{ "Event": { "published": true, "date": "2025-11-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-07", "timestamp": 1762560182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "678f5174-4830-4459-9185-2fcabc9a40e4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8d9ecd-bc1d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762549531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549531, "uuid": "a88d5138-61ea-4ca3-93d9-6fdf39abf665", "comment": "Malware payload (Mirai)", "value": "49d0bb7224fbd69eb3c13ab4af077496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549531, "uuid": "7071a0fd-a4a3-4ee0-b6f2-9f50895c2466", "comment": "Malware payload (Mirai)", "value": "0165942d9b8d742c06314183248313f5f30c45ca8ad0928ffbfcd1b09eab1826", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549531, "uuid": "ce4421ab-8892-4db8-80b6-439364b1feb4", "comment": "Malware payload (Mirai)", "value": "e747ccb29b6fa80641fd46916a1bf5eefe4d1fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549531, "uuid": "2e9bda38-5564-4c4a-88dd-ad910d91b40b", "comment": "Malware payload (Mirai)", "value": "57785e29666d43617fa97fab8ab5c4a99091433bdf2f2fe88b10214f3d489cf86b3d161a3699a4a492153baf4a7750b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762549531, "uuid": "676cfb0c-d4c9-4fa9-b64e-d0af340719db", "value": "T170737CC5FA83C4F6E81205351277AB379AB3E53E2168CF83C379A676EC13502E91625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762549531, "uuid": "4f2fc35b-e408-4352-afac-b3af8a01f586", "value": "1536:+xWcbX4vYlTBOvtOOc4/72D2CYVNhXdCo0ZEo:+kckvWOvtOP4CDLMddno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762549531, "uuid": "0c9284f8-455c-4758-b4a2-d9df45cb9d84", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762549531, "uuid": "385e4633-1563-4fc9-8e75-21174a664835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762549531, "uuid": "773568e0-c721-4baa-b490-8cbcb7053e08", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cc1d1f-bc03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762538248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538248, "uuid": "a8c4b9b9-392b-4ceb-aa99-361b322af5e6", "comment": "Malware payload (Mirai)", "value": "35e39c8ecb03fadc5715ccc0e102b9cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538248, "uuid": "537361da-43ec-4bff-9948-ec805657ee21", "comment": "Malware payload (Mirai)", "value": "03210b9a4a83e38cef972db97a33af5365ec109a13506d9af64b894d4f0c1974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538248, "uuid": "8f5707db-8269-4207-acea-70e9468d2387", "comment": "Malware payload (Mirai)", "value": "add08d9f0c5ff446e80a5aa3d566a10de0394500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538248, "uuid": "3e6f5abe-85a5-4a01-9a1c-45bc9352fdcc", "comment": "Malware payload (Mirai)", "value": "5ca0e00bd81220d045aa989543b1892e0c2ea40ab9c274d5a042678ca6e8dbfdcd759bc4594b063bfaf47be029a866a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538248, "uuid": "1c123627-ad2e-4cea-8a37-be1b5b728cf5", "value": "T12823F11AD5584B05F002663808FFF54F2DA0461D9BEBC8E3858CB61F9752FE179297C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538248, "uuid": "799e5cc9-b3cb-45cd-ac57-ab1b489e8445", "value": "1536:L2yeVYI0Rozi4fRBSIzDJsaq0kqRs1fnouy8Hyg:L2nV+mdftveaG2ooutT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538248, "uuid": "10be8403-74cd-42f4-ae5d-3bd3515be15e", "value": 49344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538248, "uuid": "d62b8cc1-67c7-44fb-bf43-27d9cbb148ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538248, "uuid": "e3cf3f4c-27f4-44a5-95ed-24ebaba68982", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b532bf3b-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526430, "uuid": "d9bbde57-0622-4a95-a2db-ad60a7a60d34", "comment": "Malware payload (Grandoreiro)", "value": "c2b271e959ba98452acfc1648011a7c6", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526430, "uuid": "6e6d19c8-3417-49a0-848d-a96e530a749a", "comment": "Malware payload (Grandoreiro)", "value": "03ffbecb1561db61a61c9eb7d2ddffbe5aa5f8d979dfc6ebbcab94bd8ad07623", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526430, "uuid": "75a18f7f-1438-4144-b00c-cd9ba0de50d9", "comment": "Malware payload (Grandoreiro)", "value": "e511bc762ad016bf7fbc9c0f98968d9df6ec7117", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526430, "uuid": "0cab26a6-1f66-4daa-95e1-1cb315245019", "comment": "Malware payload (Grandoreiro)", "value": "430b01ad21c6d8f5fb0e6b9b9e6248eb86de6e7155cfbd328a364571f2cfea69e2f6c04d5c19246517ee7f7504276226", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526430, "uuid": "dc8cd515-1226-44bf-bca0-a0d09078bfae", "value": "T17D8623722E59383BC6614735F00F37229E3D98578B4891EBF4CC914A369B6D6493F8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526430, "uuid": "fa68b6a6-907b-461e-a0fe-3143aa2ef032", "value": "49152:cxaJGRzzWsib17LNeHO4DEaI2Aseca6Ip+EF8/OLFABd1htKZr6YZst2y7KHvzwT:uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526430, "uuid": "69ac384d-f5e7-43eb-a95b-1d5695738c7d", "value": 7952384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526430, "uuid": "9a8f9844-3bb0-46dd-8434-9072ef5e4568", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526430, "uuid": "0efa9a61-09fc-4ee4-9d56-fff08aa4e5ea", "value": "TMS2651O425523200.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1b772e-bc33-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762558949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558949, "uuid": "4e39cb56-363b-4615-a24b-1ca225ea2eff", "comment": "Malware payload", "value": "a1c0b619c4b6eeb9e3afeb5f1bd5d249", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558949, "uuid": "f94f9114-b752-47dc-9d4f-611a8700293f", "comment": "Malware payload", "value": "04536a23b54005b43ecbb7188c39ce992a852e824c608a26a7837b60280ad76c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558949, "uuid": "3f4bf201-5477-4ebd-8067-388d7dea8ab6", "comment": "Malware payload", "value": "ae73eeabc05aedee0a377f7fd37065949a1caad7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558949, "uuid": "2d764951-da67-4535-842e-60c9bc14bbf5", "comment": "Malware payload", "value": "79cf02402702eb1ebef8eea7cc75a57ea85d1b1a8aeea9083b67cb1b3faaeab5dabd5f070a87c1cf8298edc3c74c0948", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558949, "uuid": "4c0dbccd-3c21-42c2-a56e-5feede008f4f", "value": "T1B2D0C259FC420836B8758CBA77DB3451910B920B6A06958A31CB520AAAE4960A060453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558949, "uuid": "1d792bde-8f34-4060-aa3a-f83656ee5b76", "value": "6:hftJ+pUKUF2RVYrV/jkOYf53I4Y3FoF/fkVKhOXqIKXD73IKX+N1IEWYq1IKBKW:ZtJ+jRaV7YJF0ghsOTh4WYO8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762558949, "uuid": "acfd8a64-f98b-4a8e-8763-eee3cf601691", "value": 290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762558949, "uuid": "c7ce8379-d994-42cc-a54e-0ce6209709a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558949, "uuid": "dbdc6043-0e44-40ef-a26c-0067884ed78a", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e35e9d-bbfc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535398, "uuid": "0d17937b-7fb6-429c-ba3b-e9d644046c8c", "comment": "Malware payload (Mirai)", "value": "7f890af1fb4c65b247b8e80ee3058b85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535398, "uuid": "55e64fb6-0bdb-4456-b743-21b067bae2ac", "comment": "Malware payload (Mirai)", "value": "05d2d4be8bc03591f6461dcbf68cf8445fbb403fa4b4ea4f5435dc1dab5c9ab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535398, "uuid": "43d8530f-051f-4b15-9d94-16e818be1e5c", "comment": "Malware payload (Mirai)", "value": "eb2e2647fbf991a6676caba37ed568aba08ed12c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535398, "uuid": "04f37dd1-5e69-4b8f-9dfe-a02e13728e9d", "comment": "Malware payload (Mirai)", "value": "fbe5d0b63ef97561106a1c1ea6a93e5c443962a03a2d65bae096ff1917170db360d264e57c5a819dde1b5ee16ecf9ff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535398, "uuid": "03f969a5-ddea-4d57-98fc-398b39cdb716", "value": "T13B23014A583C9708C2BF52F9D93E278F655CB2D315A9D43AABA059A1D4B6FF03600CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535398, "uuid": "fd746dbd-d489-44d5-be92-b4a699a7637d", "value": "1536:38KlwmMVHwrjCz5T+CFn5t1cVrupnouy8Hyd:sKlbMhw3gEg5tG4outu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535398, "uuid": "47924335-ae17-455f-ad8a-c8621903a2c2", "value": 49208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535398, "uuid": "0c7f5536-7801-4f8c-98b0-ac2ac98fd888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535398, "uuid": "47965472-32f4-4b20-a9d4-32090d82aa8d", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bb7c0d-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513861, "uuid": "e41ba9c2-0105-4cc6-a19c-355f62ca1104", "comment": "Malware payload (Grandoreiro)", "value": "e7f1af13ddf71b5466c46b07f3b23f34", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513861, "uuid": "b54627b6-9b8e-45c6-a0d2-e0822952fa9e", "comment": "Malware payload (Grandoreiro)", "value": "065204c8643c60a7d6b964a5ad166fef095a630dcc55d3d9a9ec3837d75dd338", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513861, "uuid": "4064c6eb-4e1d-4f22-b2e4-726a5a945cd8", "comment": "Malware payload (Grandoreiro)", "value": "f4ff9d2f335a03c38563d06fc7652fac0efbd8fc", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513861, "uuid": "8167d070-1cf1-4fc0-9993-c7f3d0662793", "comment": "Malware payload (Grandoreiro)", "value": "166649f20eb5546006843c086d21c982ef2be204854154176fe46504641297beb9bdea40041f01c1aef59cb3c1b4e609", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513861, "uuid": "16d4a67a-79ee-4688-aa04-3c20cac28667", "value": "T1805623736A55353BC6A10334F05A37635D7EC4A7CB0892D7B8CC918A37CB2D6897E4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513861, "uuid": "28ef57a6-73df-4b86-ad4a-8d3230264233", "value": "49152:clOeLiXAaHjgsnJgBlyYBPp3YRpC25QXYzq4OFsiO36vC3S+1ZjGBRSeC6JvSzuU:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513861, "uuid": "489e5711-93c4-4eed-a780-a429a8060f97", "value": 5928960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513861, "uuid": "d7580b79-2186-4e91-820b-b70e8213be55", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513861, "uuid": "0428a51a-2aff-47fd-bafd-64acf98c0edd", "value": "QBN600947C3A7C99594.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5752b0-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502764, "uuid": "196337d7-81e6-4c57-aee3-05bcbefd0c5e", "comment": "Malware payload", "value": "89ec39486e978e05a7671858e67f4fa0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502764, "uuid": "96de4c1d-31fc-49dd-b2d8-c68cd38763c6", "comment": "Malware payload", "value": "07713bac63b5c648c308cf8b7f8a8228cd8dd69104fa390381562182c4f1ec0a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502764, "uuid": "a858b3ef-daa3-4b18-8054-57c34dcd42ad", "comment": "Malware payload", "value": "59e0e73a4332aa9cd9fbc07b8a705795d46a7849", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502764, "uuid": "9bf0d5a0-f3e1-47ed-a1a1-6b61e6f72c40", "comment": "Malware payload", "value": "2c2966ff5fc6faa688d62eea6f7f82bdbf5686d71535998630e539f13fe60201e683f973ecf7ebd95ff8fbb96ef0fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502764, "uuid": "a0e828c8-6a6c-475d-adbe-e1aa21ce5254", "value": "T122D0235107A4D905C971D120657535C1D6750504D0223691F3986CD9ACF61EC4DDD929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502764, "uuid": "41c76b9f-b528-4372-ac78-20c6e60156b4", "value": "6:s8qXQV7I7vaduX/JjJVDLgyKBM3S1EBzyK06:s84QMvkuXRjJFLgyaIS1EBzyL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502764, "uuid": "e2962caa-c2c0-4ae3-8f8d-d1e44fe8bd44", "value": 220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502764, "uuid": "ca026a90-29b4-4cb9-aed2-b63a9925f233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502764, "uuid": "2dd355e3-e023-4f93-bfcc-efbee6bc2fd2", "value": "49EvsjR.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e9c845-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498589, "uuid": "133f9532-d174-49c9-a2b7-0df0d02a18cb", "comment": "Malware payload (Mirai)", "value": "cd097421782f8588af773bc7c502b02a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498589, "uuid": "74a3211a-21fa-47e9-80d4-993aefde5c8f", "comment": "Malware payload (Mirai)", "value": "0a068ca810979da0c55b3b3e0aa69f153d805c799d74c0d8463eaab0759e2816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498589, "uuid": "ccd1870a-579b-4a8b-8edd-16dbbf6158ad", "comment": "Malware payload (Mirai)", "value": "05ddaad4a4008952f0948f159fd979e50c1a4cf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498589, "uuid": "52cef83a-409c-49d6-bbbf-a44e7ca3dd31", "comment": "Malware payload (Mirai)", "value": "d22b96101343b6546afbe1058a68b1eb247f234e2a047bdc4d57639ea1a36187f1a6c3e3ca4cb1351bd66de754cf83fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498589, "uuid": "6250b180-f6af-4a94-b474-a84f3e4ad0d9", "value": "T1AA03F1AA12861D61DF69C8BA02B713223E910F709017EC7765DE97DB9F902943C1ADF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498589, "uuid": "35a8d35a-5e32-4886-a191-066de776da93", "value": "768:NzFpBO3QkmpwlcWctKRaZ602lLVCDxs5kXmi16D2UYFm0+mJgGlzDpbuR1JxlZ:5J2Qkc0cWuKRkqJCDnBjUoVJu3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498589, "uuid": "2dbef531-e747-47dc-abd7-9a51c1f03206", "value": 40876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498589, "uuid": "7d7b871f-e6e4-462a-8a0f-c2bcce189af7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498589, "uuid": "e88e6747-9671-433f-98ff-7cdc1fba77bc", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e400d588-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526508, "uuid": "9bd76bdf-5fbf-4b72-b326-ad11e5865482", "comment": "Malware payload (Grandoreiro)", "value": "3472ffa19d62df6a8e06fb2ee6e1f37c", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526508, "uuid": "d40a48d6-fe9c-45fc-b5ab-0f1f690537e5", "comment": "Malware payload (Grandoreiro)", "value": "0af46ed0d78b68ee2635f8b6c57c856a4c92f7e3774825c1e1a4589f03618f87", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526508, "uuid": "a526591c-2b21-4788-9634-deeff2940c00", "comment": "Malware payload (Grandoreiro)", "value": "8ab61627f64cc5bb2eec1739c9f0c2fed258940e", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526508, "uuid": "37eeb3bb-d96c-40f9-b75b-fb01daec4e8f", "comment": "Malware payload (Grandoreiro)", "value": "83fef97f5d5a9735ebfe6639a92d6f329fa0296f0c4d6592291518dc6e59b185b225b8c69d3aaee73d98c71ed50c3762", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526508, "uuid": "bccf32c0-f45d-4535-8094-eb0cb1f5c06b", "value": "T1325623725A992927C7620775F14E2373AE2D8867CB0C91D9BCCCD08933DB696853F878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526508, "uuid": "4a9343a9-dcea-479c-854d-0bfb44919eca", "value": "49152:Cln+DH39ssDw5PtBljs+jN2BhHftCI6HzPP97MgEYGHg79D0szBWsPQDlixBpOj4:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526508, "uuid": "9ac0c23f-1509-4f93-b15c-5dcbff25e610", "value": 5902336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526508, "uuid": "9b70722d-1b65-44ae-bc4c-08565f908a51", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526508, "uuid": "da34ef29-5cc6-4da6-b670-76bff4c76ee1", "value": "TMS6855N3VRQ143645.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3760b6b4-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513763, "uuid": "d2719317-25f0-4cf2-b424-b6be87ac12b1", "comment": "Malware payload (Grandoreiro)", "value": "fe65898853f6cdb1fe68f3f5a0cea98b", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513763, "uuid": "517ed3b7-4d56-48cf-a16f-caf26ed35ef5", "comment": "Malware payload (Grandoreiro)", "value": "0baac6fce31b46e8f0f9c1e6a9db61163ea51b7d6ccfa75a0e8b2f475efe2828", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513763, "uuid": "623f33f9-e18d-4993-b708-96567cf45dae", "comment": "Malware payload (Grandoreiro)", "value": "f5f67500e03f41a576d8a52453f133ab6ed2f59d", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513763, "uuid": "d138d4f5-80af-4b0d-b6a5-13c93e44c82b", "comment": "Malware payload (Grandoreiro)", "value": "e238b12e35791bcb37abf45ea4193c2680a55cad686cc1c81aea7fd2e9a97d6b445bb4cff70bdf2d15747421a0d2e55a", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513763, "uuid": "c4ce56b2-3e3d-4725-8fd6-6095835b62cd", "value": "T1278623726A95286FC6500B35F04F3B766E7E4427C70D91DBB58CA08A33DA3C5853FAA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513763, "uuid": "1e6418aa-24da-49e0-8ff8-33220046e7e2", "value": "49152:mt24B+arKWpibZv38APBbkCIp3df9sziwYS43zx4HANrAolA1s64h4jFGB6RBrka:4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513763, "uuid": "2044251c-81de-4946-b956-78de0285f592", "value": 8169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513763, "uuid": "d400f8d1-5ea3-4a7c-a10c-d8a81f71d1b7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513763, "uuid": "c6880006-b30c-4033-b150-3bd89e923083", "value": "QBN25596MU2B26723.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05995fd-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498585, "uuid": "c569ff4e-43be-4d7b-aa5a-fedf922b6042", "comment": "Malware payload (Mirai)", "value": "2ba0e31e68ed7d079f9ce94366f844e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498585, "uuid": "93bc4e29-6a0c-426b-aa1f-ae692aaf123d", "comment": "Malware payload (Mirai)", "value": "0bff533eb25d736b1a4e3ceec09d7a5a622995c156f640621f82a67a2f1a75ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498585, "uuid": "8cdfd018-5893-4af6-b7e5-5193283022c5", "comment": "Malware payload (Mirai)", "value": "1b2a3abaec4f525c463f097eb6f605c21dbef8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498585, "uuid": "eb5c99cf-43c5-459e-bfe6-ea0132ef19d5", "comment": "Malware payload (Mirai)", "value": "09f55c133de208614a6a47b490dd02f03fe3442722456dd8b199e2ad6e763fb6631368653ed756c454912da89a74e815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498585, "uuid": "94d864cd-d183-4082-86e9-0133feb4116f", "value": "T1F5C2E12863DDCC71D3B0E43E979DCA8E601246FDC1F62331430567A8A9AC12765FD69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498585, "uuid": "d4946b76-f97f-43fa-bcaa-022ef0f33bc1", "value": "384:4B5vm+rsc6ZIQSTB2ZDsJnsbbwyd4fIhuBAXaKFOaw/7PAUmhymdGUop5hD:cObVhbbpe4iA3s7oUms3Uozd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498585, "uuid": "6671af55-aa1f-430e-ae06-ea01a9ced89e", "value": 26788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498585, "uuid": "efd679cc-4a02-4db9-b06c-4a79ac844ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498585, "uuid": "2a805795-6575-4104-a8d4-b88bfa2b2264", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7626fee1-bbd7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762519452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519452, "uuid": "97963fa9-e8ff-4413-a67a-2a420a2bd132", "comment": "Malware payload", "value": "3ba2b40df1d23e9f176ccdc0ef9d40bd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519452, "uuid": "31c831f6-4054-4ca5-a8f9-6454248fdf32", "comment": "Malware payload", "value": "0ee9272dffc57c49f3b539656afeff80599be3f75e5625701eb1201e8c08a095", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519452, "uuid": "6a2c9996-6174-4e97-8f67-3fd1963cae78", "comment": "Malware payload", "value": "5b73f1780233d9eaef2e280c247f7ce9d481660d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519452, "uuid": "cd44a1a5-aba7-4ed4-a9b4-20aed4c22bde", "comment": "Malware payload", "value": "a666ce6d45caad255bcb10900200af3385a854684a9d0c53564a1743f52ba7ee20110d631847059d4120fc1ba792f124", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519452, "uuid": "6d73836f-2696-4240-8b3f-9dd81539e8dd", "value": "T12207335D99F005F7F9E7923EE972C51DE32039EC2F62C8DB5AE052930E130E29635A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519452, "uuid": "35227886-3e2f-49de-8054-3ea293eaf3d4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519452, "uuid": "c3ac9d0a-cb00-42e1-b785-accad05731bb", "value": "393216:yWSONo/SPCIVDCH2PkRdx4YXMCHWUjMVg74wFKwmIb4fiPA:yWSOV87x4YXMb8kDwFKwmIb4fiPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762519452, "uuid": "9c4e37a6-5d33-4b7d-bf68-0005cb2f6f2f", "value": 17525662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762519452, "uuid": "d61613fd-c664-4fe2-aa63-baffbe7774da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519452, "uuid": "fc7cc363-4700-4aae-8a61-4c8ffb87c2ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419eda46-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513780, "uuid": "86189b1e-6513-44d5-a739-549c6cd3303e", "comment": "Malware payload (Grandoreiro)", "value": "e60a2832f4c232bbbe50a7c9bcd98ada", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513780, "uuid": "cd276aef-6494-4217-9092-4c9082a39381", "comment": "Malware payload (Grandoreiro)", "value": "1162c180d7d25b02337e3395dc1da160a1ee1c0b4bdbcda80663145f0bcacbfb", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513780, "uuid": "0aefffc6-40d2-46f7-9f27-5e922697275d", "comment": "Malware payload (Grandoreiro)", "value": "78d275c5867da594b9c993d0160725d20f9aefb8", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513780, "uuid": "ac2b08a0-6185-4d01-a0a7-daffc0aa6426", "comment": "Malware payload (Grandoreiro)", "value": "7d8d25d1c0889c73005755db4264c0712f8f9e759fa098707efb33c64ccb48e3b1fcf112404d9a849e288e3f4611a565", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513780, "uuid": "43e65e46-6bc3-4527-93f9-9501fbdabc9f", "value": "T1257623715A58281BC6614334F00F2722AF7D99978B4CE2EAB5CCD18B339FAD5463E4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513780, "uuid": "438edd80-c8ee-44b7-8638-3c352142c426", "value": "49152:FLpWUcIkR4oEbogV1qOuL/MnxIajOncPdHFQnjA90VJ8JWocIaaSzGhYj3Fyb6o5:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513780, "uuid": "d6b1a097-e571-4108-891d-69ee7ae63f4b", "value": 7364608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513780, "uuid": "c2c0e736-fbf2-4c17-ae7e-7bf4e31874e5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513780, "uuid": "f4e2875e-8850-40ad-8727-03d4d0f56166", "value": "QBN2453X86S84581.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77acecfd-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497980, "uuid": "f0a00d35-7884-4ce2-bbf2-a9ad0aa20b37", "comment": "Malware payload", "value": "716b890d8c8a127949d12f81d32d7f98", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497980, "uuid": "3deaaed7-9ce1-47a4-a9c4-3b3bc18a86d9", "comment": "Malware payload", "value": "120f2cdf64340f5141a369b567489e457ab85d9f7130d25396250f700b825c4c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497980, "uuid": "b6313ad1-7def-4f53-b740-169ee58a8ad0", "comment": "Malware payload", "value": "b31a0fbd42b90d7d464a0c6b7b91889ec2d572c9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497980, "uuid": "a19d3256-e32b-4111-8fee-b656a61a0301", "comment": "Malware payload", "value": "ee2f897b357936ed458de0d7e397747a2ff900622a12d00b263f14a67892714a4e2d03adf00d30fef4e6c4f37bbab8f8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497980, "uuid": "7d961ae8-e1a0-42d9-837b-4bd6dfbdcd86", "value": "T14317F147E120BAD4DDDB113696373E9C92C20E3FCE03C095568A70B849F76DE3666E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497980, "uuid": "3fb1bb4e-7ed7-44a7-9b89-29bbfa5e1c79", "value": "393216:WomV0TnbpUxKkE6YJ64fyuYhC3iAEmX7ebrcXvfTYB:ambyqJ6FuYhOkmX7wrUTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497980, "uuid": "273b18bd-915b-483b-9229-6ac4be80d941", "value": 18954606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497980, "uuid": "03ce3de7-ff39-49e7-b20f-6ff3db99f5ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497980, "uuid": "68735bdb-61ed-49ca-8c6f-3f965b86f824", "value": "tiktoktv.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b9903f-bb73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762476332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476332, "uuid": "64ee8589-a899-4c6b-bb73-366b565473b6", "comment": "Malware payload (Mirai)", "value": "201afddeea15d68da5ebcdc2da9eddfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476332, "uuid": "c6ed83db-cc4b-49f4-badf-a9885d105b87", "comment": "Malware payload (Mirai)", "value": "126f8be1b4e8baa5cec51dc32156d0904f1525d386514b877599568a0d333016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476332, "uuid": "1c89893e-e1a8-44e1-9b09-8b25a5c890de", "comment": "Malware payload (Mirai)", "value": "3f0d5b343318cf1191d81eb3109a8202b34e4d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476332, "uuid": "9c003af8-84df-48a5-9e30-cd26bc088db5", "comment": "Malware payload (Mirai)", "value": "490dac328034f6bc240074ee7596b702ba0c8c4d112b1924eb0ff3aebc42cff38280d4680005350caee8570841bd4cb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476332, "uuid": "55f5dc9c-896c-453c-87a6-90b5dd3aa429", "value": "T11103010AB2DE23D0EC2425B5B5BE551B8A10B61FBC1D40D1E6C866137B07F556B3DF50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476332, "uuid": "2c08160f-2691-4f1f-8d92-c5b0c7c9db0f", "value": "768:8n7V00h3HoAKmFMYB0pFyQkWBJSI2OSVPi0pEI67hNnbcuyD7UHQRjm:wVhh3HoApMYB4F/CFVPvWThNnouy8HyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762476332, "uuid": "adbe7805-448f-4671-b80b-5145c06f4b8a", "value": 39184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762476332, "uuid": "04021ce6-ad6f-4715-8e9e-16206690e3c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476332, "uuid": "bb76d9f5-42b3-4a6f-9253-64f39c0c783a", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f92199a-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762532675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532675, "uuid": "8fc82401-5751-4618-a447-2df8cc3befdb", "comment": "Malware payload (AsyncRAT)", "value": "48f98e055815942b7103ab142da006a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532675, "uuid": "a7501824-2fda-42d7-8e61-871332e55cbb", "comment": "Malware payload (AsyncRAT)", "value": "130aeeede68df38905e1983bb2bd29c7f622d1f6e99b89b3be43787f7d803f32", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532675, "uuid": "30c8f8db-4234-4363-9ca2-1555b0ea106d", "comment": "Malware payload (AsyncRAT)", "value": "8bdeb6c60e5d3699ed2d5a1e079bdeccda219d51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532675, "uuid": "baf1a06b-a6da-40be-8c8b-9b1f5614af6e", "comment": "Malware payload (AsyncRAT)", "value": "098525a8e10c26a2c5e5c61c4a1c255e16ad522419d359fe3d964ca2b802f60bb101f087b4531d0417391d7a4f75e05d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532675, "uuid": "509388a3-fa13-413c-bd50-372bebc54577", "value": "T15514C2FDC5226D87123F7DFA611216A73C56098BF6FB1764854890243E2833AFA9DC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532675, "uuid": "f8a9e9ad-2d7f-411f-bfc5-5db6c0b9e57b", "value": "3072:8TZ/H3fvdDbePOiWZYY3TcuDzfHUc147fJeCHbeRp/B:aZ/HHdDKOiecuDzfHUc147fICHbeRp/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532675, "uuid": "9dca7587-4dba-4ac5-95c3-100df8a3c176", "value": 193388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532675, "uuid": "321c996e-e89f-43bd-8a96-5aef28c97691", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532675, "uuid": "1a664660-7d98-4251-b6c3-b23e04ed0ed7", "value": "INVOICES.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07db39bd-bbb1-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762502946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502946, "uuid": "1b79f841-f1a8-4923-8b2f-a009aed8a680", "comment": "Malware payload (njrat)", "value": "e4c5653a862320f86ea6def0fb69939c", "object_relation": "md5", "Tag": [ { "name": "Blabindi", "colour": "#233287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502946, "uuid": "4faa16b2-b399-4918-aaba-5a6e1a4763ed", "comment": "Malware payload (njrat)", "value": "13bc5c5f0c35cc0fcbd569c63ea4306bad5bde24302ce6825c855d5f2c4f1b48", "object_relation": "sha256", "Tag": [ { "name": "Blabindi", "colour": "#233287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502946, "uuid": "966cfffc-2b00-43dc-ad98-503aa2cfdb63", "comment": "Malware payload (njrat)", "value": "24dceb7b1fb2749ae52c57209e3f88188b0319ad", "object_relation": "sha1", "Tag": [ { "name": "Blabindi", "colour": "#233287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502946, "uuid": "4e82fbef-ad1d-4725-a76a-41f766d30a5e", "comment": "Malware payload (njrat)", "value": "debbbb73abc0d5a925b378300f1c43755c4e668c792cd891e495362ee4a872c4bcce226520d03950495e8182e4ddbd69", "object_relation": "sha3-384", "Tag": [ { "name": "Blabindi", "colour": "#233287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502946, "uuid": "e2e727c4-8ebd-444f-9d2a-4d1f62800a56", "value": "T156B2084E3FA98856C5AC1B74C6B5965003B491470413EE2FCCC554CBAFB3BD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502946, "uuid": "83c0ce77-f8b2-4fe9-a7a9-186d5201dcfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502946, "uuid": "2f73bcae-4b88-4b1d-b359-72bd4b0765f2", "value": "384:QQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZYeL:X5yBVd7RpcnuHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502946, "uuid": "53e1a6eb-f953-4aa3-b441-03028d1e2c94", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502946, "uuid": "00b4f49a-8514-45ae-99bd-fb76121a07ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502946, "uuid": "5e538ba9-8732-4c57-bc97-3fb1c3e54c10", "value": "KolenTrojan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f8fe48-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762502809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502809, "uuid": "ea64c10c-68f6-4000-9bae-2d23e3a02a9a", "comment": "Malware payload (AsyncRAT)", "value": "29d679b1a4e81235a787539d851076be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502809, "uuid": "abab245b-10d6-4df1-8d27-1a3c75ac193d", "comment": "Malware payload (AsyncRAT)", "value": "16979f2060a835ff4b481cc0e192ac0302f65e3fa9e389e53b8e79f52821d0cb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502809, "uuid": "22715408-293f-41e1-81c2-0cc5989de45c", "comment": "Malware payload (AsyncRAT)", "value": "d6d73a36b30352a1c595728c61c26a88d94901c5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502809, "uuid": "33f01e1c-1546-45c2-8277-987a2d6563d0", "comment": "Malware payload (AsyncRAT)", "value": "7cdd9db4cdf659fd0cfa5baf8116c970282daed6f3cf77f95791aab7c5bfea11f16d2a2e23c208e10a6a5c086b0ce8f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502809, "uuid": "3dd2990e-1c2c-4af4-be2a-a1b38d1412af", "value": "T1831643352D3A4E8E6D7D746158693E11A13D73DECA6D2B84098E6E32C4F8D4C2B0BD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502809, "uuid": "0135a889-e24f-4cbc-ad63-c0f9b73d8ba3", "value": "96:1PxOlMilRlbY8X/Q8EsbM9qoIJWpOi7rVHCQ74YT+ZCWKANzrdpRvn:VoZDNRgmWpfXF7tqjRTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502809, "uuid": "40ca3f66-7592-4ae7-853e-8b65347c136e", "value": 4353326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502809, "uuid": "cb7793bc-315e-42dd-bc99-bfb878924778", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502809, "uuid": "ac6e1b35-bf44-4722-b7d9-6c5cd84a77e3", "value": "sostener.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3259b1f3-bbde-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762522345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522345, "uuid": "39be0fdb-6a61-4315-a8db-3caadb4a1157", "comment": "Malware payload", "value": "4353c931de5e2f1243645fcb8704d770", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522345, "uuid": "2476a6ec-67ef-4d0d-9c3a-1ec67ccce1bb", "comment": "Malware payload", "value": "16d9768d71ce48325213018fa6358498875415b5284c8fea6c2583c343a6dee1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522345, "uuid": "70c6a3fc-b533-470d-b28a-db091d5e8678", "comment": "Malware payload", "value": "e969892f41a34c7b735fc5e74a03e746caaba1d0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522345, "uuid": "abbcc59c-b2fe-43b6-adc0-e575876ac63a", "comment": "Malware payload", "value": "98b2dcc831886d17fd43eb17f62dc96623d607ddd36b95f154c9f243601c322a71fac4264b74d0b3257856008d1d1d53", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522345, "uuid": "818d6a18-a3f9-4479-8ad5-d3113b287ab2", "value": "T16016F1DBB788593BC8B7197285AA637156878C128F879B836C44360C5CBB6D42F4DFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522345, "uuid": "4e871bb0-acf4-48bc-b1d4-1d1f6579242a", "value": "98304:1rV9+ndrK3R7GgLCr+oO0XDYLBQn8UFiGfNCpaOwdN:1B96dYR6hslQn8UYGlsqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762522345, "uuid": "c09062ed-36f7-4000-a159-8556d567a67c", "value": 4239065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762522345, "uuid": "9a56def6-c158-4507-8390-df9d11379f54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522345, "uuid": "5e29c8a7-daa4-426d-b8be-be0117060c49", "value": "decrypted_implant.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e0774f-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762526323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526323, "uuid": "a6b35c7a-a2e1-4c17-9df8-581d4deb2b6c", "comment": "Malware payload", "value": "bbdf8070f86b1968f0541868b07da40d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526323, "uuid": "6f8c3dd2-f2bf-4e7a-8bf8-e45b583244d1", "comment": "Malware payload", "value": "17d8768cb0ed901d39b44364d493bf13a7a09874638f5f6ab8afd3c652037371", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526323, "uuid": "5924a45f-265f-4dce-9967-5028effd59d2", "comment": "Malware payload", "value": "c5b0ca746d2e280aa92b33be520945c9b31b1f45", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526323, "uuid": "6ffeb80f-e00f-417f-9d5b-bef16c85e5cb", "comment": "Malware payload", "value": "9bd1f8a6985c0c7084888aa29121581a6c92188cddcad99b683232c1be85498aec43b4673f59e82dffa1bb05020434b6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526323, "uuid": "ed732087-d2e3-46f4-95de-6a6516a35d9b", "value": "T17EC73317E39300ECC52BC1748797A373BD71BC650230BEAB2264DB352F66EA0675E658", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526323, "uuid": "0ea103c9-a475-4532-89bf-095da39113b2", "value": "d49615a3eb128e46d517908fa72917e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526323, "uuid": "adc56d83-93ff-4c65-870b-e05e7716a4f9", "value": "1572864:ZMqFkI6zTDLIRZXK8r2JqsgbuX4ECETEn3XeVG:3kfTDLIR9R2Ngqyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526323, "uuid": "43485ed2-04fd-4eb2-ad29-396c54ef40ed", "value": 52952938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526323, "uuid": "70d48cb8-4dbd-4efe-94ff-23ffadc1791a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526323, "uuid": "a2398414-dd4b-4acc-8f33-9b8a40cf91c2", "value": "winrar-2025110203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e0ceab-bbc7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762512573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512573, "uuid": "3dc48060-affd-41e9-990a-ac261c1fc69e", "comment": "Malware payload", "value": "45600147f2850ba180b384aba23f6999", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512573, "uuid": "83d2b6e4-e262-471c-84eb-953d1a0d8427", "comment": "Malware payload", "value": "18cb036bcc7aacf7393575ddf15133e24d3a22cc92a4b14e8595686e4bf80629", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512573, "uuid": "850cd4e0-c376-4d8f-a6ce-477be83855bf", "comment": "Malware payload", "value": "2295397009b9a9723d3e8092f42d629b5b7e8a81", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512573, "uuid": "ae3d5d41-458b-483b-b787-8c7003af612f", "comment": "Malware payload", "value": "905834ca860a947c85b16b38278874572e17dd3a90b2c5fdfa7de956ac089cff4d446216cad1ed50ba1c236ccbc86a60", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512573, "uuid": "9f8bf592-b4dc-4020-8252-95511fdde3a8", "value": "T17B8302885D5CFFC6FCC1F03E66C8E9B4138465D4628E10EBF3A6C296A158860BCD9B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512573, "uuid": "bcb13be2-b5d5-4d96-b533-009015ff8c57", "value": "1536:6KvHpHpvPq3BTQPQb5SzHbFEbbien9vWE3l8qzwoJVwrMuT8CNjfS23oj:6QVVqFD9CHbFEbGe9vWEVVwOVwrX5Nl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762512573, "uuid": "42160e7d-71f9-4351-aabb-8096f06c1e83", "value": 80971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762512573, "uuid": "f14b0027-844a-4ee1-a699-fd0e06b45e21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512573, "uuid": "9d1600dc-48cf-4fa7-bb4a-d148068504ed", "value": "Tax Payment Notice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efe7ac8-bc09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540834, "uuid": "d38d0d94-d1d6-4b30-ba99-d38186f5d395", "comment": "Malware payload (Mirai)", "value": "8a61742387f886fb35ddbc301d6e38b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540834, "uuid": "37861eab-8e79-48cf-aa00-4b165c444521", "comment": "Malware payload (Mirai)", "value": "190e206fc326095adda8939c076bd6f71b0bdecd4fb52255022f80d171a1369a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540834, "uuid": "ec9a4403-0c9b-478d-bd64-d34c260aef71", "comment": "Malware payload (Mirai)", "value": "31b3de0f86bc9370be675e75d2311992c17414e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540834, "uuid": "eaa806a3-7a2f-460c-ae56-b5998e581517", "comment": "Malware payload (Mirai)", "value": "d34a490a848ab46021ec691e63cc099acd777583ad3de371afca8d677faa51c6fc9e0a26e8a8b96b4973dcc9fc5e684c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540834, "uuid": "5701949f-70de-40ce-98d3-5e27066672b9", "value": "T1BFF3C61D6E318F3CFB9883348B778A35E619639636D1D5C5D0ACE6402E2439EB41FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540834, "uuid": "036ce84c-8c67-4129-b802-a05665793ce0", "value": "3072:dUr752oPbj7wr5XKclhjhPRxl7ZTdr5oLA6FPtAU:dUr752mb65XKc7jhPRxl7VpCs0mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540834, "uuid": "14be32a7-cf16-4fc0-8296-db1027f196a8", "value": 157516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540834, "uuid": "a8ea3337-9cc3-4b67-ad81-6b462717cfb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540834, "uuid": "b7e33a89-bab9-4141-ab2b-7a052095b70b", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cba3e0-bb8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762486427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486427, "uuid": "cc28114b-8052-4411-ac2c-6853e76267d8", "comment": "Malware payload (Joker)", "value": "530346c3e81d8b9802883bfb119cc5c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486427, "uuid": "00c099cc-78b6-4448-a1bc-fa6fc4ee9b49", "comment": "Malware payload (Joker)", "value": "1a13890c7e2d50a24c68efc7d735492191257785cbedf76c678ba8c26c749a5d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486427, "uuid": "67a7bf58-cb07-4042-b468-1a56b7d46592", "comment": "Malware payload (Joker)", "value": "fc9527d2d59dff2755ed4fa975e1569050ff6ffb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486427, "uuid": "d64d17a0-97b7-40f2-9936-8981d14eaf7e", "comment": "Malware payload (Joker)", "value": "6e3a3889faf1cd8ccfa40701b29e48623ced5a889993f9e2503f767f351c30b069087b1068a82e4ba0f2853925e29203", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486427, "uuid": "1368b4f1-bc80-4066-92c0-39578faff885", "value": "T1D6C6128BBB08D93FC4369133C5A6123732B7DD1258935B73751CB20829B35899F5ABCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486427, "uuid": "ea527076-e86f-42fa-aeed-2133ad9ea5d0", "value": "196608:3emzvrRfLkTjV+fe5NT37aSkRPXERlXaejHLNUJvWvYpuoBqR/nr3:NXRzEgWPTGH8laeTR7vH1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762486427, "uuid": "125eb58c-0104-4749-874b-c5acce0cfcfe", "value": 11980498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762486427, "uuid": "8da15d67-c208-4b64-bdc2-5de84e46d2f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486427, "uuid": "96ebf268-7366-4184-9f12-da910f01d27d", "value": "Big Keys Keyboard_2.0.8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f1999e-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498646, "uuid": "ae60ba5a-e734-4c25-b99f-ca2f68f68352", "comment": "Malware payload (Mirai)", "value": "fb1ad34b0416f990012407ba6df411ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498646, "uuid": "23ec5b12-9487-4b7c-b666-84afd2fb11a7", "comment": "Malware payload (Mirai)", "value": "1b2ecea40caae11887393a8cfaeb41c3324c72fd496d5baf7123c3f94001a411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498646, "uuid": "66e20253-d582-4bba-9592-8cc4f72c6a74", "comment": "Malware payload (Mirai)", "value": "4099b8c72e3823754cd9ea2b188a82dff113cbe6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498646, "uuid": "e01e4684-ee79-4cbd-9d77-126b9ceb1253", "comment": "Malware payload (Mirai)", "value": "ba34239854396b7e7d1d92369d131f5b61e1ad6f8d2930e29b0e58634e783f1d7a55270518839f8982e4a0910d105bef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498646, "uuid": "9eb0e27e-f706-456d-a702-0078485dc31a", "value": "T1B1837F09BF615FB7E8AFCC3709D92B4234CD541A26987B39B934D818F24A24F19E3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498646, "uuid": "991ecc8b-7cf4-4ef0-8cd8-cdcd0be2fc98", "value": "1536:JcGXcgLkNZ2nMeJAXM0gWnR7RFQgHKYFN72gZsMwpm:JtXcgLkNknM5nL52g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498646, "uuid": "36952362-d2e9-40d3-9e09-6500c217b40d", "value": 80884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498646, "uuid": "858bf7f0-b130-4cc3-abac-a99d10e50129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498646, "uuid": "c6db3916-0e2d-4e47-b416-1399daea8c78", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bddd65b-bc2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762555861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555861, "uuid": "7042fed5-0a7f-4667-b1d4-9552e1783c26", "comment": "Malware payload (Mirai)", "value": "5a9c50cbc816d3ff4a063b9e3e149459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555861, "uuid": "22d5d71f-f600-4347-836b-8d5f6150b5bc", "comment": "Malware payload (Mirai)", "value": "1e63edf262d21d49fe667fd7ada520626abd9f4395202a1ebee9b9558340cc5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555861, "uuid": "3383bd90-8ea0-41fa-a09e-9a1ac48df0d2", "comment": "Malware payload (Mirai)", "value": "a58d7e1a987538dbcb9382151103e7ec0d10cabd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555861, "uuid": "3d1764d1-955e-4385-9f5b-dfb5d8dd1207", "comment": "Malware payload (Mirai)", "value": "4af48701bae2bcc337480dde462702bf35b39be75a8d9c317e1fb9f7fb6d4db3969aa3087f6f65570df1f2b2901062be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762555861, "uuid": "4de3126b-d529-4929-8ff8-064aba48ddab", "value": "T1FFA31796B8829B15D5C0127FFE0E118E3323277CE3EE72169D245B6437CA56B0E3B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762555861, "uuid": "5b4a38c6-da1c-4490-95f6-dc5b5074bc7f", "value": "1536:HPnCnrKKl87fCaOckix8KOCMxiumOuyzK21rzbNn95IYQZZOuy:6nmKlmCa1XOgyzK21rzbN9Cvsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762555861, "uuid": "77d85d89-33fd-445a-864c-a2cb081acc26", "value": 99480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762555861, "uuid": "564e5075-01f2-4fb0-8597-626cde48aeed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762555861, "uuid": "46779924-99ec-4760-9f2b-a6c08da18e16", "value": "kvariant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c56d52-bbba-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762506835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762506835, "uuid": "20f10094-1444-4244-8d3c-6a9c89ef673b", "comment": "Malware payload (RedLineStealer)", "value": "acfaccf392ece6b4042790a8de85a86e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762506835, "uuid": "beef76f6-8220-444c-86ca-2cba2832b216", "comment": "Malware payload (RedLineStealer)", "value": "1e9fcd3df0e86145d3ef878d875766c98e6012fd51725e2ebc61c38aa7544fd1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762506835, "uuid": "375dae8c-dee9-4903-8d7d-fc599d778d7b", "comment": "Malware payload (RedLineStealer)", "value": "d12f07e82c1927b22ee3d4f2a1f5b59478944163", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762506835, "uuid": "dd0d8e72-f0a7-4967-8508-50d406e91e7e", "comment": "Malware payload (RedLineStealer)", "value": "6d030f514ad161dec03c610ecc78e541ddf16bbab11ede4ef918309ff40d935814ed2d88b37aeccbaa0412218a7ec0ce", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762506835, "uuid": "88042adc-3a51-4c1c-aed2-3281617c1651", "value": "T1DC645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762506835, "uuid": "4e4cccd2-cf01-4af4-a162-f6a0b1119b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762506835, "uuid": "efdf8413-a038-4d1d-b2d1-0e644a929d7d", "value": "3072:WcZqf7D34cp/0+mAokyOppAQUg2ZB1fA0PuTVAtkxzb3RIeqiOL2bBOA:WcZqf7DIknHrz6B1fA0GTV8khIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762506835, "uuid": "0668e39b-ad45-4e30-8337-d0e18a032db2", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762506835, "uuid": "c1ab106d-8a7e-4e51-b1a7-e1ac9254c79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762506835, "uuid": "b092908a-444a-4772-be39-20a89f2d52c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81952467-bbd5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762518612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518612, "uuid": "3859b8f9-aabc-4c26-905b-581359458a93", "comment": "Malware payload", "value": "eb50c4a9a25242f1be5ff0527590161e", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518612, "uuid": "f92c8faa-5edd-46c0-b12d-f3e987d9edc2", "comment": "Malware payload", "value": "2079fae93f3819e19d1036cd92a403ba718faf017dae3b4c900c213d4bbb612a", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518612, "uuid": "86345c6f-c484-4f8d-a11c-75eba0cf1b18", "comment": "Malware payload", "value": "d32ad3a98b39beae0ba246a4aa05fb6743c7d950", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518612, "uuid": "2b9251ef-69b8-4690-ba46-51a79fe9b58e", "comment": "Malware payload", "value": "a35e1d97dbc996bb4240ae7ae63e2200d00e5e4223571a57d0e92cd3e92d3a1f523bbd1a7527a52b358c36e42a3f618e", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518612, "uuid": "1eebf598-568f-48f2-b988-4d70da20ddd3", "value": "T1F99423BF30C0E3330164D77F9AC3E95C3D91BFD6C805D5C67BE9AA4798AA6A8A574040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518612, "uuid": "63194622-638c-4eef-b4b2-44fb4d870581", "value": "12288:hEZ5Xu7ifzSIkk8wZKXKH8178DGvq0luqkk:KZ5Xu4khwZel7DXkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762518612, "uuid": "f1edf78e-a387-4e44-bac1-f63940a6a557", "value": 441765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762518612, "uuid": "b22b963f-ce58-4c8a-be8b-40ed04da3c49", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518612, "uuid": "73c54ec9-1863-43de-8e9b-5a7d82789bd8", "value": "nComprobante_pdf.