A38E457296F586336463428000A6DC7CBDC4D3EF44E2BD17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512095, "uuid": "e8a3ae26-9609-471a-a4ad-a1058246f13e", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512095, "uuid": "c7d5cab5-83cf-40c5-aa45-1f84e47f5973", "value": "49152:/9t9uoN+RW2nKJ5jrwDM0eByLr+2tL9uybLYchADyE+mx:/9zuS+U84jrJyf+Ku2sDys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512095, "uuid": "4b545967-cc00-46ac-af20-29144d704951", "value": 4370944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512095, "uuid": "9ca557f3-e656-4383-b9bb-6a9d53b09970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512095, "uuid": "c4094c1e-741d-4e47-9ee4-5c6ba9490591", "value": "3dba3c311081de68b6af398972931d47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f27e79-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512202, "uuid": "d788309c-695a-4177-a1e4-6c64cbe1b9d7", "comment": "Malware payload (GCleaner)", "value": "ec9250971b68d8ed4e4c0ab7ae6d1d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512202, "uuid": "59275649-134b-4260-9241-57df55a4121e", "comment": "Malware payload (GCleaner)", "value": "a6b48ebeabd9aad5bdc9b4fdd12d3192c734d31adeb38550685a52a4b42d4536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512202, "uuid": "0c2ecdc3-13c7-486b-a9cd-6f6a180790ab", "comment": "Malware payload (GCleaner)", "value": "f3ef921603f7bcbd2b1e0cb7726df8a2e0beaf85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512202, "uuid": "89dcd6b9-8e6b-4611-8866-508156c7cded", "comment": "Malware payload (GCleaner)", "value": "817275cc31f9d856c1ac8732979e2552d8b8ba46dea4a09430bd9fe19052c1f2c3d36617744558893ff15fb68f45790b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512202, "uuid": "5fe15abf-381e-47f3-96de-c0da7f5294a1", "value": "T1A416E07496B21AEDDC76BBF41C3782C02728BD418C200A5F1299F5D9CE11B5C79A8FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512202, "uuid": "9ec9464c-4a17-4048-b32e-805320d382db", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512202, "uuid": "d96476e9-9afb-4aa2-b98f-fb9c2bb48ae7", "value": "49152:LuBqw3SJBfK82/l5dUS/yGVSbckltD5wYbnVFiI9Ft5FVWSe7lb3CLtNTxpuvu6:LEz3SJAtrUSqGeVnD5wYmW/5+J3CjAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512202, "uuid": "353046d2-1808-486c-9fb3-d0e4506e0676", "value": 4298752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512202, "uuid": "bea7b707-4160-4836-bff5-4a2b8d28b825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512202, "uuid": "260f8198-0c03-4ac0-a4b4-c28f2998ebbe", "value": "ec9250971b68d8ed4e4c0ab7ae6d1d6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bf488d-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493535, "uuid": "2a123ec7-5752-4748-8b51-8a3dca8accb0", "comment": "Malware payload", "value": "fd0e1b5ebacfc37fc4dfee88e7429433", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493535, "uuid": "f3a6f89e-4418-465a-b123-77a7cc25c724", "comment": "Malware payload", "value": "a843b7072af05c7cbb64659267ddcbd4d2d149bb5b5f62ee3b110bea0f17be98", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493535, "uuid": "aea9dd47-db64-4927-9db6-a682932ca99e", "comment": "Malware payload", "value": "6fbc162bdadec71a178f82fc629171b1c5fe6a89", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493535, "uuid": "c36126ac-31a9-472d-979a-7fc2982b401b", "comment": "Malware payload", "value": "a5fbd2275a4a59e97a6c5fb484227b5cb2457679d42576ddc7637e73cfb492dda5b0fa5fbec0aea2e40ff7231b51e865", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493535, "uuid": "d3002f58-bddb-4bf1-ae67-9520d1c924c8", "value": "T15092743BE918DFF40B2E61E0518B6C1150599BA6F43A49BCE4DDC0987F26B508FE64EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493535, "uuid": "950b4eb2-b2f7-4f12-bc71-66d0c56ab3e9", "value": "384:OUxujbSdhvcrAtw6w+/+hKQbt7bBobez56L9dnbTxiTEC/qP:gjbSHkIBktl6LboTSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493535, "uuid": "1c0f1f05-04e3-4496-b652-fd4c783212c4", "value": 19681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493535, "uuid": "af7025af-f385-494d-8fdb-0cbbb628bcac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493535, "uuid": "4e039a05-60ad-409b-8541-bec08dc6401c", "value": "Desc_Qtn_400_16_02_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51993d39-0d5c-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771482558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482558, "uuid": "e1229889-e22e-4e83-a5db-f08a4614d0fc", "comment": "Malware payload (SnakeKeylogger)", "value": "dafec6526b2a0eb5b961cc11afb0014c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482558, "uuid": "3e1f92fa-cd26-47ed-91df-eb6a8682b51e", "comment": "Malware payload (SnakeKeylogger)", "value": "aa9dd8a41f50d49b98a050f75690629df04ed991bb9d50c16164764fc3025528", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482558, "uuid": "3312e549-c637-4a9b-b3d5-e62e786a1a90", "comment": "Malware payload (SnakeKeylogger)", "value": "0b029e475ac21820a205d2829e326bb434e56f32", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482558, "uuid": "7aaa6124-41d7-471e-8e74-2732d4fd45be", "comment": "Malware payload (SnakeKeylogger)", "value": "50c9beddcc51017b66e3ff056608d48aa1f8aa336c61d79d9caf0d710430318c9805e3af5876712bd85c6648e8c1ec7c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482558, "uuid": "bcb1f9a9-0dc0-46d2-acc7-d7e1d2bb1766", "value": "T18485339637DA721F002EF734E7C8B15F7BEA50AE2750630F1570BAB8814B64BC4D8A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482558, "uuid": "d9f4a997-e995-4446-87c3-5012f5d4b25e", "value": "49152:j9byh7p0YV2roWODBUcVaEKhpa0Pn9Cd4Lz:j4h7GHWlIxaA9C6Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482558, "uuid": "3e181019-cd4f-49b9-ab73-11ee40503cb9", "value": 1745142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482558, "uuid": "933d6a16-a277-45e7-aae8-c019e03e0dfb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482558, "uuid": "37d17182-7734-466f-b8cd-13c08ba0b3f9", "value": "DDT-8030-PR225 Order Spec. And Drawings.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1942304-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771493429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493429, "uuid": "977b2a42-4984-4186-a154-e72f2bf9f802", "comment": "Malware payload (RemcosRAT)", "value": "aa75344e70894f3078ce5eccc5217e32", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493429, "uuid": "36104fab-7ee0-42c8-baa5-038ce0a57cca", "comment": "Malware payload (RemcosRAT)", "value": "ab8bff235c745c895c80c1cff9bf486c055b3f1865a382e99769e7e470350b55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493429, "uuid": "328d35c8-4d3b-4bad-9fd6-fdf5a4189c3e", "comment": "Malware payload (RemcosRAT)", "value": "3e52abecda49e70ff177cf11ae9baf33f47cea5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493429, "uuid": "2d445b81-672f-4798-9a7d-2dda4cbaaca0", "comment": "Malware payload (RemcosRAT)", "value": "197fd24eeb492ffdc3bb87b7a82156db5e1aebe061889ed107002bb8bd5fb1821841743360fbc4341cc5a57b083c5abd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493429, "uuid": "8a6912ca-b184-4073-a6f9-bdf4f2658ed7", "value": "T1AFE5AFD631947D865ADCA10680FF29190DA0CF3A2C272F98B5116F685E3BFC4279B46F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493429, "uuid": "76b1e9e3-2234-4837-9773-584a638cffbe", "value": "49152:n7wdEst/+G1ausrDlvPr2/1A4Ii6Hj0QZ+wTUhP:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493429, "uuid": "ac63a3bc-0027-4f63-b506-26d16ac92fd5", "value": 3066999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493429, "uuid": "81132cc0-d6be-45c0-9967-a81ed9dd2a24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493429, "uuid": "5b48a433-7d9f-4c30-a7fd-8f0b5e4e8fce", "value": "DSTV-PO-18022026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308cf703-0dce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771531465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531465, "uuid": "69831355-0539-4559-b896-629cbc0999a7", "comment": "Malware payload (Mirai)", "value": "c4de595803333fd13806d10863f8d014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531465, "uuid": "616f9217-7356-4de3-ba1c-4734bb82e90a", "comment": "Malware payload (Mirai)", "value": "ac37c10e305013baa340250628bcfd4c6bf72b85c3c932e9588b85baa1175682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531465, "uuid": "9d776a98-1b11-485d-a8f1-105cac739e4c", "comment": "Malware payload (Mirai)", "value": "523f6c28161a7b89d849293ea0f17c76c87748d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531465, "uuid": "803b6371-cc2a-4336-a0da-3ae4106c7fb9", "comment": "Malware payload (Mirai)", "value": "598e1e2dc9e1f709b9749ddc8dfc57b76127a571e08b9aa6c2024a0b3b0ea860b47d5d5b5a9574539ee3f4eefb8bafd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531465, "uuid": "3e87061b-27a8-4b04-ad6c-234732b3da60", "value": "T10092C07152C8E622C2A048B7E4F9DA0A63E30FA8D9673061534B4F566CD44837DBC38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531465, "uuid": "eddc3515-c23c-4622-8254-31d2b2bbb5a6", "value": "384:TgR+GsHP+oIbfp42bIru3yMVAciU0Och8XO364LPzZmmdGU57DltK:T1GoP+oIfGwNCciPd8XO36Glm3UhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531465, "uuid": "409f60aa-f523-4f0c-8c8a-408d98cbf4cf", "value": 20612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531465, "uuid": "cbfebc67-9474-4b68-bb82-256c8dbcd1dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531465, "uuid": "4e0863cf-523d-4c66-9c48-168af6244646", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d766a3ba-0da6-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1771514565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514565, "uuid": "3182eb36-914b-4a1b-a53c-7cfb8974656a", "comment": "Malware payload (ConnectWise)", "value": "55271911ee3705fe99210709560d0c5f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514565, "uuid": "f3d51730-d03d-4d4d-908d-88220b962c73", "comment": "Malware payload (ConnectWise)", "value": "ac9c912efbed697af7befaef803b15ebd95d29afc2a6cae92886e8a3642afa34", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514565, "uuid": "bc3a65c4-33f7-4030-bd25-8616d26a38b3", "comment": "Malware payload (ConnectWise)", "value": "21b212fe50c368272d764fb2e9431021deb7bbd8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771514565, "uuid": "fc8171c1-17d0-4e66-9573-67ccdfc27604", "comment": "Malware payload (ConnectWise)", "value": "0201797c3d1101d1c3d1a4e6b420b2f3567250d63a334af084121d581aef7a997bfbad08f1ceff9f786934a813e04a5b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514565, "uuid": "9449cf91-382f-4675-b625-00728c7571ff", "value": "T187C61211B3E585B5E0BF0A38D87A86562A34BC049716C6BF57A4BD292D32FC09E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514565, "uuid": "45e4af0f-7af2-4978-9035-d9c3086f4d15", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514565, "uuid": "d95ee7f7-b91f-49de-8b5a-19f887dc1235", "value": "196608:51EfefPkJKaLNkbgzi4QCKaLNkbgRKaLNkbg1KaLNkbgp:5KWgziHUWg1WgpWgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771514565, "uuid": "eacbe39a-87d5-4be5-9940-e0a964021515", "value": 12580920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771514565, "uuid": "626cb588-b1b0-4ef9-bac0-68b9fa804fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771514565, "uuid": "1c74648e-c8bf-4c90-af80-e10395cb1908", "value": "ScreenConnect.ClientSetup1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d630515-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493422, "uuid": "f99ec2c8-9a42-44ff-bfdb-2f3f3defb5e9", "comment": "Malware payload", "value": "2a31b4fcc8987119ec09ddfff327df1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493422, "uuid": "04bb7267-af69-4fc3-83e7-29c03ceb4d2e", "comment": "Malware payload", "value": "ad1ffb52407633a6e9eb7f90afb6f541f241e3a948ce17ee286e4331d5197faf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493422, "uuid": "8ddc8f7f-7ea5-427b-910d-ea9ce60764d9", "comment": "Malware payload", "value": "6c2ad27c8e7a7d72d1649b88ca76e46f7ac4e2a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493422, "uuid": "15d3082a-1e68-4a11-99ce-e086dbe3b2e4", "comment": "Malware payload", "value": "c1de47bf7c9c1e9ebd374a82519066cbf48f80c4470ff6cf9bf27aa65e891e47cf308b93da436201fb5a9184ed984e7c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493422, "uuid": "6d7f299a-22da-463e-bb7a-8c004cadc884", "value": "T1B273448B38C1F363C2376777391F704EEAAF9F547148017CEA692898F852248D8765B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493422, "uuid": "3762a5e9-2b7d-40c5-a5ea-fffa683d331b", "value": "1536:cHpzAL7r8mrZ8rgSdGVrqhcTq/YGjrYm4KBrrVafGQZJRD:BX8YDmGVrGdjrBrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493422, "uuid": "eb2ce8ad-c72e-4b5d-9b13-036e5e699531", "value": 79807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493422, "uuid": "39a16b87-6d7d-483d-8cd6-4d2c85db8654", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493422, "uuid": "11548947-a8c4-4c3e-a23d-fe93c3e673db", "value": "Vessel Particulars.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4ca33e-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512154, "uuid": "aacfb5bc-56cb-4ed6-a8ca-0b1c49a2ed8e", "comment": "Malware payload (GCleaner)", "value": "ab17125506851a458ec124aeeb04a6eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512154, "uuid": "20300c9c-2bda-41f0-b3bf-2f0029075d8e", "comment": "Malware payload (GCleaner)", "value": "ad582716454da86dbd26b7b7d137096338d09863196dec2a0c4033ce35dd2216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512154, "uuid": "456714ea-0e53-4e1b-8583-abd50de4eef6", "comment": "Malware payload (GCleaner)", "value": "21eeb04f97f1874c1471c984295f0f1a97497d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512154, "uuid": "6ab2bae7-2a92-459d-99da-54166bb2bf9c", "comment": "Malware payload (GCleaner)", "value": "81b1af695b3b8a639bd76c9e306208f39384b65945e873f7fef49233a207f846f18cf4a4bf2e54122e29b4a8e3afd283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512154, "uuid": "276c5d27-0936-412f-a46c-40e8245d3cb2", "value": "T1F0E49F36E7E08533D1335A38CD6B52A59C26BE812E38D84A2AE71CCB5F38741752539F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512154, "uuid": "3dbb417a-02ff-45ea-ae66-7816e80efacb", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512154, "uuid": "fa441ae6-bac6-4573-b853-c3373993172c", "value": "12288:k48VY65TrPsgNDHZ8nqReaVokOFSFhbbh2mC:l+7PfJZ8qBVokCSQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512154, "uuid": "33abbffa-dbfc-4bbb-9faa-08144d289589", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512154, "uuid": "b563de0d-40a6-4c9f-8c22-499df16c9ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512154, "uuid": "28258682-75b2-4c8e-8a84-caeb47386da2", "value": "ab17125506851a458ec124aeeb04a6eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afc2b14-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512128, "uuid": "a88a8462-44f6-4d17-af2d-f4ce148784ff", "comment": "Malware payload (GCleaner)", "value": "5fa2cf02f630087d35a45b89e310ca74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512128, "uuid": "6e90bccd-8ffa-4548-b300-2eab688afbb5", "comment": "Malware payload (GCleaner)", "value": "ae92d2913550e5108dc1bff9624f6ed374171893f91c65cc2ce0461256959024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512128, "uuid": "94a543b2-0fda-4181-964b-87c2450a4ef3", "comment": "Malware payload (GCleaner)", "value": "bbecc455e6dd7b30002206dca5b52e7cee60c31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512128, "uuid": "6eee4aa7-9f60-4b75-b059-4d1cb7326878", "comment": "Malware payload (GCleaner)", "value": "61b47cef544f0ca733911bc805b6842aebf4c1ed11cee27a50c5782843996cb6d0fb17e6dd41c04810a714f35b86385b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512128, "uuid": "8febea69-6a7d-47db-94a8-4c2175b7ce0a", "value": "T1B206D0A7538A80B9DFD91DB79DBBE4B8907AF7111F10B037B98427C9C9392B45427B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512128, "uuid": "b5cb68e3-6760-4a3a-985b-0ed5b1707a14", "value": "66d4174db3b382b1ff6e32a72864c0fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512128, "uuid": "d0ec8b11-f2ef-4fd7-ada9-cbe777c0f123", "value": "49152:U5NVuDZNMcRhOlOaFN+O/U99/zmkDPqPwhoumuUOfBkD5XBl+23O8dDaqnj9bsPh:U5ruDjfZpzfDmW6XBl3BOgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512128, "uuid": "d4419858-ec2e-49b9-a301-0ab8abebe19e", "value": 3979264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512128, "uuid": "33ea25ad-2256-4ac7-8520-e7f8d53d15fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512128, "uuid": "1a90f9b6-bf23-49d5-ba8e-f32473be6ade", "value": "5fa2cf02f630087d35a45b89e310ca74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d2d328-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493389, "uuid": "eb549afd-4019-4006-953d-28961e55c1f4", "comment": "Malware payload (AgentTesla)", "value": "ce300e0d830ddc5514d9afb131749e5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493389, "uuid": "3e2e8305-a772-43d4-a616-c66f2192e907", "comment": "Malware payload (AgentTesla)", "value": "af8181f8d0017001745901a9ba0ef1d6949c71c5045f4886facd5f128b6202a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493389, "uuid": "c0339fe2-63ff-485d-80b4-9b0b3982c688", "comment": "Malware payload (AgentTesla)", "value": "4102afae0e79c2e56609bccfa75bd10110c2870c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493389, "uuid": "9eaf526d-1c55-41dd-a874-7bb8b70049a0", "comment": "Malware payload (AgentTesla)", "value": "5d5cb06cd5fca29115936c4e652f0788ec5c5ec0f0423a5d6116200ceff0a338be9306b40800f7d3923dab05493139a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493389, "uuid": "c4782da9-e628-4477-98a6-9cca6d3e9a1f", "value": "T1FFD57D048FC4237E06115E1F52CC62FB95E09E438A31BAEAFB113DED9E7E1845B8A45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493389, "uuid": "4c4e1bee-de16-47da-8dca-2cd6540d64cd", "value": "49152:ZJXTmK1Qqe8YIl3gv3QSL6w6OBH2q070H8QVZ0qgBSe7d9k92mbKDm3:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493389, "uuid": "ea5f7761-9962-4b48-9d1d-8f25ae12ae34", "value": 2906807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493389, "uuid": "c7be8fec-1d4a-4963-98d6-5c777d36045f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493389, "uuid": "46235b54-6517-49ef-8dbe-51b27998005c", "value": "Order PO-000182488.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e61274-0d2f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771463478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463478, "uuid": "f260b9f6-75ad-484c-bc1d-a0e7d46f17f8", "comment": "Malware payload (Mirai)", "value": "a62e3114ba91dd8ecbf10f7aa1260b90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463478, "uuid": "204a4a6f-17c3-483a-91a1-a19992773d2a", "comment": "Malware payload (Mirai)", "value": "b0c3009d6cb05ea40dcb0107603c63fc20354fa1abdb3e505ed6d839924483a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463478, "uuid": "7722dfa3-cd17-40b4-bf03-1886af39f488", "comment": "Malware payload (Mirai)", "value": "03d8432a7ed2ca19b956446d58fde7d9f659a3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771463478, "uuid": "c5f39518-1dd0-4ceb-8970-83994968356f", "comment": "Malware payload (Mirai)", "value": "3cd0776049c2740ab11f7bee4883f4026e8941b94f0080d8ed593a44c742676e3d9ed2ceb8da41da82cb15cecdb1a25b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463478, "uuid": "ece87952-a47c-4532-ba16-84be5b4c5801", "value": "T13B134BC1A643C1F2EC5212F5147B67628F76E4364A7DFA92EBA92531FC03B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463478, "uuid": "c8c80444-0a45-44a1-b4c2-d5358f304313", "value": "768:QQaiSup66OkEgy5oD5YQuj4J0UTeU4wQOnwspVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/J0UeUDtwspDbOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771463478, "uuid": "20a7d795-4f50-4293-a296-1bc8fb8471cc", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771463478, "uuid": "e99ecda9-1e0a-45fc-b330-2681921b3891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771463478, "uuid": "821514ad-6feb-4e73-a2dd-d4d239aa51d0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b21def-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493384, "uuid": "789e3b40-674d-49e3-b982-e95a6c0b72ce", "comment": "Malware payload", "value": "23f477327a18ee346596c3eb85b162aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493384, "uuid": "e9aa24ac-c6b6-427d-a388-77c0a236206c", "comment": "Malware payload", "value": "b1f158d0b1cefed083e2881955d3f4101e903b637866e5e33e17db8a07085f78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493384, "uuid": "38e096e4-3744-4e2f-8d23-85f00e02dd17", "comment": "Malware payload", "value": "f9186644a1ea4895dfd07cf5e67ab776fafe78da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493384, "uuid": "dc2d87fc-b7a7-4d29-83c7-19fa9c2c40d8", "comment": "Malware payload", "value": "3d3aa22b11d31cc69d39667ca9201ff87de926941adc9d7b19d6c1cdc007126505f135b188315195aeed47a48fde20b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493384, "uuid": "984bd706-7e86-40f3-8d1e-c9ea6d697682", "value": "T1D3C4DBDD2EC1F25D0F82A923F60AF06DF4F988F0936A5C29A4DC1C48E8A56D4FD15639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493384, "uuid": "dcb004cd-c863-4dc8-80dd-4f6b189a59e7", "value": "12288:v900oWjn46mP/CJjhOAomAldFRfmsY7jp:100oWjn4lPdPFRfE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493384, "uuid": "72244518-a7b4-46ec-b56a-6e17f47097eb", "value": 552751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493384, "uuid": "c11693d9-4a53-48e6-a320-d8b48323e2f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493384, "uuid": "7e828ffc-2188-4eb0-adf2-45d365f431c2", "value": "QINHP5-TIS-L0009- (AL DHAFRA).