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ae099f-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497976, "uuid": "217fa4ee-79a7-4848-9981-40372c79562a", "comment": "Malware payload", "value": "e5e80e6e5e90d45a6af8e6b3392b633c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497976, "uuid": "15df8976-d44d-43b5-a9e6-e55d37d75cf2", "comment": "Malware payload", "value": "216fc8825a12b923200ca6f6e976c593f1d53371a3369e01446c738456eca1cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497976, "uuid": "3a57afb0-931a-40bc-b174-59b044889126", "comment": "Malware payload", "value": "4a5c7a908e5b3494e4ff846f599f1b197486a0da", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497976, "uuid": "c54ca2e8-d0f1-4066-9fa7-3f366aed8bb9", "comment": "Malware payload", "value": "124905612324199b0161f537a01d125d95a3575bbe6359634ff91b02139e0b64b8fe529ed4dcee49329da4c6fb6447f8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497976, "uuid": "12d3ec2b-e70f-474c-a118-19cd3be3fad0", "value": "T1C6672386F388EF6BC0F79331CA7D4223309B8D618B4396B76914723C58B7AD54B46AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497976, "uuid": "4cd58226-2993-4110-bee7-701bad694b48", "value": "786432:9PthaVVDrrRjWajIj6SaT0ot1ECsUI2FJjG6U3iS2BoWPrDTVujBPrnx:NtMVhvRjWa8Lagc/JmidPuBPrnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497976, "uuid": "1d5bd3ca-8a82-46df-a86e-ee86ba8cf479", "value": 31679151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497976, "uuid": "ddc12314-7e17-43e9-b6cc-239e529197e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497976, "uuid": "d1418545-6244-4dd0-b637-0fe675fe9358", "value": "new_ibo_app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0725b7aa-bba8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762499079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499079, "uuid": "93bc2689-5bbe-4dc4-888f-44b72f11cb03", "comment": "Malware payload", "value": "e6aab104d3736a642e9af9e95e2cbccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499079, "uuid": "d482b2fb-7007-411f-84b3-2ac74ec1660a", "comment": "Malware payload", "value": "2173d7332325cca86dfbdfbda3ce8521106bb7ee87152d13b2b283f0b3198786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499079, "uuid": "e7a8537d-d8c1-4b42-9676-56813752b824", "comment": "Malware payload", "value": "84cfca05b43d64baf9ccc402b4b81eea4e098969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499079, "uuid": "065b202c-011e-488b-be31-3853bdc68eaa", "comment": "Malware payload", "value": "24cadf13f2baa18a6d2bee21bd0d27032907ead99785a3360d7538956c82427b335b9080d264b0cf19a391d5ba365e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499079, "uuid": "2a92e6d2-9c83-4a7f-a7c8-eb8e5861b497", "value": "T113C5AD05E3A800B5D87BD674CA959333D67079968732E14F0A9CD6062F33AA29F3F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499079, "uuid": "4c3b4933-3501-4bf9-b47c-64ee10a738d7", "value": "e5e9aa86012953025ed16fa18b504762", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499079, "uuid": "c5ed81d8-f28f-4714-bc00-5cfcb86f9baa", "value": "49152:pwfQtsm1qfAxxRCqVbrPOw89LyPNGjvHMXR1m2Frfx:o8P8pAmvRgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762499079, "uuid": "bef7fc59-e1d6-4035-a8e9-082bdfdc8da7", "value": 2672640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762499079, "uuid": "6016a40e-3992-4cee-84b0-896b02ee228d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499079, "uuid": "b0973c76-577b-40ac-a31e-9ed0fd4557f6", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e61f50-bb73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762476450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476450, "uuid": "2f7d9dcd-cd6a-46bc-80e0-9bd111eac645", "comment": "Malware payload (Mirai)", "value": "771814b24e48226f4c616355c1007c37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476450, "uuid": "8a4b24e4-3a95-4193-b4d5-b5b0a097b479", "comment": "Malware payload (Mirai)", "value": "21d93cd5593cd8e8a33dd7dd8eb4f8fa0f39bda0744339f5ea700d8ecf3023cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476450, "uuid": "f9edb87c-2f20-4289-8f42-070715fb2d8f", "comment": "Malware payload (Mirai)", "value": "56650c3da1738a0698e2c521ad70f23446ca4c5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476450, "uuid": "06087898-f6ba-44df-91c1-7c8b83d6128c", "comment": "Malware payload (Mirai)", "value": "99f130d1f90660e09b9e138146f69d1de3fe71f1d5182051ac375219275ecd61598b02a39b1aa4f99b0e8a3d7e259699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476450, "uuid": "2969e6f1-e69b-41d0-913b-ec49d66e0f2f", "value": "T10113F15E786A3DCBCC0C1C7EC4C82572D788F54113A91ADEAB450DC87616E47F5AC4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476450, "uuid": "6ea3f683-acd3-4870-a7b2-d430ec2a804c", "value": "768:TrrkGU0HoCMvQ/K3wZCMtQwjhwdzAWjsZaP2ngpPcXeWeWq:THJUzHI/K3wZ3tXhuGZkAgRcXe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762476450, "uuid": "9a664238-67b6-461d-b0b2-ebc46d8495b8", "value": 42104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762476450, "uuid": "ef91d728-2cf4-43f9-b129-0649129fe4d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476450, "uuid": "982e7a1f-6a10-4bf7-821e-862349c70865", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f925a86a-bc12-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762545012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545012, "uuid": "6f70c602-e924-48ac-938e-0873116b4c51", "comment": "Malware payload", "value": "70bd95ef47b33de1b31251c3fdf2e35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win32.BitCoinMiner", "colour": "#8F58C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545012, "uuid": "69c2e835-1bb8-4ac0-b231-6ec038e4c0fe", "comment": "Malware payload", "value": "22dba908d7c340e5e5b9f0ce076a58dd4d60c71d16ef166b44014cd76588d5c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win32.BitCoinMiner", "colour": "#8F58C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545012, "uuid": "1b68fe24-6f1b-43ff-a17a-cbcb51edfc7a", "comment": "Malware payload", "value": "c94d97663d1eda023743e37d5ae4df2b393051fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win32.BitCoinMiner", "colour": "#8F58C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545012, "uuid": "2903ad69-8328-4bd2-bf42-109f14b39e77", "comment": "Malware payload", "value": "b08f9be13c2f4a830af0541be3ef4fb026ec7fe0a403ecfabc0a7d0529d3b35f54451d40bd07d7c80ca18ca40d84e289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Win32.BitCoinMiner", "colour": "#8F58C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545012, "uuid": "c46c1981-4615-4f09-b39d-169a1cb47994", "value": "T12A473370265478C4D68278BE62D020B8BCC73E7A7A5A31517547FCAB39CAEC44DD72CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545012, "uuid": "5eb6d4d2-2428-4e52-b253-8dd5480857cf", "value": "e7b89a93b2788977e5bfcaaf3cd602fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545012, "uuid": "f098f2fb-98a1-45d7-9c9e-a9721fa3ccaf", "value": "393216:b2BBhj47osN+gEF+jUZZFShAqYSC3oe6b7zRUhJZ8QmOfs/fV89ttnx/Xc7y:b2Bb47/EQo9h47tGCQmJHO9bntIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762545012, "uuid": "1052e1a0-50e5-4812-8cc5-482bf8202eee", "value": 26527744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762545012, "uuid": "70253960-dcad-465f-9c70-f99f29d7996f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545012, "uuid": "9a0950b2-d2ff-4cc9-80db-73466b2710a0", "value": "winservicenetworking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9994bd67-bb78-11f0-91c6-42010a9c0006", "comment": "Malware payload (FatalRAT)", "timestamp": 1762478709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478709, "uuid": "118c1a2e-0158-46b7-b884-95fdd0d4b5ba", "comment": "Malware payload (FatalRAT)", "value": "cb6e17018ac8e6aea677f49b08c0d355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478709, "uuid": "2c9adbd6-0be5-40a0-bb48-8eea2ef563b9", "comment": "Malware payload (FatalRAT)", "value": "243cd136b5aa42c20c048a1fccb215749c482519488f46b05130f5f7dc33583d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478709, "uuid": "be13a757-3132-48bd-bbf6-ac352164f69c", "comment": "Malware payload (FatalRAT)", "value": "a8e7bc429b76f4a095a9ae0f7ffb548357018f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478709, "uuid": "d4660b49-91f3-4cd6-bd6c-b30a2a965958", "comment": "Malware payload (FatalRAT)", "value": "df860e461c8b0a50150fe7f700f4cc635a239d9862da6e2b614d95a8fa2d3396813685f0f5fb49fb32dd3b2f73d3c6c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478709, "uuid": "f604fe22-fad6-4b35-a9c0-3901633c0803", "value": "T1E205AF063951C27BC9E761728E3A6B19A1FCDD900B26A5CF239C4A5E4B31DC27D36237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478709, "uuid": "10e96fa6-156a-4cda-a9d0-76d204bbe3ff", "value": "347c78c8c65cb786eb1ac6893d046a5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478709, "uuid": "0fa0378f-9cbc-4a2a-8a47-6f170db1c4a2", "value": "6144:+Cs5XapMUkF8ixk3FaAY0RzX67xUaElqmHjSqXWFSzkPDNGEfWJBgAD:Q1apMUkuixqY2zqNUaElDHhXMykLlxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762478709, "uuid": "c1c39473-8d96-4838-8469-96e53c29a862", "value": 798826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762478709, "uuid": "423b4712-82d3-404c-92a3-89084484b5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478709, "uuid": "c7ff1a82-3363-4e9a-bab6-3dd8466a2107", "value": "243cd136b5aa42c20c048a1fccb215749c482519488f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b39924-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513754, "uuid": "2bd121bf-24b6-4879-8e44-180ec358bb95", "comment": "Malware payload (Grandoreiro)", "value": "ee9439495c81b42cef42859f88ee3a18", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513754, "uuid": "8f579dbc-0e37-400d-be2c-3e2a819e7b48", "comment": "Malware payload (Grandoreiro)", "value": "243fc7573f45a16fec3ac7f228a0bd702984ce324de52ceabc3240d2fe28fa5e", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513754, "uuid": "16bea1a3-763d-4bff-9b36-82cd3f3a8c1b", "comment": "Malware payload (Grandoreiro)", "value": "43848c8a88c13bdb49caf9aabc3dab3efae40bb9", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513754, "uuid": "bc588edb-55ee-41e4-8d8d-cd7a29be5409", "comment": "Malware payload (Grandoreiro)", "value": "777c7c5fbd33faff510972292b8a86791817d14e2f6771bc9c13f567d01f1de9f40ee83eaa98d72f7abae093ddcc67c5", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513754, "uuid": "4e903a63-4fb5-49ce-bbcd-49045a41ba72", "value": "T1509623326B992C3BC6900739F05F2B636DBE4C97890C95DA74DC905A72CF6D1892E4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513754, "uuid": "3f8362a4-f4fe-4837-bd5b-fbe077e4c66d", "value": "49152:RkzEYR2KMWilrgk48b2JckesVPHIszAqdDBGwO63vW5hpVvMSLtb1djciVfa62rL:rWzuim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513754, "uuid": "a37a230a-5c9e-43b1-9fba-93dc78d0e5c0", "value": 9418752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513754, "uuid": "6bbab464-5ce7-41c5-aff6-6e35fd928c5e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513754, "uuid": "ebef43bc-f082-4928-8ce9-1aaa5e8c053a", "value": "QBN32472OA8RV412651.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726db669-bc0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542209, "uuid": "306e61e9-2da4-49e8-a04a-45cf943a0101", "comment": "Malware payload (Mirai)", "value": "0144b41373be61c8b9077efd694c913b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542209, "uuid": "67c6a219-8847-4264-a9db-e10158c5dc4d", "comment": "Malware payload (Mirai)", "value": "244a44209c678dd822000e02e08ebce4a253ebc2cd77eea227dbc5d1b2815848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542209, "uuid": "8c12d40a-081a-44db-b1ff-c92fc582cd6c", "comment": "Malware payload (Mirai)", "value": "1ccae22cdde90c51a047e5a952b1fbdf1799a5b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542209, "uuid": "2994fb4e-eae4-4995-ba81-5a0cf8a8b240", "comment": "Malware payload (Mirai)", "value": "1d60c6fefe07582964021d2727d325654fe8b01be5ba0dc9a8a7af3373ea7257335af12c2e69e20883b2b17f015df9c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542209, "uuid": "32e35987-6f37-4f83-9b30-61a12613d722", "value": "T1DBB3AEDBF7072191C86247F007C74BDE3E6322119E6BA8E76C0F6A7A0A790DF5916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542209, "uuid": "d87a8a5f-ad74-4ae1-be92-95f7064641d9", "value": "1536:JF38syuPgwHMD7qEywla4Wq0z0zkppYjjHBZibxZJ8EkgH/LWk:r38syV0MfywlBtMhihZiqbgHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542209, "uuid": "87d37521-87b2-49bb-9ddb-d629cf261cce", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542209, "uuid": "0862a83c-5951-4a32-8fe2-5608e8f78a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542209, "uuid": "c6f7b07d-d478-4046-8734-4fb4c765c4db", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32999122-bb98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762492280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492280, "uuid": "1406d4ee-69ee-45f9-a143-c8847d405de3", "comment": "Malware payload (Mirai)", "value": "5b2cc7cbb7ddebb86da7058bdc5a9711", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492280, "uuid": "19b98f8f-ac70-4f8a-acc7-90f3c33b6eda", "comment": "Malware payload (Mirai)", "value": "24dc82d5cf6ed929fa931f38be674fef12256c10d6dbbccab4123cb7d047173f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492280, "uuid": "07073ee4-46e0-4734-b00c-25dc1f2aa047", "comment": "Malware payload (Mirai)", "value": "d8f757c90baee405891a1350c7ba999f2e7cdb3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492280, "uuid": "ce644a3f-f969-4ff3-a4cf-4d46e716fad3", "comment": "Malware payload (Mirai)", "value": "69801036ad48afb98a81f8f1776f307d6d1c755e14d7afc0ec61c8bec265263bfe77ebc4cad83e912309efb08e05e206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762492280, "uuid": "a47c67de-2c0e-41df-b77c-5baa4097ce1f", "value": "T103535AC5E683D8B5E86202756177EBB68633E6351026DF57CB68F936AC17A02B31730C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762492280, "uuid": "5936874c-65cd-46c1-9958-97f53d4c4413", "value": "1536:jC2Y+ymU43RPaOOW4yy9mmiz8dGvzwrgtK/8e6SAUduG5o6:jCqymU43RPaOOwy9mQGrw0tCp6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762492280, "uuid": "b9183e79-33e8-4835-b50e-9dbbc7950522", "value": 64244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762492280, "uuid": "bdc274ee-c1d2-4bdf-9d33-e9882ecb47ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762492280, "uuid": "d9085902-c0a9-4a62-b90e-81ec9a138a72", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf5d3bd-bbd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762518656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518656, "uuid": "4ff15ffa-d64f-4010-8574-7b10f14f35a0", "comment": "Malware payload (GoToResolve)", "value": "5585786a5f7be9465d417a5dd46ce12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518656, "uuid": "56ef4f81-00f6-438a-89c2-24d9d77ef790", "comment": "Malware payload (GoToResolve)", "value": "254ddaeee0221558d4dd5c258dd6695bde2941fb9a4b2325fd8bb6ce984cf9de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518656, "uuid": "c2cc3aca-dcf6-4c17-b9ef-5f31b82a60ac", "comment": "Malware payload (GoToResolve)", "value": "818ae3ef6f667a23dc0432ee576c59de790ba3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518656, "uuid": "7a0d2ccf-9ef8-49fa-905e-a555ee90df73", "comment": "Malware payload (GoToResolve)", "value": "7dfa14e23a3ab427e1776dc2a004940d4e9f5d6e57fbc09c507fee8f06d01dfc5e8387b201e902d72a5052e0a52e09de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518656, "uuid": "e1e84122-ccff-49c2-b80c-dc63b7296326", "value": "T19837333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518656, "uuid": "d4e2f056-a3ce-4c28-8a94-df992cd9a3a3", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518656, "uuid": "00b32656-8e3d-4e1e-ac8a-0fe0d4943ca7", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpY:q9WtLzgOTbjZvk/ekS/mcpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762518656, "uuid": "b4493845-242a-4a8b-8290-5be1c8f11614", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762518656, "uuid": "41d2b7b2-ba7c-4e90-88ff-f148ffea9f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518656, "uuid": "cb84cbfe-88b3-4da5-a662-d00713dd968f", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a2b4fb-bc34-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762559547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559547, "uuid": "1f642fb4-2ee5-495b-8c35-2af132969d1d", "comment": "Malware payload (Mirai)", "value": "07daad747f5cab1afce1a874025a5414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559547, "uuid": "17c4f802-528b-4ecc-a90c-47a09cba1e7a", "comment": "Malware payload (Mirai)", "value": "25c9d7f646136fa833eb7229f805d3ae53c7b9b51182b5d09bf1df4042ce58af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559547, "uuid": "c6905358-60f5-47f0-84f3-89d4d9a18955", "comment": "Malware payload (Mirai)", "value": "3ced057635f6420e583bc4681b66c02d504dd399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559547, "uuid": "8592e05f-f9d9-4247-a0ac-294b0e108ea6", "comment": "Malware payload (Mirai)", "value": "42aef62a5895b31c31d121284efc77b213e0b9cb52ca565b55c61fb775649b0bbb6af45d6552d744a896cbd3b6ea3c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559547, "uuid": "04608e40-8965-48b9-ba60-ea7863185aca", "value": "T18B331841FCD2996EC6C4137AA77E258F3311B3A8D2CF3607CD586F21768661F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559547, "uuid": "0dddffb6-9606-4b66-941c-dddf83e9854a", "value": "768:9ZyyN71CsoMLyqEmh+CV9fIrh5FwuMfbj89mNB7cjoAHVPnY2LHBNKn+KmzaK:9pjoqEuPGFwuMfbZcDFnY44K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762559547, "uuid": "80ec44fb-6fb0-405f-b266-c2bc4167d0aa", "value": 51108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762559547, "uuid": "1054666f-605f-44c9-a296-52afe851fb30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559547, "uuid": "e4526219-d3be-46a5-bf16-cde5a5530a57", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be7b953-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload (ClayRAT)", "timestamp": 1762497960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497960, "uuid": "12d3f35b-539d-4bf0-ab22-6a39994fc69c", "comment": "Malware payload (ClayRAT)", "value": "91639eecdb4db1b4041e292b5587ef0d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497960, "uuid": "49812a85-b508-4748-9454-dc8dece522b1", "comment": "Malware payload (ClayRAT)", "value": "2625df6b52a737543cbf542325dfcfc6208d2be67c4aa0cd26b6a0e3aa5bdb33", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497960, "uuid": "469a59ea-1269-4a44-8c06-2ab11dd6c8a1", "comment": "Malware payload (ClayRAT)", "value": "5e15d5c504676dfff05b6aaa3366563ebd8ecd11", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497960, "uuid": "385881d8-5b9a-4a14-b3a9-d7ea803216f3", "comment": "Malware payload (ClayRAT)", "value": "03305a3c926186acbe84f563770efdcdcc947b9f3fe5c9d06f3093f76984aa3b00c67122c19b71d0b90e420563b8c616", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497960, "uuid": "ba8389b3-c4e4-4ce7-a3bb-cbf05ee4e757", "value": "T1CB460192F709947EC4FB5332493A12661263CD668F839683296C737C68B7ACC4F24ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497960, "uuid": "d8c6ef60-45ef-45b9-b063-3ec855127b7c", "value": "98304:OJkzMPAaOZjMn2PMhNnXq1WXS1eJ0qtSpoFh3nP0ZEsjBQu2AuGgVx3NsfBk3qG:OqAP8jM2PMh9q1YC65SpoX3MWQautvg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497960, "uuid": "b6ec8c2a-176f-451a-bef7-43b5c75adb10", "value": 5567258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497960, "uuid": "6c6b2abc-d70c-41f8-91e1-f11124b313bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497960, "uuid": "ab5eed93-6aaf-4c5c-a462-63ea94925e22", "value": "YouTubeGG.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a114ff31-bbc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Bitter)", "timestamp": 1762513081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513081, "uuid": "03b2a2e6-007f-4144-8308-5fae2cf272fc", "comment": "Malware payload (Bitter)", "value": "f6f2fdc38cd61d8d9e8cd35244585967", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513081, "uuid": "7931d5ed-0ffc-401a-bd3a-cdbb748eccd9", "comment": "Malware payload (Bitter)", "value": "269cbba01f9da99983945b3a07db8749f521a92f9faa814cd134763207651711", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513081, "uuid": "01de9397-93e8-46f0-878f-7403c1312075", "comment": "Malware payload (Bitter)", "value": "783569ca748662dd4507fd12606ab09173f9acca", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513081, "uuid": "d7936d75-ca11-4c8d-a825-b52abb515b44", "comment": "Malware payload (Bitter)", "value": "017a7e9dc4b8a8a4c5ff7b29b13099cabfbc2fbaa70df0f72cf826757bdfe3c1455b016b5fc9d0b77e071777375bb9be", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-08", "colour": "#5B0B3B", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513081, "uuid": "7cb57b92-dbc2-4bf1-bbbd-0fda54176893", "value": "T16E33E025DE5E74038ECD6D7644A48371041EAFD3BD060F680B336BF7821B8FA76426A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513081, "uuid": "a246ea8e-2cab-4633-95f7-0ae45f831752", "value": "1536:sHhqAX1T6BjLVHhqAX1T6BjLLHhqAX1T6BjLa:4ABfdABfDABfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513081, "uuid": "021238b2-1bd1-4196-ac02-5ee17f53efe2", "value": 52674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513081, "uuid": "19b6bc28-7cbf-4ca1-8459-50d1f04ba766", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513081, "uuid": "ab25abb5-1385-4a5b-b47e-d98b06c4f5fa", "value": "Provision of Information for Sectoral for AJK.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c9e12f-bbc4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762511133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511133, "uuid": "d40dbb12-aa5f-4d1b-b4f9-6beae60fa9dd", "comment": "Malware payload", "value": "0310535f3088303ad44e49aaab1b7fd8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511133, "uuid": "de32a380-d665-4656-ad96-a15ed62651cd", "comment": "Malware payload", "value": "26c3abc8bf32ff0f548adfa3c5fdf430c9bf061865512b83c4559553e668766c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511133, "uuid": "6ec01c17-4d39-436d-844a-eb6164b0d0cb", "comment": "Malware payload", "value": "12fbfcceb42079e9d9d302a671c7f05f5b48ce96", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511133, "uuid": "15a2231d-49d9-48df-81d2-fa860b5cc565", "comment": "Malware payload", "value": "0e38552adf1088d81ff436b0518561aae5def1bed64b2d08bfb98c4d6410a6e92f20bf67cd59fd6d2ab17194f24ac547", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511133, "uuid": "b793b8f8-f8aa-4e80-ba98-f4acfe21f677", "value": "T1E956AF03E1A358ECC9ABD674425B6772F930BC2945387D7F6A98C7302F61E50672EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511133, "uuid": "9dd9e510-248b-4f4a-b069-3203d3f7ee84", "value": "aade4ee96bc5660163903d5fb7bf63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511133, "uuid": "c6693497-3ff1-40dc-bd75-a51d8db613db", "value": "98304:+0eWMZM+pGr6kvfCoa6JHBn9zSajjJztzAANy29XOQz7D1P8rvc2K:LqoaS9zScjJztzXNvlD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762511133, "uuid": "85b3a3aa-3d06-4e24-a41c-149b002acd7d", "value": 6228992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762511133, "uuid": "9caaa496-0943-4df2-a448-69bcf52d602c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511133, "uuid": "5ba6d839-9729-4af1-8030-84fe09125a08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6752fd6e-bbc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RuRAT)", "timestamp": 1762510408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762510408, "uuid": "d9053106-7793-40fc-9643-ae1c94d45422", "comment": "Malware payload (RuRAT)", "value": "2c8f6f482791a2158dcf8b799f17fa41", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762510408, "uuid": "38a4de28-cbb8-48a1-8606-bbecb2929d26", "comment": "Malware payload (RuRAT)", "value": "2742cb72ce20f4ac2a1f7cea192b81394c72f57923f8c433ea4ffca893f61130", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762510408, "uuid": "73654259-b0ea-40a6-8819-feca766ce27a", "comment": "Malware payload (RuRAT)", "value": "0d80fb8cb65ca22fd8c785a34c77ee4b82a8bd73", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762510408, "uuid": "e8b28969-d64f-4ebc-81aa-089b2c142fdb", "comment": "Malware payload (RuRAT)", "value": "f10fb13030c150381c598737279e72bc4b2b55fa2d4b3eb22e738b32aed8e48932e365dae738c6749362b2408d4615fc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762510408, "uuid": "80dddf95-2464-43cb-8e96-6b0d84f32971", "value": "T11447334A4A2D07347C1626145A9BF522653E53E3B3B066AFA1752C0EB334FD0A9F91CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762510408, "uuid": "3c7f1d10-c33e-471d-adc2-c4b4b37925d6", "value": "393216:1c94FDPAffPdaFiKy/yAcaWHtsbH7OvRhhQjHQhisdvwbxrZSDs/CdApXI9jCPnw:1c941wPdaFiKAcaWHebCv12Hb0MNZosi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762510408, "uuid": "0eba3090-3618-4223-b75f-bf4fb8700b87", "value": 24966081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762510408, "uuid": "47aa7687-2063-44d0-9062-29be6c538486", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762510408, "uuid": "cf4cd462-5763-45c0-801e-80e591cdc542", "value": "\u0415\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0430 \u043f\u043b\u0430\u0442\u0456\u0436\u043d\u0430 \u0456\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0456\u044f \u0410\u0422 \u0421\u041a\u0410\u0419 \u0411\u0410\u041d\u041a \u0432\u0456\u0434 07.11.2025 \u0437\u0430 \u043d\u043e\u043c\u0435\u0440\u043e\u043c 817_18.ps7.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc289787-bc03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762538521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538521, "uuid": "ae807bcd-0458-43a2-977e-40634a9a0930", "comment": "Malware payload (Mirai)", "value": "5113ad27d276ea9e6ec1a6394c241a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538521, "uuid": "c62c640d-55c5-492a-b8ba-ed2112c50900", "comment": "Malware payload (Mirai)", "value": "2753387e21709065c01bdc3fdc38f25da3714dac4ee314a1895c8b62538fd6f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538521, "uuid": "a45e38dc-553f-403a-bdeb-369f5e6beb07", "comment": "Malware payload (Mirai)", "value": "c3ccbe4bd3bb038117648f9cf2440bd66209cdca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538521, "uuid": "7591b8bb-ca90-4d43-9ea6-572c588faff2", "comment": "Malware payload (Mirai)", "value": "a81326d6f57084cb726c96c0754aa40d540b683784e867ab873310a4dcf9530b75273ccf83365b69e27ab059a4f6f40f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538521, "uuid": "265c4f7f-c115-4131-be68-6c88ffe035a3", "value": "T1EAB38D12D4F56CDCC19D86B4B6E19A760B72E40052231FF7A8EDCA6A448BED87D487F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538521, "uuid": "4c711dec-77d2-43f9-a5e0-5b1f24cdafe1", "value": "1536:hzsMiWfCuUq/CQpgumiNQk/lcaul9U8KUDdM75YEPZCOLJoRhEyGX4iw:hoMtCu1KQpR5F/l69UjUeuEPZJ2fOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538521, "uuid": "5d647d5c-83c0-4498-b5dd-8e1e530160cd", "value": 108964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538521, "uuid": "f55d2be2-9929-436a-8209-7adce2c530e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538521, "uuid": "8b15c984-08f3-44d2-b875-5da7ba204d44", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d868b64-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload (ClayRAT)", "timestamp": 1762497963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497963, "uuid": "53e31931-bfda-4c4a-873c-048754a7c461", "comment": "Malware payload (ClayRAT)", "value": "a24d5fb3741eef64de13142a467719a7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497963, "uuid": "abbb3927-2ba0-40cb-8a2c-8de2b4a2e017", "comment": "Malware payload (ClayRAT)", "value": "278cb7cb0c439a180f2deee8a0cab80e5e608c80f583d4d86dfcd9265e87d114", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497963, "uuid": "b3e24f57-6d47-40b8-8530-8101711f13df", "comment": "Malware payload (ClayRAT)", "value": "dfc6814ecc6d2ffebdb2c2f587f75181ea7085db", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497963, "uuid": "62fc0035-73fe-4c24-b4d3-5d1dc7043da0", "comment": "Malware payload (ClayRAT)", "value": "2b77e9be1bea910d05ce730f5e5446e829839c86f8dbc7cb83a06ae12727a193a60853f17659981974926d11389876ed", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497963, "uuid": "f9ed7ab3-8094-45c1-a45d-28505bb879e8", "value": "T108460146F708943AC4FB17320636166152A3CDA68F83DA836D58B33C69BB5C85F29FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497963, "uuid": "4d5c85e8-9f12-41e8-9e18-e56fa7dad5d3", "value": "98304:4JeIkl58h7aqhnBBQi2ltkagiQjZAm8fH8WNFUTJyUxQWRk3q6:4sIklSQsBQgtAmSfiFHxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497963, "uuid": "c0211de2-85af-45a2-ab32-5f191d48f86f", "value": 5690138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497963, "uuid": "188ee5d9-e8a5-4969-b97d-c05540d8278a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497963, "uuid": "7d79ddd3-4808-4a7a-8481-d9f5c559c5b4", "value": "YoutubeUltra.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80bc8aa-bbee-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762529494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529494, "uuid": "8252ad46-e83b-497a-a32e-fe5a0b158575", "comment": "Malware payload", "value": "b9e2457d5d1def16a37958b29983d307", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529494, "uuid": "35f3cf33-d6d3-4113-971a-41ae19ebe337", "comment": "Malware payload", "value": "27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529494, "uuid": "4a7fb25d-d980-481f-aaba-f21deb6d9887", "comment": "Malware payload", "value": "990c07fb06af6d91148c8a7a8a7938c1e30eab1c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529494, "uuid": "8a9a925f-baf3-47b1-b453-8586cdd81af0", "comment": "Malware payload", "value": "91173daf926b46de04eafd63182fbf7f7f052ca7c70c3a57b3c6104604b05c3b96444d268c0fa291702806d167f3927a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529494, "uuid": "85cf4c07-57a8-476d-beb8-03b5e410b3ba", "value": "T13EF1173AE4860E1F539A85EBC3D148C6CF3B8A12A2FB75123473939F44BD94C955B079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529494, "uuid": "70b1ccd5-8e56-40df-b95e-6a336936c3ca", "value": "96:baMrvL7wx2qcLetysV0vDkukvCJYEzYO+uboOPMySIkcWjJMAJ8:c0wu6CJYBuMc+JL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762529494, "uuid": "588396c7-0683-4690-9654-1e7e99fbfa2a", "value": 7856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762529494, "uuid": "d42b4423-24ba-4bbd-8a4c-c33afeed57bb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529494, "uuid": "5a0de0bb-d0ed-49cb-a6e7-dcf8f185c899", "value": "2-3716-25_07.11.2025.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa73e24-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526501, "uuid": "f042d9d5-852f-4397-97e7-28b113d42ea2", "comment": "Malware payload (Grandoreiro)", "value": "9059c9a5530a653d7e101e39ee261917", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526501, "uuid": "d58e8a4d-2e1c-4eaa-9d75-bd55e5843c0b", "comment": "Malware payload (Grandoreiro)", "value": "2b31b70eb66392ab67c98054b86affd33fa6b79d3b605e0b2eafb28ae32296d6", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526501, "uuid": "c846e19d-358f-44b6-b228-f01eb7f89fc0", "comment": "Malware payload (Grandoreiro)", "value": "643140c81cd20fe5d97555e245a501bfc76f70b3", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526501, "uuid": "ff3f30fc-6e7b-447e-8bb2-d6bd4f64b252", "comment": "Malware payload (Grandoreiro)", "value": "9fe171ba4d41ecbc5a1416b0c926e126c78730782f60b77e8aa88659577f53ba8a99f73897070367f54546cb433612db", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526501, "uuid": "d039cc2a-5d0b-43c0-961a-07b992f1a05d", "value": "T14756237266E42877C6A14775B00A2772ED7ECC63491C81EEF4CCA14937DEBD1893E0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526501, "uuid": "ed7b6352-9c11-4969-905b-0c8be9b2a3af", "value": "49152:AtsV43jU6H+ODqn1TiLh0yIe37lJctI9Cy4A5RRtQvPw8ST8TIR45Ngqfdhu2:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526501, "uuid": "968f2802-8e5b-48ea-8175-2354ce5c9fe7", "value": 5941248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526501, "uuid": "7bb750ff-cfe3-4cb8-ba8c-d976ef21dbaf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526501, "uuid": "46955624-ee06-4943-b40c-9e958fd4611a", "value": "TMS251481OXQ09980147.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8b50b3-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502714, "uuid": "c42cf30b-4a0d-4771-ab2e-7683adacae0a", "comment": "Malware payload", "value": "e3713933ac1af99922a477d7e83860c5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502714, "uuid": "082a997b-542a-4398-943a-f32958f55b9a", "comment": "Malware payload", "value": "2b4505f79755c3d3a80e6e3ac1e20a0018bc8341865ce52ea31d0b1300eef2cc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502714, "uuid": "9c5ad6b6-892a-4116-8f8c-6ebf69e0f9cf", "comment": "Malware payload", "value": "7eb6d623b64f165813db9ab8113e1538290b3dd6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502714, "uuid": "d6282848-612b-493d-b2c5-e8373393ae25", "comment": "Malware payload", "value": "63dfd63d751e60f8c4791f7b39935538d632260ee77b01060c401451eb7eb52c166f652862b6a6f5ebbe882e0f231ac2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502714, "uuid": "d77184b7-ffc7-47bb-a0a0-37135b5ed6cc", "value": "T19F060193DCD13ED4A4A5F0D74E9F759A8B97701A3B29381C3EC8EA53281683F6A414DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502714, "uuid": "1fd0bab9-f6d4-44af-9e01-00c92aff8869", "value": "49152:xxrvff2mey+LFxlLqnG1Mhg/CCEPZlHZSGQZk7Uc3TTUvjh7tZDUfeH8Okf:KUGChg/6HZSGQWAc34jh/4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502714, "uuid": "f8497785-c8d3-4b8f-b46a-a2c842388800", "value": 3656359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502714, "uuid": "64e16d06-186c-4eec-abdf-eea7682a311a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502714, "uuid": "5ac70d34-0109-4612-a641-ca2989ae38f1", "value": "UPDATED STATEMENT OF ACCOUNT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38f5d90-bc34-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762559525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559525, "uuid": "5f17fed4-436c-4767-9e66-95649e130c88", "comment": "Malware payload (Mirai)", "value": "28b72544198c6399ba505a147c6c90d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559525, "uuid": "2e5f1cd8-28af-4f32-a585-adc28a893cca", "comment": "Malware payload (Mirai)", "value": "2b64907c869e4e56e3f5c86a4b1a9d34b9cf6ce8bdd744cfea58584372a8aee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559525, "uuid": "ab778964-195e-43a7-a55b-a4c8f97b083c", "comment": "Malware payload (Mirai)", "value": "d0c1d13fafd3f1079c0e616deed3505a3e6d2a0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559525, "uuid": "4546cb1b-863e-47ef-a69d-9cf0ffa4d5b3", "comment": "Malware payload (Mirai)", "value": "d735177ac3294f16d171475653cf404fa665ff7c9a248535cc6c06303ddcde249083c13aec331c54d762910467924343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559525, "uuid": "8fb7b05f-2ab2-43c2-a84e-1f23474ce4b1", "value": "T123B2E198BB58A471D530993EAA84C7C129B7CF7DC0723521BAD4C139F4DE50E13B9952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559525, "uuid": "25ba2df0-f0b7-4fed-abd2-3b99ebb67176", "value": "384:K/QKh5l+d7bXu6IApaoRgp0ulYDLS20RkMqh5HhoqJUYzKX2cnhymdGUop5hV:hdleApa/p/SDLmyxhFotns3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762559525, "uuid": "97a53df3-d1f4-43f1-b720-3e17699fc1a4", "value": 23528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762559525, "uuid": "0af98122-534a-4246-b8f1-04af1efe5422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559525, "uuid": "3dc40e4b-8bcf-4359-a070-b075f5d22e04", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f9170c-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498586, "uuid": "8fb1deae-8cc7-40be-b5c4-7c9016e417ba", "comment": "Malware payload (Mirai)", "value": "654c0995024692f065da2e5b57204d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498586, "uuid": "5b51fb05-c0b8-46d1-895f-c358a080587e", "comment": "Malware payload (Mirai)", "value": "2bc8fe6e08b30da5f1a24759602ae5789901af16daaafebd6bf5b72c7408dd52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498586, "uuid": "9d605512-256f-4e28-b69e-93e09d27b90c", "comment": "Malware payload (Mirai)", "value": "b6235612daedfa18af6a9021f4cd69692b465a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498586, "uuid": "1a8e914a-0cba-4637-9ed5-964acad6a223", "comment": "Malware payload (Mirai)", "value": "0ce8317655ee225ddceb36496933ff69cccefb74f51aa2efa63a46f43052aa6dfda6c15f61731f6d119cd5d0e1bf3738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498586, "uuid": "55bd91dc-6afe-4899-a871-d42d352f42a3", "value": "T14FC2E0C86D0145AFF6A5B87E30E64B953C2543A29982FC032A6DC7D9DF4D5A5F0C2EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498586, "uuid": "99ed55f0-9cae-4ece-b00e-8d11ffde897e", "value": "768:aYTrNlejgkVv0dQBza4VxbJGJgGlzDpbuR1JNBb:LkgkVv0dUrxbJyVJuHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498586, "uuid": "810d12c1-a714-451f-b8d1-43d6b9823dd5", "value": 27748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498586, "uuid": "5b66bce3-c985-40b6-86ec-9039d7f78e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498586, "uuid": "4b598056-0dbc-4c3c-a547-3dd3d0e389ec", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66243f3-bbfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535129, "uuid": "87afe5fb-0369-4d2e-8660-c673f42854bc", "comment": "Malware payload (Mirai)", "value": "34bcc0eec751870c2a388612601f5f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535129, "uuid": "8ba4e480-aca1-4519-a051-f42d1ab48840", "comment": "Malware payload (Mirai)", "value": "2be06d87ed41d08c70ff732f279dd5ea6f69b912cee2b1d142a2b3eec03a4577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535129, "uuid": "d42dcf14-b159-4f5f-9070-fa73bcd74ab5", "comment": "Malware payload (Mirai)", "value": "1296a8cf8c7d197d0ce65a7731099e46c5aa5855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535129, "uuid": "e02b7666-afa4-49a6-b547-9fc06ae8556e", "comment": "Malware payload (Mirai)", "value": "c95df939efd805366062590b6cf6c7ad0f1beccdb225de89a1e4b8e228e2c84e3f06a24e35242e1c4e49230aedc2fe57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535129, "uuid": "3a437fd1-8d87-4317-bb36-6a1118f3e39a", "value": "T1B1C32807B98084FDC489D27803BF6132C4B5F96E0378B19E6BC9FE1A7E09E512B39955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535129, "uuid": "afe8da81-5064-47cf-a963-9ca36b053ec9", "value": "3072:XpGUGhoMQgCnQ3wC1sOihqZIilgRbH9EmQfd:XpGnh8xZCOO8xH9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535129, "uuid": "b87e43c8-9495-4210-93e5-3700ca20e3dc", "value": 119184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535129, "uuid": "557ca92b-27ef-46bf-bccb-ee8a25fa37b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535129, "uuid": "d9b4beab-dc31-41a7-af6a-4db7fcecf4e1", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2118cf6b-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513726, "uuid": "9fd619d0-3dc9-4314-9807-0f6b0a6c334a", "comment": "Malware payload (Grandoreiro)", "value": "6e1e78f142d303a1b10b6aa367729215", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513726, "uuid": "5442d772-dce8-4c6e-b5c5-5f2a2d82d265", "comment": "Malware payload (Grandoreiro)", "value": "2d0e48e1907df41d543194338a194ccd176534296ef28824f9852d42928279c6", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513726, "uuid": "58553ba6-8e62-48a0-ad9a-530b71e67c8f", "comment": "Malware payload (Grandoreiro)", "value": "96f1072a0b0d21b5f1d744b6e74d6737f6bed0f6", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513726, "uuid": "79322e55-41e4-44e7-a384-39d5bb635975", "comment": "Malware payload (Grandoreiro)", "value": "0872b97b13c0925b771bda6ce891b4da526d0f63ab4cd2381c2803cb6d7ea1bd6a93cec7dfbcac9ec38796019efe2caf", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513726, "uuid": "94c98e75-c477-4af9-bb04-3b4957faaa43", "value": "T17EA623729D643A3BCBA50735F00F2B726E7D5C13894CD1E975CDA08A339B7918A3B468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513726, "uuid": "618c9146-f389-4509-b2a2-53f74a98b7f5", "value": "49152:t+hOkVbydWSN3OgklUtSDraR/mi48+HkzbI0ALecMRl/FetiBea9k/p0oojA3SIu:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513726, "uuid": "3c8bb436-9702-4815-809b-1d2e81a74252", "value": 10133504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513726, "uuid": "72dde0b8-1a8d-49be-b03f-3cf705a02562", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513726, "uuid": "508f3141-7310-4050-b925-2e210c79e83c", "value": "QBN3148336L8A22871.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d62300a-bc33-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762558897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558897, "uuid": "441bdbb4-5366-4f82-8cf9-0904af3276b9", "comment": "Malware payload", "value": "36c8015abd9b2eb13e0c63e2f98adf9d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558897, "uuid": "7be4751a-9e3e-4127-a3ba-f765cf25d080", "comment": "Malware payload", "value": "2d5dc22686ea63cc60d40729235d5a602fa8d903eb5451774f2cf296161f0055", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558897, "uuid": "cd18b270-e01b-45a7-9694-ec5c13f30ab4", "comment": "Malware payload", "value": "460c570e9750ae927d9db6fd7479bc7ca6b1d696", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558897, "uuid": "9b435065-43db-400d-b558-eb2139a428cc", "comment": "Malware payload", "value": "2d362d2389a2507ffee169f2fe969892730d60116dde5f183c562d8038b4a8fce2a187dfce9fa569426f009c0dc7db45", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558897, "uuid": "9da400a9-24b5-464b-88b1-81f02b0b1d35", "value": "T14E283371B95B0576F81B14BB50BF0B8614520F1E8A9055FBB735BABEDE32F1A72C9002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558897, "uuid": "0e53695d-e240-486f-bd9a-03f73df02cfc", "value": "1572864:NBZplCX6his/J6aOFAo+akgytzhVwOD6agAjL3X1uj+Ebcl+ri9bZOYmxVMfp:NBZplCXuis/pOFAo+akgYzhZmagAjLn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762558897, "uuid": "b7f32626-9c18-4ef9-b6fd-bb9078c4d425", "value": 93790208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762558897, "uuid": "819a59dd-9f02-42ab-b6e7-c9358a203ef8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558897, "uuid": "6ab746e5-6089-48d0-963f-bce12c3d2353", "value": "LayemorNewRelease.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e62ce97-bc13-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762545048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545048, "uuid": "59cd1cfa-77d2-44c0-b3b1-38b18df2ba66", "comment": "Malware payload", "value": "0d1399ef7caf88a46085142323a04ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545048, "uuid": "07a34567-fd92-4ebf-8eb8-18e5b4dd79e5", "comment": "Malware payload", "value": "2d8f27f9d08a1fc0ca66654fe943a511f3ea8e494b6c68d182c99ba46b03e26d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545048, "uuid": "681f94ef-0b8b-4728-aca9-8a4d1c20181f", "comment": "Malware payload", "value": "d9efc66d528e71a9d21d26a72e2fe8a263a331e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545048, "uuid": "4908c9c8-4682-4c02-b530-7f64ae1b587b", "comment": "Malware payload", "value": "260f498bf756d7ab5669f1e3c6af5c7618c6131c4e9db77f4859c2cdd38a9f845f7d86abbb47f54531794add29accfac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545048, "uuid": "bd655619-0cf8-4dc9-a4d9-20f2524b7c05", "value": "T17F7633E4D9002809D7755D7DE6015BFDC4689E3A4EC53888C3BECF1B69F8E851372A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545048, "uuid": "319625c1-32d2-4cbe-8b2b-d90cffa1a31a", "value": "1121df302ff393c414fe24822a6585c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545048, "uuid": "24968763-b292-4e7c-9c13-c5a7f7115d43", "value": "98304:aWMtV2BG8JNl6TvpsOK5bS7bLUivhlT+ulUsdzh2kKLnGtw2hqRo4vO3quTn9qmA:aBODK4JS702F+ueLGXvZ3s2BqJO+QmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762545048, "uuid": "300a1f5e-e3a6-489f-acbe-a347431f8a7a", "value": 7256424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762545048, "uuid": "1b6599d8-acb6-4c31-b5bb-2d4dececebea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545048, "uuid": "208726b8-8ff5-442f-846e-bdab71a18580", "value": "getscreen-643020757-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f07206-bb77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762478273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478273, "uuid": "2665bd90-ae4b-4c89-b0a9-c708976a0f54", "comment": "Malware payload", "value": "73f9054eadc4150e7b2c518ea0245406", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478273, "uuid": "60cafebd-8e03-4c49-9039-79b4cb12e03a", "comment": "Malware payload", "value": "2dbee2aec305103a2ad3fbd4e56c8973e138c30b7fb349c0d6ecd38ddc421aaf", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478273, "uuid": "1735d2cb-b346-4de4-bb93-353f7d74618c", "comment": "Malware payload", "value": "cadc661dbe59986165274e70965f920e547568e3", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478273, "uuid": "c94b0c37-7ac9-4a79-a632-74630c9a12c9", "comment": "Malware payload", "value": "dd062ba6dcc36f074af2d409ad5399d9fb94b74487a67927d319ac7ef7eacca7776ef0be19e2cd68a95d975c74807078", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478273, "uuid": "aa541658-42d8-4dd1-b9aa-353bb4ee3823", "value": "T1D3E24BAE0BD401F8DA9AC1B5D9B63907D7B1B0471FE0668F4171C4DADF42AD3A92C6C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478273, "uuid": "3e24c2f3-46dc-43e4-a901-7a9d3d199166", "value": "57a4b25d92ad302a4e318a4f1eb5ba73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478273, "uuid": "a69d2023-6b2d-4ed1-b275-ad9b1baf039f", "value": "768:1PNNACXOHmSl0mt0yGkb8yK/dzJGlVa0H6fpYRSJxrgMgOTXyAfg:f5OH5l0XqYlxqKYRSJxgMgOTXhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762478273, "uuid": "2b930f77-20e2-44ee-8180-43570ee042b8", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762478273, "uuid": "df7258ec-a9d7-4fae-93b9-9c21bef37c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478273, "uuid": "bc87c25c-7fbd-46a6-9383-382ad47d4e3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49771da0-bb6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762474709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474709, "uuid": "fa958efa-d204-4745-a165-4a9abd2b0006", "comment": "Malware payload (Mirai)", "value": "d7f2962fe694727bf4b80f25f66d1e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474709, "uuid": "3401a330-495d-480d-9193-913f4c7d61e0", "comment": "Malware payload (Mirai)", "value": "2f42ecf699717cb15cabaa0f54d92d8a3314dbf54bd4cd0c7806a735f938e8aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474709, "uuid": "136c0894-6178-4753-840b-d2cb4079647c", "comment": "Malware payload (Mirai)", "value": "f0edd04bc8804e580c537a38f227e3b8d92f0e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474709, "uuid": "4a9e1ab9-aec5-4705-b413-336d122fbbf9", "comment": "Malware payload (Mirai)", "value": "0afab16ebb6b7192f9fc486fd7d8a8783848d18fe07ad5a357c9755f84f92c36671ada6acf47840ee1f825c4556934ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474709, "uuid": "fd38eb8d-2d80-4a46-9b00-247eda1881b3", "value": "T191F2E162D0D11F4CF03AD13A059F659D16E3D188A8CC81566BE8762BF642F7E183CB5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474709, "uuid": "4716fb24-18cd-412b-925c-e2de33c93e75", "value": "768:z16dsuWan+wXse+xiTaN9hMSzeUYE/tKHQvfmEf57nhkhnbcuyD7UHQRjt:zgdsuWhheZTc5DYEmQvOEfbkhnouy8HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762474709, "uuid": "4f643c70-e24f-4e13-9870-a7c24845f9d5", "value": 37624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762474709, "uuid": "f242d90a-9171-4086-977f-f2cc68e0e029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474709, "uuid": "1a35e2f5-5f80-4ed5-81ce-9225d531f78b", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bec3de9-bc11-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762544319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762544319, "uuid": "51802326-5ae2-41c9-807b-4c8e433fb4fa", "comment": "Malware payload", "value": "057124dce4ceee9743d057c44c80a9a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.MSIL.Stealer", "colour": "#6FA43B", "exportable": true, "hide_tag": false }, { "name": "trojan.lazy/msil", "colour": "#3FF247", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762544319, "uuid": "8fcdf28b-933d-4f94-8c85-f865f51af2cb", "comment": "Malware payload", "value": "2f5074320f4255349b5e80a654d263adb6700f16b80694ba395265f1bc057a9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.MSIL.Stealer", "colour": "#6FA43B", "exportable": true, "hide_tag": false }, { "name": "trojan.lazy/msil", "colour": "#3FF247", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762544319, "uuid": "12850361-4eee-44fd-ba35-5f19bee91a6f", "comment": "Malware payload", "value": "d80beeb6a809227bf400e79b730b405c5588ab89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.MSIL.Stealer", "colour": "#6FA43B", "exportable": true, "hide_tag": false }, { "name": "trojan.lazy/msil", "colour": "#3FF247", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762544319, "uuid": "98aff888-69ed-46e7-b391-a5e0c15ef1bb", "comment": "Malware payload", "value": "c0b43063be2abcdd84447f85d0675aaa6cf79ac8dbe4c3a966912aed3f98a571582e6028c8206216e66423e709fa76a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.MSIL.Stealer", "colour": "#6FA43B", "exportable": true, "hide_tag": false }, { "name": "trojan.lazy/msil", "colour": "#3FF247", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762544319, "uuid": "d6b7d659-a306-4cd5-8b2c-74b41df1fb18", "value": "T1815733AB34070FAAE3DC1D39D183275102D6E285173BE34D2B166BB77D8139A88477E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762544319, "uuid": "f65dace0-9de2-4ae4-9feb-b053a8b25459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762544319, "uuid": "1b890db3-6851-45a9-b1c4-e15185000b2c", "value": "393216:hhL1IPRW05774+CCNQJ++EX9yotdcmHybNbhOCg/HVIr3mcA6EY+PybofcDlFrqA:hnKFUl++iyoty/5gJIl0Y0ykkDPvI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762544319, "uuid": "c133034a-b588-4df9-9040-841428f9e7ac", "value": 28322304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762544319, "uuid": "f8525a13-d356-41c5-ac38-d2ee84135647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762544319, "uuid": "739a12fb-c947-4b22-8f68-2d6da393aeb7", "value": "winaihservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97444cd3-bbdf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762522943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522943, "uuid": "61f544d9-84e5-48d5-b5ce-eff11718a0f4", "comment": "Malware payload", "value": "e12bcedfd36d925a0ace1c149dc62576", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522943, "uuid": "73d264f7-39e8-4a60-b86f-08efd2874131", "comment": "Malware payload", "value": "2f976724dd48da9b2cbe4a82ac7b001b82aaa92c7c572bdca9002bc51e182b98", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522943, "uuid": "94fa4c52-b44c-4d53-b4c1-8aeb5ba715e7", "comment": "Malware payload", "value": "3975518f9d749b8ceb3950a986f4279addf7c8ee", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522943, "uuid": "1c7994ab-db0a-4557-bac3-835f19018bda", "comment": "Malware payload", "value": "3aa91f8eac39ad8e9de7b07378eef5108df1716174763ed88408c5b03e170cd0fe6186b129d48fc0842c59c3e599f7bd", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522943, "uuid": "6491aae7-c750-4be7-b892-abb37e6aad03", "value": "T1A06134F98A61FC6E921294E2FFDCC14D6400F00AA96E6D6ADE01335E601F9344D7BB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522943, "uuid": "14c38629-ec5b-41dd-b7ab-8bf960f195ec", "value": "96:rFnAF3R343n363G3L3y/elbxBlnlfO3zzlfE:ZAVhs32CbSmbxbnlfO3zzlfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762522943, "uuid": "e77ffe0a-683e-4bb5-be11-03247804f62c", "value": 3407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762522943, "uuid": "ed476736-8668-4b39-814a-f94eb8832fd1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522943, "uuid": "c1cbbf9b-6963-49b2-9e7c-988992833b0b", "value": "E7-2981.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947cb126-bb86-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762484713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484713, "uuid": "515c134b-801c-4d4b-a819-42852ae92ebd", "comment": "Malware payload", "value": "54386e51a27c1911fb41313ed7bf3212", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.BroExt", "colour": "#ADC2AF", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSI.Agent", "colour": "#A415E2", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484713, "uuid": "c1975fdb-d467-4f9b-a6e5-8dd28f2ff7f8", "comment": "Malware payload", "value": "2faf54828c813214397e73445450ea55adda2e1b4ff3a8712d3eeb98977a3a53", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.BroExt", "colour": "#ADC2AF", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSI.Agent", "colour": "#A415E2", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484713, "uuid": "6f5a90d8-c779-4ead-bd7d-be4dcd3933ac", "comment": "Malware payload", "value": "09a3b3da130cb44a9f7bb474f159e9059fa87dfd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.BroExt", "colour": "#ADC2AF", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSI.Agent", "colour": "#A415E2", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484713, "uuid": "324f6406-8f77-4ae4-8a59-ebfec89e5c65", "comment": "Malware payload", "value": "3b8ad0d35797b5f5b46ed30924bba1bdf35313edd633d2e85553a2f0bbf8a8a83d69cfd767bd20efdf289fc70d48a80d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan.BroExt", "colour": "#ADC2AF", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSI.Agent", "colour": "#A415E2", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762484713, "uuid": "b24ff0f1-77cf-4e35-91f3-76840c85cb9e", "value": "T186B49C137E81943ADAB90E36893AD7719F3CBD245B20855B6384750DDEF40C06BB6BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762484713, "uuid": "58c7ec09-affb-4c06-a29f-b6c7a70158ea", "value": "6144:Qs/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkaNyXiB5p2rr3R:l+8jOZy2KsGU6a4Ks41x5VkzXiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762484713, "uuid": "04f63537-efea-436f-986f-790674342c56", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762484713, "uuid": "e0a00dcd-e865-45df-ac79-2a427ec87d8b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762484713, "uuid": "90881a3f-8293-4b73-8889-8db9aa738b9b", "value": "0b96eb7d3d.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b4c347-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762502733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502733, "uuid": "6bea37ab-ea51-4954-88e3-4f50d4659022", "comment": "Malware payload (Rhadamanthys)", "value": "4b8c1d7fb5b1d84280c9508a9045b3f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502733, "uuid": "a231a817-645e-4d1c-8373-f264f44227da", "comment": "Malware payload (Rhadamanthys)", "value": "2fbb5089dd8140c16c2dcf12b9a038c361521253789f924fcaeb01e3badb1062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502733, "uuid": "6846e9f9-01db-4920-88cb-328632398db1", "comment": "Malware payload (Rhadamanthys)", "value": "70acaa586f29523b0d8a44ea835911f7484278ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502733, "uuid": "5ab274dc-7b75-4e5d-a8b0-93a1dd4d1ecd", "comment": "Malware payload (Rhadamanthys)", "value": "10c73ff584a608d34c96fa398b5308aa215f511fdca012b0802221c4e8d2201aaa01f0f228fc758455855df6c18b8b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502733, "uuid": "ca942a0a-d4de-4c8a-9595-22fcee8869d1", "value": "T1D89533300C99A51EF7D61EB6ED391CC39720EA2908193DF9560C580BBEBBF0113A57DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502733, "uuid": "533ac947-77d7-4ec3-ba5e-93ec62f1cde5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502733, "uuid": "fff9612c-34c1-4c9d-8537-b4ce9d968866", "value": "49152:kha6kbLckub/B71Y8x07+TICHo2/bSHnsmAoPfd4dK:CaPbLib/B71YNszuHsWfdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502733, "uuid": "3bbba674-de64-4468-982b-bd4bc81b0b46", "value": 1989120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502733, "uuid": "ba2212d8-9472-4a17-b4e5-2e7e237edc8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502733, "uuid": "a11cc326-d20b-4c08-a3c4-62040a011ebd", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd153836-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498579, "uuid": "1e06eea1-f2c9-4329-91af-4796f1062a5a", "comment": "Malware payload (Mirai)", "value": "13649198f89c7dc15dfc42f5ee1bea30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498579, "uuid": "113ed0f1-390b-45b7-a8c7-facbea83b058", "comment": "Malware payload (Mirai)", "value": "3013bc99b8498df474a275689be6c8a6611f7a789e1b9eb884567c7f8f2c0260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498579, "uuid": "17036041-11e7-4ddf-a4a1-2da7530a58ff", "comment": "Malware payload (Mirai)", "value": "c38fa339c68b6b0d9906eaf428c93105a92d7697", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498579, "uuid": "6774b01c-d355-4c28-b357-04058be60d11", "comment": "Malware payload (Mirai)", "value": "b98b8673f549156d69fb9905abbf5684ae4b6245c9666c38262a469578f1a0cbe0099a89ccddb9424ad68f5669b112e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498579, "uuid": "6e3a5aee-987e-4261-b78b-d30d9f6cb17f", "value": "T1C9A2D094C1587A71C3706476BE3C7AC5BA950BF496A3363EA6499230B3D503359BE0CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498579, "uuid": "ab43995d-d49a-46cd-8d58-0c1384ce7f3e", "value": "384:XsELc8zDmYGCQIHXOG5o9LI4i1MoZObC5L1EIYtxkCmwmlmhymdGUop5hXcK:8ELc8/mYGCBXOQ4P+iIUVsYs3UozJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498579, "uuid": "da3dc306-356d-4b62-94db-1ef6e3aff5e1", "value": 22332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498579, "uuid": "1e54f649-010d-428b-b631-8dc825ce8561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498579, "uuid": "a4b6b32d-aeaf-459a-9eaa-654915102c7e", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e246d869-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498588, "uuid": "e7370da4-74ae-499d-8ed5-ddc0105cb96c", "comment": "Malware payload (Mirai)", "value": "e9ce71aad67e9f9a083857649110c9b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498588, "uuid": "017dd37f-2c64-4713-9394-e91d57f5995b", "comment": "Malware payload (Mirai)", "value": "306def9109b65160b5a49ae44a65103ca780c83776df4a8a14dfffd951c1f837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498588, "uuid": "cd8741e4-1d67-46d1-9a85-495cd1195450", "comment": "Malware payload (Mirai)", "value": "079315e54c13123f4e3c15e39cb2b7bfb64ee2de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498588, "uuid": "8e92124e-3e31-442a-aa78-a06848b967f8", "comment": "Malware payload (Mirai)", "value": "b761782d6e0f4bdd5446c6f9866ddf0408091ed3d23e538064af8d03da661e95ac7f312c712326a32d77f29ccffebe31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498588, "uuid": "ca289137-5f06-4472-a585-dbb4a9b011d1", "value": "T1E233F2953EBCC9F0E711AD3BC11C3A45FE789FAB88DE60924CD449B9ABE304324A7545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498588, "uuid": "47634942-36d6-42b3-bba2-dd9bdd83eca5", "value": "1536:rZZGCcSEbzc8rE73YxoxkhOsCy0MZL0UcBdDjdAxQ:rZ3c7zRrEUOxiOI0wL0UcBdDaxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498588, "uuid": "cb315982-7f1d-4750-8061-4d01ad7e64b3", "value": 50536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498588, "uuid": "8bda9633-da85-417c-a4cb-6d46e09301c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498588, "uuid": "8eac6bb7-37d5-4889-9383-f14cefd17a62", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3660c9e7-bc09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540820, "uuid": "0b25c644-ab70-4aac-8c83-aa097e3d1ed0", "comment": "Malware payload (Mirai)", "value": "6dea2f5594e49e714621e5a3c4295570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540820, "uuid": "918d3f4a-432c-489c-a33c-2d287695ef59", "comment": "Malware payload (Mirai)", "value": "30b1f26eab04ca563ec7f9b0c1de1f2bc5454250ebd7efb3ac92466a500b6bc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540820, "uuid": "d9fb7aa3-45bc-4428-ab24-2ce9ea9e5d5c", "comment": "Malware payload (Mirai)", "value": "5bfe2cbe201126cf3295135f68057cca55d0e210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540820, "uuid": "9881907d-c10d-495c-82ab-082eb879214f", "comment": "Malware payload (Mirai)", "value": "b87a7040859ed33a02ba8d76fbdfe86e169ac0b74d146b88e5a1159ca8f7950c65bec88c9755a198356803c63468eb8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540820, "uuid": "87f49510-26ba-450e-b2dd-3c3c86934159", "value": "T15633F1584A31144AEC46C07E89D443322F525EADF7009D5FA10BFAE6AE88AF17002ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540820, "uuid": "0de02c27-9a53-4123-b0d0-6a67b0af800b", "value": "1536:3F+jnaI01dv4MWAsotZ64QKF8VCVu5VJu4:gnaX1dAxAso36AaIEVQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540820, "uuid": "cad2e584-5fbb-4210-8ea6-23f1159c60bc", "value": 50852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540820, "uuid": "e942fc73-952b-4520-9885-7bf81d0430d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540820, "uuid": "4f06f4f6-a6b3-467b-9704-9131571a31e3", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ededa2-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762498998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498998, "uuid": "a9341c68-ab0a-47a1-a729-e565392eab5e", "comment": "Malware payload (RemcosRAT)", "value": "365cc5f6610671f6f3818e2a0e078fdd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498998, "uuid": "0e5a0e65-a21f-4dad-9a02-86b40bd9b3df", "comment": "Malware payload (RemcosRAT)", "value": "30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498998, "uuid": "9bddefcd-ed5c-43d3-98fd-ad9ad5ccfd86", "comment": "Malware payload (RemcosRAT)", "value": "18b9e5a01b80c4ccaa06fdee39270fa0c2a74df4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498998, "uuid": "80bc6b2a-6be5-4535-a66f-e704e803a397", "comment": "Malware payload (RemcosRAT)", "value": "02e23aeb0dc0dd4efaccada48947362cbf60a1f3802c07fba0f04d651926bb489856f7a54d17ee3bfc505b602acd3b28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498998, "uuid": "5a035859-b0d9-4c97-a06d-b37822452ca9", "value": "T14D25E37DEEE7B9F2395EDB5139A0698C2F190176DF5B1C040010FBA221E62D95ECF4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498998, "uuid": "725b5ff9-85d0-498a-8809-5a7d3f486a1e", "value": "12288:KLmY9cYTktpZIn3C3EviUDuZyPXBxYIRNDfOPv+iQwzfzkTBQ0LH:KLmY9cYTsHq3C3EtSZWqOfOPDQsr0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498998, "uuid": "60de92d5-6f0a-4a29-9721-2c7707eae5ad", "value": 1053210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498998, "uuid": "6b48e68a-fbc0-4944-a2ed-66b949568dde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498998, "uuid": "d792a7cb-b372-4506-9af4-856756ec356c", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6618ab53-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502675, "uuid": "6e3afeb1-2424-4f49-9502-84dc0359e11b", "comment": "Malware payload", "value": "fcd183e66d52c37d2acc96f43fd8a286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502675, "uuid": "c6b48810-7ccd-41d4-ac12-7412a6b2d630", "comment": "Malware payload", "value": "31f9ce30c230bb15a0366882a41ef9e6163a78205a8de5e471cd3f38280f10e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502675, "uuid": "7b1d1a71-0c45-4e1a-86c4-e41017f0a72f", "comment": "Malware payload", "value": "b42f9900f27495b2afaebfb133693231c8f94aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502675, "uuid": "993dbc50-4a68-49dd-8ca0-d37cefa64efa", "comment": "Malware payload", "value": "34347ff8ccc78b6f854db8601a9555985f744b9822ca3f71a050ffb68f9699b82caa4934da1168413a04a8f01daedd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502675, "uuid": "68e8fd1b-9290-4e1c-b98e-69dfa9ed48a6", "value": "T1A0E53317B3ABC9B0F033253561C81BD92AB0DA651B10DAC78E604F472DB27D96F395CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502675, "uuid": "62f6ffdf-e74a-434f-8fe0-150047fa3e4a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502675, "uuid": "45e300fc-4411-4f58-95cd-0e49af7058dd", "value": "49152:Kn5AooXL3J47pOgDodFYHcCpzlNByXVlViXLG7zKH5oz3mcLDUxFYiAzXnodaAOe:Kn5yL3J473DodFYpByXVy6WWz3hLDUvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502675, "uuid": "6b11b35e-8b20-45cd-85e9-8f8b353c6dc0", "value": 3082806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502675, "uuid": "33306d29-89d0-48a6-8c87-9bbdff223ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502675, "uuid": "10d0498d-62db-4e4f-bfcf-125000530e5c", "value": "fcd183e66d52c37d2acc96f43fd8a286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc92ae5-bc1e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762550063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550063, "uuid": "5c00c371-2877-4213-9f7e-01447401d2cb", "comment": "Malware payload", "value": "eb91a6584de4a77f271c0e98cb43842a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550063, "uuid": "7e6d30c7-0b52-4c8b-a190-c2fcc7213113", "comment": "Malware payload", "value": "33c1522c868fbe5ed4b88a3941523b22097e98d179a594171bc18a2eddfe991c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550063, "uuid": "5fd54675-15e4-4802-b2fd-f56fe97af72a", "comment": "Malware payload", "value": "20f0132513dc92c90601d9dd535e5f4b5e293155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550063, "uuid": "4b464d61-8ccf-44a6-9e1e-532efbdce7d7", "comment": "Malware payload", "value": "14312ede8ef8f2d7640cbd2552e1189e85e0f77fb62f637fb605b7e8f5a256ab00a6d63026d1ff8dfdbfe72a56cb8f78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550063, "uuid": "aaf22e67-e002-4e0c-bd4f-ea028c137089", "value": "T1C6D46A8EB57B0CEAC6DF95FB80368255F10368D07141862AE7AE4027DD872D29F95B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550063, "uuid": "4cc33e05-0298-42c9-9bec-52eb8c45cfc1", "value": "99660705ddfa2fb658dde087921ec28e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550063, "uuid": "ed3a2f76-b6e9-484a-a61e-8cbf7c139927", "value": "12288:scYgl8F20ivjFVCOMg/taoT0JFGjRNFLPKQjNPSl3TH:Ggl8FFmjFVKyLT0J+RNFbKsNPKTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762550063, "uuid": "c6f19533-b027-4933-9b80-91a4df2edaa6", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762550063, "uuid": "10445f73-ca48-49a0-836a-6d4dc86a1615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550063, "uuid": "e52a7830-7a5c-482b-bced-f2e43a1c80dd", "value": "SecuriteInfo.com.Trojan.Packed2.49365.20607.25764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741e1614-bbd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762518589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518589, "uuid": "d6307cd0-117f-4857-8621-47cf39b46bfd", "comment": "Malware payload (GoToResolve)", "value": "1bbc165eefe42119f9ebb4b501f583ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518589, "uuid": "c47743df-8cfc-4a55-9e6b-d8ebbcf93d9f", "comment": "Malware payload (GoToResolve)", "value": "33e59926cd50c0627c217a1173debd27742fd4b93ae8b9db513a33ecf87bc8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518589, "uuid": "c0c3d705-1917-4838-955f-1675441772c1", "comment": "Malware payload (GoToResolve)", "value": "b2d00b7708e11c3aee0fbaab026520e5124a0f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518589, "uuid": "3f932660-63ce-4784-b83c-4d51f3a42a9a", "comment": "Malware payload (GoToResolve)", "value": "d2e63a8f98e7b08aba666571d2cd559f7f65fb0a2b094f37f4e167bcc2ff79c9834c059109f749dd54d803b3a93b2166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518589, "uuid": "09c6d6e7-f75d-41b6-b5b7-0dd5576d050d", "value": "T1463733313156C031D54202F2AD69AFBAD3ADAD35477A44CB73E86F2AC7314C27A31A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518589, "uuid": "bd97addb-2400-4cc5-85d0-55be08e6c6e3", "value": "5077e3f17a4376dcf6421ee6917bf4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518589, "uuid": "1d1fb15f-6cc5-44d4-bbb8-a90d999808e8", "value": "393216:HchTd2JfbpEMIXXQEft9EDd8gEgSPjeh+DA9eyOhHy1ibWMxXsU1+RB0KzG:2TkyRXX5Cd8cThp2y1ibDszRB0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762518589, "uuid": "09ec9a27-d43e-4f42-886a-40bd75257ff1", "value": 24479256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762518589, "uuid": "3744b055-cb19-4054-84fc-bf065838f865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518589, "uuid": "6bc82aba-8172-4bae-9537-3ec7068bbbb9", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6851fd16-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762532743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532743, "uuid": "90262734-923b-46bc-bbde-31cb92ae1939", "comment": "Malware payload", "value": "5adb4af5833023cb88ce376962259cee", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532743, "uuid": "dc5e504f-1b89-4dd4-b539-c5b5bad69f8c", "comment": "Malware payload", "value": "35000d579ed54c184e8404157d0b5414c350d22ba1d0493acd0ddef6f1254a4f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532743, "uuid": "2d4ff31b-1f71-46a1-bde8-107471abf978", "comment": "Malware payload", "value": "d6ca915a8d469063c7934d4223798844a4f1215f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532743, "uuid": "50d20824-30a9-4036-814d-2adfa6856c54", "comment": "Malware payload", "value": "41502e8d6831c6bcf043921dc07dc50b5152fc13f753b9fd89ba759d0c3249807fa85229218e4d74cb85ae376f9673ac", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532743, "uuid": "c2a6259a-e882-4c5b-9e9a-e015934e79cb", "value": "T10A3198E8409C8406D6A900F7EBB7FD6E30B573B2CFC1239389346A99FC05317D816A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532743, "uuid": "defb8905-7e18-4e3a-a223-479c92ffb7e2", "value": "48:8H9a6LoGHYFSV+B358kpkveP+t9RMyYa+LjPWvnwnFrz7s:8w6XHiSoImP8jYa+LjenwF37s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532743, "uuid": "1c29984d-b227-446b-a6fd-4f00df0d92d0", "value": 1759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532743, "uuid": "4cfdcb01-e1d5-4477-81d1-6d32abc0dfa6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532743, "uuid": "6cde88d8-4e1d-403a-8c48-dcb971c9d585", "value": "Documento_PDF_41276.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a29f3a-bc09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540756, "uuid": "b87f83f7-e3c7-4c02-929e-1f494d925fa2", "comment": "Malware payload (Mirai)", "value": "cf6071666213b31c1145dbf55da17be0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540756, "uuid": "625015b4-0677-4d65-ab44-fe3fb79f893f", "comment": "Malware payload (Mirai)", "value": "357fcaf5f22f96bdb9473e2911cd7459ac7a9805184ebd33b6ebf8df086f0f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540756, "uuid": "081d9ed1-ebae-44cb-a2fd-c8c5b87e6128", "comment": "Malware payload (Mirai)", "value": "e5a3ab74bdf73ee30f21517cce912add98c88b36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540756, "uuid": "6b972314-ce67-484b-a4f2-7ff41ae120cd", "comment": "Malware payload (Mirai)", "value": "6bdcf12f037c1e50bc31f177e0c8850e4890c6e5cbbd28b29a9c20c768f89431c0bf4ff4faa71f1e30ac5897c80e7af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540756, "uuid": "766679ac-cdcf-48be-94e9-4b320248f88c", "value": "T135E2E1329E68F262A5B540F1FCFC89D41D3658F4AFD523FA25268A3AF10658A0470D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540756, "uuid": "342210a9-c620-4da9-99ce-d1e1a6170eb6", "value": "768:TEgpxJvz2+ZJLmvx430OADtb6QUuMOm624Jt5GoLs3UozG:wgjJvz2wLOOAxYuMO+gOzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540756, "uuid": "2b52b4a9-3ba2-429c-a2ef-89ae48e841d8", "value": 33192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540756, "uuid": "ef6b1afc-aac5-4aab-a0c8-4491ef1d6718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540756, "uuid": "c7fd705a-8edf-4cb0-9d67-50cf6c6ded07", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a21c2e-bc13-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762545093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545093, "uuid": "177be9d2-59ae-4cce-8f2e-68ac287a6bcc", "comment": "Malware payload", "value": "d6c538c248e1f2fd9c22e0ac0b0b04ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545093, "uuid": "963db773-b197-4f75-98d6-0a6b5505a1ec", "comment": "Malware payload", "value": "358960c8506683a69ae638443f267857f2417e9ccb62bcfd301226caae025671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545093, "uuid": "0571543f-63ac-41fc-84e8-e538d5c2f5a7", "comment": "Malware payload", "value": "a3b9913b196ad44e236116019a5216fae5461da6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545093, "uuid": "d8ca6d23-2af9-4559-9fde-8220b1b9e519", "comment": "Malware payload", "value": "7e9e774c5b81624ac0d9ae82f073d587adca9c2b029135fe863af760b408dad8cdbeaa30a2e28165d98326e2c883058d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545093, "uuid": "33082363-99fa-4688-b1a5-b2c0cd80aaad", "value": "T18117AD21A252C03AD88511F0DD3CBF7F472D6B69077486D7A6D81CB86E315C2373AA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545093, "uuid": "7ab06f37-1692-44c5-8b9c-a07b1abe5c91", "value": "2621b857dc4b3267842fde5336673621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545093, "uuid": "ca3dcefb-3024-4476-9560-7ce210fa0435", "value": "393216:zXICjfIGR8CjraSf5VIZK4rQUE4RrqNq8:HjfXraISEUE4X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762545093, "uuid": "baeaf416-189b-4e1f-b519-fde9cdac7e2b", "value": 19007336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762545093, "uuid": "ff483ca7-60ab-4f8d-a5f7-3fdb7b5344ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545093, "uuid": "47bcd107-f631-49ef-a96e-4c23ad51226b", "value": "getscreen-643020757-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df5ae81-bbc7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762512539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512539, "uuid": "83ba397e-323a-4dfb-9bb8-de964a50b33d", "comment": "Malware payload", "value": "c7b70fe9934ac158399a312da9b2ef95", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512539, "uuid": "2fd3fe59-b2d9-4737-9ade-a9cd67a674bf", "comment": "Malware payload", "value": "36caf3ba9df00968517e783cc25747cb9e1b0c30124c1f6d75bf2341f98f4c7b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512539, "uuid": "17b410d1-49e6-4ef5-8dbb-9c9b1e12885f", "comment": "Malware payload", "value": "bf3932381399f2c3775198ed9ca290078ac19034", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512539, "uuid": "fbf895ce-8716-41e7-a7ca-165a97b4c46a", "comment": "Malware payload", "value": "b05605bb02de49637a1f1a1260ef3927325732483512fca41217dfb2fca902c2e65ecd9e9f04ed360de6c1d6e83541f9", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512539, "uuid": "6addc906-c556-47e0-977d-a766dd1699e3", "value": "T154147BA7CD554EC9E501C7E13F1B39490F4CB24BD0C934FB08AB8EC76955E0A1A9B4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512539, "uuid": "ca111b35-8033-48e9-be5a-6497d4cc7bd5", "value": "3072:g7Ji5YKCGqBsGhlg9vPmsTgtmDVwxz+NacydnI/KdtOA2iLi:SX3W9vPm4gtmWxzsNHi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762512539, "uuid": "a5cd0893-8071-4b55-a4c2-61afd91582a5", "value": 196929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762512539, "uuid": "e5307768-6e83-4425-b62d-d15dc5001f84", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512539, "uuid": "e58cdf00-7117-4118-89ee-78b53264e5c1", "value": "Tax Payment Notice.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27adc23d-bba0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762495698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495698, "uuid": "1d196b38-db7b-4aa0-805e-1f9ceea1f7af", "comment": "Malware payload", "value": "3646af3a8d436bcdf35b51e3022cd991", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "tmp", "colour": "#B657D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495698, "uuid": "09036c1d-03b3-4ac2-9ba0-074816f39ae5", "comment": "Malware payload", "value": "373e9fafc22638a9b35cf75a608c8945df75f1fe35b15e50dfda69a98a4c76dd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "tmp", "colour": "#B657D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495698, "uuid": "0361d805-8018-4966-a4a7-d8683ea5f972", "comment": "Malware payload", "value": "81ccf746a3b772a8a0efd32f8bdaee8ed550e532", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "tmp", "colour": "#B657D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495698, "uuid": "3f9d30a6-3c5b-4f67-91b3-0eaa6f6295eb", "comment": "Malware payload", "value": "082fd3ffaf2648e921197de31b0a36573d77a8c9aa81c10fafa2f9eae620488f20b1a2285562b50f2d3a3ffbd95a4dca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "tmp", "colour": "#B657D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495698, "uuid": "c175eadb-8097-4896-a1c3-afa981f735ee", "value": "T163C52252F3209D5BC836D271169453352907DD28DA43FB8F344C73AA78BB6E88E85BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495698, "uuid": "a950d28d-4177-4035-a46d-12b24c87a0d0", "value": "49152:lwB57vfK15i0DzQs0LONvdOkJ71INJmj9gYvmkP91fAEjWy+kG:6B57nKJv5xBamjSMJ3YEjD+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762495698, "uuid": "6435c1d8-74b2-4a1a-ac5c-c06f2f110a62", "value": 2687587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762495698, "uuid": "699759b3-7bb4-43cf-84db-dfd0d917a236", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495698, "uuid": "8c33e4c1-bd44-420f-93a7-6abc0ff92f28", "value": "tmp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717da9a9-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497969, "uuid": "a5c92908-f0eb-4078-98f4-29d2e1368e52", "comment": "Malware payload", "value": "9078f0ee769b046c293c6f2ece8ec3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497969, "uuid": "b1f35345-7168-4a1e-a0cb-e33be3bf61e1", "comment": "Malware payload", "value": "38f41074090f9daf71889137b7bde0721c47f09f62a70f2be9ad8630da2aba3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497969, "uuid": "ba39b0e9-1195-4f42-9537-89885dc4a713", "comment": "Malware payload", "value": "fe52816212b2e6c4e2e08369d3a40704b12aa95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497969, "uuid": "73c7bbf7-44e7-493e-9ca0-e4e66c83c5cc", "comment": "Malware payload", "value": "c41f9ae3bd1cb2fcc31ec9f563f6fe6660709889ee270a40c7487108d1f9f501f6fe76b26b4ed5e79cc9df8c5106db27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497969, "uuid": "c2c26a92-a8ef-45cc-9251-a7773a1d060b", "value": "T10B863344A3B011FAFAB3913D99F0ED3AC661785A27A1CAC757D84B632E131D52E3C721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497969, "uuid": "e46438a7-a61b-4edd-acc0-97c9de0bd50a", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497969, "uuid": "fb38e710-8f61-426d-af87-5a6926ad8e26", "value": "196608:4Q8VCUVXMCHGLLc54i1wN+DrRRu7NtbFRKnZMjrl+DYhmh1wlxN8:VKjVXMCHWUj7rRQ7XbFsn6jsUEWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497969, "uuid": "3b1fff0e-84b3-4c05-83cc-55e92fd970c3", "value": 8029468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497969, "uuid": "c9d083b3-003e-4398-b73e-b7ab162b6ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497969, "uuid": "584af1bf-bce0-4331-8d3f-d696faaa8bee", "value": "els.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1351980c-bc0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762543338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543338, "uuid": "691f5af8-4e1b-411b-a425-426696561a36", "comment": "Malware payload (Mirai)", "value": "f0298018d204c5349d9d18edacc12cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543338, "uuid": "c15e1af0-9b00-4640-b446-7feeeb83b146", "comment": "Malware payload (Mirai)", "value": "3bd45e0ea09965e3454a55b9794f8d30f05c20e7e4f7ca75f24e0de999a88650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543338, "uuid": "e8bb69a6-995a-4aaf-850b-16ac3ada4060", "comment": "Malware payload (Mirai)", "value": "691c026379fe63059160e4a7235c4a5860c45e0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543338, "uuid": "6476e09d-31cd-4078-9116-1f2dba81d73b", "comment": "Malware payload (Mirai)", "value": "10b99bce3dc557e1c028f608bcc48548bfec0d3c1dc3d9d5929e701c7a1c2c676f46b188ed4a57ddf04d0edfedad739d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543338, "uuid": "d2fabf1a-4516-4727-98fb-e4746c24402e", "value": "T1E003F286E4D0D661C17B107D497CF24F6009819A7698826E6FC8AD3279FEE84F33C289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543338, "uuid": "42826336-8d90-44cf-8c8e-51a79444491e", "value": "768:gV3zCK+kSPH02uQWR/xVnjiQBiul2qjaslOdKkOi+mFkm3nYYNnbcuyD7UHQRjP:gVQuQWxLnjBVGHd1LYOnouy8HyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762543338, "uuid": "52280f48-80c2-4cd0-98a7-43613d6ff7ee", "value": 39384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762543338, "uuid": "a17cb037-456d-410e-b9f7-be4a23be6d10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543338, "uuid": "85df0607-edde-4d6e-9e1a-8013015cc060", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2cdcbc-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513773, "uuid": "80df0a38-e947-449b-aea1-952ce67b2fff", "comment": "Malware payload (Grandoreiro)", "value": "dcf57f510e934a8b816c4c54df337aec", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513773, "uuid": "80a460ce-0024-4bfc-97f6-4ad0939b8b08", "comment": "Malware payload (Grandoreiro)", "value": "3c1cd4546117a05caf6b2b25b2401ce81edc73b409a2e24136471ecafb545195", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513773, "uuid": "7dd653e1-693a-4401-9d9c-60d2204c7bd0", "comment": "Malware payload (Grandoreiro)", "value": "b86da5c6571ab7bdf198a77023e54d908d654b05", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513773, "uuid": "7dfc6fbf-7f67-4e96-8b32-c18d47f389ca", "comment": "Malware payload (Grandoreiro)", "value": "5c97bc94086602e20cd9237daf5530bc9b0c3b9833118f62d61f2a7a47ff2f4f39f05f65f83ff0fc18678490da65ad31", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513773, "uuid": "e6c53cdf-3899-4847-86fe-eba23b1af761", "value": "T1588623326A583D37C6B40739F00E3B61AF3D54578A4CE1E6B9CDA186325F6D1852F8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513773, "uuid": "feaf2f01-20f9-486d-b2e8-6da6a50ffafd", "value": "49152:Ob/e/UTyJsdlneRxZNc8MuFuqbaFOPWELDL3nwP04ixYt3EP4TWZHPj7Hh7xvoyC:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513773, "uuid": "98060d67-34ec-4f8d-8ee2-d9d7028ad87a", "value": 8071168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513773, "uuid": "447afaed-8c25-4fdf-877c-c4a478cf3d38", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513773, "uuid": "b1079c29-edd6-4c3c-aa8a-2e5605f70000", "value": "QBN6032ARP5S9162572.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57a2f71-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526484, "uuid": "bba28968-8c4d-49dc-95a9-464018d742cc", "comment": "Malware payload (Grandoreiro)", "value": "23f04147fdd318b3ebbc9351722fc282", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526484, "uuid": "c181b532-5331-4b5b-9e05-24dab52f89ff", "comment": "Malware payload (Grandoreiro)", "value": "3c3957a38d18bcf0b31ab6f1bc3dc6643f31da6f54e72999cc1cb295da7ac021", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526484, "uuid": "4a6b92e2-81a7-4abc-a33a-c0dd5a84831b", "comment": "Malware payload (Grandoreiro)", "value": "d6a724f3ffb00725327ce5c2499bd7d0b0fe01e9", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526484, "uuid": "83eb4c71-7a46-4618-a8c9-eec6173999e9", "comment": "Malware payload (Grandoreiro)", "value": "a91d8ef786d98f6f83ee54c6982cfc914e3c3865d4acf67c1fb08b53ceebb918241b880c78b816366cda55c4229391be", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526484, "uuid": "3e7bbc73-722f-4896-b284-c227123efb52", "value": "T1AA5623725555396FCAA10735F00D3777BEBD8C63868881E9B8CCD18A73CA692853F4E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526484, "uuid": "5f32ed23-90b0-45f3-aca9-5c9c9c24826e", "value": "49152:svR6EgpYccnMlDpQGzg8DFXfBo0rSwXRnF1P7uCioSV2WxBXTbLNL4rnSrS+LebO:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526484, "uuid": "90f122d7-efba-47b2-8bbd-2b0b402c05d8", "value": 5965824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526484, "uuid": "eeb3b50c-53b1-498c-bf8b-43b515649760", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526484, "uuid": "e4e67d39-0c3b-4158-a7ce-22f26f2acaad", "value": "TMS84372HC31993912.