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bfe028-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512148, "uuid": "97ef64eb-896a-433a-bc98-25fd810fe848", "comment": "Malware payload (GCleaner)", "value": "965ccc4111e29073e015d243ea600acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512148, "uuid": "4acaf272-e233-46f7-adb6-d2697903187b", "comment": "Malware payload (GCleaner)", "value": "b3475b64fa057d9dac594e5eaf2606b5e4d69b0f2307c7fbf91381aa01783086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512148, "uuid": "799eda8f-8611-4d19-8afa-bf6c6955d6d0", "comment": "Malware payload (GCleaner)", "value": "e4a305c36748f2b447bec1e55b1de1cccbd01d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512148, "uuid": "cdbcd77b-c87d-4232-b395-2deb1300afdc", "comment": "Malware payload (GCleaner)", "value": "67a15cf4a36dc9e9b49688729a55bd75ade8365f30390ddc6c6f34d057f37c6dd5f7b0e58df5e12c9f5e020a80754bca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512148, "uuid": "69dc829a-a17b-4ecb-b1b7-d5149b5c8213", "value": "T15D46D013F240012AC666CB7809AB529CD12CBA872693AEB2FD4A0FF5C5B05CD5F759C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512148, "uuid": "891acdc4-3f48-4643-bb64-73627639fd88", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512148, "uuid": "3680bb87-4fbf-442d-ad08-f84ec4ad3614", "value": "49152:giZH7okEdkGu29IU+OZZH4/xBFkvBfbpZ78zPYmahpOdi9nrl1nUFS/DWWWG1KJ3:giZbokEq6B+OnYZrSfdEgqdidUFL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512148, "uuid": "8371ae4f-a1f4-4fe8-bc41-15cdcc41092b", "value": 5450240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512148, "uuid": "1b2c8f64-fa7b-4a8e-9b40-3b3c34e8b0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512148, "uuid": "7c6a6ddf-e579-408e-9a2a-5e5386cc0f33", "value": "965ccc4111e29073e015d243ea600acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9421381e-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493407, "uuid": "812ddfc5-e950-496e-a41b-6a22e04e4d2e", "comment": "Malware payload (AgentTesla)", "value": "0564ad25bfc65c5ca8671b035db07726", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493407, "uuid": "118c6e82-fcad-4986-90f3-b1c94c21b863", "comment": "Malware payload (AgentTesla)", "value": "b40b2e56c37b8929e869b4d245e45e2aff655d025a01c0e940aa404912ef47ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493407, "uuid": "7516866b-1cf0-456c-b849-26e87e340f18", "comment": "Malware payload (AgentTesla)", "value": "0963e9a8e418fdf011541259a308f63c6c3dd5c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493407, "uuid": "62f4090c-bdcd-4129-8ae7-35227aa6d092", "comment": "Malware payload (AgentTesla)", "value": "ee2a42d4e74f5e8f2964096db9de21c74a0e409aa6c61076463353bc4cab4fc4897dcdc2afaadfb59db15205b5c0f583", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493407, "uuid": "84c0162d-5b3e-47e9-b32e-eb5785f18303", "value": "T176656D9D2C405D8C5FE84818E0A1E18D5FE85F3EB68E52F8F526EC7137D29522AD90F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493407, "uuid": "8d230724-f103-40a7-a265-c4d30f50ec67", "value": "24576:tiRKYSQ1FZv+1rdRtI4lm3t+SnNRXVOY2:oKYTml+NRXVOY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493407, "uuid": "0ddbfbb9-88fd-49ad-ab8a-6234421a8e31", "value": 1418355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493407, "uuid": "165a178b-8111-42a2-9c51-74727df3ec46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493407, "uuid": "856f1666-a0bc-4fe9-bcce-48e38eb977a2", "value": "Gulf_Tradings - 20260218008.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c915a7-0d8c-11f1-a129-42010a9c0007", "comment": "Malware payload (PromptSpy)", "timestamp": 1771503124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503124, "uuid": "f8580e29-8d73-452d-be02-fe7dec2b9efa", "comment": "Malware payload (PromptSpy)", "value": "d35341798bd6ce066d3bea0a6acc18f3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503124, "uuid": "4a3e0b28-37ba-414d-8214-4b3f4922c64c", "comment": "Malware payload (PromptSpy)", "value": "b420b96e0d76702f51ba0e3364da881aaf766e00538059e58fec6b7676a68e6c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503124, "uuid": "2a998c53-3964-48b3-afbe-6feffc951f63", "comment": "Malware payload (PromptSpy)", "value": "375d7423e63c8f5f2cc814e8cfe697ba25168afa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503124, "uuid": "2484bf5f-7723-4d68-97c5-dee2852e0fc5", "comment": "Malware payload (PromptSpy)", "value": "cf82949527f3fe1c925cc992f60baa30e05a12aa8d22fd48d9c21e847552df8e102643ce7babc3cd9d6be7b9e93f45eb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503124, "uuid": "95953c0d-b0bf-4601-bfef-2240fb8d3889", "value": "T11796BE86E7859C56D7E24131CD2A92B1571B3C1E87F38AF77900B2E838736D07E5AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503124, "uuid": "4d372129-cf53-4238-90a9-5e6e53d53613", "value": "98304:QY6qPtleoCLbxD0i9sBkPLV8i626KNOR6ZbZyrLRAB4zQro/KrtQfe/057bM7HhB:mAUoCLCqnPLKiZ6KNOR6Z2GBEQ4u/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503124, "uuid": "9612aad0-7b9b-413b-b4ab-e50563e18ee2", "value": 9250064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503124, "uuid": "c183a8a3-90b3-4679-825d-6263755f0fa6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503124, "uuid": "5debd34e-a13f-4ef9-993a-fe405ce39dfc", "value": "nlll4.un7o6.q38l5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9107d7-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771520991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520991, "uuid": "e8e6d9cc-155b-4b10-838e-29a7b2a92bc0", "comment": "Malware payload", "value": "2a27ad3f105fc50033095c5a8eeb23d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520991, "uuid": "d5afdc19-4d42-4aeb-9bbb-85404cca41b1", "comment": "Malware payload", "value": "b430b6d8ffe30bb994eb58e11cab86092452755f0044acba6de4ef305f8fc28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520991, "uuid": "5e701e52-6f5b-41d5-a818-0528cc6e0c66", "comment": "Malware payload", "value": "69e21b8e6d3c552acabe5d2e75db56d880fc20d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520991, "uuid": "d1b13e69-d65a-4f6f-bdb0-78e8ad559be4", "comment": "Malware payload", "value": "3822a403f7f4c3466a82980ee313127dd29359acef0f10f4d462d45681afe22b3d776a8bd05cfb60b245a2bcf58d089e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520991, "uuid": "276a0c2d-453b-4e9e-ace1-13f6e50a1980", "value": "T18D85F1257E632705C53AAB3984271D8423F0C9839A93DB0FAFDD41F8BA5A3F5D660742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520991, "uuid": "d33b07e6-a7b2-4f7a-8cb1-5ee70d3fae12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520991, "uuid": "6d43777d-26ce-4bd4-8459-422b2121398d", "value": "24576:HvdP4lTp3YHdCvVGEKN//eu9BrV7qItrE+qlLB1o:HVPYp3MdCvMv5/VVmIUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520991, "uuid": "29d019d3-ca7d-4845-917d-65a1ba4609f5", "value": 1765376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520991, "uuid": "5d99f425-3638-422e-ae65-1fbf0eaeaa52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520991, "uuid": "ec80f426-d128-4c64-aef9-789c66e7f1fd", "value": "Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8d0b01-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512268, "uuid": "f26c78dc-6402-4e14-87f3-18077e85300f", "comment": "Malware payload", "value": "aded4fccc1713aa0596fc3d825b69832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512268, "uuid": "08ab2f0d-e15b-4dd6-821f-eb3ad9338432", "comment": "Malware payload", "value": "b5440e2bc6394a4f05e5875a809e6e7b03df0e1c26cf6ec76dc0ea5cd172e693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512268, "uuid": "fe5189c1-1293-4f73-816c-816a532de694", "comment": "Malware payload", "value": "286c115ae0db10bd046a2677c900c5fb76a856a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512268, "uuid": "6fa062a8-46be-4209-bd00-61017e0e0fc9", "comment": "Malware payload", "value": "0585cda0d6e9ee2a8091e97a0d00596bdd37597dbf0f0e534e13674558f754a05a4ceab10613958fe12e59b46f8eb6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512268, "uuid": "d32cf1e4-0fa3-436e-aef6-ee66ebd7f875", "value": "T1332502483726ED02D86A0BF01AB1E3B91BF94D9E9911D303CFF6BDEBB4267911D41186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512268, "uuid": "78ef9b5b-69cc-4584-8ebc-2c42d6602dd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512268, "uuid": "64cd4ef9-c66a-425c-847f-1095dfeba737", "value": "24576:iqu2VMn/I9eKqSdd1msrsR9Q0PwMcIVvJKrWORKjb2w5hOKI:ieVMnw9nD1dmFzKzRKjb28A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512268, "uuid": "034b3c05-f0cb-4e41-b588-a00a56e6a2c5", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512268, "uuid": "cb16f658-e3ee-48ff-bdce-c0dd96cced84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512268, "uuid": "95f88f7c-9579-4b9b-bf7b-cd6001ec22fd", "value": "PO 870EW31.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140e9b2c-0d76-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493621, "uuid": "85b40737-bbbd-4a1f-b639-c19ef52609d1", "comment": "Malware payload", "value": "dfb0eff9f81228ecfae31c15a8a05121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493621, "uuid": "dc906644-3381-4810-a9e0-14038701237b", "comment": "Malware payload", "value": "b54939881c946c9a7ea237852acc92c0f6c0705cf1552706e8d7c1c8d536a313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493621, "uuid": "98b8bb0a-d3c6-4e2a-8c2e-91f561eec3f2", "comment": "Malware payload", "value": "c038e945a9e1cf3fa160a26b9a2131b16820e9b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493621, "uuid": "4041e0f8-3a89-4b5f-af08-b75a01f206cf", "comment": "Malware payload", "value": "566c111a79ad34cc7aee614dcf62abf35cd6766152d1cfaed525a37f3f2f7a94bf6bafd0383947ce064f7eca47b00f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493621, "uuid": "60584317-c070-4cf5-bab3-2567669497f7", "value": "T1F6E4AE2A7E530B41C67AA77986331E9423F0CA938753CB0BBFDD40F4AA2A7F4C561651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493621, "uuid": "fe256a97-10c9-4f92-bfc2-616837596204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493621, "uuid": "a64281fd-0b20-4cdd-a72d-3b499c6b6237", "value": "12288:XwmiCRig/+VndCq7Jb8G26y7p3YS+quCvCY6+6WGEJ5BjQUgzB:XmCR0ndP4lTp3YHdCvVGEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493621, "uuid": "4b4170d9-cc81-4173-8571-2048fd0e266a", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493621, "uuid": "4d40e545-6621-447b-9b22-f2deb61583d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493621, "uuid": "3cdc6c0a-2ac9-4b4a-b4d1-59389d64e34d", "value": "CH3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88662a72-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493387, "uuid": "6aba4659-7388-4796-9cd6-ac12c2d7c9da", "comment": "Malware payload (Formbook)", "value": "1c198165686703dcd7bc83d4f118b896", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493387, "uuid": "ad6d4bf7-5b44-4b56-81e4-1bc2384ae0d4", "comment": "Malware payload (Formbook)", "value": "b57ce95b3dff59901ccc6dbd3b5139dc285bf8723d65bf34434d0369ebb3cd8e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493387, "uuid": "f4788a3c-4353-420d-99e6-0dd02d9c27c8", "comment": "Malware payload (Formbook)", "value": "f7ad9b9857360293c6ef76353bbe8b2f42761fd7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493387, "uuid": "f3cd2090-21aa-4897-aaf9-329aa5d2e867", "comment": "Malware payload (Formbook)", "value": "217bb21f19d90a634393ceccaf977da51dd7d78c2501c86c7187c3fc0a145fe3091af7e64d8d91e559c988eec4d3518a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493387, "uuid": "7b2757dd-6bc2-4e64-8bea-472dc430d5a8", "value": "T17E95D00845D45FDCEE1D4C25ACF567AF537276A3CCED80ACB661BD829A43832C816BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493387, "uuid": "fff7a2ab-491b-45ab-a557-0d5e2aa887c6", "value": "49152:10DeJS6TQzEwQkKq+tZOwYr/NmssNZ0p8:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493387, "uuid": "51e56ed2-c2df-4084-a26a-58a9d8aeb250", "value": 2047995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493387, "uuid": "36e7e13f-13e4-4572-a5ab-a4bf5a112f5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493387, "uuid": "60c07117-6c3b-4d89-89e1-9491edefd3da", "value": "Purchase List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08465240-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771484582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484582, "uuid": "a5d1f21d-07a5-42c9-9af7-886ba8eda05d", "comment": "Malware payload", "value": "e017391efaf0115efd1289411fc70ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484582, "uuid": "02a91398-5b47-47bf-9d92-c8e6b1a68352", "comment": "Malware payload", "value": "b81c8a40791accd30622ae664ad974ea460ddc48f16e7c8e2b648a0212c49d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484582, "uuid": "9b85e37e-81f6-43bb-a8f2-e28bb2fd5e75", "comment": "Malware payload", "value": "5253cf5a51bf45418e17c24e57db6bdf9f716509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484582, "uuid": "00f8d0bf-7ef3-4662-8f7c-8f94c6951bba", "comment": "Malware payload", "value": "0179f0584e08b6c3f4cc30142336905bb3b593bb1f7ff175ffe2fe78368811998aa8614da30867a26a85ab552b90fb0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484582, "uuid": "3b85d8ed-8483-44f6-93c3-621ae6489a1a", "value": "T1E7112B47DF9888BCD55A21F90AD68A05221AD5F823F5C30F1D15007B5861B6CDCBDD59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484582, "uuid": "d190bbf5-ed4a-4184-b36d-6dd1a9a572b1", "value": "6:idqLvVg3F+X32ZqXuP/5y9t4bcPKQFwb+XM/Y2lX6tQ070f8EXL2t4xdlwVn:eqGSGZZ50ubcPKgwKXMDX6pofp2tmcVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484582, "uuid": "1b0e5fb9-19a3-4bd2-a0d1-74f4e4991e3e", "value": 1088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484582, "uuid": "3ea72b0e-1628-4687-9695-8e28c6d7b3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484582, "uuid": "0469ad76-a6bd-4f30-9b27-49e9cb3e1155", "value": "e017391efaf0115efd1289411fc70ed8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613ec5e2-0dc7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771528540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528540, "uuid": "d1e70c36-8052-4707-9a62-855ee31595af", "comment": "Malware payload (Mirai)", "value": "ea366157b06277272e01e903ab3cd509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528540, "uuid": "969b1046-18be-40bd-8cd7-896a89f42aa3", "comment": "Malware payload (Mirai)", "value": "b875cb9b341c6d62c6c74e193a9cf0d5b49b971fbb4ee86d0de976a2757df384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528540, "uuid": "c6297628-cc19-4246-b0d0-ec11cf0cf5c6", "comment": "Malware payload (Mirai)", "value": "d5c5efc894fce205b1087e4adb8de3d8547cc9b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528540, "uuid": "473bb329-d59b-4f65-bf61-d38d5757070b", "comment": "Malware payload (Mirai)", "value": "8a72a8e361b8baeea747fc42f386e593acc24a0c2e6c5db5491ab71f8f7b2c66db3e0e28a245b8055fc38132e30758f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528540, "uuid": "4aaea74d-5519-4797-9cd3-ccb4d1d34312", "value": "T146D32A45F9414F23C6D112BBFB5E428D372A17A8D2EF72039D256F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528540, "uuid": "ad343f60-6791-4edc-b446-5d79b2d7a7a8", "value": "1536:+W3+JAXM5fh2RRvquV2BgF83AxM54VMtb4Tj1NZ/SJVAOBMW6pytCsv+LlDpwywH:+W3hSGa083j4c8tNZ/AETGvwC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771528540, "uuid": "b40ea4db-fe08-4be5-8b05-ee1f82cd75ea", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771528540, "uuid": "4a49e302-1148-438b-b2e9-b1862802976a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528540, "uuid": "6dd3a0f0-dd93-432b-88db-4e2ac9ff026a", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3434b81e-0d67-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771487233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487233, "uuid": "f7806aaf-dfa4-4ebd-a084-6be584df5695", "comment": "Malware payload", "value": "e9066b15b61539b3b7c0666ef2fca519", "object_relation": "md5", "Tag": [ { "name": "compassmade-space", "colour": "#49509E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487233, "uuid": "da001756-c41a-4b1a-b447-8f58c31a88ad", "comment": "Malware payload", "value": "b8ef37d342138e489a4e8c2a54804becfa857496263a31174db0ddb3bc6249b3", "object_relation": "sha256", "Tag": [ { "name": "compassmade-space", "colour": "#49509E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487233, "uuid": "20de670e-5ff7-4388-b3ba-1af13066efda", "comment": "Malware payload", "value": "32ac822f399666adeb8da307b2b018d99e463631", "object_relation": "sha1", "Tag": [ { "name": "compassmade-space", "colour": "#49509E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771487233, "uuid": "9081497a-148f-432b-8754-5645c7a72476", "comment": "Malware payload", "value": "c0ae56e3b5d375a39c8d016edeee968b466539a065560f21bcdd526c698fde1d6e45f1f201968ceb2134a7518de6bd39", "object_relation": "sha3-384", "Tag": [ { "name": "compassmade-space", "colour": "#49509E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771487233, "uuid": "71926206-7710-4a6e-be1d-d92aafd37b5b", "value": "T18B8581FE43829C5099AB2568A2266222CBCE0F274D79C4C97855745416FE23F87D3BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771487233, "uuid": "f25efb9f-0702-4e51-bf4e-cb94cad30960", "value": "12288:KYt10R3nvB2eibQsj6VdfhXlDp7/Z8mbrSDEOSCZmU5:K410R3nvB2Vb/j6Vdfh1DpTZir15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771487233, "uuid": "f683707c-06c0-4958-bb28-83a0fe46f416", "value": 1759088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771487233, "uuid": "7154a314-50e6-4816-89c2-ba9bcec91487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771487233, "uuid": "c3c0f557-1817-4466-bc6d-825f9259506c", "value": "bundle.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a37713-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512195, "uuid": "446c5eb2-8a5d-4d98-aa37-7a977ffadd51", "comment": "Malware payload (GCleaner)", "value": "e7da92ced773e786bd6c1486bbb18f5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512195, "uuid": "5c2f8d08-409a-4c05-b6f2-0cc6c5659c12", "comment": "Malware payload (GCleaner)", "value": "bb6a16e951ca2d0164017d08b0f3422c47b7edc0560e326c280c711e3c0e0ddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512195, "uuid": "3b186807-fd14-4e1f-829d-dc51b5bcbc5f", "comment": "Malware payload (GCleaner)", "value": "26a95f8344484b5a2cd626d3cb4e72b478a0ace3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512195, "uuid": "2d39f87b-edaf-4c06-885d-4c4609f3e888", "comment": "Malware payload (GCleaner)", "value": "495debeb5c4834e7ac04d867bf9fe025c508dc175198699bede8a389181e94156592410dc033ef947a9a9ba3f275f488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512195, "uuid": "2c5db2fc-beb0-456f-89ba-c4b819a4d70c", "value": "T1B826E1DED4F58C32C279173DBD7A7ADEE0263B31182890CA10DD48CA0BECADAD4555A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512195, "uuid": "f6170eb6-57d7-455c-8f8c-48fd907af670", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512195, "uuid": "8bf1b7f6-477a-47c7-bf83-ef368e41e00f", "value": "98304:KH5TVs/CVitaQwwc9HHrK/ZLJTkFJ+8lcCNDH:K8aVit9sHexLJv8lcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512195, "uuid": "24b5b253-722a-4ac6-ae7e-b7d0386b8eba", "value": 4744192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512195, "uuid": "d5fecc0a-991a-4c55-b3fe-d3e551a65579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512195, "uuid": "63b631d0-8d30-4fd4-9530-45d79d7331cf", "value": "e7da92ced773e786bd6c1486bbb18f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ecc842-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771493326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493326, "uuid": "c0ac7f21-eefb-4cd5-b023-75a6ad0b3285", "comment": "Malware payload (PhantomStealer)", "value": "b8cde0716c7c02c1598e36fb9af92f31", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493326, "uuid": "9565ea35-dee3-4d11-962e-1a6484d1045b", "comment": "Malware payload (PhantomStealer)", "value": "bd559923b667de3320216c42bcc87c6c4d273b1de488409fe452efe2902bef3b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493326, "uuid": "3017ccd6-872a-4413-ab5b-cf88287e85d6", "comment": "Malware payload (PhantomStealer)", "value": "b24709124c59ded85b78b3aaa7a59dd620609b06", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493326, "uuid": "7bf23a93-52ea-4ce9-a506-5fa5e35ab4bc", "comment": "Malware payload (PhantomStealer)", "value": "9d152a150d37963562e23c982ce6baba90af1bd87066b4e806217f51ed73b3f59b9eac95b6f9ff23467523bef0f41958", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493326, "uuid": "eb4afac2-760d-4358-b0f1-2e229b1620af", "value": "T12C26BF05BF4A777AB188BB2D84F0360767D905E82C1930CC8F7B79A5EFB6042635E619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493326, "uuid": "45ad98bf-840f-4b00-ae74-86e078302dc3", "value": "24576:jRu1NwFViwbiYsmDH6xk0+wqgqGh+weoyegORu8iFvScKKuMnCJQ9/lkct5s2jwQ:MwpgqwzXgOK1JlkctglI7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493326, "uuid": "07031370-e4ff-47f6-a491-eef743eb2b46", "value": 4703527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493326, "uuid": "970dd1f3-c7d5-45a8-9993-8203496aca49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493326, "uuid": "96f27d9c-a1a2-4c90-a543-bcd084dc3f45", "value": "factura de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73579c5-0dcd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771531288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531288, "uuid": "9fc9c54e-2996-4e96-9162-00b20ec8bac3", "comment": "Malware payload (Mirai)", "value": "6dafbe45c4182fbcfe0c5956652bdbdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531288, "uuid": "1cffe830-e1c8-47c7-84ea-d901db979145", "comment": "Malware payload (Mirai)", "value": "bf33971db5a3b38f8bb20a6372d7a1eb03760647dab6b1ad8530631acf6aeacc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531288, "uuid": "7fa77fb6-b885-40c2-a53a-53f0598127d4", "comment": "Malware payload (Mirai)", "value": "7137fd5118839420aa4d942973e5ba6e79de0cb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531288, "uuid": "ab23910b-0f1a-4ab8-8c96-b00cedc2adf8", "comment": "Malware payload (Mirai)", "value": "a80ba8d25006c14bb109a1d38aad1b687ab284d32617ea7e4ac3bc52c0e50550116811a47900a2361c3289ab36726bde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531288, "uuid": "c25bef44-0046-49f6-abf2-925a6bdff7a7", "value": "T120D33B06731C0A47D2633EB43A3F27E193EFDA8121E4F644255FAB8A9171E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531288, "uuid": "51e70fc0-28e7-4350-8230-1fbfbaec478a", "value": "1536:bz94fQVaghEZpTA5FboAExfTIcEP97yTOU7HQ4znvAbj00WulzNsq1CcsxQJI:bzZErE5poAExXEpK7w4kbxkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531288, "uuid": "910cc216-b926-4150-bb0e-a1056cd66773", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531288, "uuid": "7560f7b4-62e1-4331-8f6f-0bfdacc22b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531288, "uuid": "e0471837-1f39-4207-81ba-b10e813f99cd", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206b3eb7-0d8b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771502662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502662, "uuid": "e6ecfba3-3c80-49a2-8235-ff9104cbf1ff", "comment": "Malware payload (CoinMiner)", "value": "f9020f2b28f3006145a5af763a1ed6c9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502662, "uuid": "6ff38b9d-445a-4e95-bf37-99cad7dc8bfd", "comment": "Malware payload (CoinMiner)", "value": "c0edb98ad330905bdf5759116ee63ad877eeecfb08dcd83c953172141ccdc9ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502662, "uuid": "88c243ec-bddd-487b-b4ce-8d017ad8aafc", "comment": "Malware payload (CoinMiner)", "value": "8cb4d3fc457c14bfab0a5687a74c6ac038b7d2e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502662, "uuid": "b2863dee-9df5-4f28-845a-3556f6c608f4", "comment": "Malware payload (CoinMiner)", "value": "50a741c006a419d8d95650b6c0e17fe3a3daf06c3dac4a6d0ffc3f7aa5add60347b44c960c6ceb52fa5a25da167be850", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502662, "uuid": "2abb4fd0-50d3-4330-95c9-93b23f5d3b75", "value": "T187C5AE0AF1534AD5CC9BC0BC839B7131EA357D79CE282E9B17918B613E45B807725F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502662, "uuid": "5b1a7f86-4514-4aa3-b60e-eaf293d3dea0", "value": "aa756d232dc6341b93de4ea08c5fa368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502662, "uuid": "07c1be35-de41-417c-9a83-d87f41bfaf7a", "value": "49152:xKVxKbdjNu40J41Rg/oKCQOydhYMJucKK6q3MqCc/9kyOle:xBbIMg/oFQOyrYMkcKzjw9kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502662, "uuid": "093e7628-2d2c-41fd-ae30-1485fc4d6aa1", "value": 2635776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502662, "uuid": "934fc3e9-89d1-4d30-aad3-8fba32800a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502662, "uuid": "f89d6311-2c66-46b5-8eec-c34262d1707e", "value": "xc0edb98ad330905bdf5759116ee63ad877eeecfb08dcd83c953172141ccdc9ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d1008f-0d9b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509564, "uuid": "e359ba03-f74c-42d1-b5ab-c597f11ed960", "comment": "Malware