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a61af2a-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502682, "uuid": "5f14c126-35e4-4350-bd05-0707418b3b4f", "comment": "Malware payload", "value": "44c7a685b3678f6fe57df6555b9f9bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502682, "uuid": "c981057c-581c-4aca-9b21-1376582b5b04", "comment": "Malware payload", "value": "3c7a508b73f361f93765781ca77c1ecd93c915ec56e6b23f215caf23e755eb90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502682, "uuid": "ac3d46e4-6ffa-48f6-b7a7-7c0a8c585208", "comment": "Malware payload", "value": "706aa9b0deac8013611af521d50e2bc6ef94034f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502682, "uuid": "a038d061-82d1-40c7-960c-5ca16b10fcb3", "comment": "Malware payload", "value": "9c077ba2dbf18de204e8eb32a13ddb230603f8c4167378e5e9b8918bbf71d0f10378ff7655c806eb67e500ff569b90d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502682, "uuid": "e5186867-956f-46af-93c1-f537d374f488", "value": "T148A318DC3A88C057CDA9C27C75FA89448570B5B5C222DB01BDCC699E9BE2BCD6510F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502682, "uuid": "46d63dc7-2c10-4275-b448-0e53839070ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502682, "uuid": "836c48fc-5d4d-46af-84f5-5c7468a80af6", "value": "768:KCnWZWFTwL7wuikjZOSAeX1HZLQ2WDhjEJbouI1XbYC1tkkW3PSmYpW8roxEWZcr:KOpwLXFXNqvhbYkWfFYtEEH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502682, "uuid": "09b912b8-c046-4143-88d8-bb08d5b6d507", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502682, "uuid": "ff418c38-bc1c-4197-8fb7-276d03ea33e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502682, "uuid": "6e3a3ab0-7f6d-4b61-9411-e5737ea1d8d7", "value": "44c7a685b3678f6fe57df6555b9f9bc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93eb62ec-bc0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542265, "uuid": "224ec337-d6ae-45cd-a27e-53e097015294", "comment": "Malware payload (Mirai)", "value": "2b4acb7dc319028c890c23b39ed707f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542265, "uuid": "2b6d9e01-f01e-4dab-b666-d12677246d4c", "comment": "Malware payload (Mirai)", "value": "3c97f7ca46519d6fe30ab23a301dec9a12211706589ad08b91cd9bc559e8efe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542265, "uuid": "ed4ad29a-8282-4b93-91cf-4b9b84fef207", "comment": "Malware payload (Mirai)", "value": "08449af84a4e890bf8c2cae2a58b2361cd834f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542265, "uuid": "cf59e3f6-0dba-4fa6-aab5-49db772d5a05", "comment": "Malware payload (Mirai)", "value": "f8eb953082e2621198fdfac8ea848f0b8fb6227d1e4900139405aa714e8456bc865af5b10a4a6c20a31a7272495fe8e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542265, "uuid": "ae2f613d-53fd-4821-87b8-543d16d3c2c6", "value": "T158A32C47F9928E12C5C212B9FA5E514D33136FB8E3EE3212CD24AF6123865DB0DBB516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542265, "uuid": "2e119883-a5a8-4e3d-aa7c-68ce1336069d", "value": "1536:1An+3IsJ0KO536EcFdtO909VSpW3lz7WaSp1SXzDgRiYm13eiC7SN5wYX02:/YylemSQVz7WaSbm13eiCGNiM02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542265, "uuid": "72ce0dd6-6b26-495c-b235-019d8ae59973", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542265, "uuid": "dd147fef-64d3-4da9-a3fe-a016aac505fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542265, "uuid": "8a4e21f4-9f85-4452-bf17-87a8b8c8b70f", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a426d098-bc0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762543581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543581, "uuid": "af4c941a-5209-4408-945a-28e0b6189bd9", "comment": "Malware payload (Mirai)", "value": "3134310a4e601e18356ece4dbf286a48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543581, "uuid": "65693984-b57b-422f-aa5d-8fc18140c5fe", "comment": "Malware payload (Mirai)", "value": "3e914dbdce770e72235fd258382b3acf428be78ba57a7f0f00786ff3ff7c36cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543581, "uuid": "00f4a04b-5f3d-48a4-afda-501da86fee34", "comment": "Malware payload (Mirai)", "value": "01621978617cb26361ff5cdc382a7ba887e0a1fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543581, "uuid": "a76b1d60-fe40-4c0e-ab09-08c33d14ec8d", "comment": "Malware payload (Mirai)", "value": "060d1f51ea25360aa8e75c6c30ce94d7ab37a49c675b53956fe3b05b85bb284e41603dac8010676d568cc504c5b821ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543581, "uuid": "4c400d6e-a200-4349-89aa-5704d3b20a08", "value": "T18F736CC5FA83D4F6E81205351277AB379AB3E53E2168CF83C379A676EC13502E91625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543581, "uuid": "18c44920-8171-424c-8354-c015aa354903", "value": "1536:+xWcbX4vYlTdOvtOOc4/72D2CYVNhXdCo0ZEa:+kckvmOvtOP4CDLMddna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762543581, "uuid": "8fe864e6-5eba-444c-90ad-4513cf7f3a21", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762543581, "uuid": "4d110c6c-32fc-4404-9b13-a59075bbac49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543581, "uuid": "78d74f82-4d33-47e5-b6f8-45708b2a14be", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5b63ac-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502717, "uuid": "3253585e-253c-4057-bc37-e813a1cbbe29", "comment": "Malware payload", "value": "4f5bc7e16a35a8897c955109376c5c16", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502717, "uuid": "5a789513-a225-4a66-857d-ca44ef9e91b8", "comment": "Malware payload", "value": "3e9a5320b9d24f1accf5254b5f27fc7340308a56006fed220fccf87db7ffa75e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502717, "uuid": "108e728c-310d-420a-a4ae-9e0741b62cc0", "comment": "Malware payload", "value": "4fa16f1ccd53ecd652c15da0fdce6a330b930b49", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502717, "uuid": "d2dc989e-7f2f-44be-877c-777fc107415e", "comment": "Malware payload", "value": "988b2f381f686c49f86609a90ab0fd37a64cf3abd76058e5d9b8128f95eb4f448a554c59ac82fa0378742348a6d6c1c5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502717, "uuid": "99a1caf7-5915-4847-a7a3-c13a7818d0b4", "value": "T13E841A40779EC52DE63988325B47EB903D6DED30670AF20732E7A92EB6F0D2618B50D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502717, "uuid": "0dfea9af-0fa7-4cd0-b5dd-8f276d5dba50", "value": "6144:UX+1yYPGH/84e1SdgbVIkGuDQMi2cS8ys:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502717, "uuid": "ef360a4a-cba8-4739-9d03-5b070cee0445", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502717, "uuid": "a2c5fd66-ba4f-4d7d-951a-edfc0ff05269", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502717, "uuid": "ed3fcac5-9fba-4a93-8025-85b8614c659d", "value": "Auditoria 20251030172946.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3084ebdc-bbdc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762521482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521482, "uuid": "5345e3c2-d647-432d-af45-b815e482cd84", "comment": "Malware payload (Grandoreiro)", "value": "2e5081d52e8227b3d3aa84fba55f8059", "object_relation": "md5", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521482, "uuid": "617d42a3-66d3-4eae-b1c8-d57627db3918", "comment": "Malware payload (Grandoreiro)", "value": "4167122e423f5bf3f3db14990e4d1a53864af96bcedd51e08c2e21c8dc4d653c", "object_relation": "sha256", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521482, "uuid": "a9a84535-4c89-4344-8faf-d8a57e36fa6e", "comment": "Malware payload (Grandoreiro)", "value": "9d0ac66475cb2004da01c7e2a0dbbe3a6942fd68", "object_relation": "sha1", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521482, "uuid": "81f19932-5bee-4a88-afb4-346d8a8a1ffa", "comment": "Malware payload (Grandoreiro)", "value": "a13d0aacadb1cb8cc5d989ae9d2b4f7233ef873b5c2cee3998b6ae77ed309b39de8d54738187f0678d1fd6bdd5625780", "object_relation": "sha3-384", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521482, "uuid": "c69a6c20-a5d6-400c-b850-90ea114117df", "value": "T1F3A6AF12B68C903AE16F06325D3BF719743E7EE11B258CDB63E4A88C4E355C16A36B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521482, "uuid": "c8fea017-913c-4d7b-a663-77f2841d6ae1", "value": "98304:hUJf+MdWKattS9Ibmu//ShjV2IMWIqr8fIC2H1Sv8M:hUJf+oW+ID/gV2cqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762521482, "uuid": "772b8c56-bc69-49c6-bb45-e78f12dfdde0", "value": 9763328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762521482, "uuid": "09098a9f-abf3-4480-8295-abc8b117a68e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521482, "uuid": "1c4741fc-7827-42b4-a5e8-d094ecf79006", "value": "4167122e423f5bf3f3db14990e4d1a53864af96bcedd51e08c2e21c8dc4d653c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe94ba4-bc14-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762545741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545741, "uuid": "9b7f72e0-8260-477b-8fb8-4acd07119569", "comment": "Malware payload", "value": "ee648192370dacdf2a1e9fe7deac95d1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545741, "uuid": "6be7f687-91ca-492a-b04c-d1e5abcdc769", "comment": "Malware payload", "value": "4193bd8b3cc174d26468d7e725822a0873e47c4ce63f6a73856ff04459963d41", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545741, "uuid": "49cc5a3e-2cc3-40d5-bf15-8e7786aa5dc7", "comment": "Malware payload", "value": "94318d6eda5ae139822a7872710b1fac2ee05f1d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762545741, "uuid": "7e3f675a-aa8f-4231-bc0a-414184230a2c", "comment": "Malware payload", "value": "5db449b42a9d5ed0a90173858797932e53ad32484cf283a92e7745bc60df9a84120e0f7ce40e65eb6fd772b644b7449a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545741, "uuid": "a62c8783-c827-440c-a172-061ec6e6fc6b", "value": "T1F70422E71D06435A8D71C0BE07F539FDB9CDB6826632FA93227468613180AFDF529C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545741, "uuid": "c89f7443-5833-4b97-a492-2a773cea6564", "value": "3072:x8R+/4bOCvWYnnlgVh35nwEmZ6CKcwpeMQ+hv0VbDKIAN10h8LMpiOfG:xhIxgpVmMCKJpe1+hv0VaIQ1U8LiJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762545741, "uuid": "fe6e6207-37da-444d-b218-a5c927a62372", "value": 175079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762545741, "uuid": "49126737-832a-486f-91fd-03456df60ecc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762545741, "uuid": "b3aedde7-94ac-4d32-a5d2-03a4f665e73d", "value": "XX\uc740\ud589 \uc1a1\uae08 \ubc0f \uac70\ub798\ub0b4\uc5ed \uad00\ub828 \ud655\uc778\uc790\ub8cc \uc81c\ucd9c \uc11c\ub958.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68319ed9-bbd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (SimpleHelp)", "timestamp": 1762518569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518569, "uuid": "576ac365-a0cd-4988-9b01-8dc7d5b12734", "comment": "Malware payload (SimpleHelp)", "value": "52cbe69d2d13a467a3331e6521095ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518569, "uuid": "63ea9c41-6360-47a6-b802-a5ac76235feb", "comment": "Malware payload (SimpleHelp)", "value": "422209eb15277197588269c31e403cfd14c141abd525c212d65fcf4fb46c3f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518569, "uuid": "94bca578-c25b-49a6-bd5d-e65ecab65a33", "comment": "Malware payload (SimpleHelp)", "value": "27f1f2697611296abc414c515449dfdfb3861617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518569, "uuid": "05822f4a-513d-46f9-9b27-5ec1136d093b", "comment": "Malware payload (SimpleHelp)", "value": "913f7ead90fd076df29e8308c54558c135d4f1bb0856ae54f3a758153c6ba769b0f30b08b6f470904f4f5c50afa30e8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518569, "uuid": "2bae844e-b667-457b-994a-705361e38993", "value": "T110973324FA9259BDDE2399BCD85A8087FB59EDD30389211727F049D78E202C0952EF7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518569, "uuid": "305a83f7-ae7b-4fcf-9782-b6db89beb38f", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518569, "uuid": "5d4f7201-4d18-44cd-9421-de104a707d6a", "value": "786432:8tGOTXLwnQ6t21uSmtrYCViSVVOd/OdBt9D7aR65lIBE7ZVWhro/fraaXCT:8T7gvFLiSVVO6l7M8aE1VWhroHFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762518569, "uuid": "e6ef6c80-64e5-4276-b4fc-f55eec2fc0ef", "value": 40678128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762518569, "uuid": "07a741fa-ba02-4567-9d2c-eaf508840412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518569, "uuid": "db05b34b-ade3-437e-be62-0f4355c5cac5", "value": "ZoomWorkspace.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87de0547-bc1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762550405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550405, "uuid": "b0222a85-63ce-40d0-9831-24cb94304144", "comment": "Malware payload (QuasarRAT)", "value": "0798b60c7560866da1dc004c9433a403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550405, "uuid": "2434d8af-205b-4874-8c18-5232b0aff9af", "comment": "Malware payload (QuasarRAT)", "value": "459911f0b95584e0741a32a4e9a66916b827e831a9f21a1c3f88dd743155c95c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550405, "uuid": "a912640b-e9e0-45cc-946d-a42683bed284", "comment": "Malware payload (QuasarRAT)", "value": "f6c5820e9730a3728c79bf5c57d1c642d7f84fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762550405, "uuid": "86a66a32-8961-490e-a128-54ed37a61bbb", "comment": "Malware payload (QuasarRAT)", "value": "ae15c024494b00830845c2633dee2c4eaa97d13030b7637f3819e01ae84486ff026586e80acbd85e5b194415b84edbc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550405, "uuid": "d408a06a-ba23-45f5-8471-aa269570bbfe", "value": "T1CBE54A0577F85E62E16BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550405, "uuid": "db074cf7-7ce3-4c2c-845a-d34e3ccc63e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550405, "uuid": "f219ae01-fd15-46cf-b502-2cbcd65373c0", "value": "49152:+vpt62XlaSFNWPjljiFa2RoUYIJMimCmzoOoGdEupwTHHB72eh2NT:+vj62XlaSFNWPjljiFXRoUYI+imX0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762550405, "uuid": "3f57615a-1cd9-4b94-9f08-e52a3ebea81e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762550405, "uuid": "37f6f3ef-2807-4ba4-aa38-9ed4ff701900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762550405, "uuid": "8a4d4eaa-abb5-49d9-985f-532175e4efab", "value": "0798b60c7560866da1dc004c9433a403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a646a34-bc0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762543403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543403, "uuid": "af2e0b1c-09ab-4386-967b-6d97dfd77bfa", "comment": "Malware payload (Mirai)", "value": "fdf750eb979c048cbedc2cf5ab7740c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543403, "uuid": "2e979f87-30a8-48fe-9cc9-75aeb9d253d7", "comment": "Malware payload (Mirai)", "value": "45df2f4f4e7f20ada0fdc0fb7e91c81abd69186fe85faf65c181025968a7d0a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543403, "uuid": "98ee85a9-6b66-4afe-96dc-2c50a030a2dc", "comment": "Malware payload (Mirai)", "value": "57e4223fa71cb644b204e30f32f65eeb57805faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543403, "uuid": "b817a7ae-0db4-4ade-99f3-d1bdb396eff6", "comment": "Malware payload (Mirai)", "value": "771605745c69ecfd252d57f7bc4c21eeff04063a11e9ecdd41372d82bf3f4f5253b5e2d06380ea91b65a69328f4bd831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543403, "uuid": "7a620d22-93c5-497a-914b-5667864293d7", "value": "T15C833AC1FE8BC1F5E91B88304076F23FCA32E96950B2875DDF5AAF36DA335415212299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543403, "uuid": "25914000-776a-410a-b8f8-ee6ed0e55198", "value": "1536:KKz1LffGPJL/HcR9qkEyQbW4cjJTaoLEAQkfsaLO:KKRGJjH9kEMRjJTaYE2LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762543403, "uuid": "aa772b6d-97d7-4290-bd32-978fc4032464", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762543403, "uuid": "24c08d46-cbcc-4e89-80fa-128076de829f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543403, "uuid": "a19ddb50-161a-40c0-8fad-1de9dd539804", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9eb867-bbfc-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762535222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535222, "uuid": "2255a2bd-dd77-416a-894b-c047c9d6f4af", "comment": "Malware payload (AgentTesla)", "value": "5b275b5d1dd14d83b4db7b16f831930a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535222, "uuid": "fe4495bc-60c5-41c0-8f61-d6823c687cef", "comment": "Malware payload (AgentTesla)", "value": "45f1f0c4c76cee479f0bb2966f4d9c157e344f9749cdfeb5e4b396aa3285c18d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535222, "uuid": "687de8b3-f42f-4420-b60a-50c9589d6622", "comment": "Malware payload (AgentTesla)", "value": "c587708549df7ea218ff99fadaf1200b3c57d978", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535222, "uuid": "343216c8-e575-4592-8c32-df53569fb305", "comment": "Malware payload (AgentTesla)", "value": "056d5717641807894aae8bfbcf883e862d81cb710307a2e24906cfa6ca60efd1b7cee5d611918aa3fb1a739df2f4144f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535222, "uuid": "42b65d97-222f-4a52-9349-9260da68f1ba", "value": "T16DF4F19C3650B59FC857C97389A0ED74A6203CAA970BC24391D75EAFB80DA978F141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535222, "uuid": "2b32d52a-ceed-48fb-9953-7a4e580929ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535222, "uuid": "f8ea9b69-c2ba-4c96-98db-55099debf1e3", "value": "12288:BVxmscrKHLgT+Cjn5xGG4Kcy7CuyY5oVbqmlKHGngd5qtFlB7KKMhJGdSlGd4eR2:ldcmLSH8y7oYyVGmX+5+Dt+mkS4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535222, "uuid": "8654d7f9-e5ff-4a3e-acc4-69df6b5a01b3", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535222, "uuid": "36a9169d-736c-4b08-958f-2c511faa6cca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535222, "uuid": "1d255889-8378-4b75-a875-5690baad24b8", "value": "PO82200287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a2cdc6-bba0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762495886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495886, "uuid": "3db1dae1-9f12-49dd-8066-ca91192859cb", "comment": "Malware payload (Mirai)", "value": "5be6b2dfd234162d60964c4104fb564a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495886, "uuid": "4cd7bb27-11db-46d0-a060-ae87270b90fe", "comment": "Malware payload (Mirai)", "value": "46b4c6c170f1adb4b5e31632a51afe697a2897378396fd16d8e0c99a0ec1fd13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495886, "uuid": "a9b0d32e-251f-423c-90bd-fb82a86d851b", "comment": "Malware payload (Mirai)", "value": "b7bcaac1e524a7e92a2b295c59749f2a9763db4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495886, "uuid": "c304c8e5-0df7-4d6c-be2f-3c19ee1bd2b4", "comment": "Malware payload (Mirai)", "value": "1191d200db84095f928eca930a3a421ab3fe06668950c433295169c394b308adb167da45ff7f9ba9bbcbd0cecb841594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495886, "uuid": "23a1da64-0805-4d1e-a6cd-4a902da3460b", "value": "T11E833A56FD814B12D5C011BAFA1D114E73231BBCE3EE72668E24AB31638B56B0E3F505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495886, "uuid": "3ac3fa78-7569-43e5-bda5-e4e0214cf236", "value": "1536:WDnUuGOuwcogDK+yuUQQ2xm0aLV4yQZM6iasa0GrCo7y15fYcMrema+:rudQVDfy92xm0aLQsa0GrCoO1Zzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762495886, "uuid": "36d09ca7-1552-4a55-a0df-c99e145da6fb", "value": 84088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762495886, "uuid": "8182e6df-92b2-4825-bb5f-b030877a069d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495886, "uuid": "125592bf-fef5-4624-b520-1ed38a0806d3", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba72777-bbd9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762520374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520374, "uuid": "f1aa437b-7af3-463c-829c-5279bdaf2d20", "comment": "Malware payload", "value": "985239a7dff8f5ada47c59988bb036f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520374, "uuid": "d91afb12-baf9-4b9f-856e-5ade391b0c0c", "comment": "Malware payload", "value": "477963a4547ba7635d5edd19dfa4f492504c80d75cfab54b7bbf77203256a553", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520374, "uuid": "4079f836-7b3e-4571-b49f-ffe0ea6fd186", "comment": "Malware payload", "value": "6656a4b91501912ee11016d5f74638e2b41dd363", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520374, "uuid": "addef27b-89f0-4c32-9711-365eca2e6a76", "comment": "Malware payload", "value": "2ef1719380d86101479ba63eef57a77e767e6e8339e0d44f4577faa790a7d7b3cad9d5a507a7222b67c5d1bfbdda1d43", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520374, "uuid": "d3418fa5-60d9-456d-8a84-adc2102602df", "value": "T1F3D46A8EB57B0CEAC6DF95FB80368255F10368D07141862AE7AE4027DD872D29F95B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520374, "uuid": "13df1a39-8bdb-4b76-91ce-2b125cca6ae0", "value": "99660705ddfa2fb658dde087921ec28e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520374, "uuid": "8857a99a-67da-4dee-b3d3-f408b00dd09a", "value": "12288:scYgl8F20ivjFVCOMg/taoT0JFGjRNFLPKQjNPSl3IH:Ggl8FFmjFVKyLT0J+RNFbKsNPKIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762520374, "uuid": "bfc2c804-001c-490f-ad43-521c4bff7feb", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762520374, "uuid": "55d6bc56-c8d8-444b-b1bb-55bf5ef9362c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520374, "uuid": "e56dc7b6-84c4-454a-9e35-ab5045708051", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0654ec-bb77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762478285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478285, "uuid": "761d250a-2ba0-41af-aae7-bebcfc57ce44", "comment": "Malware payload", "value": "bf9d73466dfdc51cf10ecac155fd2423", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478285, "uuid": "0a2a2999-b691-4da6-a368-efed688e35ec", "comment": "Malware payload", "value": "47c3a31ab04b76ddbaef87cc0447fdddf6c15aa5159eb4d41b064d73988488c3", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478285, "uuid": "34100c2e-c40e-438f-9e09-713539f66f68", "comment": "Malware payload", "value": "364596cda2e822b37e45955ae4c002edb629643d", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478285, "uuid": "9fd01658-7d98-4c59-9227-b578491655a2", "comment": "Malware payload", "value": "1a167913362425828135ed30df0d07f46be4074b77c84ce18f6b6a92b684eb34052811b0d1ed5eff8bb35d20135687be", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478285, "uuid": "994f8db2-4b91-4577-b3ae-83f685a43ea6", "value": "T123444B4977A400B8E867923CCDA39A86E6B27856077157CF036443BE5F377E09A3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478285, "uuid": "e9542b92-9041-442e-ab4a-00037079239f", "value": "5bc0b70caf749d10ae7da841cddb62da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478285, "uuid": "524d1c46-1ccd-469b-9dac-1470690e36c9", "value": "6144:8RT0hlXUHzPFOA8c28cd+TUF2W4HuTxm+EiLCyyw:8W3WFP2mHWm+XCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762478285, "uuid": "a05ea48e-8df6-43fd-8064-602bf4112a95", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762478285, "uuid": "9e9a030f-6e3f-41bf-b083-70cc4cd4ac2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478285, "uuid": "8f4bed6f-f792-4dfd-9c8b-87778b60ce49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefc57ee-bc05-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762539411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539411, "uuid": "be1e0cff-9a31-4328-88fb-447506de7234", "comment": "Malware payload", "value": "8e130c2604516ccd4bcba72cc6549649", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539411, "uuid": "c97c3461-8ec1-4df8-a92c-2bfe9cad867c", "comment": "Malware payload", "value": "495cb43f3c2e3abd298a3282b1cc5da4d6c0d84b73bd3efcc44173cca950273c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539411, "uuid": "0cb6b0fc-d75e-44a0-b1c4-3dc49f819f2a", "comment": "Malware payload", "value": "d70bad36a4060f93a3c5c9092bbf299c463a1451", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539411, "uuid": "bf258290-cee8-4c70-89e9-2c99a9248aad", "comment": "Malware payload", "value": "801afaa48f46972c05d4e173926e50e71a60a16d2289e6c8c680723abfe0e02967cf2e711a9d4b2072e823acffc5f535", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539411, "uuid": "22d05d8c-e759-42cd-91a7-5d0324f049b3", "value": "T107A4239724731167FEB1FCA77CCC5A210FF484E973AE196B022AE85C45076A786CB05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539411, "uuid": "34433ec9-39bc-41f1-9ded-9ca7c5dce400", "value": "12288:i1x8DZXQN+IcPgrX5uSWEsmhKgHnqDSgz6Bnas:i1xMrIcPglRXagHqD6BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762539411, "uuid": "045af6ab-f74d-497a-b122-619b8ca0c874", "value": 459842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762539411, "uuid": "8bc95cd9-e799-4cae-856c-d75e74687644", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539411, "uuid": "ff5305ca-3d3a-4d8b-9a1e-9ea119ef717c", "value": "PCG_124th_Anniversary_Event_Documents_Office_of_the_President_23102025-Archive.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae42401f-bb81-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762482609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482609, "uuid": "2e32f964-6169-452b-9473-95956cb3f626", "comment": "Malware payload (ValleyRAT)", "value": "64323da0889df17fbd61728dadaedfb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482609, "uuid": "e2104c7e-7a9b-4864-a26a-2fb04e981673", "comment": "Malware payload (ValleyRAT)", "value": "499ed1dfdb2b51f3e1bc8859dbd64c3e15b6f61d1a8fa5b644968514bf7e064a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482609, "uuid": "e02fcb58-99d5-4d99-a121-0684a8fe4889", "comment": "Malware payload (ValleyRAT)", "value": "9b2f1de35d2d2bf3050696b63472087b7d338395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482609, "uuid": "c32fd05c-2283-493d-8beb-2b3f441a362e", "comment": "Malware payload (ValleyRAT)", "value": "aefbd2d7561f88ec70bd615f61696c33873d23a6b10e7418c98f59e2f9080a81f73495289d4f728ab7d1974d5f8a153d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482609, "uuid": "a0cf3a22-6fbc-4d78-b4e8-ce8cc32eaebe", "value": "T14F553A8B7CC115B9D0BA923188A612417B21FC661F3663D72B61B6F82F77BD44E35328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482609, "uuid": "5be826a9-8061-4295-8ded-4eb5c0d54b14", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482609, "uuid": "6a764c96-522d-4c8f-ac98-41797b896a08", "value": "24576:nYAYseTloTIaR16OEMd2AJmCnU6vQPWW3/vTYgFRj4C1:nYdZoZR16FMdYCnfQPl3jYgF14C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762482609, "uuid": "a88c3936-06e8-47f6-bada-50c9858bf262", "value": 1378816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762482609, "uuid": "555bbf4b-f22f-49df-b982-1c6e4cf2583a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482609, "uuid": "0be36fb9-9eb3-4dd8-8f3e-4c2e7c0c78e5", "value": "499ed1dfdb2b51f3e1bc8859dbd64c3e15b6f61d1a8fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d4005c-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1762502531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502531, "uuid": "40b79b94-cb61-458e-9535-61c8d21f9c45", "comment": "Malware payload (CaminhoLoader)", "value": "66fbee1d00125ffb3c43adf37edf003b", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502531, "uuid": "74ad9347-5867-4b67-8a42-30b2c5410db1", "comment": "Malware payload (CaminhoLoader)", "value": "49d5775abe05b6be2c9caf1f3d750ba95624ddebe5fcab939f3be1e8c44c840a", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502531, "uuid": "b281add6-2154-4940-b131-7f0ae382d7b3", "comment": "Malware payload (CaminhoLoader)", "value": "49b1b5dfc0487e4227a4851760ffc00f1e83ea27", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502531, "uuid": "e3347687-276a-4836-87f4-1f86c97f6a65", "comment": "Malware payload (CaminhoLoader)", "value": "0f83e5286c6d1a1addcb5fe6d24b829be47ff8b90ed8d288c2b20fb0d60d07a71954d01d703ba32f463089d801bf5158", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502531, "uuid": "0c389eba-e4c1-4f8e-98b5-f1d6b271adde", "value": "T1865602A1E6A51BE2B4D802C1CED477A6FE6556CA1A434DED371870D8CFD03364112EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502531, "uuid": "3c48afd7-e072-435f-958c-de450485ebe5", "value": "384:YdNH5mAQOnt0R2GpW3CsrHZIuCHYIRacAjZXQn4:xAdQn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502531, "uuid": "7b6e1dba-435b-4c2f-abb5-ef313b700815", "value": 6091616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502531, "uuid": "6122760a-559d-471f-9d10-42c83105a65b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502531, "uuid": "1cd7e6de-b3ad-4196-88a5-ab8bd46f8b59", "value": "Booking_Reservation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94db4eb-bbaf-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762502385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502385, "uuid": "26fee31d-65f4-42bc-aa95-7ce56100ee48", "comment": "Malware payload (XWorm)", "value": "8c1ae52338302b6534afa05620273a5a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502385, "uuid": "cd2269f7-d768-464b-bbe9-3e938507002c", "comment": "Malware payload (XWorm)", "value": "4a0f0b6e12654bbefd272ab747cefad3275156f6b0db9e8dd30b63880e858659", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502385, "uuid": "7a9e0c37-6c2f-48b9-bf4d-5b478ba932a3", "comment": "Malware payload (XWorm)", "value": "7534e0f45452f9dc8956fa3dee4f500b68a9d54f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502385, "uuid": "ccff6d4b-1edf-4601-a2c5-67c5e0d1559a", "comment": "Malware payload (XWorm)", "value": "2c77ef7be9f2e6577c16f9445b3d0615e3ea1ea529467f0703262db5743c8640be51375af481046beebc2b8ddeca826c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502385, "uuid": "9fc44a08-47b5-4595-8941-f6efbd62de67", "value": "T17122FC41EE04635AF467D50B42739A261BCCC6F702C48D9936F8938FE915EFAE872C51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502385, "uuid": "ae9e3674-e18e-42a5-8140-cd69860707a1", "value": "192:Du8j1I7HNQs0AsHSppMSppMSppMSppMSppMSppMSppMSppMSppMSppMSppMSppMI:D/j1I7HNQ3Asypp3pp3pp3pp3pp3pp3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502385, "uuid": "bc406221-161d-459a-9cc5-62d47b8e6d5d", "value": 10721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502385, "uuid": "8eb11d77-ad73-4c31-beb1-06e3a4885d69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502385, "uuid": "84abf529-c780-41b6-a2e8-b127af39e4e9", "value": "Zapytanie_ofertowe_OMEGA_Sp. z o.o. _82100982.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596d6323-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556340, "uuid": "ea407222-44fe-4afc-b226-78ecbdf68529", "comment": "Malware payload (Mirai)", "value": "39d2d7a7c43959eba9a5c2c4dbce7c2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556340, "uuid": "36ca20a6-856d-4144-8260-26bba66b8565", "comment": "Malware payload (Mirai)", "value": "4a1e3149d4e7ca4497c06412938380a195fdb03212a426e146b2622857e9b8b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556340, "uuid": "acd52c2e-0146-4f45-b2d3-c247fe6cc31a", "comment": "Malware payload (Mirai)", "value": "6dfbcd08d2a9b9e5960b57167fb32dd374378821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556340, "uuid": "2d41f822-ae24-4857-9c74-983fc946bc01", "comment": "Malware payload (Mirai)", "value": "7bd991ee12997a9db0a5ec12c2e09b46528f68813605a0f782740472666f7bc0985289de3e70bfb8a8f84b240cca92d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556340, "uuid": "3d1ac1cf-4132-4b0a-8875-9883e8a8547f", "value": "T1D7043C56E6818B07C0D2277AFADF42463323AB64D3DB33069524ABF43F867AD4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556340, "uuid": "9631e5a2-2eda-4cb4-8044-7ed358d1ecce", "value": "3072:UmuWAtstqa9IhI/rT1xWWhSzBQgboNTlMKdu+a4/VM/9Q9cmuw41Hx6iC:nVqa9KI/rT1xNhSboNTl17a49M/9Q9c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556340, "uuid": "12177c68-6962-4e34-933a-d8c595497049", "value": 180497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556340, "uuid": "e08c3ece-048e-4db1-8016-8df026b722e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556340, "uuid": "583c4fc9-bdd7-4376-8707-8d74e6075821", "value": "kvariant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9150215d-bc31-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762558152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558152, "uuid": "4d087e9c-ae10-4b76-87b9-535af3c50982", "comment": "Malware payload (Mirai)", "value": "bd54736fce8818df6f75f03c9ed3d6fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558152, "uuid": "b4c299e9-eb1c-4d80-9e2f-ccb586f03f28", "comment": "Malware payload (Mirai)", "value": "4a46d888f109367df04fe843ff8c76a5bf46499f2a0e8aeaa080ad3e7f37a3f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558152, "uuid": "993c4891-9f47-42ac-ae09-5c109d473e15", "comment": "Malware payload (Mirai)", "value": "3b737b654d9a1dc1ce7e9fcdc0e5f67cfd17acc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558152, "uuid": "d37637ba-0c12-4341-b3a2-9d944929d92b", "comment": "Malware payload (Mirai)", "value": "1663e20d843d5bebd59c50a77ca4dc06a662457a6a53fe450e92e58448df8a108e8ed8649e6f82c48efa5697381581fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558152, "uuid": "02b41e46-d742-4df0-99dd-5aa157916632", "value": "T1D813F13580A61DB0C1142AF1E76C44D4229912FCB6EFC1F72FF285143EB667931EA45E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558152, "uuid": "0a09036d-656b-43d6-8cfb-955f24a5f602", "value": "768:SIwnj82JCAzMR7fEL3tqKBiecFYPaNPZhboUAXYth3388baLK8hhpEy6Oecwr91U:0g2FMdcL/X2TPPbouzaLjhhpx2raLlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762558152, "uuid": "532218a5-c89f-445b-a23c-6560e50e7100", "value": 42980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762558152, "uuid": "6128f6f8-9b3e-49a6-bbcb-5d5bff820605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558152, "uuid": "4cf94d67-0983-4564-825d-3875af8e5cf0", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c896c7-bb9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762495258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495258, "uuid": "b2345426-3116-4d3d-8040-615a21167923", "comment": "Malware payload (Mirai)", "value": "8eed3c792c65e75e0495b324d09d0196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495258, "uuid": "1bdaf6e9-67a7-4080-be65-1e6402f04087", "comment": "Malware payload (Mirai)", "value": "4ae493be7d19ecfa2400ae75d1d7c6ccad2168c932d3fbc5cc537c2aa827ee97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495258, "uuid": "a17636b9-d5a9-4c2d-b694-96fdf3e81d42", "comment": "Malware payload (Mirai)", "value": "c8a73d908639ac7f3fd2b40c4b1de46288acbc58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495258, "uuid": "7cb65491-d829-4480-84f5-4a5e8a3abc98", "comment": "Malware payload (Mirai)", "value": "7dff8a0b7d567bcfaa9ca5c2249286e9c91583c3995268263a0e9f59d02a7d88c651a8c2fb6136ca87ccb81370138994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495258, "uuid": "075c5042-bf6c-4fa9-bb10-378a30a1d310", "value": "T11B931941BD829F13C5C622B6F7AE018D37127BA9D2EB3203DD25BFA133865DA0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495258, "uuid": "64016103-885c-48e6-bd47-7e8880a8f469", "value": "1536:0nsy0CcLK5Opx2TkjZzKlJQiiCv+KZYKQTEviFv:0nn0q58kTEOXQihVniFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762495258, "uuid": "4b3cf278-9317-40aa-b23d-60b744252f97", "value": 90660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762495258, "uuid": "f9fbd97f-0062-4b2b-973f-af7414967175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495258, "uuid": "5670f33b-9a6d-4beb-94d3-aac079e21eff", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc6dcce-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526367, "uuid": "09cc3427-cb3e-4cec-9d4e-f32a9f91fe83", "comment": "Malware payload (Grandoreiro)", "value": "a51159fe48d087ec50e99e3de152c61e", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526367, "uuid": "dc2680d7-d2df-4829-8fb5-3f29e2df7a27", "comment": "Malware payload (Grandoreiro)", "value": "4b89e2ec51afe2d5df6e42b68bce7ee29804b8efc6d65a694c31ca112c7f6cd2", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526367, "uuid": "ff5c4c48-3530-4fb4-85c5-483144e6112a", "comment": "Malware payload (Grandoreiro)", "value": "2bd17f5d097f8afcba21ed4b2d935fb3b76f76f0", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526367, "uuid": "1dd1dc03-ecae-4785-a792-0c1be5495179", "comment": "Malware payload (Grandoreiro)", "value": "dcf092356998a2c40908514e7e1df22802652d4f8c2058db87840e0af72967b56f76ba6a07f3e6ba202d59f60d275f5e", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526367, "uuid": "934ee4e8-e00e-48cf-90b8-3c808bec6e77", "value": "T1BD462371A6542927C6B10B36F04E3763AD3ED853868C51E6B88CF14A37DE6E1816F8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526367, "uuid": "0d31bf5b-b676-4611-8e05-e3ff951690ce", "value": "49152:CjNu0d38fgCoVVst8DLcTOkhG9jPFB1z1GUHMFMfVrBbGZWt3g95c5Ao70nT7:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526367, "uuid": "b5ed7d3e-33e3-4b5b-b901-0d4e44190ff3", "value": 5613568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526367, "uuid": "03088547-9e61-41e8-8c31-3609785e7151", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526367, "uuid": "7f55b684-19ba-4f78-a1e6-880556607889", "value": "TMS8218499LQ505002.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944571d5-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526374, "uuid": "fec1bbd5-44ae-4a70-ab8d-55509ad42920", "comment": "Malware payload (Grandoreiro)", "value": "f7490a253781f43e0600335acf4eb1b9", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526374, "uuid": "2cc44013-186f-424d-b6e6-f6c85ec438f3", "comment": "Malware payload (Grandoreiro)", "value": "4b9ac0adb84a69a914238a905815b593ad295eaf8d112802b8c1c61894444da2", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526374, "uuid": "a6a9e592-ecb0-4826-81bb-b400a0c4a4bc", "comment": "Malware payload (Grandoreiro)", "value": "6ef3609e132759364c42cdedaa37a8ac35cd84a2", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526374, "uuid": "f6b38d56-eae7-4454-b608-9e7251bd24c5", "comment": "Malware payload (Grandoreiro)", "value": "56fb37c86e620f37a191be2c51026dcc10463e9c4a99f90c6144e55ec7c9065c1d96543c2f0be53341b9e963ccc179f8", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526374, "uuid": "6bc777dd-0dc6-4028-9643-76d6cad1c4ae", "value": "T1C6462372A6A43437C5B10F35B04E3372BE7E9867890D92E5F8CC914D77DE2C5892E4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526374, "uuid": "74159339-8be9-4cec-8fa7-bbe87af8f1fb", "value": "49152:h+ZkZjZiGivxwYblTRW1pxsuDfYLBbSbT65Zmqwfjji5rkpXBOmwrEa10GurHL8Q:kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526374, "uuid": "c8f60ae7-ab43-429f-b46b-c5ed2408736e", "value": 5603328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526374, "uuid": "e3315c7a-6899-4ecb-b523-eb4df73be425", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526374, "uuid": "d28e645e-c774-461b-babb-2d82c67be9d5", "value": "TMS62490NN6545127.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832f02ba-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556410, "uuid": "8b20de95-5b81-4d6c-8b47-9abcca7c4a8b", "comment": "Malware payload (Mirai)", "value": "89e543620b1b2d75d46c24b3bfc8ed80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556410, "uuid": "36ead426-8adf-4d34-805f-40e54d17969b", "comment": "Malware payload (Mirai)", "value": "4bce1b87b6a2a6343b264652842ee1293512cee34df1d23091f5aa60442f057d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556410, "uuid": "f04d76da-96f2-4827-bcf9-6ff6e74cb593", "comment": "Malware payload (Mirai)", "value": "8e4a60a3dfda36d35f37d62a6295dc8b33eb8808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556410, "uuid": "e42d8303-cfff-43f6-8349-dfa30e8c98c7", "comment": "Malware payload (Mirai)", "value": "3718b75fccc71413940e856884014eaa9f6308ed1c1c115745eba4aac3992e646cb5eb02b08a581e86197abac322b189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556410, "uuid": "c7655fb2-c185-49b5-af6e-0f65a799a9a0", "value": "T1469328CAB400DC7DF81FDABB4463490AB931E3515A931B277767BD93AC321A44867E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556410, "uuid": "6985db7a-9e86-4300-974a-c8589dc5f9ad", "value": "1536:c8fF4Jus6GxrbZn/RZiAI00D4H05Oc3JmWYHa8Y6IXFVPQ8IQv6OHbEiYAT5vCHl:cBrdnXcHM68hIXFtpSTifTN+l0fAraZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556410, "uuid": "d0351b06-3cdb-4a37-8192-ec925feb5f60", "value": 91724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556410, "uuid": "1411268b-e457-4bce-97e4-281cc1b6c53c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556410, "uuid": "630c5309-ada4-4fb6-b375-fde92c782553", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14051304-bb6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762474620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474620, "uuid": "1434f11d-dca4-4772-a5af-56bb7065969c", "comment": "Malware payload (Mirai)", "value": "66a2640768f2d2b3d161ad70b6e118bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474620, "uuid": "57fd950a-0e56-4858-8aad-a80478e27021", "comment": "Malware payload (Mirai)", "value": "4cc6de05809879891b55c42e41af9c310cd4fe63915161bd5f564d12eb56b8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474620, "uuid": "76d3bc35-f7ec-4826-8964-a4da8d2e0b64", "comment": "Malware payload (Mirai)", "value": "970039ece618e997ab99b0659835367dace9e43a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474620, "uuid": "44b2e6ec-ca27-48ce-9e1b-2b7934369409", "comment": "Malware payload (Mirai)", "value": "fd41f3864ac7392c2a22c910c80d44fa3e40cc152f7f8bb78b1f3f5a07a7ecc7c3d99110d62a23f184afa999c8f73074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474620, "uuid": "5c4b21c8-9d8e-4018-8ba9-00b49df5a284", "value": "T18E23F19C1D96E6A0D359543B8A24944F485F9AF2F30A6016B3F787120F8B9773BBE04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474620, "uuid": "ab219a2c-5364-4866-8e56-e10096984bb3", "value": "768:uNON9EfSfxb1B1opfe1FMV0fGB20eH3HRwrSB5s2GbYhMHfAFDGgmuAauZpW9q31:mONEKx3wfMMS+B2jxwb2SYhmfUCgrApX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762474620, "uuid": "b9e6579d-66be-44ad-a58f-b84aa27155b9", "value": 47936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762474620, "uuid": "b0002c68-ae57-41d9-9179-f589e091f2fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474620, "uuid": "f6295197-1524-41e7-9ae7-db5df9cbeb47", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5937339-bc0e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762543234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543234, "uuid": "ca804ddf-497c-4846-ba8d-2ece08e22990", "comment": "Malware payload", "value": "2d3793bf30555c4d589cf234469fe5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543234, "uuid": "6964770f-feed-428b-8359-71af9ba77392", "comment": "Malware payload", "value": "4ccf898cc525b1110389480b45bfe09b73f899e35289d279411bc238ced32fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543234, "uuid": "5a44d896-aa5a-47a0-900d-2b726209b68d", "comment": "Malware payload", "value": "88cd1dae2af77eaa4378a9e85e19c5f9a962a465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543234, "uuid": "6c9451ef-bee6-4f23-87a2-5e6e8a9057d6", "comment": "Malware payload", "value": "93891ef6ecb0abf6b1304a011a46ae16b2baef644a4d21bb65b0b24709c1b6326dbe1a81aadd845f374e4f1aada9cc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543234, "uuid": "0f37ba07-74c0-482f-8452-4c8299e57ec3", "value": "T1137633E4D9002809D7755D7DE6015BFDC4689E3A4EC53888C3BECF1B69F8E851372A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543234, "uuid": "310fa644-4428-4696-a8c2-07a88524afeb", "value": "1121df302ff393c414fe24822a6585c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543234, "uuid": "2411966b-0872-4d0c-abcf-4db55b72676a", "value": "98304:aWMtV2BG8JNl6TvpsOK5bS7bLUivhlT+ulUsdzh2kKLnGtw2hqRo4vO3quTn9qm1:aBODK4JS702F+ueLGXvZ3s2BqJO+Qmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762543234, "uuid": "a57100d6-b39c-40c8-a702-d9a5b7641347", "value": 7256424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762543234, "uuid": "e32af302-6cbc-4338-9aaf-2b95ed13b2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543234, "uuid": "92e321cb-5ed6-4d4a-b9dd-a39ed1c9da67", "value": "getscreen-149018000-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6038a0-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498662, "uuid": "0f26bb4f-be3c-4076-b1e7-c810847c0323", "comment": "Malware payload (Mirai)", "value": "a74e961c41a81d3f1ce5a1e54dfeb4eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498662, "uuid": "3d3ac183-0885-4e71-a935-b33964c131e1", "comment": "Malware payload (Mirai)", "value": "4d18c194a1b4ced8f68fe05db8e6f7eb22b1cb6fae3bba965ab5343ff89a3862", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498662, "uuid": "6799b9bb-3dc5-43d6-b7a2-374c69f77e17", "comment": "Malware payload (Mirai)", "value": "074a3aa24a4c14caa84c3eb7d1df1f038b8e216b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498662, "uuid": "3018e79e-0a5a-4f06-b6f2-1598f64e6cd9", "comment": "Malware payload (Mirai)", "value": "8b697adbceaf0b7a4e1714833c022d8d4eda7650ef78b9062dc490b69bb5b66a90f8ca566affd64726985c050c1268a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498662, "uuid": "802b26c2-be8d-4984-889e-1e698a9103e6", "value": "T11AB3D74E7E215F7CFBAC823447B39A21A65833D727E1D989D19DE6001E7028E641FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498662, "uuid": "f2d316d8-8933-44d0-b594-45fe7ea642b2", "value": "1536:zATEkX9Z8VmhaIzVQ1SsoLwOonc6GtUWYvaREbDoeOpo7ppHeRep:BkX9hU3SsoLBonc6GCWYvaObDxtpHEep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498662, "uuid": "9d7531e5-81b7-46d7-b144-ccf8c3e03141", "value": 109752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498662, "uuid": "a2f10ee1-a9eb-40a4-a281-484b2079b217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498662, "uuid": "d8e78de1-5e65-4b12-b13b-6075486daa52", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5c8871-bbb2-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762503603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503603, "uuid": "c6148860-7ae8-4dfc-bd75-d8276b648457", "comment": "Malware payload (AgentTesla)", "value": "2098b0b9065ffa345a530495c657ce35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503603, "uuid": "128411e7-353b-4705-bde8-ca619cffecf9", "comment": "Malware payload (AgentTesla)", "value": "4dd4dc6e537cd6431e9f5b84a99a81349e2aa2816dc2c95db9590ee958acd05d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503603, "uuid": "f594ea0a-040c-492d-aeef-646172c6d8fd", "comment": "Malware payload (AgentTesla)", "value": "96875bf43e2bdfbe862a0fde8fda60cc554fb3be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503603, "uuid": "a97e485e-5553-4500-bbe7-7367002dcf1d", "comment": "Malware payload (AgentTesla)", "value": "75e2f752ceb9d1d8654fa04bc9067d27910055cfd4b115a002153c0dc613f6bd7870a5d5af7c3f6e0c9157c0b775dfbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503603, "uuid": "95428994-16fe-4ef0-a265-2ec5aa23fa43", "value": "T11AE412C03B98DB07D5A63BF21672E7B413315EBE9614C3568EE8ECDB7925700AD24B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503603, "uuid": "26be11c0-6f1e-41cd-b2b2-b282f4807a8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503603, "uuid": "2d26f9dc-fe86-464d-a819-5d9d462fdd3b", "value": "12288:YwTtae4ATcim1AkvYvd9DDjK5LII5RWuti031r61yoPr3MwYveRPA:pQ25+A3DjKdIIfWuLsyobMlv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762503603, "uuid": "d8c738bd-23d8-4bc0-8809-5e2b937c2bbc", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762503603, "uuid": "8b0ad9e3-36c4-4836-8fa9-def0895883a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503603, "uuid": "08e28856-c773-40dc-9d55-8f4b88f409ea", "value": "SecuriteInfo.com.Variant.Application.FCA.2785.1507.30043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0b1bfc-bb8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762486847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486847, "uuid": "ec2d4450-5f93-40f2-aa96-2fe1ae4f3156", "comment": "Malware payload (Joker)", "value": "f89999a233bf441f2193343de138ec68", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486847, "uuid": "4a7c7850-bf1b-4db6-8df0-cf5f0020c685", "comment": "Malware payload (Joker)", "value": "4dd5fc92fa5a77dd73672f520c9d7ba1ee8663971a2391f7522d94940fd561dc", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486847, "uuid": "2e861b30-b6e5-4221-b873-a76f2cd622fe", "comment": "Malware payload (Joker)", "value": "c0f2a66cf4ec8c9f79d94c0aab327fbeda97737a", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486847, "uuid": "d7e57518-a34e-4a92-906d-19e7fe85d667", "comment": "Malware payload (Joker)", "value": "4c96d6b7ab4757e9be652fb441ddd6e9ef54bb530c0381e01d0f124ee6f12b5500e97f0d03fbd11397069d7e366b7528", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486847, "uuid": "04a63f78-9956-4db2-9c94-26c17abea9a8", "value": "T16F271256E70D241FEDE2E2794D38165279B7AD206343ABCB1C00B17C2AB7AD58F497E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486847, "uuid": "88521696-a19a-40a2-a3d1-6d38f165a3c4", "value": "393216:35CGi6kI9W/hiCXg5uOplg6ohxXMQmJMmC9GcEYMigzwPCKKh+5NhK1FSRqy4hbp:35j6qW/0CX2uIP+yM5scEYMigOchOhod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762486847, "uuid": "696fb711-eaad-4874-a2c4-76cf913a0e62", "value": 21886080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762486847, "uuid": "4b0b9f1a-a36a-4ca8-9e7c-e3d53a232b17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486847, "uuid": "3e2adda7-527d-40e9-93e7-a1aefbe4d95e", "value": "File+Cleaner_1.