payload", "value": "ef9ba9c3b5c79ed4f2ac65cc3891be0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509564, "uuid": "282c3cdb-ebb5-47cb-b86c-c26bbb41b181", "comment": "Malware payload", "value": "c230ee6038bf851cc5d5fb561052682269d70cd99929c3794cba09c260379c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509564, "uuid": "f2d79386-bdf0-41db-adef-9b7713302353", "comment": "Malware payload", "value": "0d4513887d34eebc270502de1da44d0ed0cfc6e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509564, "uuid": "bb9e9af9-cdf4-432a-a746-ee90f8d30d59", "comment": "Malware payload", "value": "2e97a356c0fea2ce3dde29c7d0182c83019875e75f5d81936647c2c6f42cb6a1bfede8eb204bc4a2701b64b3a30f2e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509564, "uuid": "a257292f-2bd3-4f66-ae94-060ff738ca82", "value": "T1B4650107729EDB5ED5A68AB03530E23163B89FAF6415C24ABED9FCAF303538C11452C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509564, "uuid": "54ce7bd2-a03c-4d89-8e5f-3d575bb9aaf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509564, "uuid": "f954e9c9-aeb3-4987-a45d-f572a76bde77", "value": "24576:n/FI1M1IbVRw9i3Bje7W5GJfUPF1Q73pa+O8Gxv9Q5ox:n/YOIhMi5e7HUPF1Q1a+O8G59Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509564, "uuid": "e5e3dacc-1e96-4d0d-ab62-a3d40772215c", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509564, "uuid": "6f9f1bf5-75db-49a0-a6fc-404031859a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509564, "uuid": "99d965ba-1a56-4e6c-b966-8f0f5cedb6b5", "value": "FPWWcqUuB9w47xz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21090924-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1771484624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484624, "uuid": "79f52067-241a-402a-967a-3cacd43caf15", "comment": "Malware payload (njrat)", "value": "05afec9a5472fe64c8cbb56b9736036a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484624, "uuid": "b5ee6960-03af-48db-b1c4-c9639e764175", "comment": "Malware payload (njrat)", "value": "c2900be6f4c814d97e0d5c722caaef55548a8da4d50be4a3919cd8735cf86ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484624, "uuid": "62946dec-5295-45bb-9e64-ac800757ee68", "comment": "Malware payload (njrat)", "value": "4a7d40a037997cea5a51e51dcec60a20a6c05344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484624, "uuid": "bdd26f11-2798-4231-a5ec-e4084754dfc1", "comment": "Malware payload (njrat)", "value": "1ae67eb7b84a46e8db4744117bf18f4bef756c7d57385410c272a6947fc32a9912322a95e8a678061a5b71afcf56eae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484624, "uuid": "7fbc0248-509e-4992-88a6-e4b2e1bed03c", "value": "T12A13E74CB794E175D5FF8BF1B4A2B2890B71A01BA802930F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484624, "uuid": "fcfeb6c5-04d2-4b6d-bdf1-b86b85636e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484624, "uuid": "adad1c46-f668-482a-a214-fdb6ba8c5d31", "value": "384:AZy5rsVqb08yPIpXixeCGEslmcNz0Iij+ZsNO3PlpJKkkjh/TzF7pWniEgreT0pe:mors8Y5PId6ROlBuXQ/oDA+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484624, "uuid": "86504396-dcb9-485a-a63f-9c31de3c5930", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484624, "uuid": "0f366f4b-110f-4838-8ee8-7f58863467f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484624, "uuid": "7594a8ec-1fb2-4156-98aa-3ce175d7435d", "value": "05afec9a5472fe64c8cbb56b9736036a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b93a5a-0d86-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771500795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771500795, "uuid": "bb7cb9bf-3d8e-40d6-a285-ce1f889f89ab", "comment": "Malware payload", "value": "50e1ce8d692619634e28a87f141b8b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771500795, "uuid": "e7344adb-1104-4f9a-9b63-ca76767997b5", "comment": "Malware payload", "value": "c388bec860ce843bc16448568d642cc8c3afe127ac09f7758fd2e449c75fd202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771500795, "uuid": "c706a3db-9dbc-4912-b04f-9160fa3febac", "comment": "Malware payload", "value": "ac2b031e67ea5ba8f97ead025f22b4d7a49082ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771500795, "uuid": "26a15e3c-9073-4cc5-bbe7-1b94ae69decf", "comment": "Malware payload", "value": "4a70c6de29958e164623035473bfabc475daf56c1e9479827d24c9f1da85ba193d8fec8302cebe361eab3429a10bd426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771500795, "uuid": "32e96cff-8e09-4dc3-a9f8-a9333954fdf5", "value": "T106944C26B67914F9DC5BC17E84410905E731F8522B98DACF0FAC15862DE36E08EFEB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771500795, "uuid": "f6e6ef25-00d1-42eb-887b-1924b68f48fe", "value": "62334fd349500de20fed0d359142541b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771500795, "uuid": "aaf394d6-19ca-4fb1-8276-ce2f801aef6b", "value": "6144:VbvAFh1CezGpJRjILoPLhSr4mNFxL3Oivs:VbvAFh1r6ljILoPlS9tvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771500795, "uuid": "50ae7588-6f06-484b-b0aa-fdd78770a7b8", "value": 442976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771500795, "uuid": "cb2489f6-3bad-44cf-baae-39ccfd7e0c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771500795, "uuid": "94fa1b60-8756-4251-a557-49e93a44b412", "value": "18_02_2026_\u0417\u0430\u044f\u0432\u043a\u0430_\u043d\u0430_\u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u043d\u044f_\u0437\u0430\u0445\u043e\u0434\u0443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16fe8de-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481967, "uuid": "ffc1e76e-7ba7-498b-ad92-896ac8977625", "comment": "Malware payload (Mirai)", "value": "d6cfd86295684b46842722817e4c64f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481967, "uuid": "81399619-c517-43f2-a75f-02d1d0329195", "comment": "Malware payload (Mirai)", "value": "c49a964df06ea699c6dbfd7db5d55c23ed042af7f03ebf700e4663f0a6dbbe66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481967, "uuid": "fba84f0d-a911-43d8-b37b-b8529973f2d0", "comment": "Malware payload (Mirai)", "value": "fbeb66e10b4ce708d817206c8a6d29b84df8d056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481967, "uuid": "19a4b374-6877-4e5f-9da8-35499f345f1a", "comment": "Malware payload (Mirai)", "value": "c7db6987e4c5909689dbc4f8051ab204e3a5385382a4a8c702859aa7067c3391f62af8b3f340f207737d1a8b33dd63a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481967, "uuid": "6e25a677-65dd-4ff5-9d5f-57de13ca99ba", "value": "T12B146D2BB3C39CD6D11063304C316362776FDB081958EAFFDA0B3794A997B625A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481967, "uuid": "e06de22b-ba38-4b6d-b367-40c43238f546", "value": "6144:EdJOm515xCNumRrQ/oMUybgq44Sx7IKTt5:wCNhs/PsPx7IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481967, "uuid": "9327f3ef-dc48-4f79-8a43-be6f06f37720", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481967, "uuid": "d7955e29-bb41-49f7-8f32-b7a4c22283c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481967, "uuid": "68570330-28cf-490a-bedc-46c6b6efe5c2", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d47196-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482892, "uuid": "aa12b105-4fa5-4cfd-b05c-bc7930778a86", "comment": "Malware payload (Mirai)", "value": "d4b10bde99f4d27170168a2dd725b911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482892, "uuid": "78ec01b2-294e-4999-a8fe-bb57214a078a", "comment": "Malware payload (Mirai)", "value": "c5d731eb806c636ec059435137148fcd58bd6749a3f1616078b795596331bafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482892, "uuid": "74bdeb0d-f7a1-4501-b04f-9882c7eaabd0", "comment": "Malware payload (Mirai)", "value": "5660bee13550588797b223364ed825c8313bd0ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482892, "uuid": "c7aa8d8b-a54f-478b-8c2a-e69e0cb30daf", "comment": "Malware payload (Mirai)", "value": "93e79eeadf37b2c25489ac35acefd66dc9a02401e9d8f657e9aae3faebe9b8c5c2f738415d10dd91c29b424e402ef97f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482892, "uuid": "c71c5eb1-fcf6-4840-9068-4f0bdf1bea7c", "value": "T1507302AEF562BFF8CB53993CCAF5115CA1E3866A81E113C83887619939C44209FC6957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482892, "uuid": "1761d893-e340-4203-ac96-3fb23ca757ee", "value": "1536:MZ0Zv1fb/Ylw0z26KWUReLIVlC+D8tsYnJLltsAgOM2ddorM7:MZafbL30MeLTtDLltsTOBddSM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482892, "uuid": "3fb6e67f-f1b6-46a2-a0f9-95919fe99e92", "value": 75804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482892, "uuid": "82fa8a08-464d-43df-bed1-4db3a8471d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482892, "uuid": "ed9cba6f-49c3-401c-9e93-9e252c8605bd", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86579d2c-0d2e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771462889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462889, "uuid": "9de6c0ca-c8e7-4d2d-a671-af262b8f5419", "comment": "Malware payload (Mirai)", "value": "64e313cff16c521834378369f4ceed41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462889, "uuid": "a5b04104-4ff0-4771-9ada-6460fe588dcb", "comment": "Malware payload (Mirai)", "value": "c6edd8231759bf8260a5115c72869987ddfa5166c4338bb7145be81c926e9961", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462889, "uuid": "d75641e1-3b4f-481d-8237-beb2b5b7f663", "comment": "Malware payload (Mirai)", "value": "af0b8407f3db380d861ba496f9e9da9f81b1f98a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771462889, "uuid": "711ead33-8542-4eb3-914c-9e3e78b67aaf", "comment": "Malware payload (Mirai)", "value": "134a7fea9049940ca959044e5af9e087a4f478360b7833984f937eff855ccd71be366090c9b00a182b4d0cd88b56ad27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462889, "uuid": "718a477b-f93f-43c6-9c89-5c52afd60fb1", "value": "T1F453831AAF650FFBEC6BCD3745A91B49349C640A12E93B367934C818BA5B20F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462889, "uuid": "2763c8c8-7ba2-4340-9ca7-45fc60014c98", "value": "1536:yGtQ8AKyjOz8lIrDXUAF/MSL3bKL2LZgsF8qD:yM6KyazQODUNL2LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771462889, "uuid": "8107d5bd-ce16-401e-8e22-feb304971177", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771462889, "uuid": "45b6067f-aeea-48e4-bc1d-db67bc52fcab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771462889, "uuid": "926e11f1-6497-48bb-a345-136f28f0bd27", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e9f292-0d8b-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771502610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502610, "uuid": "5f0617bf-623e-428d-8dc5-c2ee7ee743c1", "comment": "Malware payload (SantaStealer)", "value": "0634ce4c8dcf31eea7f733905515a831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502610, "uuid": "859763d2-254d-49e6-bc4b-16460e53e485", "comment": "Malware payload (SantaStealer)", "value": "c7cd0e78fdf7064f85c20af3def4df27e370c62f5a8fd0e2c2815de1d3cdbf93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502610, "uuid": "0a892f80-a5c9-414d-85da-235d03895ee2", "comment": "Malware payload (SantaStealer)", "value": "ee91ed9e08ddffea0d09347aec99945c34cea309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502610, "uuid": "d4671e10-c450-4964-8bed-4eab88889933", "comment": "Malware payload (SantaStealer)", "value": "f2fab5c086a8bb501e440a12b801b8bc253776e0bc31e9e1766cda4b3898de567df68eb94dcd08ae0947a9adfb980792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502610, "uuid": "186a17f5-4cf4-4351-9af6-259a1740d6c8", "value": "T131E5330B466790CDCEB3D1BB87FA2335F633F452865A6A5FB360C5396930C70219EA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502610, "uuid": "edf1742b-91f4-4fc7-8353-4ebc580e3086", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502610, "uuid": "17f768c7-29a9-4d18-87a3-7a1976b2f4f9", "value": "49152:yjto2Rx9J1YyVKAevkZe82Pbho+bNoG7wY78eWSqDr9iygs+8sJiKZa4DR4sv4:b0xRbewUNvcY75GtiPs+8sJiKZa4DR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502610, "uuid": "d81b7cd1-3337-4d1d-a3df-c541e6a857e0", "value": 3022336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502610, "uuid": "1b98a494-79be-4080-83bd-4457570b79fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502610, "uuid": "b7bd40ff-579c-4bd9-b358-23579117883e", "value": "c7cd0e78fdf7064f85c20af3def4df27e370c62f5a8fd0e2c2815de1d3cdbf93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7240ed0f-0d5c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482613, "uuid": "4f3c43e9-38b3-4148-9a11-10449ecef24c", "comment": "Malware payload (Mirai)", "value": "18cd78f743e81252bd31ede23aa64984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482613, "uuid": "fe01ac63-4151-46ed-af02-f6571944c776", "comment": "Malware payload (Mirai)", "value": "c842f5d9ae99d308f9364ddcc4fe69031158d4ce9a10e910a3040d9089e89b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482613, "uuid": "71ccc98d-e03c-4fd0-b89b-1528173a8dc6", "comment": "Malware payload (Mirai)", "value": "fda4aafa6ac06c2b05a42da10879ffee6cdaa9fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482613, "uuid": "87ee21e2-5c4c-4af6-9080-13e69bb6ca59", "comment": "Malware payload (Mirai)", "value": "24ce387718d8ffd578d19ddd64858f7a4d95900e64d04c68895fbc53bf2b588a073eb931a7fc4b6e3b412ffdbf1af469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482613, "uuid": "e81aa3a2-34ac-4bec-8bfb-aa1545e2485d", "value": "T109530232D2D8F71FF15F213BCE6F407A41A772E6F00AC24F5A9458EDB629640E526923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482613, "uuid": "0a68d3da-4c18-486d-9994-ac3426f36bde", "value": "1536:ZFaIEtmT/F8oxwadUEW407h1JZy7zg3P/CDF5cTXiTgwAQf:3zT/F0EW7i760ceUQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482613, "uuid": "1b517518-6af0-47fc-80b1-701cb97263be", "value": 65252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482613, "uuid": "72f1c169-1008-4f13-884f-21a9073e0dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482613, "uuid": "a38c6ff4-a1c8-4646-9470-d08ca3c4a021", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d034258d-0d8d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771503815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503815, "uuid": "7ff2727a-0f51-40f5-a2c7-f8ca5214fdc9", "comment": "Malware payload", "value": "21a4c5b75623fbdb1b285996008745f0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503815, "uuid": "fd4bbc4a-b7df-4373-b758-e25948c34df5", "comment": "Malware payload", "value": "c8f3734f1ee7f6209966b4fb4df03be65435d18bc74c058bd640008d9899a387", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503815, "uuid": "d30a6008-e1d0-4a20-9de0-2b953e9f76aa", "comment": "Malware payload", "value": "1808231c958d20bd2a06e401695a70b4252b264c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503815, "uuid": "4f5dd01d-c92a-4c70-ad33-b7e495ebf478", "comment": "Malware payload", "value": "208b4d077eaaae8254381821ff421b5794e298435c2f3cf1dcd64bd39c1b03b43852f57c4ba5818535e510bff414039a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503815, "uuid": "52fe68c0-e24a-4942-8a3e-130c7d7998fd", "value": "T151357C83E7A385D8C166D8B5534BF137F9627C8E4A153196ABC41E633E77B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503815, "uuid": "32d687f7-7396-4442-903c-11dbca8588e7", "value": "26b5ef95ca1087031e1773e20c482ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503815, "uuid": "6b95ed7f-bd9c-4314-bdfb-8e3eb2feebee", "value": "12288:4VgGe4U/H/6S5Wu9sdc90EBBBHGBdSKikwLpvgqItNq:4VgGexv/6K6dEHkwNvg3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503815, "uuid": "0606c883-6e80-4b15-b762-d9a82fdccf33", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503815, "uuid": "05efc857-9335-4dd5-b4a7-df8ff4588b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503815, "uuid": "758a16ea-ffe0-4665-abd0-0d478ead6f48", "value": "XenoExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9683ab96-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771512309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512309, "uuid": "85d5280b-e84e-4a9c-b998-c476142df5ad", "comment": "Malware payload (AgentTesla)", "value": "1187cdee109586da90f3fa0cec158d26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512309, "uuid": "e8038e16-2d76-456c-8937-2b416cb70d4e", "comment": "Malware payload (AgentTesla)", "value": "c8fae420a0e0ad1f9319d3299955f4ca0a6e4638411084c540bed8103a9278c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512309, "uuid": "e6bc11c3-8826-4aa8-9106-f876121282c4", "comment": "Malware payload (AgentTesla)", "value": "d9196b608390c8898d4cead1270e28aec5a98b0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512309, "uuid": "6d47e072-6dcb-4a83-a466-56742efeda52", "comment": "Malware payload (AgentTesla)", "value": "0f46f835985cb92921e81a972217dea54ea584ddfc3e3098078e5e625a3a121e3479f71171895c0f76f3065967618e30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512309, "uuid": "008a468f-4716-4b42-b039-e8505f4eb4b8", "value": "T1D92501322D421A24C9750F7AC016259473F0D947512AEB2FAFFC41F86DA3F49CD2B6A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512309, "uuid": "d045042a-0dbf-4e4a-ba2f-15aadf50ede6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512309, "uuid": "f6531923-21c1-44ee-8266-1ef8d7c1926c", "value": "24576:K+QBEhpLT/4PPH7caoc7vddwAKoGXaf24JblNB1:ftLzswaogddKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512309, "uuid": "46461909-805b-4277-8a12-283f98167197", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512309, "uuid": "ed733553-3f75-489d-ad6d-92e96c80d17f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512309, "uuid": "24c577c0-5b84-4ddc-b5a9-46270293dfdc", "value": "SOLICITUD DE COTIZACI\u00d3N MK VERSUCHSANLAGEN INCUBADOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45211d05-0d9e-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771510884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510884, "uuid": "2ec8f4e1-746d-4e97-b086-293b8c9dd5c3", "comment": "Malware payload (SnakeKeylogger)", "value": "0b74efbf3111b5c9e234273a9c3ff022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510884, "uuid": "0dc82791-ac2e-4198-8bbe-260872b7eb0c", "comment": "Malware payload (SnakeKeylogger)", "value": "c9e504d56ed71be71383b1beff6eb417d558387ec1e1a1e7d791dc1fab5b6701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510884, "uuid": "b7129c57-4baa-4984-82b3-c24d3cac80e1", "comment": "Malware payload (SnakeKeylogger)", "value": "1db7305d9f8c19dfafd68e484e2160e11d574615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510884, "uuid": "0e6bdc0b-1307-411a-90ef-210ddbe047a1", "comment": "Malware payload (SnakeKeylogger)", "value": "3d6dccec460715f3ef6ed0d2e4b88de383cda694fcf834a98033eca845e7859d237f6f5481b4c85f0e7f32bc30549c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510884, "uuid": "d33ec0a8-5ee9-44bc-a800-18b1fa7b4047", "value": "T17C0612027381D062FFAB91334F56F6225BBCB9260127EA2F03981D7DB9705B1563E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510884, "uuid": "eb25b680-ba1e-4949-879b-52d398b1e2ee", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510884, "uuid": "21262b28-f2dc-41af-be57-2be6698a091b", "value": "98304:5TYbInGOZ5GZE7nnoiztYZlpP9XfrmMwI:5cb2BZ5GZE7oiBYPp51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771510884, "uuid": "16c9f652-fa2a-4eb9-96fe-42d6ee21b92f", "value": 3727360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771510884, "uuid": "5f2092fb-6274-49cb-a463-30bf2df8499c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510884, "uuid": "63d47b6e-9499-42d6-b569-e90606030c21", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb35ce89-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481956, "uuid": "290f870b-d7bf-4958-8be1-00320bcc1955", "comment": "Malware payload (Mirai)", "value": "e1c36e0d03393418cb54812820803ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481956, "uuid": "d5e1a328-5da2-43f6-b6b6-812c087515a6", "comment": "Malware payload (Mirai)", "value": "ca0cd0a3739329808d9c51c93dbb7d220e9504b4e847a217074e95595d5e552f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481956, "uuid": "67136942-a581-4142-87cd-a1c4b7480c30", "comment": "Malware payload (Mirai)", "value": "8d792841cee551f9449bbcc58ab3337ce624036a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481956, "uuid": "815d3ae6-bcde-4287-af07-9e6954352c25", "comment": "Malware payload (Mirai)", "value": "a15cedc2784723095ef324cde62b6f2bf465e4570a3909078dabe662b66a874ee9e9804d89d5cc57e063ef263534ac9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481956, "uuid": "42309b6a-78c5-46bb-92c6-1de29f5d4bee", "value": "T144B34A02B70E0F43D2632CF02B7B17E197DAFD9116B8A580612DBAC59374DF62186ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481956, "uuid": "678ec004-e0a0-4584-9ba6-a1de3bcf348a", "value": "1536:DWlZFqCtbcFrv+t9rDRPKQL7svMh7KPNHlU/Az6kF92m30y/A9p39VeqLk9vpyy3:DWHJbyvqDdK5MMPNHLxrb0y49ds3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481956, "uuid": "8c1dab8a-1170-4cf2-9e30-d61772018cc6", "value": 118112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481956, "uuid": "4ced63ad-8d9a-45e1-90e4-aeea08cf0972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481956, "uuid": "85e46d1c-3da3-4b99-ba20-bb3f465b6290", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194d3f28-0dac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771516823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771516823, "uuid": "0e77e3d3-9dce-4270-b1c8-5ec63fb2c500", "comment": "Malware payload", "value": "76e983d08569fc6b5ce998bd91219b72", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771516823, "uuid": "03576a00-66af-4c93-a95f-caf5e8f5af31", "comment": "Malware payload", "value": "cb158ee29be61a8e8c18dec9b0a706e2213b5e488c2809be4a4fb3037f6edef5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771516823, "uuid": "7ae14d97-504d-4473-baa8-ff91eb67998a", "comment": "Malware payload", "value": "1177d2ec87d57fb2e9b4024c77f5776b967a0f13", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771516823, "uuid": "940db373-4142-47ce-8574-544a7d4a7439", "comment": "Malware payload", "value": "6e58e9cf0c4e25217c02c2916e3b1ea2c21163678945dbd037b6bcd0a44d5b5b1545edc2320879040c1deb18f7458d51", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771516823, "uuid": "d3d6bf38-a700-41a0-aa8b-128900d659d5", "value": "T16045627839E0F3307D09DD1B33F254E5CD08BA12188BB2EA19DF4E9C9D356BB9589924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771516823, "uuid": "4ed2f1ab-fc54-4223-abb3-3c1a29ac6246", "value": "384:153rn7sQRl0+REhbHYPqLhemelWHSMo8/q3uY12qOH9Cg05mRgnFc3yfXcoMcnL:157n4Nt4weWG8uuY12JHkroRHoMcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771516823, "uuid": "2dfd0055-8394-4367-b7b5-b887c7222ea6", "value": 1184152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771516823, "uuid": "a2eea14a-eafe-4a2c-a3d6-ef0971027c09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771516823, "uuid": "5bf4e391-737c-4107-8482-dce5e72f7135", "value": "z35PEDIDODECOMPRAEPERFILDAEMPRESA-2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1094b8-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482894, "uuid": "b0deb858-6a32-4a3d-9cca-9423b25d865a", "comment": "Malware payload (Mirai)", "value": "982114268a8c333570051b171a550c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482894, "uuid": "404087c6-ebba-4bda-aaf8-dab16df17d08", "comment": "Malware payload (Mirai)", "value": "cb770312983dcc409bf5963e1fb5f3755db312a7e8f3bf64e11e08ad1aa55336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482894, "uuid": "c34ba2f8-62cf-4898-89f3-ef35b777d22d", "comment": "Malware payload (Mirai)", "value": "6dca0d09226b69bb12fe6b265b6410ae7818a7f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482894, "uuid": "f57668bd-5ebc-4594-b2e1-0dcc5bcb5042", "comment": "Malware payload (Mirai)", "value": "ed6647157b8f83dae08e22aaafe7b83dc6955cb6a18100504ec189997d70cbae1a26b21aebfc42a713f65117d24b2aea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482894, "uuid": "d7e3a76b-9e8b-47a5-8e0a-ea6634e2058f", "value": "T174143C537B224FA0D365C5720BB38B1A5DEB15411EE298D5932CCB103E20AE96C9BFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482894, "uuid": "a7f00665-bff7-48e8-a8d2-a1f7d1cadc53", "value": "3072:JMgrk+4HHTNYlvWBfb/3MwrM+gs7YplbC3qWQ1tpr:FrfIHTNf78wrMHs03C013", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482894, "uuid": "d3c8157d-ffd9-48a7-bb1a-db49c04d175c", "value": 197612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482894, "uuid": "6a1b5678-b73e-45a0-a6e3-f8b66df478cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482894, "uuid": "c5273ad1-5460-4819-bcfe-7b99fbb1b219", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a91e073-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771512181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512181, "uuid": "fde3a941-8303-480d-9022-21b7eeaf9606", "comment": "Malware payload (Formbook)", "value": "7794c7fb063ccf4063714337e0a2364d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512181, "uuid": "88ae4165-62b9-400f-9693-679b14f6157a", "comment": "Malware payload (Formbook)", "value": "ccaf12a84ec8278678602b9935798332058711387aa3edae68f59addb673e6c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512181, "uuid": "4a11c75b-9fe0-40a8-ba36-4cb49348000b", "comment": "Malware payload (Formbook)", "value": "b377ff2fccd43368042abba0baefcdbf3e572697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512181, "uuid": "c89ea52e-b8c6-41e9-a13b-704eaf65d6fb", "comment": "Malware payload (Formbook)", "value": "7858966ac4a93b8b8b1cd204b81130f39c56dd5b0a03c9ff3cc7246d077d23783f40567a0faafd26189da03e0cf63ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512181, "uuid": "b4c92bc1-b8bf-4531-8d38-f6af1ad52123", "value": "T13645BF0273C1D062FFAB91734B5AF6115ABC79260123A61F13A81DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512181, "uuid": "3707ae8d-fcf8-4851-b34b-d0e2a1c9f10e", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512181, "uuid": "002dade5-d281-4e8b-a072-785d4426bc9a", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdavj4GFG7fdzi3J5mBMWI+3rmV0t:0PVt/LZeJbInQRavs7F4mBMWIOra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512181, "uuid": "6fba83df-890d-4eca-9d9b-9e13102080af", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512181, "uuid": "aaff56c4-3fef-44ea-b3f9-feedbc6f34fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512181, "uuid": "250c8e06-101b-4848-b319-51e1143762c4", "value": "DOCUMENT 1011DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca42b38-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771484616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484616, "uuid": "c49c441a-7745-48f1-aca6-6dc051926fac", "comment": "Malware payload", "value": "6fd491a5936e696a3c4ac8f548231cb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484616, "uuid": "58f2d326-2374-4b17-9d1e-237fd177a4ab", "comment": "Malware payload", "value": "cd1703d5242c6cd2420ba564376f822366b52ea296d1bb005075c9b198a16501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484616, "uuid": "444afcaf-2849-437e-a14c-459bd2dd746c", "comment": "Malware payload", "value": "5af384ff032fea6ed9046442449c7bf6f6f07c16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484616, "uuid": "4c272f95-1c5f-4d74-b683-864c6c68ff03", "comment": "Malware payload", "value": "3a4c09f98dd724eb75edbbd4dec400cf085a6905bf56588e8641b53eb126a223dc3b626626d3f0d863c5e3947079d4cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484616, "uuid": "019c8689-670b-4d16-a994-7e5c349c8a35", "value": "T1DC83D60AAFB12EBBD4AFDD3345A60749389D550621B57F3A3A74D81CF20A64B15E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484616, "uuid": "3b032477-867d-441a-888e-6e5a50229ee7", "value": "1536:323Ycve6ucgOn5/iGoToGXIv3SP0ERqJYCZRb5s812MHN+L8p9cIrZfqFX39wu7t:3ChIoGa7/IXAU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484616, "uuid": "d13f9216-c801-430f-86d9-3341e744bf02", "value": 88396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484616, "uuid": "2834ba2b-0c46-4484-a5ea-57ab9214d5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484616, "uuid": "bad3331a-f09b-4e98-a63f-5044d58f91d3", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e91efb3-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771493344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493344, "uuid": "3fda6584-38dc-41fb-914a-764592ae2c9f", "comment": "Malware payload (AgentTesla)", "value": "9fe1785e2604c34bb6480f83a7323e8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493344, "uuid": "b01a37e7-f9e9-407a-8591-fedd987ca4d7", "comment": "Malware payload (AgentTesla)", "value": "cd329814d045ab4c69754a6f45391850bf125f225574192634fede704f735d6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493344, "uuid": "e7e773f0-6a82-4a4f-a6ac-0caac0dad6c7", "comment": "Malware payload (AgentTesla)", "value": "999e7196930e49f0cdbbae29b40c2f70225266d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493344, "uuid": "4b5527d1-ee5c-4bc5-875f-e5aeb9c8771c", "comment": "Malware payload (AgentTesla)", "value": "43dbdea6985f90b0cab1301a34c7d62484410ef457d409797202a93f7de486c5baa32283013f1dfca6c6bb99ce2dfa66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493344, "uuid": "efd76d31-31df-4649-ae85-fe6fcf39f1be", "value": "T1AD659F0E80D92EFCFC4C4D8926BF5A6B858218FF89D6C59C7AB0DA75567903708313E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493344, "uuid": "7f307672-dcb4-4dba-9454-7ca125880b66", "value": "12288:ZkmmAyxDiycsqHAV8j4TUr5YsDIMcviLa4QUp6ixfnfwcR1m2CsH8uUSmYWZ/u+0:ZkmgxD829sDIMcD5+1+sGtg+DhhJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493344, "uuid": "9aae0c46-5168-4610-9ef4-9ca84f20a1e5", "value": 1418231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493344, "uuid": "a66c02e4-3b90-488b-9eda-cb2c11a360a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493344, "uuid": "04062f39-4460-4a4e-bfdf-b3f96a043e20", "value": "Payment Advice - Advice Ref[A2mQhxJUbfPy].js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa2f61d-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512208, "uuid": "84661adb-14f5-41ad-87bb-e356a381e98c", "comment": "Malware payload", "value": "15759a3c297492d2262ff36e93e0565f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512208, "uuid": "effea295-2245-4504-b0bf-11aa21ae2131", "comment": "Malware payload", "value": "ce92f7320232dc9b217f5e54f6776ba32489f4df17ef561506470999d7128a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512208, "uuid": "813d36bd-13fc-4537-a6f5-de703a61ba4f", "comment": "Malware payload", "value": "86ece0d4a1b9dc1dee38b2d3472ca45830618a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512208, "uuid": "bd35604a-b5d6-4cc0-83de-93ecac5b884c", "comment": "Malware payload", "value": "7861eee7f7fdcae36113766bedd4378d120c9e13d102b31e04e52d8caf49b8b6855047abed9734a8f45eda8a24e03d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512208, "uuid": "cea29dd0-2967-4e0b-9c9a-c0769e6655ff", "value": "T110152314BBD1E53BF1CD073218A60AF10FF87D1A8791A14B5390BDACE479A94DB25B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512208, "uuid": "90aa78ea-bcf1-4052-a4f9-a89c4a8798a8", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512208, "uuid": "8aec1ebc-62cf-4672-a649-b9ece92a8b32", "value": "24576:J3dJAaVRwFx/S8IPaylCTsuJlsOSpMYWzAb76VAtuuWSgHX:J3tacPz5uJNzAc0WSg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512208, "uuid": "72db4433-2336-4bb2-8960-55176ba62d0e", "value": 878064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512208, "uuid": "7443e410-d4ad-4659-ae96-76b5b8aceaf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512208, "uuid": "2edbe8a8-f28b-4b9a-a963-4cb00647b2e1", "value": "Etaminers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0c798f-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481666, "uuid": "40dc8ce7-b333-44c1-a59e-bc6c27aa9d92", "comment": "Malware payload (Mirai)", "value": "33eb0330e369197e475a8bbb76568dac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481666, "uuid": "310a4851-0e69-4ddb-a4fd-61291de0566f", "comment": "Malware payload (Mirai)", "value": "cf790014ee477293f17867568261e576147e763fa8d36c04aa653880b05f5e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481666, "uuid": "c23947e4-f475-423f-8593-c73620703dcb", "comment": "Malware payload (Mirai)", "value": "7a3592df464d128fd7c796553ea462ad3131a1d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481666, "uuid": "08ae7982-9c96-4705-b0d1-09f22a2edd4a", "comment": "Malware payload (Mirai)", "value": "91dddb1188c677b9a8961b8fde2cd9176eada3acec3703ba9289f80c8f02175182041912a04246b6992184a816af5804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481666, "uuid": "1217611c-67d6-4ac2-8472-e1a3ed69d50a", "value": "T19F53F1F51602DCA1F17F7AF65AA147AF472148E33E57CB91819DCB3521DCF0AA2081B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481666, "uuid": "9013a1c3-ee2d-45ed-a981-d4a3f9ef12c8", "value": "1536:ak1xumXVqaiMoNkwGw6ZoMNAeRSOTuAegDPffvxSOZI7CviLkg4azHG:akWmX0eoFMNAeRTaApPnvIOe+6LGazHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481666, "uuid": "e97249fe-328c-4a13-828a-4bd6776e9592", "value": 61832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481666, "uuid": "8a8b7113-62f5-4a35-9191-3c319b8abe7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481666, "uuid": "af4014ef-d622-4e2c-b058-5479c36a1d85", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61c9c0e-0d8d-11f1-a129-42010a9c0007", "comment": "Malware payload (PromptSpy)", "timestamp": 1771503852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503852, "uuid": "be458370-c05b-4249-b1aa-a7bffd908da2", "comment": "Malware payload (PromptSpy)", "value": "e7dd284c175192580a97f843b7629689", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503852, "uuid": "6b8d7bf2-d1d4-45de-a2f1-c1b0e0209d29", "comment": "Malware payload (PromptSpy)", "value": "d076268a34eb62ba17aaf3cfb244998bd3a1a9a4c1ca98d21944d94da30f42a8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503852, "uuid": "2e17d4ce-5ec9-4c5e-a136-d19ac6bfd1f6", "comment": "Malware payload (PromptSpy)", "value": "9b1723284e311794987997cb7e8814eb6014713f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503852, "uuid": "39d01027-a2ad-4434-ae3a-0de089911e70", "comment": "Malware payload (PromptSpy)", "value": "984cb0bf154452ee15ad0d192c9e5de1d90f602b5ecdbf7ca6a453beca1b4796f693d53385f12917096827028367c0df", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503852, "uuid": "d8660d25-385e-4563-88e2-a9db5b2a7f0b", "value": "T105F62342FB68AE1FC83750320D4B473556596D23C7468347E9783B2938B76F80E897E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503852, "uuid": "a019a793-fd9c-4a7b-84d0-66ca16848543", "value": "393216:CWpb9cr+pfCFm/2i6UE2klfvyrai74rv2OXSUbm7l5Hnb:CWpb6rGfMm/jCfar/Mrv2amxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503852, "uuid": "5cf62481-e498-46f1-a1c5-f28069039f30", "value": 15831131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503852, "uuid": "6ef60fe4-8ada-47f1-811f-6eeca2ba10c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503852, "uuid": "3fdee125-0e93-4bcc-86df-2f0b52871d5f", "value": "mgappm-1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a350b6cf-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771512330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512330, "uuid": "70248d5c-501a-4767-9ede-28cf41e049de", "comment": "Malware payload (AgentTesla)", "value": "d66e5e5dcef1f1f4b9339b22d21782c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512330, "uuid": "5e2c9b84-9a2a-49d9-b89c-5ba5569ab6d6", "comment": "Malware payload (AgentTesla)", "value": "d53126947017ddac4656d193dc2c95bbf69c9ea3775e35e5f51fddb362b94954", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512330, "uuid": "9f8f5693-2af0-401f-82d0-5cba2b7e86a9", "comment": "Malware payload (AgentTesla)", "value": "93e43bc176ed727b41023adf030642cc3ef617ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512330, "uuid": "0f5dfb2c-ea17-49e4-8e7a-4eeb15fe1b5b", "comment": "Malware payload (AgentTesla)", "value": "4843e37742be2920beb4ab3b8df0301e69804e0b6d7f98d973a0d78e37d9608717721980a972bddbbcdfc038f81aa8a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512330, "uuid": "4a1a9990-bcc3-4f8d-9238-4d1d367a1d1a", "value": "T1BD151206B710C91FC4670B719A32F2B92775DD05AD511B4B27D8BFAB3D72382CA0639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512330, "uuid": "fc4216ef-34cc-4a3f-89e1-baffbd16c1aa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512330, "uuid": "767aaba8-1692-493f-9ca7-2c189c6e28f0", "value": "12288:8RpNfR2xZk9G2uhy0/U+CHSy7+8892YTQ/Ue1Txon6dB9mf0+5CtMv3lRpcMX:8zuA9JhyQ89PMUmTz1+5VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512330, "uuid": "33903ee9-ca42-4ad8-8026-e99a43a30c7b", "value": 885176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512330, "uuid": "a1b34d92-8d16-406e-a309-2f541b3bccc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512330, "uuid": "f39749b6-371a-457b-bd97-502c15782142", "value": "\u03a0\u039b\u0397\u03a1\u03a9\u039c\u0397 \u039a\u0391\u03a4\u03a3\u0391\u039c\u0391\u039a\u039f\u03a3.pdf.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd209ee-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482306, "uuid": "1c7bd2a9-98e2-4421-b642-36acea567727", "comment": "Malware payload (Mirai)", "value": "80c700876bcc737c8df1b2c36b0945af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482306, "uuid": "123c4eec-3e12-4964-9123-4c1b589d6dd5", "comment": "Malware payload (Mirai)", "value": "d5756bf69724a1ee6baff284dbef17729e94c5ddb3209f2c3910a92f176cf762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482306, "uuid": "1ca7a848-cf93-4f4d-90f6-3556802e89a4", "comment": "Malware payload (Mirai)", "value": "c3feb576b7d458de278b060b082a0a48af537600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482306, "uuid": "64049bbd-560a-4288-9615-2da85bbb78bb", "comment": "Malware payload (Mirai)", "value": "c1a3c6dc284ca514c645364430196546a73dafaa5a6b68337cf2572437105f96578a51346f22e1bdfde10a7d7eba0084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482306, "uuid": "12da5308-8375-4dd2-a0bf-469599efef39", "value": "T1EFB3E148B614EA55C02772FCB14609C0E3B15EBB6BAA5A065063F5B46DBCCD03F07ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482306, "uuid": "32c0a9c9-63c4-4768-abc2-afde346cc1c3", "value": "1536:XFN7EZMO/s5G0jCRnI577NlM3yLoWJI+NMx75Oep7dZuJ8bkhj7S6ppupgwgF/lc:nkMOUCRSNlMUI+Gx75Nv28bO1uewui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482306, "uuid": "7ea50cc1-a615-4f43-8723-e6970e4a0898", "value": 111776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482306, "uuid": "55163178-0540-4a70-b742-9ef2c24ed208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482306, "uuid": "89cace07-b17b-4a5a-b838-fb9dfa4254d6", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d798d3-0db5-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771520736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520736, "uuid": "8c41ceda-9f4d-4102-99a9-cba25ef01d05", "comment": "Malware payload (QuasarRAT)", "value": "26bd189b85859591b87b6ad76c83d4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520736, "uuid": "cd47423b-b160-401e-8fa9-27fa296dc482", "comment": "Malware payload (QuasarRAT)", "value": "d61fe84902836ee1f89b96bd840c3d7e8679d45e45793671e20438b0cc10213d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520736, "uuid": "2a28b85a-c20d-4228-8176-b9375adb6b1e", "comment": "Malware payload (QuasarRAT)", "value": "afb63605a8a787147e97f1593837514686eba0bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771520736, "uuid": "86bd2943-27ce-40f7-9839-f0acfbf226cf", "comment": "Malware payload (QuasarRAT)", "value": "8969cf3bac4efd6887de7ece038b133d19176f230988faa5d05b4cbe12213ed5205d2373984a8948cde2ebb405679d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520736, "uuid": "fb57b879-282e-4cfa-9ca2-aa2e70385b59", "value": "T1ECE55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520736, "uuid": "34e532d4-5406-4c4d-acce-c1f82460dd81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520736, "uuid": "3a2c4c9b-5af7-4feb-85c8-c4ce318d0ba3", "value": "49152:OvWI22SsaNYfdPBldt698dBcjHQyQaEfeDk/l4ooGdQTlTHHB72eh2NT:Ov722SsaNYfdPBldt6+dBcjHQyQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771520736, "uuid": "6351a183-3678-45d5-9e1e-afe7aff7f184", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771520736, "uuid": "d8598a78-7c23-4a53-b239-7623260e6721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771520736, "uuid": "522403aa-a290-4547-b1e3-706b77b8ceb7", "value": "26bd189b85859591b87b6ad76c83d4b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e691e23-0da2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771512537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512537, "uuid": "440596e8-f906-4418-9da9-e98286cc146a", "comment": "Malware payload (Mirai)", "value": "c43229e935f2c2b407224073129662a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512537, "uuid": "53c00e69-6ddd-462d-8cdb-f1d495f1b303", "comment": "Malware payload (Mirai)", "value": "d759bfd882a6e19267872f45585e94f95ad4de47f665c2a7353691cf6cd1662f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512537, "uuid": "b3323fdd-089b-468b-88ff-df55572b0a3d", "comment": "Malware payload (Mirai)", "value": "201c2a27a2ee57392bcceeca6064c7187708d74c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512537, "uuid": "db835981-1e25-48d0-ba30-cabef0a745a3", "comment": "Malware payload (Mirai)", "value": "8de3f8b760e2dca313d4f8b94c31f67a1d2e8103133a52389b335f624b003462f88d97f5ea91b604501f3d781bf44b17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512537, "uuid": "c2861b38-5089-47f8-ba60-13484241743e", "value": "T15A4301D01761278C4371D9753CDE304E86341A2E72EA2D102DABD18AF45A62268B7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512537, "uuid": "9c42e244-a124-4e18-b8fc-be2c17a7321b", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAd:8D+CAXFYQChaAUk5ljnQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512537, "uuid": "243023d1-62ef-493a-9b30-65084036964e", "value": 55900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512537, "uuid": "971a2796-12bb-4f28-af3e-3f1abb3b82ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512537, "uuid": "5e84b8a4-3b61-4715-b206-2091fe3a6762", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8439fa-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1771493392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493392, "uuid": "ddba78d3-d236-4c28-bc64-055eb95284ec", "comment": "Malware payload (DarkCloud)", "value": "f7095f086bba330dfd57456e9c499cbf", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493392, "uuid": "46a31ae2-3730-440f-b297-fd3eb052fa9a", "comment": "Malware payload (DarkCloud)", "value": "d81085efe48f293e94a5bfcdbe1f88b9b7d64537bbdaa27fa88a78b7a31198d6", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493392, "uuid": "0ae5a07d-0098-4524-ab3f-2db99679f813", "comment": "Malware payload (DarkCloud)", "value": "56d33ca6028d4c54f831ce82fbb04dbf74190133", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493392, "uuid": "3d5e4b23-4d1f-4e78-8cf1-95d4a5f645e9", "comment": "Malware payload (DarkCloud)", "value": "534abd86fc1f47f776183bdcff867feb6044759d11274dbecb9654f0b62888dfa012d8bf1165ef9960c1c4f5aaecf0d6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493392, "uuid": "d8ce21dc-e093-4cef-a39e-850ba810c1d3", "value": "T10735E5BC76D296815A6E502CBFCCF53DDC88D09D594E2EC40780F499BAFB21A10A4F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493392, "uuid": "1e6bc75c-4f8b-4695-b0f5-9983ff1c6486", "value": "384:XTdcgHCRHPYDDoWzxKHz1DZMWyZeZ527cRv6lr37BjRi7T:niv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493392, "uuid": "0b1b276f-e3e8-4a9d-b0de-bdb6552cfb28", "value": 1134570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493392, "uuid": "20264542-a51d-4312-a363-8bfa5edb2eb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493392, "uuid": "ad404af1-0288-4666-aa15-b5a79c5ab9ff", "value": "INQUIRED ITEMS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b36478-0dca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771529697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529697, "uuid": "a5b8b785-3032-4336-8175-2ff2e7882c2d", "comment": "Malware payload (Mirai)", "value": "78385f1546241355647082f1b4bea419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529697, "uuid": "fe7a7bf0-307c-4af5-a295-9a7d40e60334", "comment": "Malware payload (Mirai)", "value": "d893dd82b222e8a19cb4c009e7c2aaa2761930f88d3b81d5f44b32d15ebc8d87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529697, "uuid": "76abc8ab-e129-4fe8-a044-a69d4664fc19", "comment": "Malware payload (Mirai)", "value": "a079f61777b51d4a250d4485bd24f30e2b462014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529697, "uuid": "5872d5e7-c1cc-4e9b-be52-7469050dcf54", "comment": "Malware payload (Mirai)", "value": "a07e8f36a9fd3aca5a256791c61168633e4ececff6fc21e4b63115c116f5c15f5ee395fa94f99a4048116fad213452c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529697, "uuid": "87adddcb-ee4f-4386-8ad7-57b3262197e3", "value": "T18BF2E1A2CFA2EC82E9E750721C3E75A86CD4C31E8748117C87E56535E4A5BE43C993F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529697, "uuid": "a8b83d39-95b9-4edb-9798-d1a7096efddb", "value": "768:kk/MtPQlj3d8ShZrOpk+eZwM5OkwNwbzipe/EkNj2iv2AEUKChnbcuyD7Ub/2k:j0tGSShMEwsOOzB/Ek5ZeA1thnouy86k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529697, "uuid": "c0a80eee-6195-443e-a3ab-929d54f359f3", "value": 34980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529697, "uuid": "31c7222d-2446-43ed-982e-7f1660f9fe7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529697, "uuid": "6728ab75-8c63-4259-ba09-62ef84a17fe4", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95cba55-0d74-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493067, "uuid": "2fffa149-68f4-47fb-b725-8737464c70de", "comment": "Malware payload", "value": "a31c9bb9e548b1c28a6d4d9c877f21b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493067, "uuid": "c9b35036-fb2f-4580-9601-7dea12779fbf", "comment": "Malware payload", "value": "d8a18c36db996b7e2d9e5b511044af81349b624dfb2d58ee4fbcb18a192f2b52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493067, "uuid": "37213f01-b450-46ab-bb37-edc7ee350216", "comment": "Malware payload", "value": "2ef033a7c937d2e808b4ffac51910d88007f8edb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493067, "uuid": "dd484cae-3ae3-4881-8fa1-79ed6cb59d13", "comment": "Malware payload", "value": "0a312a89b9acf1e0d963e12e3dce5d7aabd38ffbdbea833432c4f5844b90b9fdaa1aabc63421e3ad9f41b74331232ad6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493067, "uuid": "bfd5878b-406a-4f03-b8cd-e3feda623b84", "value": "T13BA275CD3DC2B166136A603B3A2FE46AF27B5C88F64CA594E9376554F494B08C863D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493067, "uuid": "2c02b505-c27d-42e9-a3aa-3ec6e393072c", "value": "384:P8H3/ngpovwpYy00aoJav6T5thFOmF2HxckCOFwNcr8CWEhY:a3lvw+UT32CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493067, "uuid": "2a3f0f7b-7f2f-4d21-8db6-382dd26f65dd", "value": 21967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493067, "uuid": "1c5daf5f-277b-4884-abaa-95d3c755d986", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493067, "uuid": "e2f37d1d-085a-4df2-a1de-8e4f460ba23a", "value": "PRE-ALERT ==HTHC75331529.