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354263ea-bc2e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556709, "uuid": "6978aa8e-fb1d-4898-9479-c71cb05a08ad", "comment": "Malware payload (Mirai)", "value": "80036cf348b1258b8e967d69327fba25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556709, "uuid": "5f8f7b6e-9ea2-42ba-ac66-01e32b556652", "comment": "Malware payload (Mirai)", "value": "4e69e1260daa921f93adcf988b4d504288889406972b7b05259f1031b5e6c952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556709, "uuid": "6ef5aa76-c028-4519-a992-de6fd90d302a", "comment": "Malware payload (Mirai)", "value": "6dd68667a4e403cbdbd807fde3389f7ce0d4330a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556709, "uuid": "a8911f5c-2165-4e40-810f-b4f28fb52c8d", "comment": "Malware payload (Mirai)", "value": "ea3f754923f1ec197c42b8c4e5dfcc174ab58aaa116087eeed6ee0280a7128be453e7e7f7202333c7e12ddb670de557f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556709, "uuid": "1a335cb6-2158-444a-8ea8-784604528cd8", "value": "T1D403F14D58816040C87B457DB8BDBFCD6612D84FB294D9A28DDCBA249C88F84B32C66E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556709, "uuid": "d48422d9-67dd-4513-a7bb-ed63e3d1f70d", "value": "768:dQ3zCK+kSPH02uQlug3dIlDhX5VApj73x/MALrUx+JPMBa2kF5nbcuyD7UHQRjg:dQQuQ332ldJVuNzkOPdXnouy8Hyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556709, "uuid": "a8d886ae-3ae4-46f9-955c-0eca5ed0017e", "value": 39392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556709, "uuid": "fbd2a5a6-caa6-4a45-b98a-cfffa6435311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556709, "uuid": "fdb85497-9a49-4190-8819-2bb62649d032", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ead8916-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556403, "uuid": "f7283000-824c-4735-a29c-d1d5c3ce0fe0", "comment": "Malware payload (Mirai)", "value": "aaf997d782aabeb1b80ae6996e83d83d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556403, "uuid": "c2612df7-38ac-4f6c-9339-b52b8752527f", "comment": "Malware payload (Mirai)", "value": "55bb7ec894f1b92dd31a712dcd8d291fb53dc72060f08bbccb05dcd2010d422f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556403, "uuid": "95990252-0243-4001-a535-b7132b93abb7", "comment": "Malware payload (Mirai)", "value": "d07c29ea4e52e610b52de103799d5952d6254a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556403, "uuid": "53ad9c5b-b8fc-4f2c-a708-3244e303c0cb", "comment": "Malware payload (Mirai)", "value": "ccd233c7bfdc24d6c1125d884dbcb7d8e80623565c0db7eee587751fb3c6f868e24a902bb6114bd7ec61f1f4a46801ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556403, "uuid": "7817a691-eab8-4ef8-9246-500f192688d3", "value": "T162737C52CEB92E18E854E5B4B4718E3B4F23A565D1821FD58462C2BD9443FECFE483B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556403, "uuid": "f9eac617-0d15-4135-bb84-a24711df6711", "value": "1536:NbVK1FRamyui99SK4ctKUZ4DiXf5YLVSCQkoVWu:beivV4CZ4DiPiShYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556403, "uuid": "b0ab1d68-45dc-42ea-924f-5e08f41cef4f", "value": 77380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556403, "uuid": "ccc6c94f-df94-4676-81ba-dc79fb754ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556403, "uuid": "0773d645-fe14-4caa-b325-fdbe02074826", "value": "kvariant.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4090cb-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526413, "uuid": "9f7139db-71df-4f3d-8b78-05a54c4402cb", "comment": "Malware payload (Grandoreiro)", "value": "cd419173673b65b17b60ec35e5a18fba", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526413, "uuid": "f83bb7ad-643f-4067-8d76-0048c509d4cc", "comment": "Malware payload (Grandoreiro)", "value": "5770577ce5a439c3d6270ee1dc6c0f1616fcc2c3bf2c8a7c7e123d4445b98bff", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526413, "uuid": "d12456e5-a5dc-46e0-968f-586ca8af7505", "comment": "Malware payload (Grandoreiro)", "value": "b9f770b8e1c4f2873767df1cc3ff76a379618558", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526413, "uuid": "af56be73-296f-413a-b402-03cc91767e94", "comment": "Malware payload (Grandoreiro)", "value": "882502d4dc36e6775b9f54865f62ef112490a681b087a356f7675bbc2e08fcd694f7053ef217e98b707e16aa783e6c7d", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526413, "uuid": "0303e200-e52a-47fb-b530-2ab6a1f69c2f", "value": "T1628633721E542D7FCAB14738F00F37669E7D49978A4C91E678CCA18B338FAD1891A4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526413, "uuid": "73359da7-63aa-4716-afce-fff12233a69e", "value": "49152:AS1xsPGxHI5OF7+ZddOk3CTtZvFTfrbbL02wzhrWynftcRD5XJL4kv1dzJovzcCN:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526413, "uuid": "90c1a6e5-9498-4de0-ba41-b0da7528681a", "value": 7995392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526413, "uuid": "2abde68e-3759-4d95-b0f3-38573943b8d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526413, "uuid": "c5ca9e6d-dd63-469b-904f-7be3703c4bcd", "value": "TMS21294I9FF0U989161.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b38472-bbf9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762534238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534238, "uuid": "c7f360e8-e8ed-4ac2-9c6b-2fa437cc1abf", "comment": "Malware payload", "value": "c0238f5ac8700b9a6268b4b455d11b81", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534238, "uuid": "ff481737-7fbf-4f63-acb2-1155583145c4", "comment": "Malware payload", "value": "57c5c4f6168a7ae4c4058da6063334c2254e68e90e78c1a2d6d357f35dcd708c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534238, "uuid": "2e4712ed-d2b5-4a09-9af7-c93767de96ab", "comment": "Malware payload", "value": "667877ddcd3d8d6846cb948edeecf560ef0362af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534238, "uuid": "4ae4a16d-7b96-4134-91fb-5f2f530934d2", "comment": "Malware payload", "value": "71d0eac8041db0818b49799e1fd288219bf28cd2aea5f6775a1d85eb67106a2d8885e96d854778d408ca4b4cf20d82fd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534238, "uuid": "6fab670b-3ae7-4483-ad2a-0cf9d671052d", "value": "T1DD858F46B2B800FCD0ABC1788A565907E7B2780513759BEF56D089EB5F23EE15B7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534238, "uuid": "942d18d3-c645-4bc8-9db7-ddf17bbfff03", "value": "64789a613c7a2418457bdb51447208b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534238, "uuid": "33505e02-8f09-410e-b7a3-b23ddd664977", "value": "49152:smdtlM/UFoSd6+T6iKp41q7L7oDYQrYuV:TdWUF7VT6iKp41q7L7oN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762534238, "uuid": "8938fe20-21bb-4566-a6fc-0e1ca694429f", "value": 1712640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762534238, "uuid": "221dc929-7d7b-412b-93bd-c3218436cce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534238, "uuid": "4a2997c8-7f3c-489c-821e-11a0e3d44a03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7fcb93-bc07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540216, "uuid": "10efbf08-0fc9-4174-b605-4016f0ac0cd6", "comment": "Malware payload (Mirai)", "value": "45d626004efae0f02595918ed6731469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540216, "uuid": "305313b4-364f-4c69-83f9-d40be853074f", "comment": "Malware payload (Mirai)", "value": "5852fd9bd1d180beeac3eb4074956ca62a6ea9ed96f379df599f490af937e234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540216, "uuid": "dcfd49e8-e8e5-4dcd-b323-282911e09ee2", "comment": "Malware payload (Mirai)", "value": "1c3973f92612993a8b7ac61c2b9f8e318a869279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540216, "uuid": "8e72c6e0-3df5-4ff4-953f-2d8e0efb5bd9", "comment": "Malware payload (Mirai)", "value": "b0347d13edeb7a3701268b32b29333d15bbb1295d0d17f851fd84ad7213a8eca96aee4a208640e36978fe09b46c91bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540216, "uuid": "0191f273-99b9-43ed-b373-11cc05ae65da", "value": "T13623F1B01912D759DFB00530E92BD2C0B3A119E2F6A6B5252FAE4B33FED04660CB194B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540216, "uuid": "f364fb0e-37c5-47a8-a63f-087abe2be0bf", "value": "768:pgwPLRl6Kuik3LniJy8ByGVcaqS0Rt1W9DfG8qtaN3hfdvnrlOKzwboIe7iKNs30:J9l6KP0G8GwL5MG8qANxfdvrEKdMJzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540216, "uuid": "07f7df78-6df9-4fb7-bfde-e5acc188a61c", "value": 49688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540216, "uuid": "31b2a53f-146b-404d-8ecc-9219a7bf197c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540216, "uuid": "36e7aecd-8b4f-4260-bd0b-4da97ca9ccb3", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0e1cba-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526493, "uuid": "ed5908d6-3961-4903-a53e-f9a0f9e0d52a", "comment": "Malware payload (Grandoreiro)", "value": "8aa0ee07a505e3928a9584a9468b9825", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526493, "uuid": "28902112-2718-4622-b612-47b6a022175e", "comment": "Malware payload (Grandoreiro)", "value": "5a9f7cc3057f30359dbe91c658d6e0c379f677dd7791515aca85be7a3931b6d6", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526493, "uuid": "4266ba39-0282-4098-a0d2-60fb11422e10", "comment": "Malware payload (Grandoreiro)", "value": "88e6d08abf844e2d8c7b4b038a9d794a45fa925a", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526493, "uuid": "5eef629b-ebde-459f-893e-f5533dc6878e", "comment": "Malware payload (Grandoreiro)", "value": "a9c639ee3a8cd5b1029acc4be23c5f0c0b2b3854ff2526136d7602b4d68714d215af9a7d84800faa683812b8a87e2ea5", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526493, "uuid": "2ce32e0a-8035-4290-add1-206c3543db77", "value": "T1FC5623719E94362BC6510B35B00E37B2AE7E9867894C51EAB8CCE24933DF6C6451F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526493, "uuid": "b6888cf1-db73-48d7-8cf1-211afdcf2b48", "value": "49152:lFjCZMi26UO7jba9rnR73J8fcyumh8usUJCPl0JFKiHifIPEAsX15a6Sqtpx:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526493, "uuid": "2296d1b8-11fb-4add-a5cf-8cdc365ba40a", "value": 6131712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526493, "uuid": "349383c8-74ef-4908-add2-621b6d2e69bf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526493, "uuid": "bb979a8e-393a-4e75-ade0-e8f457949dc9", "value": "TMS87997334Z08207.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a34f31f-bbaf-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762502225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502225, "uuid": "8dff8a55-2b71-45ca-814c-aed01547a52e", "comment": "Malware payload (RemcosRAT)", "value": "ebefa78a103d6b2af0fd5604cdc58cc5", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502225, "uuid": "8999b448-12ae-438e-8a00-016610a478c5", "comment": "Malware payload (RemcosRAT)", "value": "5b016197e556099ddb7fe85ebe2f00a2182cd5811a2bb0573208fe9123f4104a", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502225, "uuid": "0b590678-315d-4d2d-8230-8a1aec030476", "comment": "Malware payload (RemcosRAT)", "value": "6a7e5707b98dd1a5c28f89e0d058151e725e8012", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502225, "uuid": "e8df9c1a-afbd-4d1b-a3e3-13097858e6f2", "comment": "Malware payload (RemcosRAT)", "value": "b1f1c065e240d4023d2cba28996cb195bd57a5e821927f5a8921abbc54b7338e5810f11f68606e7e7d38a18fca12bcd6", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502225, "uuid": "9ce08934-de84-48fb-bdd0-21bb311c5fad", "value": "T1C415CF34C1354B966FEF21F232123B0A536D974BD1309A9CAABB64DB452D304DAE7387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502225, "uuid": "ac75d716-677e-49c3-a8a5-59d87be3d294", "value": "12288:nwH+FnnRxcCfcNKjDV/aQ9HtyppejdN8FW3oPvKREgaaTRCSAAXs18jCyGreR3E+:n4NKjDda2g2jT3o/iVCSFs2Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502225, "uuid": "56bfbad5-6904-4172-bd03-dca2bd089124", "value": 923901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502225, "uuid": "99128e57-8d6b-49fc-bf53-2918ea024091", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502225, "uuid": "20e1532a-7000-493a-9df6-e01d1aed907a", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603b8aba-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762532729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532729, "uuid": "32ccad38-0a02-490e-89f9-346b72bd0fed", "comment": "Malware payload (GoToResolve)", "value": "3a1086328997d7d90e58c6cb6c93b992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532729, "uuid": "88269887-8991-437c-98da-af069fba7210", "comment": "Malware payload (GoToResolve)", "value": "5b1cb864c27cd22cb250e4b2f601e6ecb93f3f3727f0f2bbb9975252df22b60c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532729, "uuid": "0fd10e27-71d9-4bf2-8acb-846795376657", "comment": "Malware payload (GoToResolve)", "value": "3fa1b8a1c0066f915a654c0001f44e0addbae53e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532729, "uuid": "d078d7c8-6f5f-418d-9e54-04f695ee3a3c", "comment": "Malware payload (GoToResolve)", "value": "148d5611f4d1866e440393b11552523946da408dfcfb510aa836c0bf7b68f2749cd370dbab575f918a1c8a24dbffde08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532729, "uuid": "7cc5f49f-95c0-4eaf-b00a-06d835215476", "value": "T18D37333132568471CC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532729, "uuid": "6cf06364-007c-4f2d-abe0-180cbdc0a1a7", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532729, "uuid": "2e7e689d-7e28-47ae-b0ac-fc3c61f81160", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpX:q9WtLzgOTbjZvk/ekS/mcpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532729, "uuid": "6850c18b-0a5d-4474-9ee4-db261b07d135", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532729, "uuid": "cad3fd8b-b56a-41fd-a92f-17df14d3c899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532729, "uuid": "c3d84d8d-7bbf-4bfb-b2f4-167a3fe4f88a", "value": "SSA REPORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e310c6e-bc0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762543571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543571, "uuid": "8c86ee1e-c42d-4215-bed9-34fe3c97b34d", "comment": "Malware payload (Mirai)", "value": "56d46b5ae5ec02f6a4ca1d49ef89d631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543571, "uuid": "4bffba1f-cdfb-4876-ae6c-35059c7e8fca", "comment": "Malware payload (Mirai)", "value": "5b818ebc7689bdce52139a6e0dc01dffa87bb0b25bc5129065c674e3818b6000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543571, "uuid": "5604aa02-bcb6-4ee2-bb01-6eb6b88db0fb", "comment": "Malware payload (Mirai)", "value": "6ebdacaec9d5a119ec9319c5472d340e15dca995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543571, "uuid": "95eea3c6-9660-4230-957f-54e66d72192c", "comment": "Malware payload (Mirai)", "value": "ae0880fd315af7243ccaf5c5696136303a72f4bb9378e925a4922c71c8fe7502ce12d0b95f636030b31d51dcec19293b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543571, "uuid": "0667bb42-94fb-42d5-b347-982247ccea07", "value": "T16303F1556A938F1ACAE8D2741AEBF70C1130DE05D9C841303FC562368CA5FBAE734B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543571, "uuid": "604bc7b3-2b6e-4cd4-bc9b-813f34d71e7c", "value": "768:RpS+nJVhHnxQbCh1PU8NU+4VQpnohitMVeTenbcuyD7UHQRjF8:RpdnJnOuh1PUu4VQpndMSenouy8Hyp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762543571, "uuid": "50450960-57a3-41d6-9dbb-349ce5faace1", "value": 37820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762543571, "uuid": "e9dd4cb1-c650-46af-84b3-6677652b91e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543571, "uuid": "dbfcd0f7-8cd4-4620-8184-f2885f8f5eed", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc1e0ad-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526469, "uuid": "b77320a9-d00b-461d-bb4a-85b1b396b692", "comment": "Malware payload (Grandoreiro)", "value": "40ba8c7eb1955135c42d55031c602584", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526469, "uuid": "251bc7dc-482a-4bc4-a96e-6872f7a96ce4", "comment": "Malware payload (Grandoreiro)", "value": "5bba18e7f95c8ddd669b1e4b74d944b032d3d19b6d97d3b9ecacac7cc2121e61", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526469, "uuid": "f4bc5606-8063-4087-8d39-812768cead9c", "comment": "Malware payload (Grandoreiro)", "value": "737e44a82af27255c396a71d685487c9140026b2", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526469, "uuid": "ed404afa-fa0f-4b56-83a5-510bcc3c4886", "comment": "Malware payload (Grandoreiro)", "value": "de334735a7f2e5e8ba99b682ae96626ffae44441fe799feb51fb0ba30a6278fec87c4c39e9cdb8dc23e356e33c291c68", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526469, "uuid": "fd1dfa9b-c414-4cab-bdf5-093d3a9ef2bf", "value": "T1795623727A55243BC5610B35F04F2763AE7E84678B0C92EAB8CCD15E32DA6D1893F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526469, "uuid": "d44b86a4-e0e9-461f-9650-4b2651711681", "value": "49152:aIyRQbjhdE3SanZ9QfUt9SPXzccN8/36Z4q200OQL2KGXqhg3JX5OnckYn/unJYE:iuim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526469, "uuid": "d109ee50-e34c-4b7c-b8bf-9965143f1da2", "value": 6152192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526469, "uuid": "64d795d8-9bb9-4c41-956d-5bf5c8f6eef6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526469, "uuid": "dd47fa17-9d13-4967-8468-9ac7384194a6", "value": "TMS921733PPLAR811075.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e7c710-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513791, "uuid": "3ef9eaed-4935-4e38-b0f8-067bf74714cc", "comment": "Malware payload (Grandoreiro)", "value": "ac5c82ad6b05b73c2e4145af8a759e0f", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513791, "uuid": "b49f1344-dbb3-4bd5-a711-7027c3d99881", "comment": "Malware payload (Grandoreiro)", "value": "5cb8cc9fbe2e531f235ff32b2a7d1a6fff5df30746a9e2d2728df3ecbbb46025", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513791, "uuid": "151360a7-d9bc-452e-a13a-58022155414b", "comment": "Malware payload (Grandoreiro)", "value": "0d20eea49bf1ec1bce08df575b2bb0910991aa61", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513791, "uuid": "0b20c3ab-f371-4c52-8562-f5221e54dcf2", "comment": "Malware payload (Grandoreiro)", "value": "9df9de81ccd137dedb099d76e0ae800dcbc0e86f98f123b40a4d887f123e3977826a518e0e3f452016989f2d2f9d2acd", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513791, "uuid": "71925aba-7e29-4b45-9a61-422dc4141678", "value": "T1287623729BA4782FC5600735F01E3B229F3D9897894DD1E9788CD14A32DFB9A852F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513791, "uuid": "9a418909-b566-423f-abe6-11c987eb19d3", "value": "49152:Ycc1mPV0//ZcHHcvmIY78KhSCbM/YgaKf/8WhyO51wRUulGjX7v9ySR+JYgsaGc5:jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513791, "uuid": "01c0c9a4-401b-480b-82e4-215a94d7dc8b", "value": 7774208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513791, "uuid": "308ba247-0695-448d-8f59-facf775b86f5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513791, "uuid": "9e5b0620-52b6-4303-93c9-3c215b08d4f8", "value": "QBN203448VT647392.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439045e4-bc27-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762553727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553727, "uuid": "0ea9b448-c9f0-4a48-833f-226abb0c6b33", "comment": "Malware payload (Mirai)", "value": "020f6a62f73235e04569199acf955c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553727, "uuid": "afb2b72c-7179-4c04-b518-2e9551e33f5b", "comment": "Malware payload (Mirai)", "value": "5d2f9368e05fb7aee8c5e42d57ac39160e96e1fe19aae25bdb5f7a9d54706a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553727, "uuid": "ace8cff2-bf95-4a22-91c3-310634c06b92", "comment": "Malware payload (Mirai)", "value": "bfecac6077265f6549fea5832a7b9a8a0342841c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553727, "uuid": "de0af17a-14c8-4b06-8c7d-4f7f92b667ee", "comment": "Malware payload (Mirai)", "value": "15b1ae7db8954a2482240e29130e9b15c23064626051d0efc94724317f3761b0546fc177ff93c16454aa6e5977c1766d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762553727, "uuid": "857ee0b5-f186-4d43-a877-7c959f272186", "value": "T1C3733A07798081FDC5AAC439437FB136D463B0BE1239B29B53D8FE262D0AEA01F5D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762553727, "uuid": "79f182bf-4981-415a-806b-7455d6d41cb7", "value": "1536:X21xbHR/B/wnd/BR7qf7DqsmztgeyBlsPUVjxfq/kxeX:X21xZB/wnd/jWDDOztGBls4xfq//X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762553727, "uuid": "24b6e201-30f1-4fa3-b3fc-f6cf22fe091e", "value": 80624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762553727, "uuid": "72734c5b-38f3-445e-8066-7dc8148d4fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762553727, "uuid": "4d14cc94-3c19-4c51-a55f-eabbd6be3d9b", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7665e39-bc03-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762538432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538432, "uuid": "f22b75eb-e98d-4018-965f-a00396f6cf71", "comment": "Malware payload (ValleyRAT)", "value": "fb594d02ac4d8f1feb86e9a012e85bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538432, "uuid": "be7c69bd-f116-495f-8550-1b71dc6f5774", "comment": "Malware payload (ValleyRAT)", "value": "5e6a838682d323eb21425fcbf81e40767b0e63cb53622eec56468f389902ba81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538432, "uuid": "ec65e3f2-4a43-4e46-b946-ec1df1a031fb", "comment": "Malware payload (ValleyRAT)", "value": "6f4117734fc3a986e0345ee5c46f4bf39cfb3a0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538432, "uuid": "3a7e5887-1673-4bdf-a704-0a9c533cbb97", "comment": "Malware payload (ValleyRAT)", "value": "a61e612b080fd7b6cb0c4dc49fb7e7ca65e86b77056f8dd0121de43d9262956b205290ad279108b9da1ce839dd7e7467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538432, "uuid": "042d4c4b-78d1-4ed7-b339-c24b5abdf5eb", "value": "T189E2E096527514A6C150107B59BA90CB0BF7BABB5FDE2738392C6D251F90080CD977F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538432, "uuid": "09f147c6-922d-4534-8633-9c72d617f5e8", "value": "c1201007f24fe8ef3e37fc185993eed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538432, "uuid": "f2c715a0-673f-4fdd-a753-b13297ec3777", "value": "768:FZetPTxI1SZCe/SwoXya2x8xXpPNynD53HR+UsjW2:rOTCSQe/tNa2x81pVAX0UsjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538432, "uuid": "e6f69438-f70a-4e32-b1e7-3cc5b67f4415", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538432, "uuid": "06df6b01-010d-4c4e-a822-6daad4dde363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538432, "uuid": "123c48b6-2950-42ee-90ed-f6c032dd8687", "value": "HONGYANG641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df103b00-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498582, "uuid": "966599a6-fe96-4d2c-884b-c9347c61f1d4", "comment": "Malware payload (Mirai)", "value": "ace436d0d201247fb43d894f40b0d041", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498582, "uuid": "f77c2b97-0ee5-4882-8a3a-40b81852343d", "comment": "Malware payload (Mirai)", "value": "5ec6d6372e363bdfc5d7637a8fdca1ac85012f8086d48e5561f8709a70b18105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498582, "uuid": "fd47a830-0159-4e33-b9f0-63833f2bff72", "comment": "Malware payload (Mirai)", "value": "476b2cc401d6440fc25de35e1d096f8411f162fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498582, "uuid": "f58d08c8-8797-4d5e-b84e-23728f7a95fa", "comment": "Malware payload (Mirai)", "value": "6690fe2b8a3de416ecca5291f3072b14c7709ae50e1954a79d4ce0049281bd609f2d8cb87a704100c6370b68180c3255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498582, "uuid": "080e300b-24e1-4a45-8484-974c37611201", "value": "T15B439D7AC069AE88CA958138B119DD791F23C1C86AD33DF26792C2B29057ADCF505FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498582, "uuid": "9740edb4-ffea-4cca-a991-9bc656d7c4f1", "value": "1536:Ra9/HXMYqC0wtPDDZAds7KDqe53+6BaC7w:RwfXovkDXKD7+6BaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498582, "uuid": "e81d42f0-deb0-428f-8cf4-295dfbe58532", "value": 55396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498582, "uuid": "dc3bbeaf-6aa4-4484-855a-5d2686b53395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498582, "uuid": "1000031d-4ab4-4b65-9479-e5f35a517fde", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4e6c01-bb86-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762484700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484700, "uuid": "a169e34c-31b2-440b-9203-6a0c2031f8b8", "comment": "Malware payload", "value": "5c5d29800e81720c88529fbd6b8bb6f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484700, "uuid": "aa099f39-d5f5-4277-9689-33c38920f294", "comment": "Malware payload", "value": "601aa16bb9460cc9e28b5a304cddd7cc26892c6ee05ddfc36ca3900117f7c563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484700, "uuid": "351f6ce3-fb36-449c-8be8-78f8e11da954", "comment": "Malware payload", "value": "1cee86af207ebd5869381da7ba3f2cf277502a8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762484700, "uuid": "1ddd5381-1e45-4667-ba75-b9bcd0aede5d", "comment": "Malware payload", "value": "21f4e975efaf135218a777c9fd2b3b6cd4beadac2f0ae6c1e4eb3a9617656dd8f40d208c1466eefdd2679bf85ac1a0bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762484700, "uuid": "599b84b9-2e22-42b3-ad57-2787f01f6b02", "value": "T18BB50657BC924946C4E53A37ACBE81C433665FB98F8A531A2D05FE7C3ABE1C90A35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762484700, "uuid": "3028c9f7-8deb-4b0b-9a43-5436eba81d11", "value": "24576:NQx/ZtptlBLxRE3ippAd8QylLiape4D0KttZBQXEojUQh9JI2+zQ4UeBp8B7OpY/:4ugeoSsEWO+9r5VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762484700, "uuid": "7b93b71f-24e6-401e-ba01-ba21d9235a4f", "value": 2490552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762484700, "uuid": "538baf4e-7c9c-4ed0-96ae-b2834add226d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762484700, "uuid": "4b72918b-2805-41f1-bf59-cda6e17b3542", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b73b41-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556339, "uuid": "8ed53a8d-0995-470d-ad3b-365277eca02e", "comment": "Malware payload (Mirai)", "value": "9dd9ff51cf3e4cd9aa1f0744698293e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556339, "uuid": "84c489ec-3494-4766-808c-491236377df4", "comment": "Malware payload (Mirai)", "value": "62dd781a4e571fa797612ef112cea6645758682d74c75cdb909d3832f27c8ca0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556339, "uuid": "6c68f0ff-573e-45e7-8dba-a83507b0e2b0", "comment": "Malware payload (Mirai)", "value": "39166386f376b140a9ca7b7a7fa8d8777c344d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556339, "uuid": "b27a4893-8856-433a-81b5-b3dc5f328445", "comment": "Malware payload (Mirai)", "value": "009d5ca77293263616bcc76295ac4c6b29e7f07a7333f8ca638c0223fe24b3356d979f6039190eafd1fe5ad374f5b302", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556339, "uuid": "9a03229a-8ac6-42c1-aad0-069ddf8d7f70", "value": "T1FA931985BD819B12C6C1127BFF5E428D372A63A8E3ED3203DD255F61379B56B0E2B121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556339, "uuid": "b5a18dc2-95d3-41d0-ad27-8edc288da152", "value": "1536:ne3zhUjn0bIKRT3zqXQQmN96P9OGlONMQi0Zy+Usv+flJxvldPu:ne3tUjSFTOXQLL6lOWzrsCRvPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556339, "uuid": "7748e5d9-23c7-40b6-9bd5-a3f6494f764f", "value": 93768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556339, "uuid": "2fb9fcc8-2253-42f2-af1b-40c088b6dbe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556339, "uuid": "69fe3af8-deaf-49f4-a4ec-5c7d0ab16726", "value": "kvariant.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e08f9f-bba2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762496693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496693, "uuid": "a9539a95-d2a3-43f6-ae93-3dd052cb6224", "comment": "Malware payload (RedLineStealer)", "value": "c4776494a1af18bdfd3bdc5575410c2d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496693, "uuid": "76ff0464-4658-4366-b137-e53e7bf92c66", "comment": "Malware payload (RedLineStealer)", "value": "6521099983b85632d93b625ebdca89a3a6126753d9866ae856a1f2f8634b408a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496693, "uuid": "d5aeedad-c90d-4b9f-9f95-ac8116b07225", "comment": "Malware payload (RedLineStealer)", "value": "abe2ef9b17b09775abf4db3368420ec6609e9617", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496693, "uuid": "f0f909a6-bcba-4722-838f-0494bed88452", "comment": "Malware payload (RedLineStealer)", "value": "bd6826a624ea2c5964e1a02ef5b9a76dfb6bbc3ed818a64d56a04609df9bd63e4fd216137a11ce92702062683f7bac08", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496693, "uuid": "e217d27c-8384-41ab-9b3f-704c44de6557", "value": "T16D645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496693, "uuid": "2143f6cc-0186-4894-a2cb-3fc006c7c40f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496693, "uuid": "d150e269-b3e0-4fae-91a2-2f16365cd306", "value": "3072:qcZqf7D34cp/0+mAkkyQsgQkgqkB1fA0PuTVAtkxz73R8eqiOL2bBOA:qcZqf7DIknKTLB1fA0GTV8kpEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762496693, "uuid": "6a54bb9c-91bf-4aed-bb68-c5d8792635f5", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762496693, "uuid": "ff8ec321-00a2-47cb-985e-2d43ba679662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496693, "uuid": "a57dd477-9fe5-481b-b4ee-aa355e8a4712", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee04a00-bbda-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762520889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520889, "uuid": "5b1d38ba-2983-48cc-89a0-e3745b6a4a4a", "comment": "Malware payload (Mirai)", "value": "b8264a3c5d5897320cf7549c149e0052", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520889, "uuid": "bf777392-dab4-4d8c-aec6-9e16b5e9ecf1", "comment": "Malware payload (Mirai)", "value": "652285d260515c08cfe146ebdd2f5a4977ec490a608c57007abcb5b6f4fd4975", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520889, "uuid": "a21012f8-49be-4eee-8bb7-e6cde6458e5c", "comment": "Malware payload (Mirai)", "value": "de7096f04340ac22c2dcfd08237c5d00e687840f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762520889, "uuid": "7e3fa7b5-74da-446e-bd26-bf0af68536db", "comment": "Malware payload (Mirai)", "value": "f0680a61ccc4280fbd8b7f657ec3074b5f1d7fc9d457fc31e50617b786c2b9e9210fe36c85c3d29ed4e2bca23e0e7ecd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520889, "uuid": "11cbd94a-fef3-43c2-8788-c290747a0b50", "value": "T1B1117C906C951587A8DBFE1CB12A53F231512C74E5A0127DC2B7EE16C87EE32B90E771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520889, "uuid": "531b89bb-cfff-4e2d-b258-8b0ff3d29eaf", "value": "24:XbI/syYzZ3OhXvuS9dLa+Jdz7+y5yswTm6:XbI/J430vu4usdzzoJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762520889, "uuid": "4624b437-9342-412c-a9ed-ec01f8ffdd6b", "value": 909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762520889, "uuid": "7f05bd88-f58c-4d25-821d-89f47e84da2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762520889, "uuid": "302ff4f6-ca6d-428c-9eea-e2d1c128cf6a", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c777e2-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526516, "uuid": "30b89291-f79e-44ca-8b16-6450a24b2026", "comment": "Malware payload (Grandoreiro)", "value": "0ced7873934446453d7cb6fac950bc7f", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526516, "uuid": "4b3b676b-5216-4700-8b14-2adf9ea0f807", "comment": "Malware payload (Grandoreiro)", "value": "65ba6050f5c6caad911277ba7b7d4770d8232ae48732c8fcaf13bee01b56e984", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526516, "uuid": "e8c694ad-32b6-47c0-8a84-0dcff0acfd86", "comment": "Malware payload (Grandoreiro)", "value": "39bb78bea0f7ec7e8fbdf8c5ed6da4c7616a3f7e", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526516, "uuid": "7b598d3a-fbc8-4d0c-b44c-ea8b058563ce", "comment": "Malware payload (Grandoreiro)", "value": "3c0dd914a75e386f03298c5d513c802b2ffcf41d77b5775c45d4475c7f25c53f8a4cfac4ab09c75f166c2483aab6a7a3", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526516, "uuid": "1254a623-e816-4c57-8758-5a4923b73821", "value": "T1154623B26694692BC2A20735B04F77726E7E88638B0C91FBF9CD514A338B6D5443E4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526516, "uuid": "395cdfc1-e6e9-47aa-8529-d01e0cfb5615", "value": "49152:Di0lqGmnsdBL1/zfPKdF9YRMSu6rn1A2/7nBdMue9n0vKaE6kJ21YRb25SDu6s7+:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526516, "uuid": "cb98d16c-77da-4c69-9708-644de4c1fdb2", "value": 5754880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526516, "uuid": "7b5266c7-41b5-49af-896d-c9eb1fbe3791", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526516, "uuid": "bed864d6-104a-433f-96b3-f0ddf6e9210e", "value": "TMS8917IF5G030072.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342ed5db-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556278, "uuid": "feede0d9-20aa-4e66-849d-5380ffd94942", "comment": "Malware payload (Mirai)", "value": "55756f96b52ee744cd04ddee0165e6b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556278, "uuid": "0a2eecc2-73e1-4cb6-a06b-bbb93aa59c44", "comment": "Malware payload (Mirai)", "value": "660c33caac73da96fa82afa7020e1e3f806eb4f1fba45905c6e8f9c39f73587f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556278, "uuid": "c54bf12a-0076-49a8-bc7b-c3c404791a29", "comment": "Malware payload (Mirai)", "value": "e4cc2b485536a6a236819da4d929561db270b6ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556278, "uuid": "8f66b1ce-1300-4dcd-8688-87335434344b", "comment": "Malware payload (Mirai)", "value": "07ff07053ce7293d5fb81a76759e4927f1c3088326525b9fead29b5f86266f08690df6e596d6da9128ac359b73a583a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556278, "uuid": "b66b6e0c-ced1-4725-8ca9-6d0a60e47b5a", "value": "T144A32AD7F800ED7EF80DD73B4453480AB230E3A14AC32A76A65775A7EC361A42A67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556278, "uuid": "ccca6979-573b-41a6-991e-68c833e65368", "value": "1536:awPzSosuvO1fRQdiuC8k2Av1bU3GysnC/2mO3yRDbmj31JzdX2foq5g7u9:DSBuddiuu1g2ysnC6yBapX2fB27u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556278, "uuid": "33ad0c02-f2b7-4fc7-a8b5-03b9b26c4eec", "value": 100112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556278, "uuid": "3f9ff552-e40c-4b6b-92dd-2b7fecf40ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556278, "uuid": "6f16cb9c-453e-44cf-99cb-36c12592cb0f", "value": "kvariant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fcda6f-bbd8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762519987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519987, "uuid": "83b43384-7ec6-404b-ab26-c5a4de8c5597", "comment": "Malware payload", "value": "7f026f86ec899c67ab446ef8b1d166c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519987, "uuid": "f378f058-ff9a-42a3-9a29-05d6efce54ec", "comment": "Malware payload", "value": "66546e88c51f512a43870721ac61f0ad689bedd5c65af8d56945c5ca1ea74c11", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519987, "uuid": "7162214e-64ab-4b83-be53-5d0c5b83f647", "comment": "Malware payload", "value": "825733d827ca0aa0aed2ccec4a3c08041d048533", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519987, "uuid": "24d65908-1b8c-4785-abee-d25b8138be53", "comment": "Malware payload", "value": "4d982ef91a887f27aab75b94d0b93927f030b6ce23c294acdfc747c94ca57d6f63a048a6b471797c026578d1f0c9f664", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519987, "uuid": "317daeba-5fdb-4e59-8073-0c123e3ed941", "value": "T15322AE10BB179E63CCCA625970D95122CC6E4D1D9F253E4B06A5FD8DB88F820908CA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519987, "uuid": "e087713f-d0bf-405a-ae11-2cdfc9651c24", "value": "192:sl8kwgJ7OpGVgd+kE5UnitCh2UaIvtrWX5tLB4wwjHgSiDGmD/N:sl8R47Opog0kEA6rU/trWX5t3wD86mTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762519987, "uuid": "c1301884-d6cc-4360-a20e-32a224275523", "value": 10209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762519987, "uuid": "a05aacef-0074-4638-b7d4-eafde2c6c146", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519987, "uuid": "dea96808-9d22-4271-8c78-621f63b10390", "value": "Trihydridoarsenic.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338d73f2-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556277, "uuid": "489d2623-be9e-4894-aa48-e37a5caf86c9", "comment": "Malware payload (Mirai)", "value": "2106a36374f43c414bd7e09932833f28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556277, "uuid": "4731b8c3-d86b-49ca-b2f8-eb15db68757f", "comment": "Malware payload (Mirai)", "value": "684259fbf39cc12f2b8497017d14c03dd8b6769cae6699f53e1215a568f24bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556277, "uuid": "b1a98e27-38ae-4179-a666-b1cd37814afa", "comment": "Malware payload (Mirai)", "value": "cc40444a077c1ea49b9852b3f0bac753028939c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556277, "uuid": "f71d54f2-06d3-48fb-8233-6a4904655811", "comment": "Malware payload (Mirai)", "value": "0da041dd220aaa6e5c8da7ed39380d379d1357f84b2b6834982651dc337a0510943567b08723a969955ff25ab374a13f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556277, "uuid": "7559f0c6-ca6d-4eac-ad6a-52e3ae1e53e8", "value": "T170B3D71B6E618F6EF26987304BB34E32D79823D727E1D641D29CD6141E6038D681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556277, "uuid": "8bfdef05-9087-4c21-a9d8-2986de23c5d7", "value": "1536:ks1Y9YXcs4dwQO6QLv7S+cMIcEL4eoDvggJ+5gdpyquC:AL7O6QytPcBDoZquC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556277, "uuid": "96a4692e-ac2f-4a97-be58-d9edf46861c6", "value": 116048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556277, "uuid": "1dfdb776-f6d3-41ad-9f5e-0da0fe684c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556277, "uuid": "5fc01816-552d-4efb-bca3-4b8372ea609c", "value": "kvariant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfbfa4b-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498658, "uuid": "c2a500a2-916e-4df5-b952-756886b29a04", "comment": "Malware payload (Mirai)", "value": "1e284202488298680464ce9681a36f25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498658, "uuid": "057a142a-d199-41f2-8cf9-8e001cae1c3d", "comment": "Malware payload (Mirai)", "value": "68bdc59161da48d03f591600cf4d49f7c580e907523bd8538cb285140f882ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498658, "uuid": "81ba7e13-6493-4a5f-a8bb-8c0a9c29d664", "comment": "Malware payload (Mirai)", "value": "268b2ef4ccbedec8de19b4f6f273fbed20ee2a62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498658, "uuid": "20e2b6c3-a844-460f-bb9c-f215dff322da", "comment": "Malware payload (Mirai)", "value": "39339710735f47cf408c236ba371c285ee5855e144be570a182ea997422732787ffabd7a83a3385814e6ffb0d2cddd42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498658, "uuid": "26345e43-0433-4fcb-a9f8-eb47fcd25153", "value": "T15173534E3E619F7CFFAD823487B75E10964823E226E1C545D1ACEA410DB034E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498658, "uuid": "11f25b6a-b12f-438f-add3-7412ce8fe440", "value": "1536:hjFONB6uY/aaoHlhVZ/mHeP3w62z1/jx5B0OEA:GNn6aaoHzzw62z1/jx5BJEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498658, "uuid": "5b7ce4da-a355-4a11-9625-2aef6702f290", "value": 79892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498658, "uuid": "67d71db2-d113-4fc0-80f5-ff7f020d194e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498658, "uuid": "c39edca2-4790-4b0e-8f85-033d5b35808b", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98def86c-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526382, "uuid": "25abb6ee-adfe-47f9-949e-5db0c716873c", "comment": "Malware payload (Grandoreiro)", "value": "214b3f433058365285d4cfd49bacc236", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526382, "uuid": "4c39d98a-e390-4647-8476-01e89391dbeb", "comment": "Malware payload (Grandoreiro)", "value": "68d941e890952d9d9275f06bef6ade0fb523559de6ce55dc93f7512914af7f71", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526382, "uuid": "ff4940a5-03cb-4015-aabd-a9ba7a782e05", "comment": "Malware payload (Grandoreiro)", "value": "da57583cb2f3f9e72e39b854c05cb63701847872", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526382, "uuid": "6815fd98-9f6f-4e94-9d4f-83e0790426c7", "comment": "Malware payload (Grandoreiro)", "value": "52211ceab4a3cc41257b0a8fc0ab9cd9ff1988a7a678dd12e3664e905d637c8ed20aec5a43589526955681fc68ad2927", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526382, "uuid": "b486b3fd-398b-42e8-8a08-74ec0df37cfc", "value": "T1CF962372BF652577C2A10B35B04E3BB36E7E4897850CE1DA78CC9189735B790892F4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526382, "uuid": "58a6cde5-9c5b-4ba2-a0aa-5fef98babcb1", "value": "49152:OyKQafiTPP57ffyu96eh9WKO5WPjo1qjQFckLabKpspLk7MuM1yCUeIajC79CSpz:A5uim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526382, "uuid": "47d06e1b-d5d9-49ad-9af7-0732a2c4a011", "value": 8767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526382, "uuid": "44cb7a60-71ad-4552-a367-e746a21329eb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526382, "uuid": "65c825da-b45e-4948-9e17-634333c0e127", "value": "TMS9316SQ2A87148.