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37e534e-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771483151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483151, "uuid": "cafb2406-cd1c-48d7-8b5d-5ada1d3d63a1", "comment": "Malware payload (CoinMiner)", "value": "96548d5c9c81b47a6347f170d7eec4cb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483151, "uuid": "6ff9b089-073f-498b-8b28-79ed3da99d4a", "comment": "Malware payload (CoinMiner)", "value": "d96d8f4f3bc61126be2d5781892ac2f6e39e3eef3054c40b14a2bce3b57f0e83", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483151, "uuid": "6ffae8f0-82eb-4dde-ba46-2a4818c1aa11", "comment": "Malware payload (CoinMiner)", "value": "dfd623d71dee822c4d445803356d0ee091d0db85", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483151, "uuid": "d8fdf9cd-f684-4305-8e1c-f42dcc8c8fab", "comment": "Malware payload (CoinMiner)", "value": "375ef1e6210cbf19522d41ed8fd534d9ae594a46ba36bc40b2d1076ce59b5c8e706ccedffc4362ca5fc646d00150f187", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483151, "uuid": "6bdca082-8bbf-48c2-9caa-ade84177d8f1", "value": "T1FC31AC8297227E783CC561DDB1AA4499A045826F15BB2FB4B4C99EF62F0C440F278FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483151, "uuid": "f3ceb888-32f7-41e0-85a6-59adf31dc6ed", "value": "24:VUeYj+H1TDMK9CFdYhEnHQ6Yc60mW+nl72tZ9HX9I59n5RiQZaZl1cSRs/:VUeYj+H1TDMK9CnYhEMU3lXMnPvjSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771483151, "uuid": "99d9916d-72c0-4b08-beb9-8e10db49d17e", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771483151, "uuid": "40b6002b-2a4f-4c0e-91a5-90b819494551", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483151, "uuid": "8b1d0c29-0a4f-4404-bd46-53cde36e3786", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b9f4c8-0d7f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771497574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497574, "uuid": "322ed4c2-8927-4f4c-8794-ac089b75d978", "comment": "Malware payload", "value": "57fc13bd3dc8a2429cf80876adf51b5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497574, "uuid": "c85c98da-a4f2-48dd-b397-b7c2247d4907", "comment": "Malware payload", "value": "da42f0546edf5311594f8a2aa9809c0c7be5838878986b90bc6bbccdf5cf4612", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497574, "uuid": "3baf672e-6180-4511-ab33-043927654efe", "comment": "Malware payload", "value": "b81fd8ed4296fbba9e82dcb81a20010ca35f1340", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771497574, "uuid": "40fff37e-ca9a-4dbd-bc80-8136b8df9fca", "comment": "Malware payload", "value": "580e8731a4dc13e71347de0f554efd13cce1f5dcf20606e348868078e42832f6b4c03ae4a3885595714523be4c061ed4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497574, "uuid": "707f533e-1b58-4231-8ae1-a168e90fd4c1", "value": "T15043D75492A83B6A73456FF73E2270D2D048045C304D499BE8E4BE2CBD8667AF6FB531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497574, "uuid": "af60e51d-351b-4709-8373-0089d338722e", "value": "768:xA22OIrJ9tMjZee4fm83BiynfyECg1TvZO8krapb4KSN5VghMRXKZlqABoy1OOp8:4dB3pvnkrapvEalRcOVAWdIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771497574, "uuid": "f8e79a46-91cf-4f1a-b8fe-a673a8e07378", "value": 56485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771497574, "uuid": "ebe864aa-058e-4c37-a1e9-c6065a268e94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771497574, "uuid": "d2ce8e10-ac72-47e8-8d25-7d5fe01c49f4", "value": "WtAg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d1a97c-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771493410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493410, "uuid": "87d8e2c6-3d28-4360-8378-e6e02b7e06bd", "comment": "Malware payload (PhantomStealer)", "value": "5403a2585e749447b61e3da97ca40f58", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493410, "uuid": "cee49559-a147-4b9e-b8d6-04c402f33cc8", "comment": "Malware payload (PhantomStealer)", "value": "da9a6f21174dc755d00354b0b41d309029a3019d72830476a183637481f57cda", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493410, "uuid": "525af29b-1128-4a1f-b1f4-a6493aa6011e", "comment": "Malware payload (PhantomStealer)", "value": "e3bd7245f0e3dfdf9ef097fb0a066fe07e34bce6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493410, "uuid": "1f672131-6737-444e-a0a0-80c39a821350", "comment": "Malware payload (PhantomStealer)", "value": "a1573bd103f5c14aab3615b172fd46a51fa806ef3786bb25a564742e31ac823947b1de9349986419c9fc2373c21ecf83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493410, "uuid": "56a530d8-23b8-4a43-816a-43b8d400ee7f", "value": "T1918417B0DA1001778F86BB9CBCA50660C66DD325853709A0F6D9CB0E950EDECF77962B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493410, "uuid": "b3dd4c82-4b63-4bc5-a524-e73acb059d3c", "value": "12288:aeb5ETGTjF2i/2tOjw6qPdDg1HHUojsAybHnUh7TiDffIR:3b5ETGTjF2Q46qPdDg1HHUojsAybHnkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493410, "uuid": "791c2a82-ac44-4f1a-8435-02209086bd1e", "value": 396783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493410, "uuid": "c5567e24-1ab5-4dda-9a8f-431951ff8a0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493410, "uuid": "04daf405-4a6b-4426-acf4-364ab5bf63bf", "value": "Detalle de la operaci\u00f3n realizada.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6450680-0d8c-11f1-a129-42010a9c0007", "comment": "Malware payload (PromptSpy)", "timestamp": 1771503450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503450, "uuid": "cb19335f-a4f6-4e97-b8b7-4db3b2d3fb20", "comment": "Malware payload (PromptSpy)", "value": "363846aab242c38bdfadb7634a335b34", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503450, "uuid": "ad559dfc-7bcc-4cbd-8ae0-a37ef98a3894", "comment": "Malware payload (PromptSpy)", "value": "db7a1c352c7d1ac75e0ba31b71cf4b0e3304a22b8d0d636fa80b5d5095be1e00", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503450, "uuid": "5c99a928-4de9-4c47-8999-c26504906fa1", "comment": "Malware payload (PromptSpy)", "value": "f8f4c5bc498bcce907dc975dd88be8d594629909", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503450, "uuid": "98be9a7b-597b-480f-97f8-a9728b88d4d5", "comment": "Malware payload (PromptSpy)", "value": "d8da9252ec6b695bad569b5c7228262523a3408277ee8c389470ec550c998d8c39378cdbe67e75e5e81eeb034281847e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PromptSpy", "colour": "#7982F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503450, "uuid": "0a5a923d-e5bc-493d-9171-45ceacc2f534", "value": "T1E7B6DFC6E2954C1ADBF64071CD5A92B1672A3C1E87F38AB37900B6D838336D47E59BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503450, "uuid": "a54d2a17-81e2-45d5-ac62-000247d7bdc0", "value": "196608:qM0oSAOQfqdYpHXoph4Q1NhKLl1MUoSCDv:9XnCdYhovvKJqqC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503450, "uuid": "fceb8f7d-2c86-474a-94f6-92dfe05b94d5", "value": 11033233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503450, "uuid": "f0c38a0d-1444-4743-8a36-ba223d417147", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503450, "uuid": "307ea4ce-3a8b-464a-b20e-31bbbcffa35b", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53b061d-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771493516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493516, "uuid": "3de150b2-f03f-48f2-b348-daf6e3b5cdcd", "comment": "Malware payload", "value": "4c4223d4cf4ef2175a81c8ff56851c4c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493516, "uuid": "0fd63422-f618-4972-a790-32878d699cbf", "comment": "Malware payload", "value": "dd0f4393ec1b6cec0749d2c3b388f18dad0013163ce43814d57135efbab792b3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493516, "uuid": "4ceabee9-7ae5-4d15-8096-f2d01d2dd221", "comment": "Malware payload", "value": "390d218c3bcbca55cbec545e21a339a3a7209c73", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493516, "uuid": "c5fb7c10-3dcd-43bf-a369-696408639a19", "comment": "Malware payload", "value": "eded873876ef42b4d7a6694af417c1dd975eb9537bf217aef649c976eaf226f40b4696708c68a418e9dbd419989fee4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493516, "uuid": "68b2580e-df29-41e0-9ce3-3abfc9e067d0", "value": "T1D135F547511F4C44B2898E98A25B3BCBD7D6E391DE46B0D1C63FC3C82133B29946A7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493516, "uuid": "1dd35b2a-b7ed-4bb7-a58a-e0f3c29abb7e", "value": "384:/QbCFwJo/NbyQOZouKAYT2L+nNaYgWURt4AhCaoN/CwZw9:S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493516, "uuid": "4fb352fc-9214-4f6c-b1c1-4078b7dce904", "value": 1119598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493516, "uuid": "9d3023c7-45f7-4bee-8243-314682da9a30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493516, "uuid": "cbd4f460-9727-4721-829a-c78e8a26f885", "value": "MB267382625AE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f632aa-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771493537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493537, "uuid": "c768fa9c-eac4-4047-88e9-fc5fef653d84", "comment": "Malware payload (PhantomStealer)", "value": "e237b5b3f271647d7484b492402ded1c", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493537, "uuid": "d1cbf29d-9e74-4676-bd99-469166c6c023", "comment": "Malware payload (PhantomStealer)", "value": "de196641a2df595147205dac3671faa634ea27bdf8e4bf4301a58fdf536365a9", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493537, "uuid": "99dd8855-aaf1-4425-9c47-3c37f87ef9d9", "comment": "Malware payload (PhantomStealer)", "value": "024e539ae2cb32fa93556c2423a70228b9adb491", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493537, "uuid": "ac2a8621-a519-4d9a-ae57-1f853e284119", "comment": "Malware payload (PhantomStealer)", "value": "85b0e2b63147cd91385f5caa3d04371b4efd71e106d74c8b124d03f6a43d104a0308593e7bf63c3c1f9618f36ce7ceed", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493537, "uuid": "47dcfedd-6dbb-46dc-af3c-d76867ac68b1", "value": "T1F755C2CCF932ED4F931B78DBA913ABDE18D261A10C842F26D325AD54421CDD2E8E6F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493537, "uuid": "5b5e58d3-2a36-4c37-a474-2988326d9d19", "value": "6144:CD7nobJohqtPNt9zRqUf40T+shDSJgTlV1/vqXv4Dn4w2qraayCNzAlVyXUJ9tr:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493537, "uuid": "3c4a22fe-84a6-4a17-98c5-8a4e5b8bb736", "value": 1331432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493537, "uuid": "d77c35b4-133e-480a-9381-d45578959db4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493537, "uuid": "8573f116-5236-4a9e-8e25-1bcfa3581197", "value": "shim2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674daf2e-0d71-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771491614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771491614, "uuid": "14515c1d-0bc4-4ecd-a221-b7b06d91ae81", "comment": "Malware payload (RemcosRAT)", "value": "421c05d5e9023cd6e0c86376362fe2f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771491614, "uuid": "9da0a894-0680-4a4b-a5db-199b1371f2ed", "comment": "Malware payload (RemcosRAT)", "value": "df20937ff3543e699ba6abdbd74e74e276dc8bfab9fb5cad1927292541887f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771491614, "uuid": "3485926e-20c7-4dd2-a9c0-3020537cadbb", "comment": "Malware payload (RemcosRAT)", "value": "7c7e92caffd3415b22047e5c2c94b95d1fba465b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771491614, "uuid": "8819dfbb-0ce2-46d2-82d3-4ff94a918b07", "comment": "Malware payload (RemcosRAT)", "value": "9a8d069a79c2aaa1275bbde46ea159c6ccbfffb83cc0303a6dcb32fd8635c8ce35d0d44b93462dbce6d279052d6eef88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771491614, "uuid": "3adbd3a1-163d-440c-bd61-09a5d0a0a639", "value": "T16C5512883199ED03C0AA8FB05E70E23517B12DC9A41DD3068FD9BDDB787A7E429C5B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771491614, "uuid": "f6b01b78-09d1-4151-a9b4-ae31f363ba79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771491614, "uuid": "18ec81cf-d9d6-446d-ace7-d651351dbc6f", "value": "24576:B/ju2If8zgh8KVcmcck9GDgTQS9zBPY4IShV:B/lIf+gO6cmcck9GvS9zVOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771491614, "uuid": "f186618d-10ef-4458-9f2d-549324d764d7", "value": 1285128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771491614, "uuid": "29dd90d3-524a-4ea9-9103-3b31ed43a537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771491614, "uuid": "d550851a-ce44-418a-9297-950c750d7cfe", "value": "rDekont_0138mt1031902202690461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9b68a7-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482335, "uuid": "895ae529-f54d-479c-abe7-710105bf2238", "comment": "Malware payload (Mirai)", "value": "a13f23613905eb5756e52f0fe8e0a185", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482335, "uuid": "ee36d91d-bbd6-4c6c-8bcc-52397a30b468", "comment": "Malware payload (Mirai)", "value": "dfaa7596e8a53ddf01b5d04a6267f4abf7d66ccee758cc77eea9fdacdfb13343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482335, "uuid": "87a07420-2498-45d4-af4f-5ec62ad232ad", "comment": "Malware payload (Mirai)", "value": "18c92b83cd0d72cee09db963e5ddb06453b48ef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482335, "uuid": "0556a1da-2816-4667-bc05-5d7ea669ea3c", "comment": "Malware payload (Mirai)", "value": "69552ebd91934508238258953887b07300f67d13035ff046cc35795720a9b570446bc14c0ab1d2f2c6cf33a962b0f66d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482335, "uuid": "340bdcd3-286d-471a-a237-ebe0a80eb558", "value": "T1EB149DA8FF4F68D1D2CBE37DAE4A0FA230277C749565C0B54A01929FD5EAED488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482335, "uuid": "9f4b4e55-db35-45fa-91e8-e722813618c6", "value": "3072:MEYjoKn2XFSEXfEdc7mzwoq6UidU/HNRzPxw:MB2LXfEdc7KMiUbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482335, "uuid": "3653e3b3-8022-444c-9474-9ca60bd70367", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482335, "uuid": "edacf43d-cbc0-4384-995e-57fdc5d04c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482335, "uuid": "1afecd25-0d49-4141-a0a7-fd070021d4ff", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f399ca3-0d9c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509988, "uuid": "eb9bb5db-9ab8-4aa0-9fc1-63dcda0ba7b7", "comment": "Malware payload", "value": "00e195d94d3b1f7092eb9ed132f89d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509988, "uuid": "14a03ea2-e5b6-452a-8551-5c784e7a93b1", "comment": "Malware payload", "value": "dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509988, "uuid": "138ac582-1f2d-4547-9628-b65d75659fe6", "comment": "Malware payload", "value": "dbe26539ed4701596371aa585520dd276d437398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509988, "uuid": "7b2391e3-a5bb-4c15-9a4f-e091b140f503", "comment": "Malware payload", "value": "c0f16f3384435f4c03c2cbaa248b64f81f101c05aab729005b809d115646bd545ba032a4da56c1166f9a1f651d33471d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GRIMBOLT", "colour": "#641D43", "exportable": true, "hide_tag": false }, { "name": "UNC6201", "colour": "#FD0E8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509988, "uuid": "3d51795d-27e1-4e2b-877b-176a298f8a7e", "value": "T13EA64A1463975959F1D686B08F69CB33A9A8BCA21F34C00B253DF3453E76A3EDB0B521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509988, "uuid": "54724615-3bf0-4a98-94e8-47f30c25b4c2", "value": "49152:h/fSU3q/X7rUmFnHfytY2i7xmufhyFtE6g5EbZNCRksjjNuELo9Ikj:h/6UOH34E6g5EvdIjTQIkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509988, "uuid": "9857202b-731b-44cb-8c7c-43ff44bb754c", "value": 9859072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509988, "uuid": "279a4b90-c17e-48b7-9aa4-653fb0b9f821", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509988, "uuid": "56a7362b-3eaa-4ab5-9a72-37c694b4443f", "value": "out_elf_2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58b5f20-0d99-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771509032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509032, "uuid": "66a5e061-6a28-46bc-95c3-cf149ea34a3b", "comment": "Malware payload", "value": "d2dd8f24f59d809cff889256a545b3e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509032, "uuid": "2bbaad7d-36f9-4609-8d55-b413dc866e4f", "comment": "Malware payload", "value": "e00a8580b10366c26edc801477b1f16e5d6619ea4692e862fbe4fe4adf26ddf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509032, "uuid": "cd469056-ea77-424f-b2cf-37fd75a8a9ac", "comment": "Malware payload", "value": "7f7274feb99b5cbac37402fc7594dfe048eb3b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771509032, "uuid": "338e2f96-0c5d-41e7-b663-dc30e924b497", "comment": "Malware payload", "value": "68095d35dd2093eb446aa75a1fb45862c98bf045469b26da11343887832c040d75390d284d1ce12f0f5565c3eb742677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509032, "uuid": "deea279a-b40b-444d-b3df-6f8e61863461", "value": "T183052311BAD6C5BBF69B0B7354A357BA1FE8FC9B0191920783443998F9F5740CB2AB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509032, "uuid": "07944c5f-ece8-4dc1-9054-ad0808db7a4b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509032, "uuid": "f9fd2198-88a3-4168-ab4c-30ac524f48fb", "value": "24576:t3dQyN/UAf6aW7ylCTskrJlsOSpMYWzAb76VAtuuWSgHdL:t3mC5QJNzAc0WSgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771509032, "uuid": "a270f86b-f07d-4ca9-afac-5e6375237b5b", "value": 810272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771509032, "uuid": "bd62742d-7ad2-41eb-a6eb-c4453e75d54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771509032, "uuid": "3f5fe43e-2e50-48f8-b983-4cbd40ef1b00", "value": "Orran.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8583a84c-0d5c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482645, "uuid": "ff6971df-4a3b-46c3-bbbf-8b471a22931f", "comment": "Malware payload (Mirai)", "value": "4129da40c48799c41ae0b5e5853546aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482645, "uuid": "de47db7d-305b-42aa-9741-a82d111e1da4", "comment": "Malware payload (Mirai)", "value": "e111d27191b60ab830c5fb94165b42d2dedaf20da2c1547887548b9de7706f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482645, "uuid": "696a6daa-aa05-469b-94a6-868f2be4f668", "comment": "Malware payload (Mirai)", "value": "5a36b81fea3120b883885478bebd36468d2c03f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482645, "uuid": "7fb8e401-e145-40b1-b6c9-4f051ee6927f", "comment": "Malware payload (Mirai)", "value": "cafeef9c8ef03b0b2e552b2ce15d321c1a636168d99fdcc6a54f60fa0b4303bc329bbd557ccc94a55b77ea19d0812733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482645, "uuid": "031535f4-a868-4f2e-a7a9-18669baa8754", "value": "T1DFD36C0A78D230FCC68BD170927E9F21FA36745C42583DBB93C6AE711936DE05E16E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482645, "uuid": "f395868f-c3ae-4a83-8f9d-e8ca7234fcff", "value": "3072:R131IA94sl2eqhFTNlb9qgvFuf0uSWjFm8c8xYJB:blIq7lnqhFTs8uSsU8VQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482645, "uuid": "f81834fd-eb38-4300-bd3a-85b89a5e37e7", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482645, "uuid": "c6b002a5-6510-41c1-ad35-66f843fcaaa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482645, "uuid": "f01160c3-efc9-4095-a967-cdce04458caf", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca511320-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1771493498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493498, "uuid": "02878d35-82ba-49e9-924e-0af9ffe9afa0", "comment": "Malware payload (STRRAT)", "value": "8bd04b873676ff232cb74e4357a32c39", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493498, "uuid": "ba69d5f4-1322-40a8-921b-83db708acae3", "comment": "Malware payload (STRRAT)", "value": "e1386afe9d0690b4e9a99d7f6da4839cd55d621bfef0a6575c8fb61e2c5cd5c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493498, "uuid": "cc21ff4c-5ed8-4e7f-bcfe-790cc06de903", "comment": "Malware payload (STRRAT)", "value": "3f2a58a695d793b47734a8fd1322d8902f0b7e3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493498, "uuid": "216716f8-df78-413d-a78c-69c48039f53e", "comment": "Malware payload (STRRAT)", "value": "6d841d27d388c2ad55698b262b2214f7dab4c052c77aad424683ceae2c270ec7c28f9e57629205fd15fd295b2aea6307", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493498, "uuid": "ce81eb9f-b1e2-4cf1-8bb8-367ee5a08805", "value": "T11C0412D06DCBFD688938A460DD68FEAD38B28C53417CF46FC95290AD092DD72DB4AC24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493498, "uuid": "35649c4c-fb04-40ef-a460-f5442d4db0be", "value": "3072:OJEYSulAEw9CTE+X2AcSLyBWTh1X7ksM4lXqMs4xc3w0svzLlklG2GSNu9Vzh9pn:2XT5b9y013Zs4z0sv+lG3UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493498, "uuid": "6feee00c-6de2-4e3d-9a8e-f29841f5e6d9", "value": 189917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493498, "uuid": "7ddd5ade-ccbe-4113-990d-f7192646878b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493498, "uuid": "79423811-c7b8-424a-9a4b-0014b4e5f192", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73312736-0dd1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532865, "uuid": "f1241f62-7cc2-4ec2-9b2d-44b2b05df61c", "comment": "Malware payload (Mirai)", "value": "20e7ed2850dea20d3da3db64b216c1c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532865, "uuid": "21648627-1390-4a53-ad9f-cb41d6985a18", "comment": "Malware payload (Mirai)", "value": "e13d0b4b066877cc9fcb4916685924dfff634d1fb7b1219a480e9f8769361426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532865, "uuid": "95c64040-bed5-438a-9442-ad5a9b25ec7b", "comment": "Malware payload (Mirai)", "value": "4709ca13903e4cc0cc2227edfc3b49aa6d884e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532865, "uuid": "5b4fad1f-f151-4899-a719-2b58f9c674c3", "comment": "Malware payload (Mirai)", "value": "788fb4d99a2a80bdb4385947f1d905f909d6da9ec67a46c278b40cbe8afd9f2a8341da8aae8dbabb266c8e6707c45efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532865, "uuid": "6770a5a7-8569-4969-9635-cfe24f2c5ad5", "value": "T1818339D7F401DDBDF81ED77B4463090ABA31A39106831F3A6397BD67AD361A44862F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532865, "uuid": "b7879a0f-cd60-4780-95f3-4fa9b8fe3a55", "value": "1536:ycNteQj3T3ijErkVkaYTw/Us38jDh84y+CRnAUQbr4VHu4rICXQoXpOi:ycNQpY8/UssSqCNA5h4rIYQNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532865, "uuid": "107a7155-35d4-4b86-8d08-438fe8d51f96", "value": 88360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532865, "uuid": "8dfd42e2-0cd5-4f27-b864-59fe8c0857bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532865, "uuid": "d5656f4a-873f-417f-aa7b-364eae32161a", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fcc405-0dcf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532143, "uuid": "1041b95f-5665-4a49-8ddc-f555a561a49b", "comment": "Malware payload (Mirai)", "value": "f89cf6e46dde6deee2b7430ace5be816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532143, "uuid": "08477fb9-23c9-48da-8f08-d9bca40901b3", "comment": "Malware payload (Mirai)", "value": "e15bbbf8e9b343137d70822612035a9c40b8ed744d3424910b35ff532bc6503c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532143, "uuid": "9ac43e09-7a94-460e-aade-544ad6383dd4", "comment": "Malware payload (Mirai)", "value": "98f2ba234339fe4724c76fa9731ba9367473484c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532143, "uuid": "e0afbd99-138a-4291-ab79-5f62bcd87481", "comment": "Malware payload (Mirai)", "value": "8a559ef966eeaca49e1237c51b101a2fad4525fa5fd9f5a8235924eeebcb0b72c8e4836b1c507632a509db9cf61f43d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532143, "uuid": "eb543fa8-b4d2-4b0e-9dc1-5d461c1f2a88", "value": "T1D6834B32B9790D2BC0D5687A61F30725F2F6478A25EC8A1E7DB20D8EBF2465032477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532143, "uuid": "e7d81a58-f5e4-4e5a-8948-8c6b20401e5b", "value": "1536:m97SYFq3DIiMyJXCMIJDqgEQ7tkImvoM5GI/cs+/0tn+/Fd0:e+RJXBIJtj+dvo8GIUaK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532143, "uuid": "9974992f-6e85-42fc-9df4-33158261e780", "value": 86480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532143, "uuid": "17e09dbc-5a25-4442-b5cc-8dae3fe424b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532143, "uuid": "bcd6f1f1-7105-4117-a42d-5d00e086e78b", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e325a15d-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771493539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493539, "uuid": "b0aa1024-49f6-4ea3-8e4c-6e6278fcd80d", "comment": "Malware payload (VIPKeylogger)", "value": "d68c7d345ff3f7683835864d56312258", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493539, "uuid": "f7fa7d5d-2984-457f-b43b-8eef208c451d", "comment": "Malware payload (VIPKeylogger)", "value": "e3a91224a778aee313ab0fb0de230af76a186d9311c8436ad70a58d85941f4da", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493539, "uuid": "83737c30-a113-44d2-baf3-597d42a4e49d", "comment": "Malware payload (VIPKeylogger)", "value": "c89053c185eed4d1665af5ee4054547e51a696df", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493539, "uuid": "b8a1100b-404a-4cc3-8a88-7d925941cfd1", "comment": "Malware payload (VIPKeylogger)", "value": "36116c71108ed347f7542e15643dd698f01180adba2f8307b7247fec27950a5e0c588b907605517a3b2c249218c2d589", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493539, "uuid": "61e22460-d77c-43e6-910a-4177f738c921", "value": "T171F378D3AB8817EC96944CF95209B563A5E3C57B3C1D2279FDE20693B43EE11B922730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493539, "uuid": "021186b5-0710-4162-99a4-f4684d71a1b1", "value": "1536:h9gaspsFImDPMOicRYMuhLeaaPRPI6s4P9PbgPJhgSVuJOcWV/Vo1eAJqCGfaMKF:rOugxAJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493539, "uuid": "162b8a33-7697-4ba8-9e5c-a6feba8004eb", "value": 169860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493539, "uuid": "71adddce-ce55-4ab7-a3d0-11e006d128cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493539, "uuid": "3cc7c9f1-201c-475e-876e-1e377df70a6a", "value": "CHEMDYES SDN BHD PO-02314.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efc88af-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771512135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512135, "uuid": "3b1381e7-516e-4b6f-a30b-3d4074f3153c", "comment": "Malware payload (RemcosRAT)", "value": "73fa1274cbb7d5dd3a433708a19a4a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512135, "uuid": "fba7e871-be31-44b2-a90c-5f4fb7e57d55", "comment": "Malware payload (RemcosRAT)", "value": "e3ccebebae0ce58740624ec86b74e6325e0384b3181fc493b022720c378b9a4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512135, "uuid": "c1091816-8ccc-47fb-8840-efd0faa2a3ad", "comment": "Malware payload (RemcosRAT)", "value": "4f44f15f18e6a0edc2e6453e9b146b94e99f3d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512135, "uuid": "bddaeea2-cc95-40e9-a2b0-4da8c4895fb9", "comment": "Malware payload (RemcosRAT)", "value": "86924b2d827da5353be9c8a634a5f0cf4c42448d1e34f06b4232887ef6dfc66728b2052a16577f34861e5afddd0bc567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512135, "uuid": "9d5fe371-ad8b-4c97-8a80-8163ede18d17", "value": "T1B365E00727C04AA8E5BD8B75D2B904E543FBB74B9B22E75D690901EB8D26702DF01B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512135, "uuid": "ea794dc2-bcb5-40da-b080-51f063f36298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512135, "uuid": "a2923ada-301b-422f-b82f-7a6f9ab83314", "value": "24576:ekfZNC8ZHKJCX0fI8mVS7UCnRveYepqMKDmfC4KOSSn2B6cQaq:5ZWWgI8mcJRveYkqM3fC41p2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512135, "uuid": "5bcddddc-5a31-4c9b-8c10-82ac6b74bb41", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512135, "uuid": "1cdba9d0-500c-4159-ba65-757d24ddc75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512135, "uuid": "704e6ff8-2b96-454d-bd00-6d5af888617c", "value": "73fa1274cbb7d5dd3a433708a19a4a51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0041234-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481965, "uuid": "a81a0f2d-3657-4489-9bc1-085a8bab5b83", "comment": "Malware payload (Mirai)", "value": "b2ad47f29bfb973f43827433b323f0ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481965, "uuid": "ef7ca086-7715-4d44-8828-6187bc26cc2f", "comment": "Malware payload (Mirai)", "value": "e532c69410710788a8976cd50939ac423729cdd723650b213e0baac4c6623a4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481965, "uuid": "7392b695-ffec-4c9e-8b1e-a07754a230e0", "comment": "Malware payload (Mirai)", "value": "9f6b27743329850e2ebacd9a28e5016322babcdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481965, "uuid": "76983c04-9e25-4cc7-ae00-babc46368d5c", "comment": "Malware payload (Mirai)", "value": "7e155133099c15a80504f9a880c3494f7cef0d8d81b7711b76df0d878843bf7ccc7691bdb63622b4c0dc782bd67fd760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481965, "uuid": "e655c099-7d17-440c-bb46-7979427e517f", "value": "T1D863126915FA7DDC9AFA376A444910CC0E3D726153CB80DA02DFA4ECD575DD88FA2C22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481965, "uuid": "0857cb23-b71c-4801-96ab-1eba847164e9", "value": "1536:UMxE+v9BK3TqAdBWMqEVoV7W3Sbwifiq9CAeDAIvL6UtMtrP1:UJOg3TdwsomSbRiiCAeDR+HrP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481965, "uuid": "f4ca9877-66f4-4378-a8a0-d04296bee67c", "value": 72132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481965, "uuid": "71c85ad5-aa0d-4282-887a-ac8ae83f67b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481965, "uuid": "94c06e9d-a169-44ca-9efd-e3304f74a73b", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e940be-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512121, "uuid": "a7ca5dca-f248-4c19-a677-245941940638", "comment": "Malware payload (GCleaner)", "value": "51666b274dc7bb43a88b49576f70bfaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512121, "uuid": "7d4d89dd-f676-48b5-ae22-8354fea6361f", "comment": "Malware payload (GCleaner)", "value": "e560cbe8d677697224567c051c2ac3d49dad1a3e29bf52faafe0cd01d13435ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512121, "uuid": "1d2fc033-082d-437c-8a2b-2aa8906e765d", "comment": "Malware payload (GCleaner)", "value": "a310b90ece90c9261ffc3cbc1f7e52036bef766d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512121, "uuid": "0b34bfaf-23ca-459e-adcd-cb42070d3eb3", "comment": "Malware payload (GCleaner)", "value": "2e79907196f29c4fe35d95b8b09d83c9412e8c5fd78c1e4795b345302ede4ff3132118d175250c3b2053583bda7d2fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512121, "uuid": "9ec235dc-8407-4c4a-a608-cb2f2f7a5957", "value": "T11336DF9A3AF0436BF6229EFC4C25D1230796BA31F8D94CECDA408CDC04EAF57516479A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512121, "uuid": "fe585799-ba0d-4045-b7da-ab475f055562", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512121, "uuid": "2699fa5f-9637-4c49-9557-f5f33fed2dee", "value": "98304:y9Cexhmoh80vR6Bsx9Rn7vY5flXNU2/Buu0dOZK1w87obrx:yzmo60R1ri9X5Q1w87o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512121, "uuid": "5aeceae4-07e0-4a41-8374-045d8780f83e", "value": 5208576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512121, "uuid": "8f6fb9c8-cc90-42d2-85f5-3a0fa8f66b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512121, "uuid": "fd6a8faf-83ed-4490-9373-f3216cd3c367", "value": "51666b274dc7bb43a88b49576f70bfaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459cfe8a-0da5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771513891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513891, "uuid": "216ea707-7e07-448b-93ba-2cefcc88dd39", "comment": "Malware payload (Mirai)", "value": "9ceb038b71b81213acab6bbc0aefcf73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513891, "uuid": "337826cf-36a3-4574-91bd-f6412d01ccde", "comment": "Malware payload (Mirai)", "value": "e569dcdcf043adacb9424d1d65f9dd386971c9e7935337fd1496ee9fe7eec6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513891, "uuid": "c507b217-ffb9-4730-b6fc-e1216a3dc670", "comment": "Malware payload (Mirai)", "value": "559fdf18378bbfa85eb1587b2e3bdd8d90497083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513891, "uuid": "099824bf-7e67-4663-8c85-e797db038f33", "comment": "Malware payload (Mirai)", "value": "69579729f745ba8cdcfb8c05e64210f319232a855352c144302758442baa9f429c906513d1c7af7ebcff6a6018fd983b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513891, "uuid": "b18c3119-f496-40d8-9847-b4660db8d6de", "value": "T1BAD34C06731C0A47D1632EF43A3F27E193EFEA8121E4F644255FAB8A9171E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513891, "uuid": "cf6ad5f8-041e-45bb-b8c9-d5dafbb47b6b", "value": "1536:f7uIHLLG3RSTAM5bofxxfTIkEP9//WOj7fp4unvAbjc0GuFdN9ql65s5n:f+gEMVofxx3ENH7R4rbzUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771513891, "uuid": "385c5036-a68d-480c-93f5-98b1cab7fd98", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771513891, "uuid": "9c2250d6-af85-43af-8590-b95e23408851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513891, "uuid": "3a4015bf-5187-47eb-b6f8-fb96bccda482", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351ea909-0dce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771531473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531473, "uuid": "a5d9f4d2-e2a4-4d0f-935f-374b0006b952", "comment": "Malware payload (Mirai)", "value": "bbd7da955eaf8ff13ec3b69d0ef3ffb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531473, "uuid": "1bf8f0db-3b57-44df-9314-e0e812d4e53f", "comment": "Malware payload (Mirai)", "value": "e6108380b275f6dc25de523cbf5608764210a85da7df44b52bc95594636b0b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531473, "uuid": "f849b65f-2824-479e-98ea-dbb34605e1f1", "comment": "Malware payload (Mirai)", "value": "fff514243191a3ce6c2e1557712cd2ce0a752b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771531473, "uuid": "94d41d26-323d-482d-a8bb-d01d33ca0cc3", "comment": "Malware payload (Mirai)", "value": "7e3b8917b0b4a22fdf6472d8610adea94fa8aaabe29ed863963e2356ba5160ff92e9284aeb974e2bf5884dd1cc17e865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531473, "uuid": "6db3cc45-d85d-4e16-b2b8-faa4ae783b08", "value": "T16BF2F1019509DC118C35897ADB898E8720FB5FFCDCBE3059E226DC7CEAC68C55D396A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531473, "uuid": "eb7c3015-e9ed-4e20-8f82-4822c8621f79", "value": "768:C4fV5VQqEjNA1mvyGpHzFj4iI9VUyPiwcXsi63UF:CKLVdhkTzFnI9VnGsi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771531473, "uuid": "bd52d9c6-c2a7-41de-9f54-a4b8b87eefb2", "value": 36480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771531473, "uuid": "a17c18fd-e4d8-4d5c-a287-836cb707f8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771531473, "uuid": "f5ccd25c-6010-496c-8354-6f002c7ed88e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c2ebd9-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771512175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512175, "uuid": "c4a98455-109e-4f98-aa49-bec4e4fb20fd", "comment": "Malware payload (AgentTesla)", "value": "076df4d4d98b8e0d7cb74421c2e97b4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512175, "uuid": "1eef3f17-9f64-4cda-a023-e065d0483dc3", "comment": "Malware payload (AgentTesla)", "value": "e648569e99af9d140dc6f46ba47d7d9476389cdc87a484e4039151fc9d559082", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512175, "uuid": "fb03912a-621a-411e-8cc9-6530dfbf7eff", "comment": "Malware payload (AgentTesla)", "value": "d2ee5280970b7b9e04f1d9550be7d52942cd0f4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512175, "uuid": "e0e53e6e-c309-4805-bc85-ef52729e0160", "comment": "Malware payload (AgentTesla)", "value": "593908642048ec91e2ace1a38c8df3e8507e56b74e50e02f56d0910d29a8354ae3329a7de67b22d676c78c5239f4b682", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512175, "uuid": "17e1e32e-3e90-4ef0-9164-d8f816fb6339", "value": "T14225DF1537E44B68F8BF9738B439112087F1F81E9B22EA2E7F5950E91861F4CC662723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512175, "uuid": "b08afec7-a851-43dc-ad6f-ba613c4d8fad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512175, "uuid": "42a2015d-c42f-4199-9236-106ca3116287", "value": "24576:r//kfd1HK6/XZfSY66LghoGFq4H/+Ua7KeVtF:r0fd1H7JH6thv+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512175, "uuid": "dfe227cc-7d37-4970-a6d2-608870012833", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512175, "uuid": "fd3d6c7e-07d8-45c1-945e-9ec316fd2098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512175, "uuid": "1b7be798-867e-439d-9445-3eb60d47d382", "value": "CEP-20260115-20260115400140BET0000465103250.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b71d75-0d9d-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771510727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510727, "uuid": "f04a396e-75f1-4ce7-bdb5-ff9590f60fda", "comment": "Malware payload (Formbook)", "value": "e1c63155e489bd84c3e503459d49f29e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510727, "uuid": "ba6661c4-e8f8-4984-ba6f-ce409fbb323d", "comment": "Malware payload (Formbook)", "value": "e6a5b93e3ff0565bfd8955d453a2ef89a8b7e5cc0687be73da77e8333c652178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510727, "uuid": "94c9e5ff-1bb9-47ab-ad91-aa61c6321f90", "comment": "Malware payload (Formbook)", "value": "d5dd7471a9ee36d48f5a6f1d40915664a6b6ea83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771510727, "uuid": "f1341783-01b3-47f7-a197-6548016592b5", "comment": "Malware payload (Formbook)", "value": "d75f0db623781dbd725dc1cd42ab98c740769ed0e707faf7b875415aefcf997d874e1ec33e2b48b77e3ee8aabbd259cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510727, "uuid": "a04cc519-fcc2-4241-9894-49e3e6aaa1c9", "value": "T119251248B399ED13C0AB5EB40A60E33127B86DCDA552D30B9FD9BDD778397D0488079A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510727, "uuid": "448934f4-29af-4edf-bc1f-9adafca20492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510727, "uuid": "8ba46700-0fa8-4682-86b7-cca82473d4f5", "value": "24576:x/HPnKPTaxqQNESzpq5eC6crF8xwRmxrLAbIN4IWFniYyf:x/YTHQNEks5eC6aewRQzN4NFnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771510727, "uuid": "48a75ed3-0bfb-4de1-9c6e-186494565889", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771510727, "uuid": "cc9dd225-9d8f-4873-8766-6d661f83d259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771510727, "uuid": "eb8afa16-e7e2-4959-aa38-4ea7c642ba71", "value": "PURCHASE ORDER 3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1edd7fe-0dd0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771532514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532514, "uuid": "0a6dcc82-e81a-4dd5-aa31-57a9297e8a86", "comment": "Malware payload (Mirai)", "value": "08c29d63542f2e975d2fd8c9165d0a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532514, "uuid": "654fbf68-1354-4355-a955-ffd465b8d42a", "comment": "Malware payload (Mirai)", "value": "e737a28a5b5bc301e3385e00de4c1377e44e4eea371b55598b8bb8e75e8f15c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532514, "uuid": "e7f30865-44a0-4ceb-8775-194cdb4315bc", "comment": "Malware payload (Mirai)", "value": "4fade15bd14b37296ba5bda592561d597a542f18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771532514, "uuid": "ccd96fca-a96c-4042-b916-6b6081e99e2d", "comment": "Malware payload (Mirai)", "value": "9f5f3a77d74d41b0a168f0deab1843e541a6ef4dbc32ed3e16607eee7a1048dfdc1ef276e8e97441b83e49adc73ad644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532514, "uuid": "233e07df-af28-4fc9-8702-27281f3ee4ae", "value": "T1D2639D77C52D2DD4C29556F4B9B08F791B63B44081AB0EFB4A95C1BA8043EACFA053F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532514, "uuid": "bdf27e48-0039-4a17-be52-22912bad24d0", "value": "1536:WaBwtCeT4zeGmREHCTKJtjRm1rwCWpvgAlRjBZ/Ic:WmuT4zeGDCWJ21rwPvjtKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771532514, "uuid": "38b9ac3b-d233-4828-8636-02547c8edd18", "value": 71372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771532514, "uuid": "e16648cc-9a85-40de-82c4-5222f222e432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771532514, "uuid": "1bbab88f-cad2-4ebd-8128-795b3678a3c0", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5663de46-0d82-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771498887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498887, "uuid": "7c063666-5866-4b2e-8740-03b6a3a48eb7", "comment": "Malware payload (SnakeKeylogger)", "value": "8f689bed3cfddbbb18abcaa2bad94ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498887, "uuid": "34592e1a-be25-471d-aa4f-6d21e6217f5d", "comment": "Malware payload (SnakeKeylogger)", "value": "e8c96e9b3d270abd9522f17ab7d493d91099e9b0d637b792d686b6536a59ec7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498887, "uuid": "f4f4a1e7-02ad-40de-a0be-79ec89c0bd41", "comment": "Malware payload (SnakeKeylogger)", "value": "237c47aa2711efbe6adf5b8068578d712f5d27c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771498887, "uuid": "22df3e33-a5a1-4d71-b4d3-2d5800cbbcbc", "comment": "Malware payload (SnakeKeylogger)", "value": "b35f8199fd540bdc190d7492acf2a30fb82801d3239da8f4351117f48dcf6e0177f35207a85b2cb942217d2f07b86627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498887, "uuid": "bdb45b49-2520-435c-a0e8-ffa33694f806", "value": "T13FE4229265809DA0E259B3748832CE514E763C704E547B3F8799E27F6870383DEA7B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498887, "uuid": "d30c0551-5213-479c-b041-e66fe97ab349", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498887, "uuid": "ab681dd8-3589-49d3-9442-874efec49b7d", "value": "12288:Tz7hU5I5yuNHIgzSFKxWltRohBfSTso93UfE0B/WO/au4I1qiPFeFrYgqjgSh0Ap:Tf+iN57Gtene3cfdC9I1qiI90jge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771498887, "uuid": "fad91126-5ab6-4947-8ced-aaa08b12b776", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771498887, "uuid": "6158c895-a6d6-4a79-84c9-a4646fab0d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771498887, "uuid": "45c1222f-0dc5-4782-a3e1-bec541646c23", "value": "rCM-PO250126877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8308b6ea-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771512276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512276, "uuid": "e7cc42d8-7acc-4aa8-9b35-5c75257332a1", "comment": "Malware payload (GuLoader)", "value": "0a8cd3edeaa6848ec1432df4053047ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512276, "uuid": "98e4770d-5d88-4cfc-b489-35f7c3b151d0", "comment": "Malware payload (GuLoader)", "value": "e90650140cadc29d559b629cd55757c28ecfecce578685e146d2b983c2e61e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512276, "uuid": "c3d0d2a9-7ab8-45c7-8447-627e2fa17803", "comment": "Malware payload (GuLoader)", "value": "b791648cc202f85354936faf330dbac1fcd9134d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512276, "uuid": "97c3bcd3-9a63-4d33-a0d3-9ece232d6456", "comment": "Malware payload (GuLoader)", "value": "72c0f8f192011deb2c6693ce2dad225cc4e3df78f7d301cef5846c56232f1ab912b2dc99c5f446f65f289d3820e20ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512276, "uuid": "1980c14e-89b5-4138-97a9-f6aeca678789", "value": "T1AB0512605B02648EE0634874ACF277B6F6A8AD6633ADC7C276D0B5887D3B3454F643C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512276, "uuid": "9828357c-2804-420c-91dc-74fd49b3367f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512276, "uuid": "29579198-42ec-4126-82b9-16099cb52ace", "value": "24576:mHO/MdQM/okB+YGVnZ7WdBz6kqd43jbz1HVkMIwSqLbBYNGP:mHO/uZB+YIndWdBGzKb0wSqp9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512276, "uuid": "a6dae0f8-1909-45c8-9dae-3ee1df51bc4e", "value": 854478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512276, "uuid": "a3e819ea-982a-4c0d-8fb6-3eee47bb937f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512276, "uuid": "fb3688e1-a852-43f1-85ea-82c6a728a393", "value": "PR-000032683.