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0e0f4a-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556341, "uuid": "4f79fcfd-a5b2-4954-a5fa-d2b433248432", "comment": "Malware payload (Mirai)", "value": "bc90b6e454231ea192de77bd04191d9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556341, "uuid": "49f7bc60-05a7-4de1-8ef0-06f4013410cc", "comment": "Malware payload (Mirai)", "value": "696e8d862ac88c010a36a16d0bf84c80b08d6ab47db4078aea013694f3bc4760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556341, "uuid": "d425d05b-d67c-4723-bab1-19ca6eef2fd5", "comment": "Malware payload (Mirai)", "value": "a493ef3bd0dd9526687d455dfc582ef462385bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556341, "uuid": "bba982e4-6f5f-440c-bc11-f08dc5df9ae6", "comment": "Malware payload (Mirai)", "value": "d475da89e7069777c85f18f12bc70ab295867fd463b4159bf793d248c2d6b780cf4a1e4ce90c7f5b7e081035a1632359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556341, "uuid": "21b86cea-826d-42d2-941b-4d0601265aa4", "value": "T12C739E63DD681D98C65C82B975A4CE395363E900A6931FF6069BCA73D00BEECF5093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556341, "uuid": "6dd21dcc-f93b-4869-854f-5ddfec9eefea", "value": "1536:5/Fsv9ozAPETFxZaJXwK1jJ/7Thtdk6C+8BrL+D:5tsvezAsfZaJXX19Jtdk6WxaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556341, "uuid": "e7dd08b2-70d8-46d5-9b27-e4a2ab2a59e8", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556341, "uuid": "39481f32-83c3-4413-9314-cacf4be66308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556341, "uuid": "13843f11-eb5e-445f-9880-8661587e3769", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb6015a-bc1d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762549499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549499, "uuid": "5c055e82-9b75-4873-b4ac-966097fe6446", "comment": "Malware payload (Mirai)", "value": "0a7d010e2fb4297d532b1dda0ce28d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549499, "uuid": "9806b903-c7c5-4a14-921f-79382c58078e", "comment": "Malware payload (Mirai)", "value": "69e0228ed35ebe66349eff98157234265b68f71cdd50720590f2f2eb44700569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549499, "uuid": "8434d336-b78e-4bd3-bab4-75bad19732a2", "comment": "Malware payload (Mirai)", "value": "40ede285a949a217483621efd4073e89e05f4b72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762549499, "uuid": "fa9370cc-8ed8-4e5f-a7f1-b40a0c7ea15e", "comment": "Malware payload (Mirai)", "value": "231a4067344c6f3000a7c5a2983e42e16f308a20a95fb57eee4885f64e117843582488ff9687de1c6be0083a1aa701b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762549499, "uuid": "837d437c-4ff3-4f2d-a2b6-9c17a1e52a40", "value": "T1C203F14C7D914F1CCCA493395F5AE7270210E015E9AE8252FCA8F057D8E5BBD2824BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762549499, "uuid": "f931f0c3-3828-40f9-b0e2-2e403a4d9314", "value": "768:jpS+nJVhHnxQLX/bSuHKzWNZsW+hzYkEK+ngSG5YZlixW2nbcuyD7UHQRjFV:jpdnJnOD/bSBzpykEngS3iQ2nouy8Hy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762549499, "uuid": "38f30398-4aaf-4e32-bf80-a3b986fbba0e", "value": 37820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762549499, "uuid": "430141b9-5709-4f0c-92ac-46a56efa65ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762549499, "uuid": "4bf7be9c-65b3-40f1-a7ff-aebd18d732b5", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b512e88c-bb9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762493358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493358, "uuid": "48e61fb1-4b14-4611-9ef9-bc3e2d67c018", "comment": "Malware payload (Mirai)", "value": "c4216fd5dd8b112a0476bf62060028b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493358, "uuid": "4d094e01-279b-42fa-aa12-be6aec86a3eb", "comment": "Malware payload (Mirai)", "value": "6ac89e7cd37d2565b309750ae90b4b369db2993434d34fc8bacccfbc00947242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493358, "uuid": "08c1b0a8-52df-43c3-9daf-4e0cfc3b28ab", "comment": "Malware payload (Mirai)", "value": "1efee6f062c77d133dc6182928763b98e8aa07a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493358, "uuid": "692c2e18-fd26-4082-8807-e450a08b7d8f", "comment": "Malware payload (Mirai)", "value": "0c1530514aa5b8435cabe40ae49065a1d6039f0e720520a5ec7366ef6484784ee99e7afffaf142f5a97e85a1247fe233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762493358, "uuid": "ea2fbcf3-1a8b-4554-b1c4-5805ee5ea524", "value": "T108A3C75E6E318FBDF769863447B38B25A35C23C526E0D685E2ACD1046F7024D682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762493358, "uuid": "f6015193-16df-4837-8943-c7f9215ae2b5", "value": "1536:JpRwUJDMbqVLLMWQ4R8m4XSPWemV5fewE+WrK9Tem9e:Jpa2DMbGLLMWQ4RSXSPWemV52Kje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762493358, "uuid": "450d7088-e2ed-4a25-9074-565b98365ab7", "value": 98292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762493358, "uuid": "9529b17e-29b8-48a8-9070-c66fbc77b7a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762493358, "uuid": "47b0cc03-b6d6-4d47-8716-01fa917cb606", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659331f8-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Hook)", "timestamp": 1762497949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497949, "uuid": "12fa1493-1385-450b-8752-8b7ea3f73cae", "comment": "Malware payload (Hook)", "value": "12215a810e34537734e8802673a35c2d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hook", "colour": "#D5BE4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497949, "uuid": "d4558d3a-31d5-43d0-a05d-17632b97d11a", "comment": "Malware payload (Hook)", "value": "6ca691c97ab0028ce9acade5d079289668b1d0339ad330181c84fc7e7114c509", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hook", "colour": "#D5BE4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497949, "uuid": "874b0a32-8d91-4a7e-9a74-ff2e4b812a8e", "comment": "Malware payload (Hook)", "value": "47c3a8e85e57a263a911c9f670e014b420866722", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hook", "colour": "#D5BE4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497949, "uuid": "cf742d0e-0d96-41e1-8d2d-2178e38226db", "comment": "Malware payload (Hook)", "value": "46396f84dcd646b77447b5280367ea7ec62d3c50d033b0857fe6f7e1e09de219001cf3bcc25fe5ddac25596b0c2922eb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hook", "colour": "#D5BE4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497949, "uuid": "6fbf7272-3fd7-4c67-af4b-c142a5311924", "value": "T1BB96124AFB48B59AC4F7573385B9923241474C268B83D6835D58B23C5DBBAF00F5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497949, "uuid": "cc69c861-b2af-407e-800a-b432dc63ab62", "value": "196608:kAD11ar8RAb2GWt/HM/Gqniw1kdRDcCekj1y6n7c4:n1ar8/GRniwwws5y+7c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497949, "uuid": "d21295d4-9f1a-4c3c-907f-b637b3e44a81", "value": 8711027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497949, "uuid": "83b93dd3-ea79-4d85-813d-171d08a11329", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497949, "uuid": "74b1c191-aed9-4e28-9827-bc461afdccfd", "value": "7ec62d3c50d033b0857fe6f7e1e09de219001cf3bcc25fe5ddac25596b0c2922.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d408376-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498660, "uuid": "bb84e641-2916-4328-adae-390dbb0ab1d6", "comment": "Malware payload (Mirai)", "value": "82b6f3b7036dadcf7929ad4938ca3194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498660, "uuid": "c92e9f4f-b901-4ca6-8350-a6b91064be07", "comment": "Malware payload (Mirai)", "value": "6cfaef99b87ac204632b42bd112c1e0ff5d26fcfc62fc38b779d9c92f2130cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498660, "uuid": "901886fd-c84c-4375-b24b-8a684f87d99f", "comment": "Malware payload (Mirai)", "value": "472d251f769816c1f7b0bb06c9ca6483eebd6aeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498660, "uuid": "915308f1-a61b-4f34-8713-89c4ea969b76", "comment": "Malware payload (Mirai)", "value": "4a0fb2c3f7d96f41da5c2600b2cdbcb168506851fd6665c1b297228416de7e95ecc3d9a6eaa7e2e9c056b2f0cc15c016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498660, "uuid": "940c52d9-4bc2-41ce-b633-a52836baea63", "value": "T189D34B46FA408A03C4D51775BAEF42493322E795E3DB73079E189FB43F86A5E0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498660, "uuid": "64b1a2d2-2eb3-49ca-b9df-52c76dc39ecc", "value": "3072:owOBmCOX+9mrsplDKZUmQBKXAVanwX+F8JyvDZLLLMEv76OZ3OqCf8YDM/9EBx45:owOBm3X+9mrsplDKZUmQBKXAVanwX+FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498660, "uuid": "4ca26da3-911c-4b64-bbc6-57f7482a05f1", "value": 134673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498660, "uuid": "68ed1a7d-49f1-4fa2-b7e5-7daa4fb499dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498660, "uuid": "7ad1d34e-846f-4db9-bac2-2c9c0b92ef7b", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd75216-bbc4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762511383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511383, "uuid": "5680370c-01a8-4194-9f3e-a696f2a666e7", "comment": "Malware payload (RemcosRAT)", "value": "a765abd584289c47419746bcd1c76baf", "object_relation": "md5", "Tag": [ { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511383, "uuid": "dc0398cc-4a04-417e-8d32-bf1c5a864dfc", "comment": "Malware payload (RemcosRAT)", "value": "6ed5ec75971478f99d787a69f6352f51f4992df52cceccde6e5dd1bdcd7e7bb4", "object_relation": "sha256", "Tag": [ { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511383, "uuid": "1914bfe4-38e4-430b-8aaf-3a7a11059a65", "comment": "Malware payload (RemcosRAT)", "value": "aece8e563fed84e3cbe56ead2096348efc554352", "object_relation": "sha1", "Tag": [ { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511383, "uuid": "2a0a4781-5367-4cae-977b-c03c0c80f778", "comment": "Malware payload (RemcosRAT)", "value": "c2d178b62c7425bf6a2f7e76745336b1be0840feb41d2a3a53346afefca412d14f35cee45b226b08b95da38dd2ba75ef", "object_relation": "sha3-384", "Tag": [ { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511383, "uuid": "bfb2c40a-532b-47ed-b217-966c6bc5962e", "value": "T15C72113B956CDFF00B3E21F411873D1520A59326A83A8D6CE8DA8154BF2A7518FA78DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511383, "uuid": "4954778c-5ee9-4a17-9f22-5684388b28d5", "value": "384:XXeXOAOPshzcT5bSs0pgtLX/jF3jbWoBUdRn5uz+wAtpNrq0:WCPSmGhpgVNjKowlYtyjrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762511383, "uuid": "40ddfbbd-8ca5-433a-a68b-15aa23929e76", "value": 16073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762511383, "uuid": "ec49347c-17da-418b-8111-7d09120a19f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511383, "uuid": "55564a55-3766-40f8-9388-ba0e1fc93e26", "value": "SK2025-UP001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11167b5-bbd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762518719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518719, "uuid": "37524f03-0b9a-4a4b-bd40-e3b90a021e65", "comment": "Malware payload (GoToResolve)", "value": "4417d007fb349e22cc38afcd1f96539f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518719, "uuid": "8cd3b404-bdf4-4a2a-8eae-5dd3b4959626", "comment": "Malware payload (GoToResolve)", "value": "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518719, "uuid": "1b810f22-1a7f-4ece-9f0e-b7258c60c42c", "comment": "Malware payload (GoToResolve)", "value": "3a82bc2d3981417f70f7d649405e4e36d3255c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762518719, "uuid": "6e974385-9415-4604-9318-4f88b0810679", "comment": "Malware payload (GoToResolve)", "value": "5c4a9f92ac9417a5fb4f360f5b190daf48f8a0d5ff491add94cb3cc15970721e71f31529c329e0a651bb08601abbc5b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518719, "uuid": "2aaa7e85-f881-42d8-bc98-8819fabb979d", "value": "T1343733217157C032C99221B2A929EFBAD35DAD205BB519D7B3DC5F29A7301C32B32D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518719, "uuid": "3dcf0808-ef14-4b8b-960d-fb8323f1d02e", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518719, "uuid": "29ee41ae-4f05-4a04-9710-62cbccedccac", "value": "393216:q2mcrgZIm4fQoPl9CDyoC0CiLHOBp3IigWt3TWh5kCeSGhR5yZ8+4k:zgKsGCDy6rOvYigsjQ5khhho8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762518719, "uuid": "a1c78d1f-828d-4f23-910b-eb881d39a051", "value": 24443880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762518719, "uuid": "b4cf6923-9363-4c30-a214-f422e5fa9111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762518719, "uuid": "c5b9e316-b0e7-403e-bc7f-1a5c7399163d", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13020bc0-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513702, "uuid": "fb823a66-b924-48df-a622-c55031a0e8d2", "comment": "Malware payload (Grandoreiro)", "value": "e1ba41d4221d325f3581aa6577ab47b9", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513702, "uuid": "96d77027-fdff-45bc-8f94-3b1aff67117a", "comment": "Malware payload (Grandoreiro)", "value": "71a557f528f3e1b51f45f1f07f5d54f1ed4f9e7dc88527a722bb110b19a3f2d7", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513702, "uuid": "dcb9bf45-1239-48d1-9b97-d28e019b6d4a", "comment": "Malware payload (Grandoreiro)", "value": "1035f00dd0418399c2ef8cb8ef77ae742a031351", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513702, "uuid": "29266609-94e9-40e9-8ec1-51479e944f51", "comment": "Malware payload (Grandoreiro)", "value": "f74fa16e7caa0ec6255b62e02a467829736ff5c66cd6796abec78db3487c9eaec795d8fa9e9d70d7180d17a54ec7be44", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513702, "uuid": "be035184-fd08-4b3e-b927-618b715e205b", "value": "T1244623725958256BC6A20775F04E27A3AE7DCD5BCB0C91EA7CCCD14A32CB2D6403E9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513702, "uuid": "164febb6-db6f-49ff-af33-86b0099de477", "value": "49152:zxDBVya8T0ZNWH/OO5uXNOvbcCNxuxjY83MpdjOaWTq+96AmPDSN5igFaUAUmKT:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513702, "uuid": "c5ec8ecf-47b5-4d5d-9c02-5a7e719ff3b8", "value": 5351424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513702, "uuid": "be9e63c1-2c58-4fa2-9696-f277eb32c3a7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513702, "uuid": "a63c51b1-4e53-4c2f-859a-48f332c45b8a", "value": "QBN426917MI3B65585.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67664644-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762532741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532741, "uuid": "245f365b-7398-4025-84e1-521504a68b05", "comment": "Malware payload (AgentTesla)", "value": "5b309c208e0c48243d3199bdf2e8a5e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532741, "uuid": "c3e9251a-70ad-4b49-86d7-1f5c3a2c45c7", "comment": "Malware payload (AgentTesla)", "value": "71a9ff27e61eb20f7ff682a892b2ebe794404febc59df035e4720559f16f0b70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532741, "uuid": "5c2e3415-a877-448d-9405-83134e4ca82c", "comment": "Malware payload (AgentTesla)", "value": "49b750b7aee5a8280db0ccb585d6fa1b68ea1812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532741, "uuid": "d2354991-180e-4c1e-a204-c8f21eb81761", "comment": "Malware payload (AgentTesla)", "value": "aa339b3c693d66d7bb248e3fb4f906971848d9983e63612d5e37fd2afd4da09beaa0d77dd3fb617777c4d035e0236451", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532741, "uuid": "c533f2ba-3f52-4a23-9fc0-bf8c82284e0d", "value": "T1594502118AC86FB8CFA85A1C80FE161EA3F05A8E501B744EFB27BD46AFF7544411B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532741, "uuid": "27ffff4d-0931-4ba5-89d1-878892af19ee", "value": "24576:kzNnfp0p1UVX+kCdAzXVp8UczWwGhiQHdv4G:Ctx5HeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532741, "uuid": "bf7c92d4-aca6-4728-983d-cb8a6ed14ca9", "value": 1237906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532741, "uuid": "a7a6f4ff-c5c9-47ed-b30c-237ec0f6e283", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532741, "uuid": "9a4488c6-c9f1-474a-bf7d-4d3953fa01c6", "value": "TELEX HBL COPY DOCUMENT#79284053420.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f6b0b8-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498648, "uuid": "6660ff49-e1af-4981-9f4e-b833f2936d34", "comment": "Malware payload (Mirai)", "value": "ace5433333bd9ff07a2a7d05c488be13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498648, "uuid": "f0234f0f-941c-4908-a541-e5da0dbdfef7", "comment": "Malware payload (Mirai)", "value": "733e7b1f6cb19853ab349c199fb5956bcec7506519da7dbe98d6e8510e85939b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498648, "uuid": "54bcb267-541a-41d2-8f00-b723240f1ed4", "comment": "Malware payload (Mirai)", "value": "982cc3ed9bf5203f2ed083d0cbf3a89e658655ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498648, "uuid": "94479fd9-0da0-420a-9d54-28793c8a2312", "comment": "Malware payload (Mirai)", "value": "980ebcc127e4c7be6c337c5afd7c89eff39491ff52b1a3cd1891931c665b455b0053c9719a99e165b43553af6f60ad3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498648, "uuid": "6799ee3b-e600-4707-bbcf-0bd38102d243", "value": "T11C331981B8C29E2ACAD01379F69F258E371163E9E2CEB257CD105F253AD590B4CB7E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498648, "uuid": "6a355dd4-49d6-4298-bc53-ae4156b6b639", "value": "768:IlCx9tMtmtr/j953nLk78nKZ1nmSKQ8b6gWJU4+un8se1nQ0q63bpp9oBNxsVg:MCxsmtLLg75nJgWmH/se1nQ0q6rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498648, "uuid": "d4c5bf1f-09b2-4788-a445-439ba610d46c", "value": 50512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498648, "uuid": "8287637b-1861-4ab8-b5ba-da7cb50cd59c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498648, "uuid": "82a1bb4b-1274-4598-a5a1-47ac73d7883c", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbac001-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498580, "uuid": "13294f92-e410-48b9-83fe-43f69a8e0bd9", "comment": "Malware payload (Mirai)", "value": "dfa96755fba29f940ec67b1082947552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498580, "uuid": "9d7f5656-45e3-4d12-b017-ec7fda43a06f", "comment": "Malware payload (Mirai)", "value": "743b7a8b22f4b9cace23f681ab6c089454901e68a1d9b375b117557c65e7d94e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498580, "uuid": "c7d7064f-5cab-4cca-b0de-7c7226ce23ad", "comment": "Malware payload (Mirai)", "value": "ec520c5d131c159b42adc5988a38701dfbe3c943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498580, "uuid": "f34f1a38-28b0-48fb-8ce6-e526c2631000", "comment": "Malware payload (Mirai)", "value": "bca5d58f43a3009e0a7518f35b3551674cdf2e2e60b903e0bb609391c64cba051e012ce588dc360a375dd94f8f4788c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498580, "uuid": "495fb301-42d6-4b65-baf8-c6c2af40d171", "value": "T16BE2F12160536A72DB75AA326C3F4581B89D8B3CF37C38F9098B4014289E0077FBAD4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498580, "uuid": "7be8e841-3377-4d9b-8285-6f1c910dc100", "value": "768:P09n459RK4+I68s3zWP1xd3ah1aYON8SI9q3UELE7:+iKbfXExNM1aYIpLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498580, "uuid": "02e8030d-c509-4271-9a2e-21819dd6eee7", "value": 31340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498580, "uuid": "6a7f183d-fc30-431c-9faf-aa1e0c599daa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498580, "uuid": "03953de0-2b8c-43ea-b1c4-2403908acd5d", "value": "xd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fee892-bbf7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762533145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533145, "uuid": "f6787703-5ca2-41cd-8f4d-51d8ca5d7d32", "comment": "Malware payload", "value": "498c245adf5e1170cdfc153d765ab69d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533145, "uuid": "65c272bc-3083-418b-9428-4ac7c76503db", "comment": "Malware payload", "value": "7578c0e172c3f0053cb4f2f31ca3c370e84e29c483ebbaabe28bf57afdf5eb21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533145, "uuid": "76759b21-2cb8-4bd6-9b24-c1561b20f098", "comment": "Malware payload", "value": "af9311377bf2f65cde1f4214dac7e2470de537ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533145, "uuid": "0da1a239-60fe-4c27-a18d-be7124f223e2", "comment": "Malware payload", "value": "6fa7a05fa13976cd1b183bd4c89a138b94d0efbfb898e0bcc54baff0fae96e6a4f2f83c49f3233ad944288181d27bb5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533145, "uuid": "76762ee6-64cd-4eaf-bb97-082774e4c7e3", "value": "T108E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533145, "uuid": "81c9f08d-432c-403b-a07e-e44891b57a10", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533145, "uuid": "47ea895c-5fda-4369-b200-12af9cd53696", "value": "393216:VJF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1a:drRxvoC/7a0jUxX7h1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762533145, "uuid": "9f3441d2-9f64-4451-94fd-2f4ad1bf4692", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762533145, "uuid": "027f5c02-26d7-47b4-be3b-e33626477af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533145, "uuid": "dbb5c585-756b-4323-ab1c-8aada7ee25de", "value": "AGENT_465977_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e00b936-bbf8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762533558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533558, "uuid": "91654f2e-ce7d-45d7-b363-a5a72521ae51", "comment": "Malware payload (Rhadamanthys)", "value": "86ee085f20dbd3836f5a335b5c323392", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533558, "uuid": "c407e0c5-57b3-4dbd-aa5d-bfe95ed3fe02", "comment": "Malware payload (Rhadamanthys)", "value": "7659aa27e4d739a3e1d9a1e2a4aa8b3b3bfad2459eba45ae411b532d44f92379", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533558, "uuid": "db693dd2-101e-4042-b9df-701e9680a444", "comment": "Malware payload (Rhadamanthys)", "value": "8e053b605ed38cf3f5754935d4e91ab7532f40d3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533558, "uuid": "809d9366-b375-428b-b70d-b49a9ea610be", "comment": "Malware payload (Rhadamanthys)", "value": "78fee6083c5bf0b3cc0954ca7a57c0561eae7f0aadd5e080e1c3317a3462e07233699caac8062880cc51c54c141ef3cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533558, "uuid": "381f0d3e-0b7e-423d-985c-1148bc440098", "value": "T104F36C5773A520F8E177813DC9920A46E772B8350B61ABDF03A0477A1F276E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533558, "uuid": "456e8d70-c2ec-4180-bd32-b81d964835ee", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533558, "uuid": "62800d5b-c345-43f9-9aca-164729fc0e4f", "value": "3072:6BlWijqU87dGuWZKE7629VLbi0Xuv6GyzeO0DsIxmOnHHvSa21jdGl:6BlWijqUqdGnoy/9VH15uO25tydC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762533558, "uuid": "9ce2e7b8-1799-4dee-81bf-31207426fd90", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762533558, "uuid": "b8d8a25d-d8a3-4a3f-9728-be4280f2eb10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533558, "uuid": "6d7ab66e-8157-4473-bae1-8414b391391e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82794078-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762532787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532787, "uuid": "85ef666e-a7bb-464e-a83e-2c91e6dc9d42", "comment": "Malware payload (GoToResolve)", "value": "735797b7960185ac02b682fdf16e2e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532787, "uuid": "400c3865-b7bf-4795-9407-e7c6628e0d7e", "comment": "Malware payload (GoToResolve)", "value": "7720fc969e3e2fe684630257ec6acf08e6fa9f6a08e4bfef881f8789c7cc4705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532787, "uuid": "f2c5ef9e-36b6-49cf-8902-305c7b019a9d", "comment": "Malware payload (GoToResolve)", "value": "377a076307e9804e8e210bf94a3ce996e42ece93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532787, "uuid": "5b604f78-e676-4c70-bfb5-26c6bff82075", "comment": "Malware payload (GoToResolve)", "value": "45d3795595765a3d6c21bed91a6dd1c20cf5157af6f3f0d9055f9c2b8a82c7eecce580fee77c19b0f8f0bb59d11fe19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532787, "uuid": "7154e252-5518-4534-b67e-c5bf90438fc5", "value": "T1BB37333132568471CC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532787, "uuid": "95cb6352-88c0-4521-a4f8-251ccca9b6bc", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532787, "uuid": "4d970be9-d12b-49c7-be7a-e41e260552b0", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXp8:q9WtLzgOTbjZvk/ekS/mcp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532787, "uuid": "faa537da-5922-4dad-89f2-c7459f5a6ac2", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532787, "uuid": "e7dd14d8-0a3c-4d68-a1af-56973b2d334d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532787, "uuid": "928835a3-8060-43e0-945e-cda5044c5136", "value": "e-CardInvite(10).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7231ef4b-bbc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Plusdrop)", "timestamp": 1762512144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512144, "uuid": "f554bf95-8d71-4d4b-8365-d4c061c50ce6", "comment": "Malware payload (Plusdrop)", "value": "2910b1e118fa4fe1d636af44b9592822", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512144, "uuid": "25de2f42-3001-4cc9-b900-aaf84b180727", "comment": "Malware payload (Plusdrop)", "value": "78cfbb3dcfb3cb41f6c830f1e7108278047f4dd4dd07ae0348bb1ab605c7b17c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512144, "uuid": "7b9ad292-d7d4-441d-8aa9-325ea499c72e", "comment": "Malware payload (Plusdrop)", "value": "d849825eb43a179ad87773c3892b468a133a046d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512144, "uuid": "2a52bf72-700c-4b38-8d52-5fc8473efb80", "comment": "Malware payload (Plusdrop)", "value": "56afcc9e8f31b95bb71346d022695cfb190b033e9ad59a9dc5af911b913626a9fd75b0dc400d9ad27481635dafdc3476", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512144, "uuid": "3304da82-4497-4400-b8c8-437dd1382ca4", "value": "T158252825AE9FD5CAC0EBA13F9485094291EEEB040B1762C347508974BB339E75E3B793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512144, "uuid": "b11b7af3-6f10-448e-8eb8-a530eab6b9bf", "value": "985366a5be2c7cea641db8429a69cb33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512144, "uuid": "469c3bf8-a302-4a1b-bb80-afa14144fcd1", "value": "12288:n/PF6rC1XrBaB9dBgIs7pVYoBf3MybQtcrU:16UrBaB9dSpVZB/9qcrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762512144, "uuid": "0c69c254-93cb-4ae8-ab81-dc79b6cfff1d", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762512144, "uuid": "4a53fb84-8681-40bd-9b3b-ac2040cd84e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512144, "uuid": "a90e09ed-8a40-4cb9-8515-f124a53585c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85419a9-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526462, "uuid": "da1db8c9-47f1-4b92-a500-3f56c043361a", "comment": "Malware payload (Grandoreiro)", "value": "71800ccd7dbce37b4c6fdc417abc0959", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526462, "uuid": "aa75a903-34fe-4597-955d-e39069c0b6e8", "comment": "Malware payload (Grandoreiro)", "value": "791b66416409df48870fb1524eacf3697cf6d76e15bf43f308bc05366adb1f8c", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526462, "uuid": "3b0a0e96-f8c7-40a4-a0eb-23d2514570cd", "comment": "Malware payload (Grandoreiro)", "value": "d65b403e4ef9db957a696346e5e1c60afe8edc0a", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526462, "uuid": "d6c70cb6-11c3-4376-9d58-fe65932a1713", "comment": "Malware payload (Grandoreiro)", "value": "09583389b0a12d8ab5f0c3f8a19b023d88e24c36b6adf1e0ade9a5d63ec137ce4aecb69f02b1b7eacbadd2f0d4c23aed", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526462, "uuid": "88831cc1-e67a-4684-ba5c-38e466d0b21f", "value": "T1105623725D542827C7B14B36F01E27726E7E8C538A4C91EEB9CCA14A33CE6D5C57B8A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526462, "uuid": "c1594fe7-79ba-442b-b4b0-fbbfc40de14c", "value": "49152:CAOC2uvdgVoSLJOQ1tDB1AFLGPT9Z4AZpg4Pt642aFIULXdMUyRBLijK:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526462, "uuid": "41e5f544-0289-4614-9dd9-a9c7b915fc5a", "value": 6463488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526462, "uuid": "db8dc8b3-827a-46e2-bf7c-93dfc6da7552", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526462, "uuid": "8fabfaf9-4604-4c98-8da8-6189cf03b47e", "value": "TMS053213C4EKQ479681.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c49aa1-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526454, "uuid": "ab2ee4fb-bc0f-4f7c-827d-c242010ba401", "comment": "Malware payload (Grandoreiro)", "value": "f56acec2ff9de550198b73610db9bcc6", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526454, "uuid": "66c0ef6e-412a-43b6-ac5a-6b7b640f9c56", "comment": "Malware payload (Grandoreiro)", "value": "79f5d7ed255c91f8b94d75294e8a9b33dcc824303e3a28c1989b85b709640c7e", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526454, "uuid": "8cb9deab-e3ab-4019-8e09-4e2fa7d17e06", "comment": "Malware payload (Grandoreiro)", "value": "5c92bec3cade918df89d1378a60c9ba93d4913c7", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526454, "uuid": "3a1d51f1-1557-4bbb-bca1-1d7055eb47a6", "comment": "Malware payload (Grandoreiro)", "value": "fa28f525163792efc6f9c49fd852f63d9b3752a56921593da8b2cbbe05d6bf55de92bfed63f98588634addbcf128d9d5", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526454, "uuid": "63724a7f-0c8a-4d65-8cec-47b1fb6dfa7f", "value": "T14D6623715D94397BCBB00F35B04F3722AD7E8853858CA1A9B9CCE15B36DA7D2442E8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526454, "uuid": "ce104b43-1b76-48ea-945f-17b8cfcd0e4f", "value": "49152:CglJQfN3Nb7XSTSpaOXPfXKz8yqMT8vIk67gdEOQfmyR82i6WycCjFht/1jTdo+i:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526454, "uuid": "1e81deca-728e-4f36-89e3-f8f5bfc9a088", "value": 6569984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526454, "uuid": "f06bb53a-5d52-4a4c-b59f-62c6bb0f7cbc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526454, "uuid": "c31c179d-4575-48e1-b7a2-8a7f10d4d942", "value": "TMS264303054Z97790.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a961739-bc0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542142, "uuid": "234d9740-381c-43cb-b1a6-d3ee4e8ddbd8", "comment": "Malware payload (Mirai)", "value": "7d18dc850901e94dca768ee469844a5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542142, "uuid": "c6d3141a-5b60-4e5a-a8ae-b4b04fd0a002", "comment": "Malware payload (Mirai)", "value": "7a1ef9c04fa4204817f0929dd1ae68948cea9ed05ba0d0a1f40360907830a01b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542142, "uuid": "0fc18f4b-4279-4625-a78b-453b48ac2220", "comment": "Malware payload (Mirai)", "value": "a2e58e8974c98dd82288245fb90b9c2c3c0e1079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542142, "uuid": "f1c3f4f4-98ae-4834-8283-aa4a6c49b486", "comment": "Malware payload (Mirai)", "value": "cbef735ed5fb113f00674134d436b59e4dc41ced1c8e872cc9b5218ad20192226172df56d4d01cab6e7662d208c61f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542142, "uuid": "61e03e9e-330b-46ce-bdc1-e7c0c7c736d3", "value": "T1DBD34C8AB9918911C9C716BEBA7E118D331227B9D3ED3223CE14AF64738B09F0D7B115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542142, "uuid": "beafbd93-e3e7-4899-879e-af3bd44ff6b4", "value": "3072:LBv3rulMptHhfoUrE5E1IzhTRa30shc/smhTLN6P3:lilMnZoUYBzhdapWsm1UP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542142, "uuid": "d710c6b1-e850-4cb5-814b-636b4f8b45ff", "value": 132160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542142, "uuid": "bd7b4f42-8abf-47dd-856c-6afb43b413e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542142, "uuid": "cc70b851-0060-426f-866e-fc0067bd0889", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f8c1e0-bbaf-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762502142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502142, "uuid": "a0d35a36-aa93-4940-8e8d-91c539427e59", "comment": "Malware payload (ValleyRAT)", "value": "8608e912f66d77f78456d6e68996396c", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502142, "uuid": "f2f46900-aa1a-4759-ad89-383596d7c6f2", "comment": "Malware payload (ValleyRAT)", "value": "7d115764068807ada1ba68a89ba7dd0bf45b797879fa46835fa6f3c1640133ca", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502142, "uuid": "bf1a286b-e82c-44c6-aa25-83e4860f0467", "comment": "Malware payload (ValleyRAT)", "value": "107cafb2a00a29dc372635708827fb3bd836bf65", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502142, "uuid": "7d662387-11db-42d3-bf0e-16068c908e38", "comment": "Malware payload (ValleyRAT)", "value": "77f7d3ba6a51c43ad4a8782a668f3b8ef01d20b9dcfed188f2e6294d015034cc8416bedfba25c498af87d74cc343865e", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502142, "uuid": "ba2ac63b-e926-40c6-a24d-8772ce5fc82a", "value": "T1A52633AC927100A3462E1C2D5F99D7E0BB68C49FCD629D40D01FF32B346F59D6E21A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502142, "uuid": "939b05e8-549b-4235-b611-015072ad2ff5", "value": "98304:q6qL6s5/3kGUBo1ave+w+i5FNV7qkEVkfG7UFBwn9:HqL6wUGUywGN+I1vnG7x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502142, "uuid": "9712c1d1-308e-44c0-8a30-5747446caaf1", "value": 4450753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502142, "uuid": "afdca57b-1a1c-4ac1-91e5-05864334bc7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502142, "uuid": "998fe2f4-4a17-4a70-b021-bfb8224c5177", "value": "\u66f8\u985e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3860d7-bbdf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762522921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522921, "uuid": "5985165b-6b7a-41ce-8300-f17e588674d2", "comment": "Malware payload", "value": "a855fe0ff15e09cefa72a6bba76f49de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522921, "uuid": "ca669b85-08d1-4d22-adbc-59f5fa965a08", "comment": "Malware payload", "value": "7e9365d947bfc9d9741fc16957a907f422b4da6f51be4e3dbdf27cb92ef4d92a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522921, "uuid": "8b6e6544-b358-41da-8cf8-4d08178579a8", "comment": "Malware payload", "value": "a7d379cd50572c236b005b7b1dc6621df18af056", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762522921, "uuid": "81c79f5a-0be8-4bf9-a279-0e35a53920fd", "comment": "Malware payload", "value": "af7af34bcbbb1a4d1f4e810658c080be39df597c53a31cb01a7e715bcca5de0fc5ab22fbd7ec239def314277fed60ceb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522921, "uuid": "b1ab8150-d3ed-46e7-9f2d-3d49f487a6dd", "value": "T12921C60BE4FA41A8F60EA430091853B8940C9F247A04EC04C338EB61364DA447BC29D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522921, "uuid": "dfed32c8-01b4-41d3-9e07-b3ef85a31b44", "value": "24:9su5mZR+pQxQ8KLMfjlVRiLxg2YYfwJXfvSNjdjt03GbbOv5y:9suOspQtKZLxffw9SNjdhGwbOvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762522921, "uuid": "b5b0e602-fa79-4e10-99bd-2df9cc09b726", "value": 1148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762522921, "uuid": "4a298f41-e540-4fb9-a266-a66e52505bec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762522921, "uuid": "eefb2326-6a27-4a4d-ac05-7ddeb1d793e2", "value": "55137473869997.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407ba73e-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomVAI)", "timestamp": 1762532676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532676, "uuid": "46d08de4-272b-41fd-ab52-18eb11ab0f1e", "comment": "Malware payload (PhantomVAI)", "value": "bbb79ac59cfbf60a08a8fa4f16127972", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomVAI", "colour": "#819312", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532676, "uuid": "3b6658a2-791e-495e-a0a4-240faf976375", "comment": "Malware payload (PhantomVAI)", "value": "8019571058646e96e886875801a1711842d8974f24b413ff8b620c05aa08b59a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomVAI", "colour": "#819312", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532676, "uuid": "f9f1602c-9b5b-4a35-a004-366c64bb04df", "comment": "Malware payload (PhantomVAI)", "value": "1a8043060b981dbd75ce0acd2605bbdb710c2dc2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomVAI", "colour": "#819312", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532676, "uuid": "f21b2017-23ef-47f6-b82a-a1dc70263aa0", "comment": "Malware payload (PhantomVAI)", "value": "6852d275aedcc5358a0b151837c5eec797dc3779624a9154ecd43a8d46cfa3a2a78509a85911d06eab82bf3ffb8a454c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomVAI", "colour": "#819312", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532676, "uuid": "aae7c8b8-6079-4c44-82a4-abe674cc49ac", "value": "T1B922027B56419F750BBC21237DE15F18BEACC082F32D929892A46181C8E7D7ED3D6368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532676, "uuid": "6996f42e-f015-4dac-ab96-8c1fbbef2b00", "value": "96:JNrk+chu8j1ANE07r/oNrhd8+iddYfZ88RK:JNcu8j1HnNX8huK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532676, "uuid": "4cda491f-37ed-421e-8285-2ea0c73376dc", "value": 10642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532676, "uuid": "8bb947a1-b4a2-45fa-9548-752eb2571e5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532676, "uuid": "fdef12fd-b6c1-4934-ade1-b4b6963c952a", "value": "??????????????????.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d802083-bb9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762493721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493721, "uuid": "a24dd6f4-6d21-41a5-819b-ba6fe5fe06cd", "comment": "Malware payload (Mirai)", "value": "9b5bb7f2fd01f966d0a23d7cb7d91e2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493721, "uuid": "d1fbcd55-8aab-41d5-94bd-d63b264854f3", "comment": "Malware payload (Mirai)", "value": "83c8b5ecc93878baf8f4ebc54e8ce9271d81215af257af6c445c9176d634b14f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493721, "uuid": "3c3fe679-354f-4129-9d5b-2945d7ed6955", "comment": "Malware payload (Mirai)", "value": "2ba01b9c46c2171f487161d2bfa3eab4e836de8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762493721, "uuid": "398b3eed-5b89-4d90-809c-b1c8545611c2", "comment": "Malware payload (Mirai)", "value": "6208e0adc11c05e6a7569ae196a820c4135fedb79b6a12ac545d5e7021eb541ba0c2612f1b0647480ee0daebd5f89e46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762493721, "uuid": "44e28ce6-78da-4c41-af21-c7fe1a5c5b52", "value": "T12BA3F805EFA21FFBE86FCC3746A90B0564CC691B12A83B7A7574D42CF54A24B1AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762493721, "uuid": "0fa28149-a769-4aaf-8dec-873efb8f00a7", "value": "1536:T1EduHHgnrsF6fEkULdiFSqSiYeHiayygOSt+9g/je9fY6qMFg+6ANuT3khKGZLN:prxCUUFSqSiYeCayygOSt+9g/je96tyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762493721, "uuid": "94e153fe-3622-48ba-b6f1-a66085dda141", "value": 98292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762493721, "uuid": "6115b468-aa3a-4972-a074-17dc1279cefa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762493721, "uuid": "7e353b62-4c4a-4872-8ccd-acbf856a83b5", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737096f8-bb73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762476498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476498, "uuid": "f7493535-909a-4340-9481-f4da8e95403c", "comment": "Malware payload (Mirai)", "value": "b6d3ab4a79b8a596d95df2b74215b254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476498, "uuid": "2cea2405-9914-4163-bca2-9f962664cdaa", "comment": "Malware payload (Mirai)", "value": "83e69d77f6903476e10358b55754093f81f2891a813b74a863ace81c22169c4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476498, "uuid": "c6dd49ed-ad47-4136-8c11-f2b49b76f064", "comment": "Malware payload (Mirai)", "value": "34c2aa63ff54de8a07a38cfbbac4dbbb80074b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476498, "uuid": "59c596ef-2ba5-4126-a7f3-95d7774e7fd9", "comment": "Malware payload (Mirai)", "value": "71d24879f2af28f0b1923322729a194ea78e0e3bfd766bc2faccad7e58238d16ddf49d654d2b7f031da3e901bb266645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476498, "uuid": "c49c7052-28cd-42e2-b5ce-4f9790810564", "value": "T198B3E709AFA11EF7E8AFCD370AAD070524CD591B22A83B35B574D418F25B24F1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476498, "uuid": "6dc8cea3-d73a-4ebb-a0fb-581be9cc8935", "value": "1536:zlrTtUr6oJKLdrADCp3oalFGkEMkcfTd0sxcKqNHZqYZ/ytJyjrjSc5/Q:zlrTtUzudrADCp3dGMGKqNHIu//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762476498, "uuid": "67410965-b44f-4df2-9ef5-77be25ac103f", "value": 113848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762476498, "uuid": "6116d4e7-243a-4f01-8867-7f5a86549e04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476498, "uuid": "33a38bce-8008-4471-9d51-c26636a749e2", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd384123-bbfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762535060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535060, "uuid": "e124d3ab-2db8-4846-aaf3-5b0308af9618", "comment": "Malware payload (a310Logger)", "value": "2171136f83f91750c52373616185d794", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535060, "uuid": "cef7434a-e58c-474f-b72c-6ee9a212a3b4", "comment": "Malware payload (a310Logger)", "value": "846fb6d9a84fcb127041d2203f0dab18d838abbce22d597e5b8204f268fabe73", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535060, "uuid": "705da99e-c9e5-41fb-99ea-ed8267bffe83", "comment": "Malware payload (a310Logger)", "value": "d8ec091db4babd5262cd7846af3330fbdd28eceb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535060, "uuid": "ca03fa08-85a8-4d4a-b851-52aebdcddb32", "comment": "Malware payload (a310Logger)", "value": "e40db41e733b7a1c2257e3c8cba7d98f7a66cd07add9343fd236a555bad1690603b48109c6562131de8476505cf59ff0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535060, "uuid": "e3ef12e9-e175-42fa-8bfe-777fb7929250", "value": "T19E946A13EA20712EF1A3C9F1ADA5A25628267D395698EC4BF3405F5834725E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535060, "uuid": "96a48fc4-53db-4fb4-84d1-f1ca7a998f68", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535060, "uuid": "9999496b-c6b9-443f-819c-8d63640f4025", "value": "6144:k8d1/w5KA81IJ8GpF6nuTmOOUwrzyWTX6b0e967QUQVBKGHZoJecy6SWfjIb0:XjYKkJj6GmZUwrH2b0eIQhZNcy6S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535060, "uuid": "57f26b34-4172-48ba-8157-1058e8f481ea", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535060, "uuid": "9ed0bc75-4f52-481a-8fae-880a198f63ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535060, "uuid": "2454eb0b-d84a-47ba-b1b3-06b980f42748", "value": "Remittance slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0788286b-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513683, "uuid": "1f0a79d6-e838-46eb-9e79-e3dc554e09ef", "comment": "Malware payload (Grandoreiro)", "value": "31afb55639601f8904a191d22a1f3b61", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513683, "uuid": "dd1aac39-f095-45d3-91c0-40b94473480d", "comment": "Malware payload (Grandoreiro)", "value": "8528f11922eb96aa70a54a1123170d5586e6d43d9ab28a3fa19544e48bbcfeea", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513683, "uuid": "aca114a9-df19-4098-9d89-4f76f888a34a", "comment": "Malware payload (Grandoreiro)", "value": "c916d5501f836a463357bb3e1551f251864ac17d", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513683, "uuid": "8fc31ded-7124-4dbe-bc87-cc02eb9ba44d", "comment": "Malware payload (Grandoreiro)", "value": "488cd98853f034a3111fd9ceee27c3d0e64ca96687781f5c2e08d9fcaa6491a6375fbaf04711095b3b2fdb5452afea4d", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513683, "uuid": "e9c3cfb3-6a74-484a-9623-d21553128ff5", "value": "T1EF4623725598381BCAA10735F04E2373AD7EC857C64C92E9B9CCD19A33CA6D5892F8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513683, "uuid": "20264fdb-9bfe-43ce-b776-ce6bc4c3e389", "value": "49152:rqxD+OVbuea7ml3+IT65GUuLVjqJVm+J6XG03bK7fqBNyMO3Bs+RM0g59XzUXg5C:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513683, "uuid": "533096b4-c830-45db-b50d-711ca603b268", "value": 5505024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513683, "uuid": "23a6b872-c62c-4a76-a6ab-c7ec652b8574", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513683, "uuid": "f0ca8b39-4185-4208-b16a-2d1b268d5088", "value": "QBN2815978GFE917028.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c687bec-bba1-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762496269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496269, "uuid": "34d73e90-b529-4984-bb0f-0358a3f94959", "comment": "Malware payload (a310Logger)", "value": "5a65d763e5d76ae998d61f6748383ff7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496269, "uuid": "0991a780-c8b8-4443-a09b-c327bf599d8a", "comment": "Malware payload (a310Logger)", "value": "8565683618c7ee771b85070d5694bc041ec25aa7086ce04a44135a81493e3970", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496269, "uuid": "119b502f-f39a-4faf-9940-a37586b8955b", "comment": "Malware payload (a310Logger)", "value": "74abd8203dc704f7067d0bad3b3cae0e005b0e91", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496269, "uuid": "031a9205-21e7-487e-a137-6ac7e9d59d47", "comment": "Malware payload (a310Logger)", "value": "25d8d38d2bd661e6fa1c0b8f1592cf8b50af1a63150246f2891d882f30919b8fbc2f7f852d42dc1de1e10e4b76c62127", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496269, "uuid": "0bb4825c-65eb-4e81-afa0-178fa8832585", "value": "T1081523A43B19CE41E7601BF138B2C67C4379ACAE9920C3639DDDFCCB74A1B215919B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496269, "uuid": "ad8aa6d3-7ddf-44dd-a9ee-0ebd51ea90db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496269, "uuid": "295d3a6d-9d26-46d8-baa4-076de43a1861", "value": "12288:WPFEDAFruQeGthwafg9ArO3JeelUsGqrYoT7mnrsZ5CcSpeRPA7:WSRQeGnwaY9z3IarTAK5Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762496269, "uuid": "25b1869c-96ff-4ccd-8b1a-f87d245b8644", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762496269, "uuid": "0efcfbe0-a2fd-4e7e-a98c-f40726f943d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496269, "uuid": "ed2e07c7-2f20-466a-b999-c2f64e73327b", "value": "SecuriteInfo.com.Variant.Application.FCA.2785.14311.16423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d3be1b-bbe0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762523318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762523318, "uuid": "fc39d1e0-eb05-4790-9191-86321390cd1a", "comment": "Malware payload", "value": "218f93799dabdb0637e41b4109063ee2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762523318, "uuid": "bc85fab2-a3bd-4c80-8386-8327d982a184", "comment": "Malware payload", "value": "863fa01b53f1ae851462a921fa22ebafb7d0afd20d5996c1ea9cf609ef232a5e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762523318, "uuid": "1be4dca8-0304-444d-9998-7a56bfd9a93b", "comment": "Malware payload", "value": "16532169e49d555862f3f2c676e0f9a0616326d1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762523318, "uuid": "9bbf8816-0216-45c3-b879-e899a827c9d9", "comment": "Malware payload", "value": "3fccb65c213bcc03baed9ba662f9a81421259bd3d8ad73efca33f2e33ed77afa88c43da4e9e21aa2992d1d14ae87a351", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762523318, "uuid": "cb9e8ab0-08b0-4c3d-bc3a-5c1e4cee48ff", "value": "T1B953AF0B7780A335C89107320A5BA7D51F36EC059FB72112B1AEB7AD1F724C066F6AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762523318, "uuid": "03347082-9921-4a12-8d62-376474aa1e07", "value": "768:J2kNq4oM2U7TgO9i8mGEHyKkuNBJBueSY2FDkWPo6qbo6qmC:/UwUYmGES7OaeSxDkrGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762523318, "uuid": "914a8fed-d762-4e6c-b080-46229f1f7e66", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762523318, "uuid": "6327a019-0220-4110-b162-f2fcbda3bee8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762523318, "uuid": "e30da3b6-ea45-4a90-8a23-b9d0675b7248", "value": "333.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af44982d-bbae-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762501938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762501938, "uuid": "8b46fcaf-21c7-4a35-b9b5-3676c982bf0b", "comment": "Malware payload", "value": "4ae238ee356dc81d439b6d81feaee87d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762501938, "uuid": "4e3d85b5-cac8-43a6-9814-13079a22e19f", "comment": "Malware payload", "value": "872cd0d0d2794e85f831e92d73256de3004ee8fc402464aa32ad198101043e2d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762501938, "uuid": "fa0b3ce2-5eec-4ade-982a-0c6aebeae796", "comment": "Malware payload", "value": "50a43008b00606131c27fed597eeeb12f3c1e63e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762501938, "uuid": "c5ab3730-c00b-4468-87bb-59d219f7f826", "comment": "Malware payload", "value": "1700f80169944d41fd99523b99dbf2f8fdf4d1bb67545213b2d17923194a6968d3389ce3993c980168f506398131a972", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762501938, "uuid": "6e5a3d56-5cd5-47ed-b1b5-eae917654597", "value": "T106767D6AA6B801D9E46BC1BCC6875227D371780953B457CF1AA06EF61F63BE01E7E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762501938, "uuid": "f7a0bb3d-11dd-439d-8b77-81eca4ff1502", "value": "c903a4ebf5c713828fb01d5ba95a5643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762501938, "uuid": "c84fc48f-64bc-42c0-ad8c-53cc3ac7a290", "value": "196608:0GY1Q+2P6YiEKEm6U4b17YuW1R3imJyy6:g1Q+2P6UKE3b17YuW1R3imE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762501938, "uuid": "9616b6c6-1ce7-4297-8f57-4565f08bca0d", "value": 7311872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762501938, "uuid": "e7f4655e-354e-47ea-8f1f-a2d14915818f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762501938, "uuid": "fa5036da-3beb-4324-945b-07b1b8579977", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6627d478-bb8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762486354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486354, "uuid": "77405541-7fa6-460e-b621-68a534184107", "comment": "Malware payload (Joker)", "value": "87fbbc7d80c0fc7e7cb767155b959bd8", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486354, "uuid": "a0bf1632-dee8-4cdf-9a44-96bda11eba2c", "comment": "Malware payload (Joker)", "value": "8989ffcbca68297b0f24bb433ea234eb7ee04432f4d226e72a82462fd7ce3212", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486354, "uuid": "c0b7b6af-cfb7-4122-a056-26f2bc1bf7d9", "comment": "Malware payload (Joker)", "value": "d5284ed02b00961357f8000cbd46c991348b29ef", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486354, "uuid": "6c4cb44b-9f7c-4156-a7a0-0b5f2366a11a", "comment": "Malware payload (Joker)", "value": "1f6664860a4d4f283335abf024a6a1042f6bbc11ea48167237d6d6dadf89d513e0e1c727c98aa1018d4297c5b292ebe2", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486354, "uuid": "72354685-8efa-4bcb-a4f2-861e6d5452f3", "value": "T1AC280209D50C9936E9CAF17C9F6D0763F1367C5802A4C19A7829720DFAF76F08672B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486354, "uuid": "38b30177-7648-4aa0-978d-bacffc9e3ae6", "value": "1572864:XMH8MHat1Lk/jKYaYYe3c0R+9Io5Q/LZMF8ERKZn:XZ3LAjKY0cXLKF8Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762486354, "uuid": "fe5774fa-ce29-4c6c-af77-fb1b6412034e", "value": 97626044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762486354, "uuid": "ae981e6c-fb0f-4ec4-9fd3-12f3726ae9b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486354, "uuid": "c17c8804-8ac9-4c61-9227-2b0244e82b78", "value": "Shorts+&+Reels+TV_2.1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c45c1f-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556406, "uuid": "2600026e-7e71-4f42-8fc2-454896f5c7e4", "comment": "Malware payload (Mirai)", "value": "5b8f66c016e1ba5c63b654e6aea99e39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556406, "uuid": "5f07d5c2-9f91-4e4d-a8f4-f43353b06092", "comment": "Malware payload (Mirai)", "value": "8a247bedf3322d4408d4e07f881d0b16e89168afb53c876fb034851a9f5e0fc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556406, "uuid": "fdd55588-c782-436c-89ec-cd50c582f2a5", "comment": "Malware payload (Mirai)", "value": "888a7f32d1ec5b6d6eb5ff00a58871cb9e723eff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556406, "uuid": "8fa56ffc-5fb5-497e-95e5-dbaa0cb59f93", "comment": "Malware payload (Mirai)", "value": "56a4a64a19f6d02da077d09052c24234a605adbf88d650985ab023f90981919d6cb5127721157544a368db4427409cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556406, "uuid": "5c628e7c-7722-4692-9aba-1225d38c4dcc", "value": "T1C4934A327A36192BC4C0A47A62F34765F2B6578624F8C60A7DB20D8DEF6462037577F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556406, "uuid": "35f1f6c2-24e4-4f75-aa80-13230545463f", "value": "1536:FgqrodSvAei/NXwx0F8T+Po0CBUAi665rt4tztvtHALL7uQY:WNXwxY8T+ARUf6KEhBGnuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556406, "uuid": "f94c24f7-4fac-4652-8440-058ca89129a0", "value": 95524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556406, "uuid": "192b7526-246c-4f86-97b6-f90c4ac90c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556406, "uuid": "16af1cd1-e879-4c54-8c85-a5b23e8bfb32", "value": "kvariant.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0011852-bc07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540245, "uuid": "5f1294f0-e7f2-4ad0-bf2f-7b3a9c85ac49", "comment": "Malware payload (Mirai)", "value": "f3f1463b533912497565863ccf0cbed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540245, "uuid": "a37fb2c5-bda7-499b-bc31-3e50f3ba96ac", "comment": "Malware payload (Mirai)", "value": "8a251a42f505a8455599775d9e3a34aaf43d639db7edaebeb0658fbfb064b2ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540245, "uuid": "5b47ce32-1923-4faa-86e2-50e632e22130", "comment": "Malware payload (Mirai)", "value": "b23142bd0d28dba4db4c5a87723075b93a26651c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540245, "uuid": "f6a1aa0d-cefc-4514-a471-d7a2ab376e26", "comment": "Malware payload (Mirai)", "value": "3aff5fcc37e1c16f100e25f76e1318f7cff9bb8f1314b80b7e1c8f8f982f788eea7aaceb35785dc3e57b619c832c4ecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540245, "uuid": "83171129-d33f-4aaa-a668-94074207d10f", "value": "T131C3294AFE818A02CAC76ABABBAF054D37157365D2DB3107ED156F6233CA0BB1D27150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540245, "uuid": "1581d095-4bcf-407e-b316-64533a7ae315", "value": "3072:z2OorI4M7YEKrXd0jz8BrMZhsjqKh8nNgn:z5F4M7YEKh0jz8dWhkqFNgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540245, "uuid": "ccf0a3ea-009f-4c13-9de1-3832f9836154", "value": 127656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540245, "uuid": "00c938c4-8789-4593-a145-3c5db021712d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540245, "uuid": "56f70ac2-03ea-4608-9e0e-ca979590321b", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdbd51d-bbab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762500698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762500698, "uuid": "c705e6c3-a37a-458d-ade1-690ed8c1d5af", "comment": "Malware payload (Mirai)", "value": "0d2e7606119c282ba40e1e60844e3284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762500698, "uuid": "e326054e-4b41-489d-925e-efdc8b091812", "comment": "Malware payload (Mirai)", "value": "8a43c5645064ec5c06650c2a2a5ca0e23378f892032a8b63352fc397f48d3856", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762500698, "uuid": "468544ad-39fd-4c6f-98e4-b3ac26900368", "comment": "Malware payload (Mirai)", "value": "38ae434ac75188ef6414f751ec9f6738ad5e11d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762500698, "uuid": "45e355eb-33bb-49c4-bef0-b536e022cf10", "comment": "Malware payload (Mirai)", "value": "7614a376fd6bec8329a69f55b022df9b73e728ca2819802b1edb064929fa6ae17b1946f8b18c40707833443e32494fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762500698, "uuid": "a6c17ed2-1a7c-4d37-933e-f451922bdd7a", "value": "T1D2734C01B30C0C43D1A76EB4363F23D6C7EEB5E121E4E688650F998A91B3D72515AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762500698, "uuid": "22bceb26-6d6d-43dc-bf78-18a1e9bdaf91", "value": "1536:BGf5d9ZwT8b2b2izCBA2AIJq8SrD+dx6NGaem/1:BGBdLb27uAIc8pjM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762500698, "uuid": "f6bd30fc-1179-4043-a95b-a4a917cad99d", "value": 74112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762500698, "uuid": "2ccc1b6b-5803-4d6e-bd87-b0a4a420dc95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762500698, "uuid": "c76b1eda-5f17-4b55-afcd-802cafc63fe0", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bba809-bba2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762496867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496867, "uuid": "aa374ef6-6f48-43e7-9099-62301e3eb4df", "comment": "Malware payload", "value": "3fdd611492ae21ef5db558964394a86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496867, "uuid": "12bb895f-a5c2-4f9d-8e80-3f163b3e8431", "comment": "Malware payload", "value": "8b21606674c7ce4731f867aaf43ea3a317356b788a6bd451b6615545269577a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496867, "uuid": "b2225476-dc29-47dc-bfdb-7d628c8c28f1", "comment": "Malware payload", "value": "1a04139f9b9c82d906e9ce23f301ca9684c7673d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496867, "uuid": "32f0d2fc-3976-4d8d-aff7-c045b7a60adf", "comment": "Malware payload", "value": "8cc7a9799960bb0edeccb04046090d105cf446772822ac60323d2ebd797ca85f96859768625b089e7a4330de61602963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496867, "uuid": "a16a5736-47de-4c54-bf3b-76e2effefe41", "value": "T1F6F633B91BAED683E166FBB92E33B146B7DD807E73894B6FC506501CA0A41D054270BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496867, "uuid": "65a0754c-b334-47e3-bc16-9ccfac5b60f5", "value": "cad4c96e19ec6e52560b9ccb84edddb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496867, "uuid": "1b12cdfe-a1a1-456a-b6d8-c638a947b3a2", "value": "393216:dwEzmf17UERPRH6Wse5zokeqAyyoCzzyVmUcTax9j:dwEz2QERPjswokeqA1oCzzyUhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762496867, "uuid": "016f6b68-eb69-4da1-8229-d965ff944772", "value": 16289499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762496867, "uuid": "499b67ac-f9c1-4c07-a268-561001c91a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496867, "uuid": "ac0acec9-47ee-4b46-bada-c526528d7bc7", "value": "TPD1120001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07541d42-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498650, "uuid": "6d77db03-6bc4-4c00-90c2-0601763e2336", "comment": "Malware payload (Mirai)", "value": "ceff1b35eb120c748e728b57780e6fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498650, "uuid": "52674ea1-c383-4100-b52c-49befc3e5344", "comment": "Malware payload (Mirai)", "value": "8b4d8301640768e6b76d05edde67df02a44ca42dcdfba7a1fd25081e8f719044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498650, "uuid": "37694041-1c9e-4d8d-9549-cda6ee1180a3", "comment": "Malware payload (Mirai)", "value": "5741182f1f8b20539624af8cef20670520eac54b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498650, "uuid": "6c6c2af9-1b47-45f0-9c10-e5a21ccb33a9", "comment": "Malware payload (Mirai)", "value": "8786f8447b788a9df3a78a52f06762fe75e49421c0932e4902272b57bec08e77623325bf6777331a2fdd72c8f48b7d3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498650, "uuid": "a060962b-e5e5-4037-aea5-fd0b450ea5e0", "value": "T1AB63F845B8818A12C5D91379BA2E168E371363F8F3DEB2539E106F2477C682B0E7BD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498650, "uuid": "2aa30f34-31df-4540-b43d-2d218c13f529", "value": "1536:6unQqBHiNUNCKaYlk30MM5Opgtm439mrsplDKZUZQBKXAVanQX+F8JyvWJ5Qt4sN:FiNi10kMlitf9mrsplDKZUZQBKXAVanh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498650, "uuid": "47ea6b08-2aa5-4927-854d-bef9768be2ce", "value": 71812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498650, "uuid": "b91b2a59-508f-4c24-b9ec-12fbab384292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498650, "uuid": "8c80d1ad-0bc9-4e4f-bd9b-b3a032bd72b8", "value": "xd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1a91d9-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526391, "uuid": "887c3c64-9897-4f54-814a-4b0a3a088913", "comment": "Malware payload (Grandoreiro)", "value": "6c6f18fcebc9f17af55752a85a86726f", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526391, "uuid": "776eb39b-79f3-4289-a79b-fc232f9acb71", "comment": "Malware payload (Grandoreiro)", "value": "8cb677f225de646225f4f95b0fa0dca1d227cfec0468029da54ba6bc1f6a577a", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526391, "uuid": "245bab8f-4b7d-4b03-9e19-d8a6bb7bdf51", "comment": "Malware payload (Grandoreiro)", "value": "2dbfd151edc0ded4eaf6184ecabe6204cbba0b07", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526391, "uuid": "41cfd0a0-8424-4429-99ab-0841ce923f99", "comment": "Malware payload (Grandoreiro)", "value": "55df4c69d348d5ab81dacbf4049aa6ddb89bf30a73dfa51d866a10827c71c77e9595f8d9b3132af79c7400ec7316caaa", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526391, "uuid": "29fdaaf5-49a7-4c89-aa1b-3850b3553f1b", "value": "T179B633716B542C33C7700334B09F3B295EBD9D57894DA1DBB9CCA186329EBD1492F8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526391, "uuid": "4b06df6b-bee2-46c0-b4f0-d9fc5e021002", "value": "49152:FwXGUGwvqtm+c+xWKVPV8i3PUQ36CHv7T9IIqavZvFUy3lXkerI5BI/YQfyTO5mG:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526391, "uuid": "cee075c9-401e-4a4f-b2b7-02e76a4bfe2e", "value": 11462656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526391, "uuid": "a66806d2-0917-4aa1-a836-c3e0d4e0dc6e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526391, "uuid": "f3eeee14-9960-404b-b286-133eea60111e", "value": "TMS64833724ZS139124.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b111eafe-bc0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542743, "uuid": "76859447-121a-4c55-85fb-d7bc5f211207", "comment": "Malware payload (Mirai)", "value": "a20019d7d970b2b22e2e0db90d81309c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542743, "uuid": "236e5072-83f9-4725-963b-02d02d753f59", "comment": "Malware payload (Mirai)", "value": "8d1f6f80ec6418292e038a5abdf3a75590dfe64dfd621c615a3191ad1d77cf4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542743, "uuid": "bd7ec93d-184e-4108-92c5-d6922c74370e", "comment": "Malware payload (Mirai)", "value": "8fed6b844488bcfd453bc947e1c5ba24cea633fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542743, "uuid": "3a63df96-ef3b-4fbf-9a5e-ea4d664799b1", "comment": "Malware payload (Mirai)", "value": "377a8b3e95b608f62363bfff631e550196703ac6fad7546d3b6dd231b1b35b2ea3058b922247d487fbc966b586b7a954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542743, "uuid": "2cefcde4-30be-473f-80ff-bb8b299b9b69", "value": "T15DE34B8ABD819A11D9C726FEFA6E018D33536BB9D3FD3112CD106F25238A59F0A77112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542743, "uuid": "ced5efa5-b007-4d19-ade4-9e5391b1f3a8", "value": "3072:/BwxTz+8DyYQQ5j2noABGh3aEySfy1rN3GqKYCpBt4i0xL:gW82PQ5KvE3aEySfy1J3GEC/t+xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542743, "uuid": "de36c38b-2614-4e08-b287-feb47913b476", "value": 148400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542743, "uuid": "18359094-a8f2-4b0f-a1d0-410343fee69b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542743, "uuid": "a8d55146-475a-4b54-b083-325e0c76ff18", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a5dc35-bb9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762495164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495164, "uuid": "0aa9e5b6-db30-4271-ac67-db665731001f", "comment": "Malware payload (Mirai)", "value": "b836bbc9b5a834344c347d406d489dcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495164, "uuid": "d359572f-5239-43c0-a6c4-580f61a255d6", "comment": "Malware payload (Mirai)", "value": "8dfa1b63873d8aa1ffb943710cca05bd9d563db6851361923103fbdc35dc98b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495164, "uuid": "84894819-ae11-4a30-bacf-1fcc39348a13", "comment": "Malware payload (Mirai)", "value": "52388b88300a6288a525757a236be2a4fdad6b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762495164, "uuid": "0367b8c9-e50d-4b1a-9e52-367b96277e59", "comment": "Malware payload (Mirai)", "value": "1eae874a5d50524cc4388d68ff2d26d34e261fc54f6977ed6b9b09afe6479262d826464a46bbf4eaa07aac61ef37251e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495164, "uuid": "570eebd3-b43a-44e8-9207-baee3bf9823f", "value": "T14303F1A570DF99C416B01C329BEA854D7713A238E1E6726D78AC09089EE14C15BEDBE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495164, "uuid": "a18e7e67-7dc0-4190-8c5c-902bb4c95eab", "value": "768:xuXbeXWjz3Xyr+Yf49K5D74EVIEzWkqnUa2Q9ahNuOHyj2jl87+Rs3Uoz8:xWbj7y+Oq8D7hjWkqUjqME2yyV8z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762495164, "uuid": "ee4ef460-3c9f-4a0c-bab4-b375f4415101", "value": 39916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762495164, "uuid": "aaa0a8c6-a182-4499-8f2e-dc2c15e4bdd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762495164, "uuid": "1b00fdd7-9671-46ac-bb80-e7c510c94a9f", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba05fe8f-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526438, "uuid": "a49e19b5-b3ef-4a43-bab9-8a738e2a39ba", "comment": "Malware payload (Grandoreiro)", "value": "22715d6a83cc22158f9d904a6136563c", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526438, "uuid": "55ac02e2-c1d5-4ebe-ab96-c1cb72959565", "comment": "Malware payload (Grandoreiro)", "value": "9066433f761394e8c8bf52c4bba2a030ff448323af647c2fa0502775b9d7ffc8", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526438, "uuid": "a8c13b6d-4635-4885-aab7-a852e6f877ee", "comment": "Malware payload (Grandoreiro)", "value": "bd7ec085b0268d2e7e4f1d7d39dd00228a0b578f", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526438, "uuid": "92b73334-c9f7-48ca-ab43-510e0a05db60", "comment": "Malware payload (Grandoreiro)", "value": "43fb23879fd6a2ea7285089622e0f1b8e46364aaf0ae50fb5450430902ad759882f020a12deffa835c615de6db684b8a", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526438, "uuid": "e7a062e6-aeff-40ad-bcb4-ab18a8569bc0", "value": "T1817623726A55287BC6F10735B00E2B67EE7D4C57890CD2EAB9CCE04A739F6D0452E4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526438, "uuid": "14cd2192-fe20-4b21-ba65-64cc5eec6122", "value": "49152:xH7RJl/5/isi4QkFo1aA1iEqX8/yIJ0/QFxcFUWR/w+KuL7bI87JnqCzvMnnk+Of:juim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526438, "uuid": "2a2eb630-1f3c-4455-8b85-eaab014fa097", "value": 7131136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526438, "uuid": "bb6fc962-1731-4833-949c-8ed0b5087f34", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526438, "uuid": "33c923ed-f248-43e6-97a6-61f87f39313b", "value": "TMS9140M92SZO42437.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717bd1e9-bc0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542207, "uuid": "b05c6da6-f25d-45b3-a7f0-8e1259fe9b57", "comment": "Malware payload (Mirai)", "value": "1490f480081e4c7c88eebcfbe8a452a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542207, "uuid": "5130375b-297f-456f-a809-47670445784c", "comment": "Malware payload (Mirai)", "value": "918bdb2d980ff51b27dcff6a456f33d4a356effadfeedda4072e68de9d57948d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542207, "uuid": "02e0184d-360b-46d6-a899-141cb0b3e672", "comment": "Malware payload (Mirai)", "value": "8b13fcab6e05cbfc139e476cfd93aa2c9c434025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542207, "uuid": "654d642a-ceb4-4267-b687-5dfde4d350d1", "comment": "Malware payload (Mirai)", "value": "137f60a83f4011b20872c85801e8508e3c7aca92aefb5585b47f54425e400e2623abb8dbe4e80f9ba86bb9d657e9087e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542207, "uuid": "63c7012a-1542-4dab-85c7-891a983a1252", "value": "T1CC13F16090E79CB1CC38FAB45EFE12433441367EE5BB91B757A21870A9DA35E78D8D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542207, "uuid": "929be2c5-145d-4650-a3ff-ae2980870030", "value": "768:SIwnj82JCAzMR7fEL3tqXE8gz3Eollj1FtCAUm4Af/RAV3CYw/W26n6AaoeuxAun:0g2FMdcLvzUg/tRx7/W+Z6n6roQ0bLlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542207, "uuid": "b5da5f0f-c0e6-4795-bb6e-4b8375543f21", "value": 42980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542207, "uuid": "76198088-637d-4d32-8b7e-6dbecd8ee17b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542207, "uuid": "6b1d1dc8-af62-4dfa-8e24-64b59da0a7de", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb8c7bc-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498584, "uuid": "0f3d0d53-2823-40fc-95a7-49c7266e420f", "comment": "Malware payload (Mirai)", "value": "08e10999340a66bb0483850d0b193756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498584, "uuid": "05ad29e7-4e48-4e65-8b45-c409f291078d", "comment": "Malware payload (Mirai)", "value": "93fa783e7990973db1375abeac734ba1257d00ee72f3c1f2d47442c89018eaea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498584, "uuid": "49ce2597-42e8-477e-bd9e-be016ea8aa25", "comment": "Malware payload (Mirai)", "value": "e1c85b0827b25a6df08e0582e62c09f6ba291600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498584, "uuid": "13b4bbf5-129b-4377-83fa-f96935b99a89", "comment": "Malware payload (Mirai)", "value": "51858a0a5ec0b0d1cfb53353c5485d63b592248983876aacdc4122dc1c24dc915cbb8bf4b298af4cea08042b31ad42f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498584, "uuid": "887f440a-e3f6-48fb-a63f-9f9e6d21c26e", "value": "T1AD534B21F4392F17C0D4A47A62BB4B6AB5F506CF25A89A4E3D760F9FFF2009059079B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498584, "uuid": "1ee13be3-9ca1-4695-a706-3dce1dd8973a", "value": "768:yIio7ph791D1Kq9RfrpsE1DyWoYcA+YR1csMa/Zr2MnojcgcNO+9fOi184g:RiCpBfDgSRfrpsE1DyW/csM+ZrBj9tIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498584, "uuid": "78a886b5-e16c-43d6-9cf4-4a3f40d633fb", "value": 63472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498584, "uuid": "57c88a9d-7123-48e6-a552-a8699279868c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498584, "uuid": "93e127aa-b55c-49bd-974b-928e524883bd", "value": "xd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0e09d3-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513694, "uuid": "222197f0-c722-4048-b125-ff48147ef401", "comment": "Malware payload (Grandoreiro)", "value": "4345010c46374d6df5ddd2b4e5b76519", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513694, "uuid": "5a717ab3-b25f-40b3-9b9d-6f000e7d01b3", "comment": "Malware payload (Grandoreiro)", "value": "957f15b933ad3fe7a5e4a9b3616e189c2dd5765abb92ef9515d68953adac5814", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513694, "uuid": "799d7bca-af8c-4f31-85e6-080b30d0a1a4", "comment": "Malware payload (Grandoreiro)", "value": "fbee7695c0fc0035d85c21709e0a6796f1f714a8", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513694, "uuid": "5583f1ad-f983-4354-8ac2-29c0a8166fd3", "comment": "Malware payload (Grandoreiro)", "value": "6ebaac90e06e86a73b37511d1a1be7c46fdcf2b05f5b550cbe0aa244c3c62d6862e4d7ff4f9a150f21d303ee79683c0e", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513694, "uuid": "24b3d801-1315-45a7-aad9-e308beaa5339", "value": "T1C646237256A4252BC6E20F35F04E3372AE2D94678B5C61FBB8CDE149339A9D5C53E0B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513694, "uuid": "38be6d8c-968c-4d53-a15b-edb54b550952", "value": "49152:LT+huhUtHO7Io8B1Ol++pkyvinuuoTSIur0buH/clk74xyfeGpXTsc1FJhNFzvSF:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513694, "uuid": "a669e0da-edb4-47b3-a7c1-5e262dbc5e8c", "value": 5492736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513694, "uuid": "3db4fa8e-1752-4260-b6c4-e20b00991cae", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513694, "uuid": "4ffb0e7a-498b-4ae0-9e71-278345655f8a", "value": "QBN15414281L4969437.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dfd801-bb72-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762476149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476149, "uuid": "aecfd667-de87-4679-8fce-b3e09d77f449", "comment": "Malware payload (Mirai)", "value": "c37d691e753234523a4f9fae3db19b4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476149, "uuid": "53aeb6cc-56e3-4193-b9af-a0a1d9cadc59", "comment": "Malware payload (Mirai)", "value": "95b55787ccde3c26e6640e26b15502b5ac2be58c4a8ccb1f62bc0f1614f881d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476149, "uuid": "249c640b-1278-428c-8a09-78a4ccf84141", "comment": "Malware payload (Mirai)", "value": "48960a6ee96e7f6f2fbd2723b6ded8ba4f9f9c0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476149, "uuid": "df4fe9c4-5bed-4461-bcea-ea7dc838b210", "comment": "Malware payload (Mirai)", "value": "94a4dc88cc6c0ee95ff7ea907889e8344c6a10fc9b9421ac346a5e281e049ed97d8c3151eaba79262b9b45ad62854814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476149, "uuid": "b5d4a85c-72c1-46c1-9af8-8260809acbc7", "value": "T19103E16193396FC8DE9AFF10685273D1ABD00F8EFE5EC69172A4FA011111D26BD279C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476149, "uuid": "7a3f6ed5-113a-4946-a40d-a0016828b35d", "value": "768:eZfiD9kywx2VoEQM+N/dIl5Eqxg2NLeEGcaPk4uVcqgw09/:eBiDesVTQM+huzE2sSaPk4u+qgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762476149, "uuid": "f02410cc-9e77-40b9-b75e-acf8fbdb7a1a", "value": 38004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762476149, "uuid": "c9b4ad46-70bc-47f8-b210-7254966207aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476149, "uuid": "1d5bd695-3278-4fc9-9528-1d6d4e9e221d", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764b1425-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497977, "uuid": "3da11dd7-d0fb-4279-80e9-01a5570ba3da", "comment": "Malware payload", "value": "dedc27fdbff82fe5245c2b3237dde553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497977, "uuid": "9bfd0ca8-652f-4bfe-82e3-4b33d2fc70fb", "comment": "Malware payload", "value": "966fde1217ce69581b6ca04761fc0a8d5a9e8dc56b256bb3576f00b89e987da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497977, "uuid": "4d5024a9-febb-44d0-8ec6-7e1931e1cff9", "comment": "Malware payload", "value": "ef16865b07261be6826dcefcd4ccb1f77972319a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497977, "uuid": "de9df056-08d9-4077-803c-7ea6bfcbe570", "comment": "Malware payload", "value": "67222c7b0c30a93d0681fb5ac1bb84625c047d057e60f652d61b0a550fb128ff0eaf3881c49b8a1c45b43bc38dc0429a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497977, "uuid": "300e4cb4-79fe-4201-8e3a-8795317ea221", "value": "T1F2183323A24EB72ED0696A3640B6FD21153FAE30542ACCF7D6F45D1CCE368A41D4EE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497977, "uuid": "c047b820-29ca-46e8-9873-7229ac3ab24e", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497977, "uuid": "82d79a1b-3c9f-4b67-baf5-f077960a1a97", "value": "1572864:UTvR2AQPu0heSJYmY8U7QK6/oEBGieMSz9o0WUjaMBfAxwHgPqm:UT52xDh3JY78Uu/XBjeM8o0WUjhEMix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497977, "uuid": "fc3d189d-5a99-4e8c-804e-b462c26672cd", "value": 90475888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497977, "uuid": "6af364ae-9245-4219-adea-d42175cf57d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497977, "uuid": "e3c0bbc9-bc0f-4e52-9fe3-20fd9669fb51", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf0805d-bba2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762496779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496779, "uuid": "2002efdc-87ce-4c7a-8765-7eb508ce0861", "comment": "Malware payload", "value": "4d2f5070b14c20638c77a931da2be710", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496779, "uuid": "d2175f6a-5f07-41fc-a2c3-c01777b13b57", "comment": "Malware payload", "value": "984bbe16d9d844722d748a482625ac7aee356c7be1ece9152ed6ec4c7ab5086f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496779, "uuid": "6a47d4f8-c624-4de8-b3c6-ae6e28d5a2eb", "comment": "Malware payload", "value": "aaf0457662bf0c2bc743a48b1a6221d056a965e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496779, "uuid": "6bf3be0c-fad3-457a-ae65-9cf6f0271509", "comment": "Malware payload", "value": "838759f1060e7a759be724d03ac9ef67730321aec6508e57724ac328a6449adde833489be52764de57a9b41fa821b0c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496779, "uuid": "aed88b2b-e612-46d5-9766-287f235a9288", "value": "T103E039F92832283C189ADD0257A24C10629D81E296758EFE99F8D4E044CFE1418CC16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496779, "uuid": "7f26aae5-a28e-46eb-8fe9-a61332227482", "value": "12:v0FhTRlNiPTRlNdeMxTIdefpTFcvoyTb+EbEUEz:U1M7dsIdFxsb+EbEUEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762496779, "uuid": "d3fd4583-0865-4bbd-b07c-4b64db0cfb1f", "value": 420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762496779, "uuid": "b43392dd-9209-47b6-92e7-fe85fda99abc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496779, "uuid": "5ef387cb-54ed-4431-861e-98ab1b5f6cf6", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956b2340-bc03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762538402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538402, "uuid": "7997e57e-52b9-4974-80f4-8d20d087779a", "comment": "Malware payload (Mirai)", "value": "bab34b9d24754e9d4e83b3ee81b3fcee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538402, "uuid": "84e38d27-d8a4-482b-bacf-b3e3a02e1129", "comment": "Malware payload (Mirai)", "value": "98a33ca83265ad2d65685bc890a181a6adefa24b7125f983e66e045b890387a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538402, "uuid": "db86ee69-a50d-480b-b081-a9d86437e4a0", "comment": "Malware payload (Mirai)", "value": "34d37da9458e1117aad41419c579c48fd4a43ade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538402, "uuid": "0c2614ee-a722-4514-9ccc-0864ec9c59be", "comment": "Malware payload (Mirai)", "value": "a9bb1f051bd78847a5a6a0f967bace8905943f36a8017bb6ded58867982f37ca645f04029dbccbd36b2d1bca9cff07db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538402, "uuid": "3f3359e3-40b5-4044-b5a2-54cfeec87a9c", "value": "T15FE3BFD7F75B24B1C89106F407D34B8C2A5361069EAF94E77C2EEA7B29351CB18163E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538402, "uuid": "d9fbea34-a257-4fbe-9cff-4a42132d0754", "value": "3072:/i88SH3p/jG0TXxaBsfPLFMKDJVrzFgfxq:/i8J5/D+wi8Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538402, "uuid": "140fd964-1cd4-4580-a007-b39fb679c384", "value": 148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538402, "uuid": "1e0661e0-ac9a-464a-8c8c-2eeb32622a0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538402, "uuid": "62e85c96-2f60-455b-80aa-2b2963e69be9", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d871ebe-bbaf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762502096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502096, "uuid": "b3752c66-2e91-4499-80e4-b0cdee3a97e9", "comment": "Malware payload (Rhadamanthys)", "value": "8efa780ee4901a0bf5eba76dc0365092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502096, "uuid": "2f790ada-900e-47c0-8dfd-ee4cd4dc207f", "comment": "Malware payload (Rhadamanthys)", "value": "9a263ada9289070045e4a9f22b0036a37ff06de299e05a8a985ee8b407a77701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502096, "uuid": "4f375931-f3b8-40e5-b1c5-72206445acdd", "comment": "Malware payload (Rhadamanthys)", "value": "dbf8da63a2718185a9743626b17affc7c90e520f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502096, "uuid": "87c87598-20e3-4fdb-9da0-7d04eb4e80bf", "comment": "Malware payload (Rhadamanthys)", "value": "cdb68c9cb333f7567bb5c4abc291d20d783dce05eeb70c2c0e2485938e1719727483793a68f9fe09a10ef95fa6998c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502096, "uuid": "85675f1d-9f8d-4363-aaa6-47f90caf11bc", "value": "T173142CC6BFC9EDD6CA11523456FA83291338F6D81B824B036C6561350F17AE07E9B787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502096, "uuid": "798d61ef-6556-4b47-b336-f7f02ffb79fd", "value": "1d890bda1c073e408420cf36dc29210b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502096, "uuid": "e27a5ee0-2458-4828-9355-c95eb62b951c", "value": "1536:JYej3BAgqHYf0VDjBRNNvgEa43SMFes1raRF5HNHnbzV4B390v3zsis4YdmqlpN4:uejKgqHYkvNWkgw0fUNrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502096, "uuid": "daecd8f9-8f02-4b8a-882a-08cd0b678fd2", "value": 190973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502096, "uuid": "be6b6b2a-60b2-44b7-bc07-a893093e4e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502096, "uuid": "42e3ed7a-19f8-4ede-ad43-044c7281f8bc", "value": "img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b713c4c1-bbd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762519990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519990, "uuid": "d3f6efcb-17ec-4a56-92e4-17d9c9f46190", "comment": "Malware payload (GoToResolve)", "value": "4bf2306482d7dbbe214ca9e035455fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519990, "uuid": "c773d033-90f7-40f1-92ee-eed4df74d97e", "comment": "Malware payload (GoToResolve)", "value": "9a6898380b7be05c8fc81ae1c53a1a217bc520083a302c2cf506aacff8374990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519990, "uuid": "559d7f75-f142-4bd9-b9b9-30eca1889173", "comment": "Malware payload (GoToResolve)", "value": "eecee5be514878449552ebb5ec5ba45765516b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519990, "uuid": "e2bc171f-d0e2-46e1-bee0-76f7f2681968", "comment": "Malware payload (GoToResolve)", "value": "9ae5ecc00615594075bb3c1a121c15e7d81817e13f430827e1340b98a2889fa6a37e0f541b39276b828824d06fa8b4d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519990, "uuid": "d4147e80-8845-4ef9-8b6d-4716fef9666b", "value": "T1CF3733313156C031D54202F2AD69AFBAD3ADAD35477A44CB73E86F2AC7314C27A31A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519990, "uuid": "49a7fe89-44c4-401b-bb52-ec5d46e36f13", "value": "5077e3f17a4376dcf6421ee6917bf4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519990, "uuid": "d58b39c1-86aa-4ec6-a134-72d9c0533442", "value": "393216:HchTd2JfbpEMIXXQEft9EDd8gEgSPjeh+DA9eyOhHy1ibWMxXsU1+RB0KzY:2TkyRXX5Cd8cThp2y1ibDszRB0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762519990, "uuid": "6179f442-5179-4db3-b059-ff25467ca9e8", "value": 24479256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762519990, "uuid": "36531c4f-a1af-48a3-90a0-b9b0afd6ac9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519990, "uuid": "4ee9f2bb-f67a-4814-aa6d-3ff2e7208fbe", "value": "\uc804\ubcf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f063dc-bb8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762486426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486426, "uuid": "d660bcd8-b161-470d-bd14-7d5ca4f9a30a", "comment": "Malware payload (Formbook)", "value": "395ac356edd0f2ad2e2243f20ba68f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486426, "uuid": "6da07221-15fb-4c6d-8e73-8520d6885fcf", "comment": "Malware payload (Formbook)", "value": "9adeec7138d5d6854c3632ed0560edf5566d75347ffb0b13aa441ba89aed930a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486426, "uuid": "89139645-4932-43b8-8160-221752cfce1e", "comment": "Malware payload (Formbook)", "value": "6659c39f4ac6d345c4bf110085bf8ec02fb32dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486426, "uuid": "de1b1a6e-f7bd-4022-a337-0e5781040cf5", "comment": "Malware payload (Formbook)", "value": "a9a3e82854dad32fb2edb32e7bece6fdc1ed826791ea98a89c9cff2d903f448e8c38e8533ea7c5a738e38e19885391b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486426, "uuid": "d2c1182d-d2a1-430c-91f7-520b743262e8", "value": "T15445C01363EE8365C3725273BA25BB016EBF782506B1F96B2FD4093DB920122525E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486426, "uuid": "cd90ce1a-0bd7-41cc-8847-76db96d5bc2d", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486426, "uuid": "b26d93a3-ac04-4529-bdc0-2817c1c9c768", "value": "24576:ftb20pkaCqT5TBWgNQ7aIsACqwRqudB1bgSpYZXt6A:cVg5tQ7aIgXU4TgcYv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762486426, "uuid": "8d7d7ecf-3b01-441b-bc05-dcbfa31a3483", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762486426, "uuid": "b8f65c05-4f53-48c3-adf4-908aaa9f6df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486426, "uuid": "6f8b407b-4857-409b-8bfd-4f70bc21654a", "value": "Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acacdbcc-bba2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762496780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496780, "uuid": "6ffc6791-f009-4ed1-b9eb-53220eee92d4", "comment": "Malware payload", "value": "ca843e6f9995e0079f63768f4cc7d89d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496780, "uuid": "dafae022-b8e9-43c9-bbad-c225d37991e5", "comment": "Malware payload", "value": "9cadf4dcc03be8d8dd7d1aef31b4ceeafba92e7977886ee62b06d73c332bb432", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496780, "uuid": "a495bce9-3e0f-4ea9-92f5-ce9c1feada4d", "comment": "Malware payload", "value": "c8c064442f4c3ad68ce03ec458cb668645ef84d8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762496780, "uuid": "08c666f8-745b-4005-81f6-01ad5bf6a5eb", "comment": "Malware payload", "value": "102d3dafa643f1061b0f1bf199265649e9126698398dd8b79ae07e547238d7192089cb21d677fc6fb90c183167046adf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496780, "uuid": "f1743045-e156-4843-be07-6099b3e185cd", "value": "T1BE5185C6033288796CA7DE57FDB5EE1632DA419199E15F01A4FC74FC60CEE287888653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496780, "uuid": "cbac1a73-f25a-46b9-932a-2a7d11ae2081", "value": "48:U1yIyn02Bs1yaMyazvf2Bs1y9NKy9z4f2Bs1ycyjM2Bs1y9ySl2Bs1yjMyjzqf2G:UiJWpQzv+Wyjz4+WixWYAWAdzq+WwqWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762496780, "uuid": "0f7b619a-aec1-4ebd-98a9-8bf56f2380a2", "value": 3066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762496780, "uuid": "0901898a-c227-46ee-9f5b-9dbfa8fb3098", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762496780, "uuid": "d67476c2-6596-4fc6-b627-b0a4c04eac23", "value": "huh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e3375c-bbbb-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762507592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762507592, "uuid": "3612e667-ba72-4b16-8dd1-2ec6b8a80b19", "comment": "Malware payload (SnakeKeylogger)", "value": "a7fed3543f9d6722d7eb75864a995308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762507592, "uuid": "cbf11097-7bdb-4f78-89e6-4c2ac6ba6d87", "comment": "Malware payload (SnakeKeylogger)", "value": "9d020d9aa66b2f0f5ed13065b7d9a8413e8834fc77d78572f4e280965758ae42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762507592, "uuid": "a29a51e5-52e1-4731-8487-53714b546881", "comment": "Malware payload (SnakeKeylogger)", "value": "9f9091a21c8a69a96f56268cf89040ff7fc73e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762507592, "uuid": "7264e58e-33ae-43f7-a4ce-448c8612e008", "comment": "Malware payload (SnakeKeylogger)", "value": "c9f074f50580a94dc97790521a938436eadb5d32a24e80f2a7a5efa2fbc3945b71ceb536c4cfb8390d6690ab2a284bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762507592, "uuid": "6c002552-c09d-449f-8b05-047c537806a5", "value": "T1BBC412582B9CCB13D8A66BF029B2E27413746EAEA460C7178FEDEDDF38267115014B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762507592, "uuid": "6c6d4e9f-5b1f-4462-82c1-2843d0ecd606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762507592, "uuid": "9290c2a6-8977-4be0-a1a5-2831a11d2122", "value": "12288:leRPALpVOo1AfnEiUr+sYvNLSp2yCE2AnE51LlkJGz/lwC:l+YLOCAfjsYvsAJA2l7z/lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762507592, "uuid": "76c2e8c6-e0a9-46de-b886-1468cf07f732", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762507592, "uuid": "34ded4df-660c-458b-bb75-bc5782891fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762507592, "uuid": "cffc9c38-80c9-42fa-acc0-f5c8dddd99fa", "value": "Document Fvat 2532_PL_2025 2025-11-07_253510_ Original.