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f8a49c-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1771512115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512115, "uuid": "35713b97-7a9a-4697-9e95-61b0e972fbff", "comment": "Malware payload (GCleaner)", "value": "48e31187937df31358c33685f21ac313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512115, "uuid": "286c0a94-1ef6-4db9-9b35-bbe617554ae3", "comment": "Malware payload (GCleaner)", "value": "e97c52bc2725ba41f5d4c4d2833fe5cc927a714be8d8646dea091cd6489c3136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512115, "uuid": "c20726b3-320d-488e-b8d3-4ed5d0a63551", "comment": "Malware payload (GCleaner)", "value": "6bc4a896fccc37406f1f7f3b23fdd4d634c93099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512115, "uuid": "0a6fd769-5047-4e8d-aea9-539c18580311", "comment": "Malware payload (GCleaner)", "value": "2d1e9645f5307bb8e2c6116aaf5d15eb9d55b108f328ea0a2909bd9df2e953b96a6f1fc4d846692855a9e4ac5a6b692b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512115, "uuid": "30061ac6-618f-4475-b0e7-ed2265c53c3b", "value": "T1FF06E0E1F9687634E56EF533F82A20D8321921C6541A5936F9B3C6D48E3CF84F9216E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512115, "uuid": "9180fdd9-014b-42f0-a8c4-a0a1326b7ff0", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512115, "uuid": "e810f427-3c47-4f15-ae3a-ee0229e81ed4", "value": "49152:5uBqw3SQBfQp2ca7Dciq2qi+KNqcASDB3ZZ5u6bNL5dAAA1iNby:5Ez3SQ2kQo4JSDtZZ5xbJgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512115, "uuid": "578f0fb7-7b1a-4e73-bc24-3e719210b165", "value": 3916800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512115, "uuid": "7343b38f-a872-418f-921d-cdbe89a3ee72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512115, "uuid": "837f672d-0c1b-4118-b6f8-180d5b50bf04", "value": "48e31187937df31358c33685f21ac313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fcbf4f-0da5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771513893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513893, "uuid": "5064d0a9-c4e5-4002-9108-6d88818a3615", "comment": "Malware payload", "value": "69436b51605c866c2954b58551d3c24a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513893, "uuid": "2de1512d-5eeb-4582-850c-d020795e9be9", "comment": "Malware payload", "value": "eaaf0d9cc90668afb54648f31900d1bfa1d246be9d42f3da32508ddee213f932", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513893, "uuid": "4fa7b76e-1478-46be-87bb-554c11485fa5", "comment": "Malware payload", "value": "4614777310d0226c3eb793798163619a39383bbb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771513893, "uuid": "1791f5bd-2b93-4cbf-af2a-9047aafcf6f8", "comment": "Malware payload", "value": "3a0156a07d044dbb8fa6e551cababe38098a59535c7c309a2d6194883fd857ec6175f14d52f9aed092ffcc0dd321e71b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513893, "uuid": "4895c1f8-850b-4c43-9f40-3152178f572e", "value": "T1F6A2D7967609021FD0905B3FFEDDF7E6476817686290D0D3F6B264D905B838BBB2A04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513893, "uuid": "3d53bd7c-ba41-4259-a459-7cb31c25c275", "value": "ca5592c42b764400102051895df05794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513893, "uuid": "7917c897-197f-4ec7-8249-b36d35d67085", "value": "384:A4bmxnevgpWIZ/AK1GJs0I4u9zIqthmgav8U9co:2PZ/jwdIB9pmga0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771513893, "uuid": "31c611cf-96cc-498c-861c-673a631b4e10", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771513893, "uuid": "5205c653-c10b-4044-9362-64d218204acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771513893, "uuid": "a72b5a09-07e2-4ccf-8114-e3810dba8f79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd1af30-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512083, "uuid": "8a8bf971-30a7-446c-a155-3075f798299e", "comment": "Malware payload", "value": "2217e2d8e96f78080263ea26561f74cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512083, "uuid": "72c87425-2796-4e58-b75e-d16c72635ed5", "comment": "Malware payload", "value": "eb6906723d5161929619b529fe18b1eaa6c85717ebef881a5f25b5ef632e0b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512083, "uuid": "15568f44-da55-4467-a977-6e497551dbb8", "comment": "Malware payload", "value": "3d45a5395b43a14043bde6301b7c73a9834a3702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512083, "uuid": "65892af9-bab0-49fe-8f7b-f0dd4b1c9079", "comment": "Malware payload", "value": "bf2846fbadec55fc867fed53c672fcc00669f0191d05c399f66575694a90ac7c1ebd9574ef15aa9ff5ab709e79ac49f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512083, "uuid": "50b973e9-7bde-4e77-9536-ac6ada94b3eb", "value": "T17626E1D5B9A94C73E0EB2A37E97A815447117706D82CA07FB7E638CC1E1C583A611A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512083, "uuid": "54bdc955-9d23-43ba-9783-1acdea142bc2", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512083, "uuid": "c84dbb97-62c2-4b8d-8fc9-cfc10d0b8564", "value": "49152:+uBqw3SQBfuj5T8wSELZRD96a2i7DpPywRGr7RHiuf2P66Q+DQudRj2n6RDyT6bP:+Ez3SQqnDjhvZ6rV76Q+DPRng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512083, "uuid": "81c90285-f501-47c9-ad64-d503d7263118", "value": 4808192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512083, "uuid": "30ed442b-d9ad-4103-bd02-52a7975b18ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512083, "uuid": "bd5202a4-e7be-41f2-9802-20bbbd63b698", "value": "2217e2d8e96f78080263ea26561f74cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72a09e2-0dec-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771544603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771544603, "uuid": "c7b597da-3b9a-4515-9be3-8675d2a139b5", "comment": "Malware payload (Mirai)", "value": "c099ce59e14e524af09742c78b2108fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771544603, "uuid": "e5cb422c-49a7-4db6-9c7e-e259c79973b6", "comment": "Malware payload (Mirai)", "value": "ebdc976de1fd8dde0439e4f62ab24651ecf160b637ba710fcd0bd2616077752c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771544603, "uuid": "c7c854f6-f693-4035-a58a-46a87d51be12", "comment": "Malware payload (Mirai)", "value": "d22cef2a302ba60ce885c006aa797277cf451970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771544603, "uuid": "c5cdec27-4b4b-4a99-afde-13418a2500d6", "comment": "Malware payload (Mirai)", "value": "3e1e7901d9945b42ab7f8e9b71b66aaf50a7e080c7c6608fba486beb58744f2624c0219c167794b917ff68fd95e43864", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771544603, "uuid": "cbbe824d-70d2-49a9-802a-4db74d0e8346", "value": "T1CC437109BF650EB7EC6FDD3709A9174624CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771544603, "uuid": "64444057-a500-40fa-8dda-abbaa024e390", "value": "768:oLWu89xw1IlGGUantla4xY966x1EnB6NTcWlp21wmNOUGpCIMtjej5dIne2el9e2:oLWu8fwgUkkkLg9gzStS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771544603, "uuid": "9452d8f0-d456-45f0-8a59-a2ba874494ef", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771544603, "uuid": "138c09f3-bd92-4336-a455-ad12f8d806f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771544603, "uuid": "14554cc8-04c6-48e9-a2c2-2cb60e516dc1", "value": "0upmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0963a3fe-0d8b-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771502623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502623, "uuid": "94a51769-42c3-462b-a22c-fa406f04aeec", "comment": "Malware payload (SantaStealer)", "value": "7bcfefeb53a07032cd85fd8cd6ab0601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502623, "uuid": "4d4f40ef-e0fa-4851-a837-271cb3028d37", "comment": "Malware payload (SantaStealer)", "value": "ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502623, "uuid": "b18b0b77-8c45-4f8c-b229-7d078761d8ff", "comment": "Malware payload (SantaStealer)", "value": "a8a7056052c6dc55e38d837623bc1f7ca439fae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502623, "uuid": "7ae331f6-e9c6-49d6-87c7-1622bf7915f6", "comment": "Malware payload (SantaStealer)", "value": "ada35d2151db2836ced9b40d4ae0d8a81da90ad41b6cac257229d6924de2654bdd260fb0fb4018ab3efc238123094c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502623, "uuid": "fc973df0-6e0f-4113-8178-fa8cbad2f38a", "value": "T1CAE5330CA4A79DFECA2A06B846BBAC77804EFE076CD4CC7A4D205A5CFF45D155CA9C90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502623, "uuid": "e5db58ba-76c8-498e-a461-0028e29a283b", "value": "313a05c8f3f31305e238ae143783f8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502623, "uuid": "1829595e-6de8-41e4-8ea0-699ebf53323e", "value": "98304:K0dx4+gamVGkg49/cPELfdyVkKVj+X6NodO4v3C:K0QX/ctVfZ+XSkJv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502623, "uuid": "585f3dc1-dfc7-49df-8eb4-0a0ce2edfb9f", "value": 3177472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502623, "uuid": "febdd9a1-8444-44b0-8534-981e14e822cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502623, "uuid": "4bbcf816-1156-4452-b688-858234a6bd72", "value": "ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b257f90e-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771493457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493457, "uuid": "726f0c65-12fa-4ede-a9ac-f4e18b7570e3", "comment": "Malware payload (XWorm)", "value": "27afbfbac4c2e77e7f1f278d5a436bcb", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493457, "uuid": "826ba7a2-6696-4e45-abdc-732c9e47b81a", "comment": "Malware payload (XWorm)", "value": "ecdaa31802b6a8ef94fbc3f16da5068c6f126876af0b9c964a915a556194a1f9", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493457, "uuid": "db95ac15-9e7c-417c-b71b-8db268d6597a", "comment": "Malware payload (XWorm)", "value": "28302007dc0439c3265f3a4147eb8db03d4a58a8", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493457, "uuid": "02561d8a-b3a7-4a4b-9dab-ebca3f8bd2a6", "comment": "Malware payload (XWorm)", "value": "4a783bacea49040eec2e3472d5d8b9eb209fee9f09e3e5fe7d55bf58b1e39e2557a95cdf38b2ca37d55240bf6c6ef346", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493457, "uuid": "3f348764-53d0-4dbe-b50d-595df02ed9b6", "value": "T1D635B5521AF7F5CA76ADAF8821B014A0DF39C81764AA886FDF1064C9DE917DE130EC74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493457, "uuid": "909b90ab-f005-420e-a05b-f9c74b382233", "value": "12288:EF0FAjFBQ2KPsU6iI529ezz2yyxJ3pxUqEd3aWRf:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493457, "uuid": "f0d0d983-2a98-4327-b0b2-0ad95ee9a84f", "value": 1149118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493457, "uuid": "38555a6f-04b0-4347-80cd-2b63aa247fe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493457, "uuid": "9acef8d1-6064-4779-8341-5c9d16fa582b", "value": "HALKBANK HESAP OZETI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f18582-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482026, "uuid": "3e290a59-56f5-4da5-ad79-33addb698121", "comment": "Malware payload (Mirai)", "value": "778335aa97b8c3e78d63524cbd01df66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482026, "uuid": "37b1af2a-a07d-4147-ba0a-9c9504172e5e", "comment": "Malware payload (Mirai)", "value": "ed119d59a0d831558822eef5611772c4f03a3769fef11cc7ffb7b55b77fb47d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482026, "uuid": "2a5d7d7b-9d7e-4747-8311-548b44a84aa2", "comment": "Malware payload (Mirai)", "value": "f40dccc0fc542df04c56c75926599276c1db8fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482026, "uuid": "164e1917-4bf5-4aab-839d-e3bf45e1282f", "comment": "Malware payload (Mirai)", "value": "041d1c4c733f3438f84529c5940f7a93e451f8e57314a4890e8c2b5bf9bcbaf229b0e2bbb4ef22ac51df5db7ca3406a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482026, "uuid": "36fa20c8-e995-459d-aaa5-521a41cacfe3", "value": "T131143911FB0C0463CA831CF44E3F4BFAA3621A9215F99115250D7F5E1A32DB7A68BBD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482026, "uuid": "266d6708-0f82-4d97-9570-138b6a79c7bd", "value": "3072:3odOkoozxVLgMN3c9BJjdu5WvJAc2Ojh8EUaj:43fjsYs9BJw6t26huK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482026, "uuid": "ee1e6037-9597-40b7-b168-cf0c011e893f", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482026, "uuid": "bf826e01-cfab-4552-8080-42e2bd4e86eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482026, "uuid": "eadec6d6-68a0-4968-b8bc-b6e41b08b9a2", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b73f736-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771512102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512102, "uuid": "32572f86-1c40-47b8-9696-5b17d5788da5", "comment": "Malware payload", "value": "3e4ecb8c1b0d8ed4199fd10a20014c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512102, "uuid": "f02cb0ab-5af8-4cdc-9b85-3edc71ba3639", "comment": "Malware payload", "value": "ed6ec4595b4726f4967b6e6beb1af58d33dcc756a9486dc4fb451379c2456283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512102, "uuid": "00a3c269-bf13-4412-88cf-6102be73950d", "comment": "Malware payload", "value": "4b21466b863f99b9bf4406efd17104ada390f8fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512102, "uuid": "bb290756-8658-4ae3-9889-6d37a8ffc921", "comment": "Malware payload", "value": "64dbfc3f67903a01845febb3cd72917996f4fce40157a8f34b50256d7c22ae257fd966e482a307d4fb14e6f4ea490fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512102, "uuid": "54fea5b6-58b4-4065-8b56-9678083fa53c", "value": "T16A46E00762F56165E8127BFCF5630D215413AB383E3D5B6B27C962E80E7DA04B312ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512102, "uuid": "c9481d7c-6282-403c-ac44-f57bb6663992", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512102, "uuid": "d152601f-cd82-4c63-b2d8-847f57209da7", "value": "49152:Nto5hm40ema7lUv+6BxPHcwPws2yri7g+NznP1Uywo+qRd9XJJiCEJi7:Nte3uvZBx/fbiE+ND6ywohGJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512102, "uuid": "a6567e85-f27f-47d0-8523-c7454b1177d1", "value": 5579776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512102, "uuid": "4911fdab-e02b-4672-981c-6de6b1154549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512102, "uuid": "5e7487a8-7a56-4317-9a77-120eea3ed6e5", "value": "3e4ecb8c1b0d8ed4199fd10a20014c28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71391fd8-0d75-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493348, "uuid": "27133e06-ec37-4917-8308-750c437abe50", "comment": "Malware payload (Formbook)", "value": "a5c70d896526146238a15a93dfdb2f97", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493348, "uuid": "33d5f5e3-e4bb-4599-9ac7-15e236e3eaa3", "comment": "Malware payload (Formbook)", "value": "ee25bbfc7de3f5b04d555c0f754645286ccb27be8a1e618c9ef9d239d22b083e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493348, "uuid": "92842b5f-aa70-4fca-9bdf-d5c67ce9646a", "comment": "Malware payload (Formbook)", "value": "b3f9ffa6ed4fb98069c9d77dc73a1839bc5c2b6b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493348, "uuid": "d53aaa30-e204-4f9d-8c73-806e4626550f", "comment": "Malware payload (Formbook)", "value": "1d916bde4285b365808a82611d87875f3fb58831dbd15703f0bea820c5732b1fb972ce6b90d54e3ef2b3c122730a00de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493348, "uuid": "2f8390bd-521a-4003-8a82-cce9368c39e2", "value": "T1D2A275CD3DC2B166136A603B2A2FE46AF27F5C88F64CA594E9376554F494B08C863D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493348, "uuid": "8644368d-cb46-4829-9f7a-fe29cb6771a4", "value": "384:P8H3/ngpuvwpYy00aoJav6T5thFOmF2HxckCOFwNcr8CWEhY:a3Dvw+UT32CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493348, "uuid": "234e2761-04e1-458d-bafd-a6438c859b23", "value": 21925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493348, "uuid": "f93e36a8-896f-4cae-876f-401ba64f3af9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493348, "uuid": "f1151648-d681-4325-a8b1-87c52a4373cd", "value": "MV MERKET COOPER SPECIFICATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c6c0e7-0d65-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771486613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486613, "uuid": "251d486a-6e26-4a69-bfdf-24e090867c09", "comment": "Malware payload", "value": "bb19e71037d00ff03d6ef44d2888e8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486613, "uuid": "1ff8d9ca-64d1-4a89-af8e-bbf212767557", "comment": "Malware payload", "value": "efeefab10595d96c50268f3efa39b474512b771f3cb2d96d45ae1736f4fade26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486613, "uuid": "4817f06a-d048-4ea5-8e3d-1a4670d34244", "comment": "Malware payload", "value": "4c1d357b2e2a89599adae5af84a3adc1ba5bf890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771486613, "uuid": "05c71875-3f0a-43ad-be88-468779b3766f", "comment": "Malware payload", "value": "c3b46699f9070e666e4c171b7ff00a46d576907c4e89e23d7dc9f06e3f50349ee7f66ec6581748cbd3e8df04be6cbee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486613, "uuid": "6727a082-c523-4fd7-afc0-7f9dcabbeef7", "value": "T162E3120432102A7AE3F455FE04ECE98C9FF4B92898285EE6C5B4D0BA42DD6475D87F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486613, "uuid": "518becda-cf44-4dde-9364-074ebf0a0689", "value": "3072:Qk2XkJZMtgy7w2+qYyDWveexVD7y8W/afm4FkYvzScEzhof:4Fq3qYcWvV7ljfTkYvzuzhof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771486613, "uuid": "da479298-e9b1-414d-a830-d508f4d78937", "value": 147196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771486613, "uuid": "6af6be3c-3052-400f-bc71-096c22632527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771486613, "uuid": "7f0ef5a6-17dd-499f-ada8-dc841a4a0213", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bdf6fe-0d61-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771484878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484878, "uuid": "f4cecc49-df01-472f-b3b9-5e46a6d2adc7", "comment": "Malware payload (Vidar)", "value": "394408f46b45a7088b445a7bbbc1d7b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484878, "uuid": "bf5f2d9c-0a65-454f-9960-925af59104e9", "comment": "Malware payload (Vidar)", "value": "f089ac0cfd26d015cc18a0c98bca727b10efbc71acee1002aa9a1735a2e27bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484878, "uuid": "05e1394d-38ba-4dc5-b18c-b562f96b0dc0", "comment": "Malware payload (Vidar)", "value": "e3976d42cccdb16eecfa9246877496e8ac6ba3a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771484878, "uuid": "fda78c13-758b-4e63-8174-4a04a556d2b6", "comment": "Malware payload (Vidar)", "value": "2fde15ae03f5ecfe9e93d8546cb374128095a98750623e3d9fff38d7fcade892e9dd0722dfa51d75444378bd5df1a68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484878, "uuid": "4117494c-fb79-4c28-814d-6c8f14b1cff2", "value": "T10124122FB6247AE6E30CC0F16B839AED4E53926B2C92678E9A51577C470A1503DD3F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484878, "uuid": "06970cba-fd7e-43ef-987a-17df1150abe9", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484878, "uuid": "0994ffa7-f005-491d-a315-c828d42ba8c7", "value": "6144:HQnZ4T4SeHuYL4i4F7BVFV4ihSya37f6UXH:HQnycSguXXBnyya37f6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771484878, "uuid": "43cf73b6-d741-4ba5-a837-1e43c4076bbe", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771484878, "uuid": "be977f81-1330-4385-aa29-4f9c875c2f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771484878, "uuid": "dafdbf27-582e-42ed-a44d-64d4044af3b7", "value": "KoC0dj3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17916f37-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482890, "uuid": "d941def3-3599-4c6c-90e3-c6524fdd5394", "comment": "Malware payload (Mirai)", "value": "d3599a1052ebc2a0c2bcdd2732b9af64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482890, "uuid": "6d6d39f0-97bb-424d-923f-d06be69683eb", "comment": "Malware payload (Mirai)", "value": "f09594020089636d66419d488f6791047f6989e35036a500a8eea2ea8070cbfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482890, "uuid": "ab128ca0-73a8-4395-826d-07d8072ab76f", "comment": "Malware payload (Mirai)", "value": "f9a36c5c094ba1b9de15bcaed8840ee89a57cacf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482890, "uuid": "fb6615b9-7db0-4dc5-9837-044ae0bec616", "comment": "Malware payload (Mirai)", "value": "cc6037468f2c51386d4da464e4c0015cedd9589b5855953924fda83c97066ffd479004c775b1935c00d3df8e60f8f540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482890, "uuid": "cf3b0067-0533-487a-9cd6-8205abd98300", "value": "T185E47D9DFE4E3C42E2D7E2789E4D87E1721775E4D32391A33982430CD5CAAE98BB1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482890, "uuid": "244543b1-6261-48a5-9ea6-714f43e0dcbf", "value": "12288:afGYkTPOO2NYMnMkQCJ4WxG/pem/qzOH/X2natCTZyw5zSUlaugBv:oGZ12NYzyG/pt/wOhEykau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482890, "uuid": "7dc0c946-49ff-44df-9b37-789fd4945a4e", "value": 674784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482890, "uuid": "8f67e595-1bf9-4828-88b6-f93795659ee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482890, "uuid": "f1f9515e-9697-4f10-80cf-49e76680d83e", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbefe4d2-0d37-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771466952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466952, "uuid": "e8db5aa5-f581-4e2c-869c-d412981a18a6", "comment": "Malware payload", "value": "20e84439918890a47c6c901c4af01b1b", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466952, "uuid": "f090c765-5430-4b71-b0c6-538d4026bce4", "comment": "Malware payload", "value": "f0b0b82e444289ca38356b898589c1882b12808bad1e0bdfca467685d4ea350a", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466952, "uuid": "2e01fb87-8c71-4b8f-a59b-0dc06ae3c6a1", "comment": "Malware payload", "value": "cf51de365fe2aae3f6e1181a0a48e61bec31e83f", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771466952, "uuid": "5a20828c-53b5-4d7e-bf73-abda3683d7df", "comment": "Malware payload", "value": "be5783b28f1b83d86e04c5605efeeec397af0b1e9f77234061c68173674708819702bdbe6284ab5a72eb26d714b4d685", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466952, "uuid": "f4a3a263-dbb9-4420-9e96-02aa6a73a99e", "value": "T15A07331BB1A8B63ED46E27340673A41068FBA75DE526BE1673F4D04CCF261C01E3AA75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466952, "uuid": "eba9557e-5be6-4337-9346-812343ace45f", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466952, "uuid": "192db038-83b2-42a0-874f-289bf30f17a4", "value": "393216:VUJdFaFrXUCZBnet6mZPEfRzjWxwFHHgGo0b+OhXFA2uJ:VUJLyz7NDmZPAzamFa0b/JFTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771466952, "uuid": "4e3fdeda-4b68-4734-baef-fc57db5f05b3", "value": 18191754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771466952, "uuid": "a81b39ac-63fa-4ecc-a3f8-bf82ef57cebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771466952, "uuid": "9176436e-220d-4ba1-ab89-72acce5d5fec", "value": "ClashSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388cea7d-0d8f-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771504420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771504420, "uuid": "0a7fe41f-6ebf-400c-a223-b0fd585e2cdf", "comment": "Malware payload (XWorm)", "value": "b4aba14905490385e94de86aafabb2e0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771504420, "uuid": "65aeb556-3e1c-4d16-b964-d1e1d86bd78e", "comment": "Malware payload (XWorm)", "value": "f0c5a5dc4ab51d8f3988e778996419acdfd7aa66139d10fb17606efb7c284cc2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771504420, "uuid": "a80df5b4-d2ee-42fc-882a-f4a57e56968b", "comment": "Malware payload (XWorm)", "value": "6f20243b33962da0b4ba46ecfebafa2cca864b09", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771504420, "uuid": "d9ed0cde-b033-4388-a655-fa9dba758778", "comment": "Malware payload (XWorm)", "value": "04ce89f4e3d820c188778a40284bd00f89c75074e5518e58737e1b6a8360ee9a14ea66b8cba79c579366442729ed0123", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771504420, "uuid": "b47f5333-b6c5-46d0-9f32-9ddcdcd47414", "value": "T194331AC537E600AAC7FF9BB096E3950502B5A3A75D1BE74DD8C01AA72F637C049419E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771504420, "uuid": "f7d5254a-5bd5-4d03-8a6c-458e659f3462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771504420, "uuid": "8629a071-3e1b-4bea-84b6-3d029c64e94c", "value": "768:/eu1ARBvO0pS3bqK3OWgv69ENDI8oVFIEoFoOq9ToF:/euSy0oi69EZ/ovDIoO2oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771504420, "uuid": "e7074465-acb4-42ef-9913-79f18cd46b4a", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771504420, "uuid": "cb60aba0-1cfa-49e6-8a34-684c4e8d3aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771504420, "uuid": "67599c7b-da10-469e-9020-23ad5decce18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f74cf1-0d8b-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771502637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502637, "uuid": "e648c50b-e339-40ea-997a-8df4911362b0", "comment": "Malware payload (SantaStealer)", "value": "8046820a29305a3aed30c1de0c1c0fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502637, "uuid": "152c7550-bea4-43a4-9e6f-5238213c85f7", "comment": "Malware payload (SantaStealer)", "value": "f1087c67af105af68436a3634395235cd6f4a0427d84a4a9234529f480d4047f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502637, "uuid": "85aeac89-91a2-486d-a9f2-db44e9af19c8", "comment": "Malware payload (SantaStealer)", "value": "e357f7641646316dbafc9aa308660c48bfd231a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771502637, "uuid": "961ef745-b050-4e8a-a61e-dcc56f1c72a4", "comment": "Malware payload (SantaStealer)", "value": "fc78d9341f90c47c093a4c4039e6555e4f0d02158a81864766493c12b69a453dadd7656808990f09e3e0ad8128940ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502637, "uuid": "90379a4b-4943-4ce9-91ae-6195db831f06", "value": "T1EAE53386D246603CE647ABB753D3ED358564AC2424B13AFC23E4A4767EF3B020B27975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502637, "uuid": "62877219-db32-4494-b025-bfb52bf3623f", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502637, "uuid": "7dd87d7f-50c4-4e89-a1ed-c7750336f484", "value": "98304:oWFjBUJ44xEoakWTsKpoIx7UC3xXJzGTPvMc1yyg:oWFi/x3ah7SC3xXdGT6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771502637, "uuid": "c917dff1-d09e-49a0-bde2-9be5d1f19172", "value": 3175936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771502637, "uuid": "f025d9e9-a777-4744-9e5f-511e0e3039ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771502637, "uuid": "ab99c82c-bde9-414d-b2b6-7972b03fc6d0", "value": "f1087c67af105af68436a3634395235cd6f4a0427d84a4a9234529f480d4047f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e2dbe0-0dcc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771530690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530690, "uuid": "4367eeb3-ae8c-4d7b-b347-edbdb7e50e90", "comment": "Malware payload (Mirai)", "value": "7fedf588c22141fe90ba79371465e74b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530690, "uuid": "34fe1e5b-0577-4028-a69f-cab80a603240", "comment": "Malware payload (Mirai)", "value": "f177141de21dcf7183bd66bef83f7e752f48265c437ff9f019e6d2d37a0a84c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530690, "uuid": "4b5c5451-764b-4004-aa8d-a90c5509b52b", "comment": "Malware payload (Mirai)", "value": "046e115c59b86202fb28cdcd3e4dee455f1095dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771530690, "uuid": "46bb2d81-db89-4553-b546-89f04c70fc58", "comment": "Malware payload (Mirai)", "value": "6bc7bdfb9d1e8dc829b5fbc0f5d5d7a7452416c0eb03ce7b1b6868896a7c01c9e91ee24904be708b927cbc4bd340e57d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530690, "uuid": "869005f1-5095-4970-8b1e-cff3b6b68ab2", "value": "T1F3336B21E9791E17C0D1F8BA62F78729B3F51A0F25A88A4D7D720F8EFF2498055072B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530690, "uuid": "c22a6323-b67d-4d14-947d-a1e84abc4c0b", "value": "768:r7cwVl1oJ3q9pMRttz+wPAPN6Bz1TxZSiqN5MO+h4uxN3ZFIs:PcwVl1YSpMRT+wIPN6Bz1TxZU2h4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771530690, "uuid": "5437696e-da10-4cd6-97c5-abccdcd8a08d", "value": 53869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771530690, "uuid": "832c4a82-2c43-47fa-afbc-dda66609bb54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771530690, "uuid": "c7645bf0-c497-4b6e-9890-5b73817ff68b", "value": "odin.