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03139ec-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526421, "uuid": "a9337f26-65d2-47d2-9502-30e5bec505a7", "comment": "Malware payload (Grandoreiro)", "value": "93c7e424ce93204afb5ab0c9496a526a", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526421, "uuid": "3486e48c-9bf5-4fd3-9561-60fe9cf1df5a", "comment": "Malware payload (Grandoreiro)", "value": "9e4c77bfa9899516b70166efa39fd9725c5006dbb55912cfb9daf3c14cd2ad4c", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526421, "uuid": "c1c616a9-d237-4394-9e1a-2c5ea2da099f", "comment": "Malware payload (Grandoreiro)", "value": "cbd95881ebdec264e2b648946107881031b5cee6", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526421, "uuid": "661da669-e3bc-4a0d-944a-50b4657e5332", "comment": "Malware payload (Grandoreiro)", "value": "b9811a06e142c4d548320e8eff9b29b4a6cea5c8328d17d969103c167613ee47bbee1453dccb174b027df7a6d14e8854", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526421, "uuid": "79f454da-41a5-496f-930f-834bd0e8ad3c", "value": "T12F5623725A68292BC6A10B34F00F37B2AD7D8857CA1CE1E979CCA15633CB6D7452E4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526421, "uuid": "42ae79fc-b6bf-4c51-9d2c-73e345fd4a8b", "value": "49152:5GrGOHA8NCYhoK5Of1WcMrkeGWSlESmmRb/tg5VOAUjq7uDzEe31yxEioMpM/:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526421, "uuid": "64444d64-800a-4c13-b602-5b1c35500c16", "value": 6346752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526421, "uuid": "9d126101-9a04-4794-8e40-7caf4fe7501d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526421, "uuid": "d2b0149c-9d9a-4b43-aedb-a95ed0343686", "value": "TMS48205O14SOS37369.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad140d4-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513822, "uuid": "10c1e85f-dbf4-4c71-abcc-d82cec6d2053", "comment": "Malware payload (Grandoreiro)", "value": "2b119bbf663c0f767722fc55c9be8660", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513822, "uuid": "f984fc09-9f16-4218-abf8-3458f2867fcb", "comment": "Malware payload (Grandoreiro)", "value": "9f3f228690b24e8bc8f939eeefed8818f3ead7d8f2ab694db187b6e79fc8af4f", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513822, "uuid": "5a9132e7-78f7-457e-9e4b-cf92844ba294", "comment": "Malware payload (Grandoreiro)", "value": "5f8603691ab035b3ef7844ea1e63c4ae5d82e125", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513822, "uuid": "d060bd80-5cb0-40b6-aca1-f99d0c7ca901", "comment": "Malware payload (Grandoreiro)", "value": "e84a10e149588f950d7ef500c689fd5d104420b4904affa405d382f2357417fe1e10bd84fd4f0a6bf8e9b0995c73b747", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513822, "uuid": "ffc920f0-d849-4aaf-ba62-ff78287948b7", "value": "T1EA66237297A8247BC7610775F01E27726E3E8893474C91EBB8CCF14E37CA6D5893A4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513822, "uuid": "294ce241-aea4-46d6-a506-48b69d2359e8", "value": "49152:WBBY9CJI3hsl7WOwJtijU310txFLyzoHofBlW58Ualvhil7bjwYaMNrn2Qlb9YUb:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513822, "uuid": "c2b98c35-59ef-4ccb-961c-8c84ff925eda", "value": 6955008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513822, "uuid": "c0b8e5fb-9560-4f2f-b810-e652be15fd16", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513822, "uuid": "1dc3766f-2c1b-4a8e-bf1b-a26425e1a913", "value": "QBN3692YFP27019971.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4967fa-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513716, "uuid": "0f9a2c74-48ee-400d-854a-fe6671c5be6d", "comment": "Malware payload (Grandoreiro)", "value": "76484ef52ae60e338767e337938e5712", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513716, "uuid": "cdebbeac-9530-43a2-9e7c-bf81f3913244", "comment": "Malware payload (Grandoreiro)", "value": "9f935bfecac32a7fe9ab3d471403d68dc6b516388953d78420c7bc53c2dc70dd", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513716, "uuid": "0050f327-5a5a-4323-b499-4169a3ca9047", "comment": "Malware payload (Grandoreiro)", "value": "f9500845370db4726ab46f8b4b8362a675240367", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513716, "uuid": "d735dd54-3873-4b85-851c-c3cd9d044250", "comment": "Malware payload (Grandoreiro)", "value": "71a0867708152eee4a573a819ef8889399d469e8a315faf6b2a91e1be057ece5d4da51c7896e4bf04f2b79489a04ae52", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513716, "uuid": "3d28ca84-b16b-4769-8941-53513988e4e4", "value": "T1F83623739958346BC6A10B34701A33739E7ED8A78B4891EBB8CCE24633DB1D5497E4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513716, "uuid": "612b70c4-41b0-4209-aa69-eb5e612400a3", "value": "49152:CUQ78HL7DfAFCZtAhDIo3M6Es4tMqYH9kTxtvO2XGFzZL8xHR3QbOqc+Au:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513716, "uuid": "3b41d57b-8f54-4c36-9fba-105e86cb388d", "value": 5001216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513716, "uuid": "607b9369-5280-46ca-9e78-f8b63847ce7c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513716, "uuid": "22b19d7a-f0bf-467c-b569-1d911e8ed781", "value": "QBN9051JZENOX04875.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e6ab82-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498408, "uuid": "e96f52f1-6539-4a30-9c8f-d88446ff5d5d", "comment": "Malware payload (Mirai)", "value": "d2e6088b477d108bb8e6db0659567287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498408, "uuid": "14e4e980-1236-4761-873e-012c7efaf460", "comment": "Malware payload (Mirai)", "value": "9faf9b7146b3b69896e53386006d1d16d5b551e57ca57310eebd8c2459050412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498408, "uuid": "81ed2f3a-00d3-43fb-a34d-6897e8dd5e7e", "comment": "Malware payload (Mirai)", "value": "02a27bd3d5b37c25be1498445baae3596c7d3dc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498408, "uuid": "daf5172f-0807-4493-b0b1-069443e6b747", "comment": "Malware payload (Mirai)", "value": "b7f6a15e00a8e9bff3c3bedd7d8e20d8ee121586d52e71752b9398e3a2bc61318ee550c1802c7025384efcd6118cdde3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498408, "uuid": "9f11b9eb-433b-4ad2-9673-d9b2691d6cd7", "value": "T1B8733A65FD418613C5D122BBFB1E428D3B2717A8D2EA3343DE269F61278B56B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498408, "uuid": "88cb9f61-76c8-468b-a883-cf6b71b70d40", "value": "1536:5S4T6K/8IyknMjFjEWqQT+1AnCnCtCgjvTUemf:5v6w3y3xEWqQ4Kle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498408, "uuid": "9b7d005b-62c5-4d79-8dac-a7b79d869bf5", "value": 75724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498408, "uuid": "ae809741-a44b-47a6-a809-5f9d870642c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498408, "uuid": "77ea14a4-d0b8-408f-8d49-eadf39721496", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fc3c40-bb6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762474755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474755, "uuid": "653ec1c0-7c8b-4ed9-b7ae-cdd8dfd617fa", "comment": "Malware payload (Mirai)", "value": "ccacb17c6ad86a031df1f66b3b301697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474755, "uuid": "ea8cc3be-0259-45a8-9ee6-9a26e9560bdf", "comment": "Malware payload (Mirai)", "value": "a09391102f7bfad73cf0cfbd64645d0513ddd031d379884d67866c50b53096ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474755, "uuid": "f31be4ca-a119-444a-bed6-c8dee3427518", "comment": "Malware payload (Mirai)", "value": "62addf900ae6b90dc59fffbe0a2dbd545b6a3b35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474755, "uuid": "a421c38a-3277-4fe4-a9e6-f58efdb91ce0", "comment": "Malware payload (Mirai)", "value": "5ffc661289be981fb82b1713699c164f0355337d0cd42fe627bf1caa713f23f3f321279980cb91d66533785b57eb2cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474755, "uuid": "5cd3799d-c980-4eb5-8fb1-470057808726", "value": "T120735BC5FAC3E4FAE81205311277BB379AB3D53E2168DF83D3B5967AD822502E41625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474755, "uuid": "195b1194-75ba-40f0-9623-bf1a9424478e", "value": "1536:5lq9SXo2rL7RBBoH4q2e03IS1dG9DMcAI:5U9x2zRXa4XegxTGuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762474755, "uuid": "35f8ba7b-4058-4489-87e4-ae69c531e6a4", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762474755, "uuid": "f7994feb-148f-4397-b28d-ca4d925fc88c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474755, "uuid": "5de96386-bc36-43bc-be37-76d70c7de6c1", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b231b1d-bb89-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762485986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762485986, "uuid": "75e78401-82c9-41b4-b909-2f92973ef102", "comment": "Malware payload (Joker)", "value": "427e4b8f2276a53235d882a7223e9206", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762485986, "uuid": "b296228c-8d77-4423-b78b-5bf8888ecbd1", "comment": "Malware payload (Joker)", "value": "a0ec8177336e2c6085ce3f1b7a65d6687ab3a298b64a210194c9534b59c3b62b", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762485986, "uuid": "5af22f81-83ef-45d6-9e5c-ba28d816fcff", "comment": "Malware payload (Joker)", "value": "63980c94af5b6dd0331aed98f8e567b9935f3710", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762485986, "uuid": "b323e982-8ad5-4c4d-9dd1-2612ae23692e", "comment": "Malware payload (Joker)", "value": "fb9c450e6e6b1381e16505a93d7e9e379da67f638d1499c29674ccafe5ed0573e3763088b0497895577bea626882cdaa", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762485986, "uuid": "5f18689e-5e55-4ff0-88b2-a7af36986c07", "value": "T14477121AFB0D992BDDD5F2785D2912627622ACA4624297CB1D01F23C7FF7AC48E097D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762485986, "uuid": "58122571-a7d9-46be-bf96-d06ca46e7dc5", "value": "786432:TTWNv4YZmj0yf6jCBA8TjYvmFqpPudHBxCo3DtxfTg:TTWp4umjXiduFqpmp73Dtx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762485986, "uuid": "8f1401f9-032b-48a9-8f87-32f0ebd506a9", "value": 35569080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762485986, "uuid": "c73c9bfa-7d6e-46f2-af25-5794a01b15ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762485986, "uuid": "d283a12a-d2e3-48d7-b1bb-75593bfe6483", "value": "Go+Clean_1.1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277e764d-bbc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Bitter)", "timestamp": 1762513307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513307, "uuid": "42728292-8ef6-4e28-9fad-95b67ff35613", "comment": "Malware payload (Bitter)", "value": "4bedd8e2b66cc7d64b293493ef5b8942", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513307, "uuid": "f3188cae-08bd-4c7b-be83-b078239ba8b7", "comment": "Malware payload (Bitter)", "value": "a39a26838e6bc26502ff0b562a3a098d55c5ad5b6daf4405469ce5e11f2192a4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513307, "uuid": "17d603e2-21c0-45e8-9174-929fd19969fd", "comment": "Malware payload (Bitter)", "value": "d5fc860bf59dddaac2b81e73017319a6c0dc5049", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513307, "uuid": "10d5dab5-21cb-4c93-a985-c271f7254b20", "comment": "Malware payload (Bitter)", "value": "186f282433e542186145ba8c35fcba2f724f07e418d066c60e78cc2e4d849af11f64268bdc93bab6b9254f329a49b0d7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513307, "uuid": "a0427d31-9c9e-4591-b57f-d1024b95b350", "value": "T19D92BEADC905B82AE3A9957CD05901E6F35DC00BA206F4EF0001631F9F5368767EE98F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513307, "uuid": "759c8597-057b-4a38-8c99-96cc9e8a8b88", "value": "384:3eEL5WQZgDAI8bdbhMmVwm6u87/QG6F7//o4MA78QKEVaW:uEjY8b8mVB6usA78L5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513307, "uuid": "fe20579f-9275-493e-b122-919d0948a397", "value": 20403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513307, "uuid": "03004aea-55be-4cf0-8b01-e73031ad123a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513307, "uuid": "837a2761-c520-4323-903d-0a96153908a7", "value": "Normal.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76972f72-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513869, "uuid": "14c0306a-ef4d-407d-ae3d-c1e3b29ab2cf", "comment": "Malware payload (Grandoreiro)", "value": "5e1862eca48ae490e6eec1681822cf1e", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513869, "uuid": "4eaa0ba5-5844-4b97-a857-67461570c3f8", "comment": "Malware payload (Grandoreiro)", "value": "a3cf57ab73eba073d0874c6ae5589f2404d17add1ea363f54fffc8ca79170659", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513869, "uuid": "93d919cb-b921-46cb-879a-4d03550c6163", "comment": "Malware payload (Grandoreiro)", "value": "77aab13d0df36060b2f457216b57df2452178d11", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513869, "uuid": "0cba9d9a-a544-4d0e-8860-5c02f5754e8d", "comment": "Malware payload (Grandoreiro)", "value": "0913928f94628f62cf05f2f8ad8d3c6b26c51779a5d9e047a6e6fc8474f39152e5d6a5e2500b0ba18eb543425043963e", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513869, "uuid": "d0aa79f6-a4e1-422b-a102-008e5d820598", "value": "T12B4623B266942437C7B10B34B04E3772EE3ED8678A4CD2EEB8CCA145379A6D5452E4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513869, "uuid": "eacfd91e-1bcc-4591-99ae-9cc9644567f6", "value": "49152:SMLWr4k9+V2LasOtOSX226hXo+tgr8TIV8sS76obucyl9+NZx298nNFZJLi0BOaq:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513869, "uuid": "6070dc86-17d8-4459-b7ba-f23b1eaaef6b", "value": 5566464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513869, "uuid": "60a5d42b-07ee-4650-bce9-96f074aee485", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513869, "uuid": "7d40972c-4912-4b33-8549-739f1f23169d", "value": "QBN360945CQ6S8768841.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d51af47-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513854, "uuid": "2c52e630-99c6-416a-9436-3e88e4de81a5", "comment": "Malware payload (Grandoreiro)", "value": "54380f94cfae14b04c36e4d463fd3e6e", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513854, "uuid": "f5876a07-cbb4-4581-a14c-9343ac68ee67", "comment": "Malware payload (Grandoreiro)", "value": "a41cb5f40fe718e71db3f19faab6062336e400d400bc11f1aebacc339a61c6e7", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513854, "uuid": "2ce04e53-a4c7-40ed-977a-cb33e6756e2d", "comment": "Malware payload (Grandoreiro)", "value": "12145b9eae395a8f2b4f6d1a0cc7640fdfe1f2c7", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513854, "uuid": "f0870f26-b39b-4511-91f3-d7892dc590f2", "comment": "Malware payload (Grandoreiro)", "value": "4119d5b98a0d75f2caee35a09153deb825ea2d106885ce2b9e2dafc47872dcdef307a97b703a85cd7f807478f51a42df", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513854, "uuid": "a4ec8007-4c4c-4b08-8c5d-937293ac9d10", "value": "T1D456233359A4392BC6B00735F05E37625E7E94A7874C91F6B8CCF28A368B691853F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513854, "uuid": "fab8d3fc-ccfd-43fb-9238-48c6760501db", "value": "49152:siVYxQFWWIDeO/FNzx231aYn7TK2aQ39M0t+bXCn6p+NpEec9oa9oc+jRd+awbH4:Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513854, "uuid": "92ea9e57-0b9a-4cad-88f4-0a670ad8057e", "value": 6406144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513854, "uuid": "561d6c8b-f251-4d3c-ab13-c22e69456ca7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513854, "uuid": "cb033a17-58c4-4658-ad2a-7c46a4ecc118", "value": "QBN0325O1XN79764.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2b9679-bb82-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762482763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482763, "uuid": "2955413c-7ac7-494b-be2a-8a89af52f40c", "comment": "Malware payload (a310Logger)", "value": "3b4a6119440136a1b3f286e815189ae8", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482763, "uuid": "e258b756-9bc6-4b17-9605-39bcbbce0a9d", "comment": "Malware payload (a310Logger)", "value": "a57f0775c8de97d1592ffb63b65488c5f2470bc274f5fcfadbabf734f51f4c4a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482763, "uuid": "754eb0fb-9555-411b-82d3-fe1622b74631", "comment": "Malware payload (a310Logger)", "value": "979af52c57a4bc22da1e98f5ce0681368f672fb3", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762482763, "uuid": "73a76c16-2a0f-48c6-9f8e-394a57863fec", "comment": "Malware payload (a310Logger)", "value": "f5647f9c0b39950bd1fc0756880b39066352856519c3a1d8e7f05ef853b3505e007147fcc16e497f24081786b7b32082", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482763, "uuid": "457ba6e1-23d1-4abc-8784-f6d7d55fc7ef", "value": "T17555D02273DE8364C3725273BA65B701BEBF7C2506A1F96B2FD4093DB920122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482763, "uuid": "b27f17ff-e92c-4d71-a41e-2b44654e141c", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482763, "uuid": "865d723a-8109-42e1-8772-9436ce694dff", "value": "24576:Rtb20pkaCqT5TBWgNQ7ap1p6EMdxSieQaEKR8HQBd6A:iVg5tQ7ap1p6VWsHs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762482763, "uuid": "32124685-4470-4e04-a79c-7f64ac9af83c", "value": 1321472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762482763, "uuid": "25c7dacc-1c81-4172-98c4-1b90da0e69ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762482763, "uuid": "180ad0e0-6655-4548-a204-d323230c81f7", "value": "Pre Alert MEDUAY500301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a623224a-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526404, "uuid": "00c13aa8-47fa-426b-b65f-ca144ec3dae6", "comment": "Malware payload (Grandoreiro)", "value": "f3a270a4d223e39f0debbdc17426cc94", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526404, "uuid": "ffe314fb-9b79-4306-9852-afa1f4766c2c", "comment": "Malware payload (Grandoreiro)", "value": "a6c4f47ed547c843e33d0b3b2279394ff0804c64bbe4e024614027f45fafedc4", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526404, "uuid": "dcaf97ba-a384-4fc9-b953-6d8d1ecb7617", "comment": "Malware payload (Grandoreiro)", "value": "75f91a18ae469a5956365111962cb201652d1e78", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526404, "uuid": "0f3f1299-646b-4b68-ab45-4fb4ae339490", "comment": "Malware payload (Grandoreiro)", "value": "3148bf20555f7ded2df164d2f39bf5869881b3840c413dd8cc4bc2cd0fb4ab622632205b45692d025334b62bdd896e85", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526404, "uuid": "1477a042-e676-4b73-ab3e-158cc39e982d", "value": "T1F4A633319E593C77C6610735B01F3B66AFBD8C4B894CA1E6B9CCE04A339E685493B478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526404, "uuid": "ce5194ba-3e0c-42ce-8430-e73d1fc78527", "value": "49152:0tTkFQxHo+IaNilHJEbeFjF/rlzNE31Daepo3huVXh4HzRl65+ffZUO4kj1/50xf:kuim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526404, "uuid": "d6c7bb02-44a1-41c5-8e29-7c1887f1c4d9", "value": 10194944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526404, "uuid": "c3593a45-b474-4f8d-9062-38de26f39db3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526404, "uuid": "e99a5e48-1dd5-4dd9-ada1-da6fbc74f339", "value": "TMS60711AEIE416817.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321174e7-bc27-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762553697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553697, "uuid": "b8cc0d51-f1dc-4cd6-881b-25aa2d717bf6", "comment": "Malware payload (Mirai)", "value": "7041b9eb1a1af3a4f68d0297f455d428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553697, "uuid": "7be0392c-e299-4aeb-a9b0-098053bfa143", "comment": "Malware payload (Mirai)", "value": "a711edbd85491ecceb68adb1b16d1ed048257f1a53f7066a1ce8069b58ddb840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553697, "uuid": "840c760b-c54b-4913-961c-f9b593d69e6f", "comment": "Malware payload (Mirai)", "value": "5aef47413b0b781212b43c0ec640cb8409a9a915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762553697, "uuid": "eed6e107-c2ec-4e39-981d-ba1309a5b5db", "comment": "Malware payload (Mirai)", "value": "e6dd1ccd24af27b49cd0ae0b8120e15a35d760d76d36f7bdd202345c607ce26ea66253b345e1cecac86c43d908917e8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762553697, "uuid": "2c5fee8a-4c73-403f-92de-6a663c60a180", "value": "T1CD03F16E913FD579E496E0B3243EF780F5E56A0378DB071E30E035278A6A42136B2D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762553697, "uuid": "9f6266a6-b126-477b-bbb2-b1a3df09f8d4", "value": "768:vkUD9pmD5dMXz34vbrzmAky8+qZbeyGGvv/J2tyFV0z8bHx0YM:8uvMdOoHzmAky8RbevtuxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762553697, "uuid": "2686e897-1bbb-4d54-b228-27e1c74ae803", "value": 40060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762553697, "uuid": "698f4840-c3a5-4b95-8405-fa5892b3b489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762553697, "uuid": "4a66e761-89d0-4fcc-a3f7-2c1c3d7b9397", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4aa94d-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556479, "uuid": "120f4b3e-827c-4c32-9b26-5cb4dd99282f", "comment": "Malware payload (Mirai)", "value": "9b526836dd97ea325c1683e592e367de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556479, "uuid": "0e24925f-15d7-4e92-803c-80a34e91322c", "comment": "Malware payload (Mirai)", "value": "a7e4a8a3e820f0694211d21228136a78b42e83c53d6a4635653d1b74ff182ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556479, "uuid": "657800e8-89c2-4ebf-9e65-67c7abe2eda5", "comment": "Malware payload (Mirai)", "value": "c1580dc90a7373f1b69a498b62f8dbaedd3b5452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556479, "uuid": "acc94c66-8c97-48b4-a83f-ee24aae1bd04", "comment": "Malware payload (Mirai)", "value": "d2a19622604e4f1d425e2dc612f70e78911978639a6a4bcf9eb719d086649c5c1e2fce2e6bffee4aaf071fcfa4a66f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556479, "uuid": "69e8dddc-89e2-40b5-b0a9-5a031ab5c7e1", "value": "T178834B13649191FDD4A6C2744FAFA526DA33F07E9130F36E67D46E222E4AE302F4E245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556479, "uuid": "8bac4657-634a-47bc-935f-81230a55bdf4", "value": "1536:97NJ3Ak6EH/G8ENH9cmoYuvcY3Fl8Ruru:pwk6EuRHLoYIcsFCEru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556479, "uuid": "b65a6c46-27d8-4594-b2dc-c168c893b317", "value": 83784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556479, "uuid": "3761fd08-ebc8-4e5a-8032-7b2c98c63d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556479, "uuid": "7f6d0e6b-a610-45cc-8534-93b15611e4ee", "value": "kvariant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e9f5a3-bc0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542134, "uuid": "9daca677-cd6d-43ad-9b66-68d04cfad061", "comment": "Malware payload (Mirai)", "value": "d2e9e85e44687a88b3efce0f45e94d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542134, "uuid": "7d2f3d48-1258-4f26-a739-8df82844c98c", "comment": "Malware payload (Mirai)", "value": "a899e6cbe2c6727b536d2f82c22d2e6bdbbf7ea90944e58fa0ddc40aeea1372b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542134, "uuid": "1f021c49-2656-4b97-80ea-e1575ef45e02", "comment": "Malware payload (Mirai)", "value": "a2630f189ad5bc08b3a6213af054d53082368e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542134, "uuid": "aae6f26a-40ef-40ff-b982-58fd37a97925", "comment": "Malware payload (Mirai)", "value": "b14fb4386afdb1a0be03edb50e47868799d3fc9777fabd11fde628043ca899a16e60622825b68460cf78718a6afaffe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542134, "uuid": "b8170764-b143-4dda-b290-ad6a645ec33b", "value": "T14B33F1572C071FF3E7106DFAB97A0F0FB71E1EA980E110938895CB9A348158FB9E8955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542134, "uuid": "f461dacc-e53d-45ad-9240-d2a225641e94", "value": "768:iTd6I5giCI93Vnnv+ldOq7uxu7260jQ73XrMUTp0RtXxfnfBHTi90YuUhD28EmLz:IMihrvCwnu78cHRpSBZnfxiqYzD27KL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542134, "uuid": "0182706c-d451-47bd-8387-ace5175e63e0", "value": 52380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542134, "uuid": "11f49d56-6062-411f-80ee-e3efac119ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542134, "uuid": "7e96f3df-ea2a-42e5-83c8-c3433502b6e6", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61675ee5-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513834, "uuid": "6ad644b2-f83c-4bc6-8543-673d5d3bfebc", "comment": "Malware payload (Grandoreiro)", "value": "c7e02ce1e89be5373ef3ee9a875f3c1c", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513834, "uuid": "92d1e35b-0426-44aa-830f-132d602909eb", "comment": "Malware payload (Grandoreiro)", "value": "a8ee880c3232dda42b5243a2b30956358273766c0be70b3c8a859afa1f657641", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513834, "uuid": "7a68b12a-7df2-45a8-83b4-2e2a65ea4176", "comment": "Malware payload (Grandoreiro)", "value": "8ecbb7cafb44e88dd5bb3689719ec45a5fef10cf", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513834, "uuid": "64372639-d940-4dd0-aa5f-1609c51c1ffe", "comment": "Malware payload (Grandoreiro)", "value": "e5faa4ede259da2207900a1e031cf931fd0426db0ab97a735350c9c11cc5926267e80a44296b07ba22abeb259bad20cc", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513834, "uuid": "117c23d1-4847-4f49-9ce6-8c686c90b625", "value": "T1776623725E54382BC5B14B35B00E2772BEBD9853C94CD2EAB8CCE14636CBA91857F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513834, "uuid": "eb203a4b-134e-4394-bcd7-37ff43a41df1", "value": "49152:HYb3KPtHEt6XwKD6qvGrfG19xYmMLgcVGXRaKQMK+nnr9wr1q9LU6VIDf5a2AgF+:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513834, "uuid": "78611bbe-3990-47bd-a23b-cd2d5838d197", "value": 6682624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513834, "uuid": "7e631b57-14e2-48d7-81d5-f34ef67f5827", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513834, "uuid": "9f3d3764-8f39-4824-9bd6-14b1088957ab", "value": "QBN705133VOB929954.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6703f685-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497952, "uuid": "e6aed68e-2580-4d65-b5d7-f7a3f5722977", "comment": "Malware payload", "value": "a42380d40c230284f799fb80ec550dc9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497952, "uuid": "b6ce0149-d5ed-41ad-b842-9fdeea098f73", "comment": "Malware payload", "value": "a9b2ca36bd59919b2b136fdc5eb090df8ddc3524f3d329844e42f810f118b3dc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497952, "uuid": "b6b367ab-1e48-4331-a124-922a1589af78", "comment": "Malware payload", "value": "928696b9cdc76373ce61ef840a258ca2869c8c61", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497952, "uuid": "85c4801a-d462-4d93-8008-287a975a675e", "comment": "Malware payload", "value": "b9b3fd6c2590870915483011f9b1235360064cf91bc122df8edff7168cb9b0a01296882bbe5a4b3f18a13386dfffee28", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497952, "uuid": "5c3bef6d-b721-49d0-befb-cd1626bc3f70", "value": "T1F5260142FB84E87FC4BB8237453646A241A7DC268E83C7835959B27C19779C84F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497952, "uuid": "f0ef1064-d849-457e-bb49-bcbc7ef2a3fd", "value": "98304:Yur0C+d7xjgPFr3qyaLk3/SEGPJXaQNWTK+5gD4oOTTafLaP:8d7WWLkPGo6/D4zcLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497952, "uuid": "8a91f6a4-85ea-4ef0-9fda-d3a76d09c3c9", "value": 4480494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497952, "uuid": "a090ca0b-5e3f-4422-a088-95e9060899c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497952, "uuid": "c9793899-a4f4-43b1-9c8e-a352626a6230", "value": "FishMaps.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4502fca7-bb97-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762491882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762491882, "uuid": "b3dc645f-d912-4e27-bb73-0238cfe2232a", "comment": "Malware payload", "value": "68ea85640e2aac4e88ff0e9958fb45f6", "object_relation": "md5", "Tag": [ { "name": "Data Exfiltration", "colour": "#51AA4A", "exportable": true, "hide_tag": false }, { "name": "Data Exfiltration Over Local Diagnostic Binaries", "colour": "#EC616D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedTeamAssessment", "colour": "#0E346D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762491882, "uuid": "9cafce5a-27d3-441c-ad38-bf60856a19db", "comment": "Malware payload", "value": "aad6c9bf1f3ffc5b3cbfaac1450356b7e0c5f696da5b9d4f3d1cf0e88de7367b", "object_relation": "sha256", "Tag": [ { "name": "Data Exfiltration", "colour": "#51AA4A", "exportable": true, "hide_tag": false }, { "name": "Data Exfiltration Over Local Diagnostic Binaries", "colour": "#EC616D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedTeamAssessment", "colour": "#0E346D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762491882, "uuid": "a27a0e3a-786e-473c-99fa-bf0d8566d1f6", "comment": "Malware payload", "value": "0f3c925b6f8e529d595881853588578faea0572c", "object_relation": "sha1", "Tag": [ { "name": "Data Exfiltration", "colour": "#51AA4A", "exportable": true, "hide_tag": false }, { "name": "Data Exfiltration Over Local Diagnostic Binaries", "colour": "#EC616D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedTeamAssessment", "colour": "#0E346D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762491882, "uuid": "3dfab1f6-9941-45a8-9f27-897e4b1f31f4", "comment": "Malware payload", "value": "8d2cb1a87e9ef87a7a118377713191c53acf2d2f341c8cec4c76c3f8e2c157b78615091f04d609225fe647565de72cc4", "object_relation": "sha3-384", "Tag": [ { "name": "Data Exfiltration", "colour": "#51AA4A", "exportable": true, "hide_tag": false }, { "name": "Data Exfiltration Over Local Diagnostic Binaries", "colour": "#EC616D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedTeamAssessment", "colour": "#0E346D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762491882, "uuid": "1a2afacd-311a-4594-926b-4e26b09d32af", "value": "T10B1339487768D22AD6AF0D7DBDA21514027296135102DBE53ECC25EEEFA3704C2A1FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762491882, "uuid": "6113f290-30bc-4230-bdc6-532440376b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762491882, "uuid": "f540922c-82b4-4b33-acd0-52df11374746", "value": "768:ImQZqx1lYcTYbFyf8q8nObC/x/u8TowWusXbYC1Mk63:I0lYi86CpdlXUbL63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762491882, "uuid": "f3c85c2a-f481-4707-80dd-ce1e5e7e0e61", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762491882, "uuid": "6b3cc72d-e741-4a22-9d29-60de679fa3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762491882, "uuid": "aaf59f00-c777-458c-a7d5-3a053d3fd391", "value": "CiscoEDREvasion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fddde6-bbc6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762512180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512180, "uuid": "bb970047-ed78-47c6-bafd-7f1585825c78", "comment": "Malware payload", "value": "f4229997bc3ebeb32b423ee4918ea733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512180, "uuid": "173e9f07-8529-48b7-9b6f-c009a991def2", "comment": "Malware payload", "value": "aafd587feddfdcae825933fc3196fedbe9ceab5a382cca8d8e4dd8a41784d914", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512180, "uuid": "38cb00c9-0628-4ee1-a998-0a288af685c1", "comment": "Malware payload", "value": "b99bfa0f69f99842da0d0de488ec36b6e0f4183f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512180, "uuid": "fd235012-b28b-4ad8-ae2e-930c7c790f93", "comment": "Malware payload", "value": "99fa7dd24c7ccb0e726a9599bda102ed29e06c79b6171054b51f6d97d2d877af7f82a4061679a8f39de2dd11f7f29554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512180, "uuid": "cb049adb-57a5-4387-a520-0d70bd6f0a91", "value": "T1E7653A3BA29001FDD14AF0B499DBC1F3D954B8F4162636AF538ACA223D51EE00B5DB5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512180, "uuid": "4887d53f-f84b-42df-b189-cbe97dcc6ec3", "value": "24576:SPgaT8O+h8VYwLVLXb1REqiEUucG2JkNVz9IiS:SPgU8O+CVYwXb1R3iKcPJI5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762512180, "uuid": "ae125ea9-1f4b-4b07-af41-9af7ac1b68bc", "value": 1434440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762512180, "uuid": "e38bcb54-86e1-4279-826e-1bcc0893b299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512180, "uuid": "2d738704-a17b-443b-a5d5-d19caa235d96", "value": "sshd_v2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e2ec17-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513844, "uuid": "98ee5d89-9bc1-44a8-9b60-639b29fbc383", "comment": "Malware payload (Grandoreiro)", "value": "c1ba470f7ec0597592d757e144f566c8", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513844, "uuid": "0b972ccc-ffcb-454a-b7e2-ced5e160201e", "comment": "Malware payload (Grandoreiro)", "value": "ab17600d52849a7c87e68c2165ac12ce09b2e5f1844c6e078c660cdf016fee78", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513844, "uuid": "2f8a729d-b3ad-4fad-a22f-01deb747e50b", "comment": "Malware payload (Grandoreiro)", "value": "a9013b2c3c2c7b79e9581014871a55045255ba8c", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513844, "uuid": "39aa37a2-93a8-4530-bded-37f64275eb5a", "comment": "Malware payload (Grandoreiro)", "value": "ccde7343a32ef25fe9ffcb1d48ad353d788de7eb43e70a4671a4e7b5ebd78bda01d7c3e585a6e4748c183b595f1ceb56", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513844, "uuid": "2620b80f-a58c-42ae-bb1a-0bd04c133b41", "value": "T1AC662372AE643A17C7710735F01F3713AEBE9867460CA1EB78CCA18932DB6D6453A5B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513844, "uuid": "1d8e4bd0-2a33-4cba-ab9d-57341ff40284", "value": "49152:bbECekYgMYUreQbbazDCCPZ8w+Aw99ObshvJUwM5WBCHV9576EVTvTDAJoLEcSFH:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513844, "uuid": "8c8c6532-6d00-4f63-993f-fabe172d78c7", "value": 6674432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513844, "uuid": "adc84108-7d9c-4f4f-9923-f8fd6caa27ff", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513844, "uuid": "959ddf10-57b2-4a25-87da-2e668729b661", "value": "QBN4358K8FY2584.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28fb22b-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1762498964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498964, "uuid": "1a36abd9-fdac-4bd9-9a20-27f853cfe36f", "comment": "Malware payload (DarkTortilla)", "value": "b0022539593c48afa66a4f22f8532d6e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498964, "uuid": "d4675869-974f-4677-97d1-210fbcd847a2", "comment": "Malware payload (DarkTortilla)", "value": "ab28803f79757760027a140b87cf9d068ec8c6c8ebc541a680b6f874aeb63a05", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498964, "uuid": "4bbab450-d8d4-4167-aead-3ad764faeea3", "comment": "Malware payload (DarkTortilla)", "value": "9514c58701f8ab07b8a095c7cd2fd68ac68b31ab", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498964, "uuid": "bbeac953-1c50-481e-a49a-fb8db72d2d1e", "comment": "Malware payload (DarkTortilla)", "value": "5fa34eba2776f5ba85dd9ac68166f5f04487f5697bd36dd0189773e3dd27f712117d6c20db9532e98882818587876b53", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498964, "uuid": "3a274767-f375-4fc5-9e7d-86e0ffcff378", "value": "T1C245C01A2BDD6AF0E17F8F359274015047F0B60BC232E75E6994F3F9CE92B895512263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498964, "uuid": "49ee925c-5f55-4ad5-aaee-bf5ceea6435f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498964, "uuid": "7e31a9d7-ffc3-4342-bf1a-6e6beba19faa", "value": "24576:x6q64Cj8Yy0e0f/9KoYrv0eogZQzAy+A:sq6488Yy0Lf1vBe/K2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498964, "uuid": "db3991b9-cebf-4cad-b1ba-4c85c45cb4cc", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498964, "uuid": "e34f856b-f209-4014-b9e6-58be975f9a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498964, "uuid": "3ebecd07-2d6e-4b42-9ce1-94df20394b8c", "value": "documento escaneado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add8fc65-bbb5-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762504942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504942, "uuid": "5dc82c5c-6031-4055-81a2-633653ec9969", "comment": "Malware payload (GuLoader)", "value": "92d19643a8319b257a07b30116844db3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504942, "uuid": "817a278c-7dd7-482e-b0bf-c5699ce89aa9", "comment": "Malware payload (GuLoader)", "value": "ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504942, "uuid": "7da5ad6a-bfc5-4801-850f-e88d670a69c8", "comment": "Malware payload (GuLoader)", "value": "c980d520a1fa939ead91e1b9ddc03256fe2b8ba6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504942, "uuid": "e0db4b12-54d4-4769-a748-77222662bf1d", "comment": "Malware payload (GuLoader)", "value": "f611046f882380287693213ef4f656475b9ef93c26fc7d0878a2507645c49b8309d73e828ffccad7012312a56b069ea8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762504942, "uuid": "5f4f02a5-8c3e-4ba2-8962-5dcc60b7b771", "value": "T1C8835A66DA2406160E8A27AAFC451E52E5FCC104065760EFFED90F4F610E86CF3FDA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762504942, "uuid": "ffa968fd-93c8-41c6-9606-9cfc874a6461", "value": "1536:bhz2/feCJB5SFwRmFYGmhaCfn8VL94gBpTurA8SMC2yP3pmNKApuxiwnG:pCf575SRY3EVh3BM/SMfy/p4puximG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762504942, "uuid": "72df2a9a-9c89-48ce-a92b-9a4d87c00ad3", "value": 83801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762504942, "uuid": "56f9f020-3f0d-43e4-8251-5a66fb3ba129", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762504942, "uuid": "4d3a47ee-4f86-43ab-92c2-8d471f4382dd", "value": "Zam\u00f3wienie H-53 FV12112025111346347547.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9380f7-bbe8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762526955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526955, "uuid": "106fb81d-46cf-471b-969e-375aa7817f34", "comment": "Malware payload (AsyncRAT)", "value": "bbf5552056cc6629f69c81cad9c33130", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526955, "uuid": "07cb7295-eda9-4509-947e-59d3e170cf49", "comment": "Malware payload (AsyncRAT)", "value": "ae5b1853a93a2d9c46ab423aa90f650b8f4a2f2edb94a92848800c0c8c9b7543", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526955, "uuid": "e2a5e303-1aef-4512-85dc-89aaac9bc877", "comment": "Malware payload (AsyncRAT)", "value": "aca7a546f2e93218d90178e5c1d018133121d149", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526955, "uuid": "5042ea50-264b-49f1-8518-c55b02a2a7bc", "comment": "Malware payload (AsyncRAT)", "value": "261f0e27ea4d5128e370b6e58e8b1a56c46935aca302c6a253ca07e7a66fd4fdd7bc2dcbfebb1368c146580a5e1ac87b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526955, "uuid": "7af219d9-d561-45c9-80a7-9da0e20b88be", "value": "T1A19633413708B4F9DA4290F5CF4ED7225637C32E57496EAAFB693E7A1DD3026210B1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526955, "uuid": "388d104e-a4ac-4dc1-8b1e-e1373cdcbb43", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526955, "uuid": "3f8ba430-28da-44c3-81cf-c14550ba7578", "value": "98304:+pSWqm0qXthawo0D783RBni+saYWopvj/WnVi8yko5REa8lkp9G+ICdMGxc1/OxG:+pRXtbr83RBnvsBWol0Nyj2GS/Oxfl1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526955, "uuid": "bd47f6a5-e0da-40a1-b88b-55b79bd6b1c9", "value": 9245780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526955, "uuid": "83365257-6dc0-4c6c-8853-e7c9da382589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526955, "uuid": "73ce7802-9ecf-4e26-9adf-1369c0bd9ba9", "value": "CHIJUAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55af78e5-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513814, "uuid": "8b025284-2796-48fc-a99f-8ada5d61b970", "comment": "Malware payload (Grandoreiro)", "value": "b4c87c88e5859a5a53e3c849cd518fd2", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513814, "uuid": "12f05bce-3cae-4218-9320-a1c0243bdaaf", "comment": "Malware payload (Grandoreiro)", "value": "b0cb3f6e5eb821f162bc67e269209a60e23c11d289c05bbbffc800abbf4d346a", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513814, "uuid": "4baa82b9-3bdd-4435-84ff-ab62dd9ffa64", "comment": "Malware payload (Grandoreiro)", "value": "427815a9352af125253bf13324d77a5b2fa18731", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513814, "uuid": "12fc06bd-7e39-48e8-b7c2-e9d052f89f31", "comment": "Malware payload (Grandoreiro)", "value": "c38aa732d2ea8b27cf0523dde3fd3f2694765392137217b1a074f8b44391d5b661802ac0f5da14614904ced2e20a66fc", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513814, "uuid": "72ccf998-af02-4e85-bceb-43ae0e35f855", "value": "T1046623729A59252BC6610735B04F3762AE7D98978B0C51EBB8CC928733DF6C4893E4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513814, "uuid": "3d1a9a39-4775-420b-8c05-fbbc5470ae0e", "value": "49152:hCudGZb8Kwtis8BHqx3UCwbbs+KHpoaOarrjlS3QYhOK9E7zWRuXRZNLCxCh94zG:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513814, "uuid": "079d2c7b-b5b0-4122-8155-eb9d07ac3635", "value": 6893568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513814, "uuid": "1f4fad01-328d-4802-bb43-e1ed56a93d85", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513814, "uuid": "47424182-9642-44a5-8dcb-597870de4550", "value": "QBN8431719E7CD0518105.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ee3a71-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1762532732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532732, "uuid": "9f52384c-faed-473e-a2ed-af6f171dcf9e", "comment": "Malware payload (ConnectWise)", "value": "783dc3fa4f818a2aedeed4a6d15fd40b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532732, "uuid": "1f948077-6023-4256-ac5f-0c7e80cd3d20", "comment": "Malware payload (ConnectWise)", "value": "b10456aeb2c6f29fa81cb04cae6c5b56b0dcf883cae32db7281b9606accf35be", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532732, "uuid": "04e014d3-2736-4f3a-a740-5c130e1bc55a", "comment": "Malware payload (ConnectWise)", "value": "43e27e261ecc1e9a3519496e828067f0628a7a5d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532732, "uuid": "53f17402-9d5c-4a6e-afad-b093b679bf93", "comment": "Malware payload (ConnectWise)", "value": "c5c362b779f1beb88e62d8e8158089f420b682629009a33c65d7e57874c61228ab91a124d38c8554e7410319701b03a7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532732, "uuid": "b0f77df6-4a64-4219-8796-80b24699d4c0", "value": "T19175CF0163E8467AD5FF0739B8B242158775FC426772D38F6A8866ED1EA37C14A303A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532732, "uuid": "5895120c-62d2-4e43-afae-f0ed94def9d3", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532732, "uuid": "0ea73ee4-0b83-40cb-abee-ba0e2cf4ceb3", "value": "24576:y3a93+RfmT01krTL3ZALuypZbIRzXmLKoVfdrD/mpPSd6LKUUXGG22T9VHr/h:i2T0+TL3Z0uy1LKY9qptKAG22xxr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532732, "uuid": "36893f86-b5c7-455f-9167-509e1c24141f", "value": 1619936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532732, "uuid": "6b78a4a6-d504-4b17-b79b-9f5af2ddd259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532732, "uuid": "33aa0f1f-022a-4326-ad7c-15e70ac96b57", "value": "SSA-StatementViewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cee3073-bbfc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535301, "uuid": "ac06276c-22ff-442a-bfc4-a47e9d249c74", "comment": "Malware payload (Mirai)", "value": "e746fd26d6fb951edcad797152e9fcdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535301, "uuid": "99fbef49-5b47-495a-a37f-fe5796f39574", "comment": "Malware payload (Mirai)", "value": "b2980ef85d9795946eb269e6dde1c06c3de2fb7f0870da1064c43a44f09d3936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535301, "uuid": "b13459d9-e726-4a0b-9b55-f9baffa8ebb3", "comment": "Malware payload (Mirai)", "value": "033f040f8e382d484a001cdd8ff9e986487d6d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535301, "uuid": "9d7e2fc2-d5a9-4f44-847f-052a2f4c0a5c", "comment": "Malware payload (Mirai)", "value": "89baf78c5f1a5541338df0d14f54faaa6ef31045adf823c767bc6f4ddb128571621e7a9e0e2ec23c5efc33fd3271b2fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535301, "uuid": "243436b3-400e-4f91-b352-a97abc6d5637", "value": "T133B35BC1A5C3C4F9E903403A20B3A77BD972D8392138DD53C7E89F77A92E681C44A66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535301, "uuid": "bc04f09f-be22-49d1-8025-7eb0868c4b74", "value": "1536:prdNVah++LCCJm6ODk1fs35bx1gIFRYxFN9OZS1/ABr:LvahLbEk1E3pg0gF0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535301, "uuid": "3bd3469e-83bf-4799-99b6-cfd55b5fc226", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535301, "uuid": "1116ab7c-4422-4bd1-a462-3ca9c1cad722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535301, "uuid": "2ae68c40-c928-4718-b3b8-596860dcfdb0", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3115af-bc06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762539486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539486, "uuid": "73b571fa-bd41-44cb-9e77-5099526a5da6", "comment": "Malware payload (Mirai)", "value": "9fc8dcb11da10eb179fccf21b1bed307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539486, "uuid": "15806ebc-7504-4db4-90be-bc3e8c0b248f", "comment": "Malware payload (Mirai)", "value": "b340213ae3fef6d8d9a532b9a11329b46674d913a5909c8e9c2c0d03c086a10