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16ded93-0d5d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771483148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483148, "uuid": "ccf54078-2087-4f5b-8565-b61c5c2dd92e", "comment": "Malware payload (Mirai)", "value": "50ff9035f1bd84f46645de750037920e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483148, "uuid": "ab99ff98-a63a-42c7-bc27-306dd67b219f", "comment": "Malware payload (Mirai)", "value": "f1907adb392eeec9b55ad4528cb0a72438e53dd3f61d963d1b7df653b3c08117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483148, "uuid": "6f279717-8fd3-4cbf-ad4f-0328933bf6ec", "comment": "Malware payload (Mirai)", "value": "fab93aefc9bb14cfa037ec6c156eae47c6b8e533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771483148, "uuid": "39dea384-8a87-4de6-bcf3-2013ddf0c36c", "comment": "Malware payload (Mirai)", "value": "68cdd9cffb98015f0bdf0073baa62de88b446de5c383bdae3bf65154916f14fab33477669ea8e94397ce2a1ee86f3075", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483148, "uuid": "9ef44be0-d5d6-45bb-bc24-425ecf05f593", "value": "T1BF057C4BB2A374FDC157C43443ABC9B3A935B43542226E7B65C8DA303E16E701B1AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483148, "uuid": "5605837c-f84e-4f6a-a169-6e09fe806337", "value": "12288:KeEy4WWawlD4s50D/tkYiG+W9sv1tv51JtU6u6QWw0+h8bdzuF+4Jykfrm8qfHX:UVP4sukYiRPdth1JtBQS+Wmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771483148, "uuid": "77ff7b1e-dbb2-4fa0-b68e-1547bb477349", "value": 863752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771483148, "uuid": "c535c979-ae72-48e6-9f0a-ee05a3204b8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771483148, "uuid": "d5ae3858-8963-4042-b2af-b47fba7418a6", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed15fbe4-0d5a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771481960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481960, "uuid": "1c5394da-47a5-44aa-8ecc-fcd15d234aeb", "comment": "Malware payload (Mirai)", "value": "fd6f527b54066972b20423a4c2542498", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481960, "uuid": "d5989d25-810a-4d0b-8bc3-4b9531d626e8", "comment": "Malware payload (Mirai)", "value": "f7062777891e1a789c6c858c4af8c7d1fd96271b270447e2474c310ce32e82a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481960, "uuid": "3023724a-601d-4c10-9281-ca5d9bbae12b", "comment": "Malware payload (Mirai)", "value": "fc58b35ac85632b9219271ffbefc78bc4215b2ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771481960, "uuid": "a64ad118-3417-4653-be46-bac3552257e2", "comment": "Malware payload (Mirai)", "value": "1ba95fd53576ec9de5d65ff9af0db6b81951e395e33ff7526ed2a1ffeea3ef4626604b19c08f204c5711f246a7cc9678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481960, "uuid": "33e2bb31-e99d-459c-b7a7-d928869263ce", "value": "T162D3C031F0156CB0DC1116B8787A8A7C0700DFB407E55243EFAEE59E28BBD9579EDAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481960, "uuid": "ee66df5a-fa0d-4056-90da-c164b05436f0", "value": "3072:VvW6yaU4BtrR0zKTfo4CTbHHlhlXNrGtjYrYH6K6Zi:VvW6NtjTfN+jHlTNq1AYHVAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771481960, "uuid": "b45742c8-7157-4b87-b532-9920e3041cb8", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771481960, "uuid": "26ca0937-8c82-4395-a889-9279e0ecb610", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771481960, "uuid": "c0a23de6-37bf-4b76-8ed7-a5d25f78d401", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037b5124-0d8e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771503902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503902, "uuid": "ea59e023-5a54-4d42-a5ec-2fc55bc18eaf", "comment": "Malware payload", "value": "40502d6c52de934e8ff72644e512afda", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503902, "uuid": "923e147a-3496-48a5-be81-e0f2fd8342bc", "comment": "Malware payload", "value": "f7da537ef4d6612df109c59ee668b449981c90d7c18a96d411a1f62805bcd20b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503902, "uuid": "97d8bfa1-d0e1-401c-9613-7c14ef8a1ce1", "comment": "Malware payload", "value": "5f6dd768e83a40af155d88347a2b6dd74327d5c6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771503902, "uuid": "4a612511-97c5-4894-a9af-66f8a468faa1", "comment": "Malware payload", "value": "a1b0a4b41ef6eb0c86a4ca48dc4418023cd6c2578ac3a2dc552267fbb7fd66eac0e28619c60a68b5c1039528f36a0497", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503902, "uuid": "9d60efd8-83ea-4d46-ba47-dd2e761c981b", "value": "T1BBB633723EBA1861DF834B3C5ADDFEEB7FF1660D95EC695AA1FB534918BA4010181083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503902, "uuid": "1e36274e-ae1b-4eae-9c52-9ab955a9db50", "value": "196608:qIbKmijEywdk0wAjfe91xPYijf4UGYrFfj5dFg1tUg3:bb8Dwdk0wlxwijFbPFg3Ug3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771503902, "uuid": "a94dc585-4d47-400e-80d1-de7d921091b7", "value": 10496956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771503902, "uuid": "44309ab4-5e02-44c2-b309-cb4e899c0beb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771503902, "uuid": "af4d2366-d983-4142-ac7b-68394fa57b3b", "value": "p7gg4f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a568524-0d5c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771482599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482599, "uuid": "c383779c-4c46-4193-934e-86b04ce66a1c", "comment": "Malware payload (Mirai)", "value": "10cd1f0636d42963e0d5086efa3b6ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482599, "uuid": "4a5645ef-4803-4d68-bee2-eb2bfefe71fa", "comment": "Malware payload (Mirai)", "value": "f88260438ddfa1ccc64a02cf92e036dc8a4c8ef6c219effd3c8d66e466465422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482599, "uuid": "44637408-3ad5-4b75-97f3-3b83c27fc734", "comment": "Malware payload (Mirai)", "value": "c98e7c113398fc851f5ba4ae7e0157404204fc0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482599, "uuid": "be8dc210-f17a-45cb-abf0-5022f17300b3", "comment": "Malware payload (Mirai)", "value": "8b41e44c2766ae13c0d22ec6397b94f71acf825dfee37a5ad5660e5d76b9a4ebae0581b52936387bf806de5460e00b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482599, "uuid": "5e2f0ab8-97cb-4826-a470-4338fc85db04", "value": "T1D8D3295AB9529F11D5C335FAFAAE414933136FB8E3F97002DD206FA0238699B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482599, "uuid": "e6f8a1c0-65b4-4c79-9e3c-48a562fc4385", "value": "3072:wnBf8xdk7o7dI67w78D7abGfyQh6oaVMl9P555dAAru:gf8xdQoO67w87abGfyQh6VMlh5mAru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482599, "uuid": "690e741f-25b4-47f5-a757-77aefd89a14a", "value": 140408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482599, "uuid": "d0e26247-9271-49d1-834c-792efbdc27ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482599, "uuid": "87983834-3898-4b6f-b0cb-a632c4dde230", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd84932-0d74-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771493099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493099, "uuid": "2e4732e3-e042-4b76-ae80-3dea77eef44b", "comment": "Malware payload (Formbook)", "value": "582f3e19dcc16e9a1f2e4c7da250aeb2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493099, "uuid": "2e6e14f8-944f-4cbd-80a3-fa3ba86d2e73", "comment": "Malware payload (Formbook)", "value": "fba936f56ffa940d82bb44215b681d2834c9d3d7bb345bf96facc7670d8c59b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493099, "uuid": "797156fb-5a98-4d04-afe9-68ae414af7d2", "comment": "Malware payload (Formbook)", "value": "2d5ab2f8e760099a69e61efb6a236c82c95d82a2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771493099, "uuid": "6b5104c8-5e42-4e83-8488-a034997ac03d", "comment": "Malware payload (Formbook)", "value": "812a12396b9c921faa6df86923da5494aac2f0d1dc7d33567f544814b29183939926e76a63ef49fd95d5f989b7823f8f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493099, "uuid": "08fd4875-5396-4a9b-87d8-3e57d7452a1b", "value": "T10295B0A83A5027D1DF6D1B3586ABA90A9BB371EDD15B258E4B02FD44DF23971EC31C08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493099, "uuid": "2e3b1eaf-6dc7-4a24-911f-5c7201058618", "value": "49152:YAQr4bKZSR2Dx9aR8t0bsLvrkzl4mOyLRW/5fOzjZaOPWHnm:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771493099, "uuid": "1ec0f1b7-c4ae-4be3-9f7c-d0d8f1f34ad6", "value": 2047995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771493099, "uuid": "4a15bcc4-18b5-4bea-b2ea-dd98abde0d18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771493099, "uuid": "45823f4d-e471-43de-937e-2272667eb90b", "value": "Technical Parameters.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66657b4-0dca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771529998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529998, "uuid": "938a056c-204a-4d04-ac00-fb86efb37354", "comment": "Malware payload (Mirai)", "value": "194d9f2877cca2ff3a405fa1861754e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529998, "uuid": "e99df964-9209-4c5b-a5b5-a56208d4b214", "comment": "Malware payload (Mirai)", "value": "fbdeafe778d80a572178369d66fce182e07bff20f4e30cfcecc2bbbd277b840e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529998, "uuid": "d9046609-5a8e-4eac-ad07-30f0185beb6a", "comment": "Malware payload (Mirai)", "value": "848ae90951c5ff9bc3a0b29892f0f32ba05e77be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771529998, "uuid": "725872b2-99c5-4408-8095-e5f25d074cff", "comment": "Malware payload (Mirai)", "value": "4743f5d36d57726440a0fecd32656e1a0393a7ca3cc069badf7d652e33b1bfddde2eabcec3c88f03f7702c66aaa16df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529998, "uuid": "872f0ba2-aece-4c56-9274-0f8d7645ef4e", "value": "T19FD31B41F9405F23C6D512BBFB5E428D372A17A8D2EF720399256F25378796B0E3B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529998, "uuid": "f0a1669f-e217-4c27-ac26-47d0397962aa", "value": "3072:QmJYZsT7b+fI7Wq84o4K1N7J81dMiX32+7:QmyybyQP84o11Nt81dvnJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771529998, "uuid": "d42ed46f-a39c-4428-9d11-bb0fb13c32bb", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771529998, "uuid": "8683dbf2-050b-47fc-b884-44ed1565ce6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771529998, "uuid": "ead86054-f209-4d0e-aad6-062f618f29cb", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052aaad9-0d56-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771479853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479853, "uuid": "65ded95e-a325-4eba-a24d-96d2ae2e5f79", "comment": "Malware payload (Mirai)", "value": "26bd2846dc10964c31fc07006091f773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479853, "uuid": "cff0f8e4-2f08-4249-9039-18a8f3e7be69", "comment": "Malware payload (Mirai)", "value": "fbffe5b8ceca22e3d957820e9edd601105f94632766d7e092591914a95a73a9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479853, "uuid": "24de1d65-cf92-48f6-bd51-359e7f5589ab", "comment": "Malware payload (Mirai)", "value": "aa3c71cf99dc52d96bc0ca6ffc39b6fc58984e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771479853, "uuid": "295ce4ad-324f-4ef1-b44c-522bc7034aa9", "comment": "Malware payload (Mirai)", "value": "cbbe137e5b81fb567c9ad8eb1ca40e988f4fbbcf84eadfddb9da85277a1eba9997c627709a5ef5647f0c1a247d7cb4ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771479853, "uuid": "e2a670df-5b69-4c55-97aa-f5090775e029", "value": "T16CF34C47B7108FB1C368D67109B3CB67A6E6269216E19985E76DCD107B3035C6C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771479853, "uuid": "351c575d-b6c8-4ad4-b0e8-23eea5cf2534", "value": "3072:TVJAGpplED1I/9slHT1bUADAA0bT93lluBUJC3wxpAg8kTWzhuOfa4:pJtppqa9slHZAAz0bT9qBZYpA5j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771479853, "uuid": "905b75d5-5df5-4af3-86e1-7f73f6251d5d", "value": 170728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771479853, "uuid": "f047fab8-5289-466d-86a1-b44e69699495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771479853, "uuid": "821a7492-91ed-47b1-a05c-f89498293def", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6ff2f5-0dc6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771528290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528290, "uuid": "f218ff17-6c74-43bb-9c03-b400a5a58b80", "comment": "Malware payload", "value": "8bfddcabd1de1a3d848f6ff42f01d537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528290, "uuid": "6089273e-09e0-4372-bee8-e45939a123c9", "comment": "Malware payload", "value": "fc30cd3ea55b1fa25b7e732e7ddf1dbfb5d042fcfd33418b3b58fd63cc9c4030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528290, "uuid": "e33ec342-5bfb-4f42-bde1-6cc2a94421e0", "comment": "Malware payload", "value": "c314b2762ba4406eef2ce0b715205571f2f7d696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771528290, "uuid": "816aac44-b1a8-43d3-ab6a-a110bcb56fff", "comment": "Malware payload", "value": "8590bfd9fb524531c59a61e6874e3aa75a23038e4fd669c7acd12ee1cd9585c6879d0a0c607592144ca151737821ce0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528290, "uuid": "a6cfd0a7-48eb-4617-a240-85cb2f63376e", "value": "T15D45334CF4CF7CA2EAFB48DEE34923890743FC4CC95599E321226A70A166E787E17525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528290, "uuid": "e18a3543-3e46-4805-8408-7ef4e02f3171", "value": "24576:VC3SCD5aVjKXpb9KyHK7nIgJtTpYIHzpquVF2TFl2w4rnglV6xlh:VTCNmjK5bBKLIgJtTWWz48F25l2w4rnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771528290, "uuid": "26b3053f-9375-4c34-a413-da8eccdceb38", "value": 1196304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771528290, "uuid": "859a9bea-194c-479a-be69-33fb3f8ec798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771528290, "uuid": "becb505b-d388-45c8-80c3-f6b053d7e13e", "value": "bizy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707b929-0da1-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1771512283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512283, "uuid": "9b966bec-a016-41a1-96f2-329ee124ea3d", "comment": "Malware payload (MassLogger)", "value": "69512b80a72224061f217fdd6e585c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512283, "uuid": "ba786e71-0f6c-4d92-8f1e-f2581f7203a0", "comment": "Malware payload (MassLogger)", "value": "fc72b3ca2ae3fb65114b8c60e539aec25d8e0383204e7cda9794e8b66d2a098c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512283, "uuid": "cf2530f1-d6d3-4529-b16d-306210181a96", "comment": "Malware payload (MassLogger)", "value": "344a2cbd3b00dfd51e5b6d52347f1a208e99a299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771512283, "uuid": "c3723dfd-6078-4902-8c20-6c199f3cb547", "comment": "Malware payload (MassLogger)", "value": "9f10a8e9a18c418f8340a3559920bb5c0cb2e8d23b3601ca7df10016170a6681e657294b2482ed00c1fda9813fa399bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512283, "uuid": "67616d3c-b529-49b3-a9c3-563560a59bb6", "value": "T144F533703690DF12D67023FA0571E2386B79AD6E7511C32ADEEBECE7B4A77810440A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512283, "uuid": "cf6e8d96-f852-44ce-bb39-b11f752b7118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512283, "uuid": "b2884175-3fad-4efc-8c65-140d1fbd4ee4", "value": "98304:g69N2OK16XR7KnIX7Idp13fJTbXes5/C0K1L/Uo2Tx+y:gBX1UROnE7IX13hTbXew/vKBglZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771512283, "uuid": "4c67d1c2-6ee6-4d9b-84d3-10734e442e0d", "value": 3584008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771512283, "uuid": "b1de2cfd-0894-4ef4-b4c0-ba00a0a98834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771512283, "uuid": "4e9c85c9-909b-4cad-baef-dd314b2cb090", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7585794c-0d6a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771488631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488631, "uuid": "575ed9e3-f4ec-42f8-9594-f833b288c7e6", "comment": "Malware payload", "value": "82d077b89a59a61d88adfa89d55d744a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488631, "uuid": "67246c44-cf40-4438-9d77-1a382976c985", "comment": "Malware payload", "value": "fd3cc838775e561688cc53ea92eb17b25557181797103324e2adee6793dee770", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488631, "uuid": "6eed4aee-3120-4878-8876-c61f0c220904", "comment": "Malware payload", "value": "7ffd86762317ed173083bce8f9a61e8ba69ccbbc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771488631, "uuid": "fee17d46-37b8-4ddf-b6d1-9c3c1ccebae3", "comment": "Malware payload", "value": "1043d446d5514d7aa20fc6009ca3ff025f53fa28348af842a2d2072a604ca844219bd5c5d7b1107d61e16e5e4c315455", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488631, "uuid": "472919ef-fd8e-487f-905c-19df2d6a1371", "value": "T180539CF60959DC8AEF8B66B3FD532D89C6E870FE02D4D7A13427450AD40449DBB2389E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488631, "uuid": "a4298ef8-a674-4594-a575-246b10406222", "value": "1536:U8djHzbKXZkuAm/MbByEB7GL3//mfJWe+vCc7gfkCW5/tpISR:UU/5Ask+o/mvc7g8//NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771488631, "uuid": "4f257e97-34d7-4cfa-bd50-29f7e77d496e", "value": 61428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771488631, "uuid": "fe1a0ac8-edff-4100-a975-f58772f86c91", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771488631, "uuid": "b13848d1-3ddc-4d49-8f9c-dd910e0127cd", "value": "Pdf_431582580190226.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c33ee1-0d5b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771482051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482051, "uuid": "f113e8f5-6770-4bbc-a649-dacf773304bb", "comment": "Malware payload", "value": "d5730da08dc4db1c9eeebd4f67b9fb0c", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482051, "uuid": "6890d1a9-849b-4f0d-ac36-0c0b07bf5cd6", "comment": "Malware payload", "value": "fe87e41663d75a4988e948f993ece4d0d544a93a0a6b8c19ac85f4d26ceb6f73", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482051, "uuid": "fd35941e-a404-434f-9c00-f0b19bd37529", "comment": "Malware payload", "value": "49b23844dbf8e2fd5687fb654e4b5a46da352e7b", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771482051, "uuid": "94c541fc-dbea-46d4-980c-d747ec87037a", "comment": "Malware payload", "value": "1a177a6fc748180deb2acf31fb9617ed33e7bc83311fb395bdadc7393b96fb7106cafed4d82e3299e5f208bc5582a931", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482051, "uuid": "57c3b085-a762-4004-94cd-46ad38393dfc", "value": "T19D52D0B4EE266BF6A5C611E29965F3C7DBC029A27B21B50EFCA83315674902F11DCCC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482051, "uuid": "51c7ba31-5e61-48a3-be07-3746e4bbf665", "value": "384:KFc0VHYDnVIRmLmuN3TzM6BbzAfDY0jqPH:t0pm46BIM04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771482051, "uuid": "9a75ecdc-82b6-4938-818d-ae1bae1475c0", "value": 13522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771482051, "uuid": "c45bbca5-4e89-4161-86cf-3e781b5270ad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771482051, "uuid": "b16dd256-1f26-4f81-a0d7-b9d3b2952203", "value": "Drawings.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb85d87-0d97-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771507969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507969, "uuid": "124b0305-be37-4528-9530-b416fd97f63f", "comment": "Malware payload (PhantomStealer)", "value": "af18e2417a224ca360ae352e0577901b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507969, "uuid": "b727d131-0bed-48dc-a94a-dee779524f1e", "comment": "Malware payload (PhantomStealer)", "value": "fee466f5b375bb863ec7e353f4c94af78159753c0a12ed2df01779b2933af183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507969, "uuid": "df590d76-46d0-45a9-864b-b7daf268cb70", "comment": "Malware payload (PhantomStealer)", "value": "a009c6cfdd0110b40e97db586ce1c18eed7e339b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771507969, "uuid": "9df93f0f-49ed-400a-b8d6-a446f3093ac6", "comment": "Malware payload (PhantomStealer)", "value": "293cb99570df9f19aae0127522dcfb0db5407688305a9de89905b5b0c79e47b7458d73059b0c6c23a7ff719ea23c032e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771507969, "uuid": "22b5e170-3319-48fe-a64f-df3c653e0c16", "value": "T19226B00466CF37E46AE2AF1F8EF693020BFE24560932919C97267FC43775741639B268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771507969, "uuid": "8c54887a-a926-4977-b00b-aaff1d1a5e83", "value": "24576:MeKcxv4ZgKuJ+ln0BK2HMe4WMr3OGT+XflOTdtO06Vz7xfzfyJeVdAiaA5xDu3WE:NKkYV9iztWICKyuEpUwE+Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771507969, "uuid": "ecd69fe5-d3f9-428d-afb2-183fc5bcc9f8", "value": 4705783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771507969, "uuid": "b4b53162-b393-4c35-8c42-ae218d3a5cfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771507969, "uuid": "bf97d8dc-40c9-45d1-9177-68a7be2c1e38", "value": "clofjs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }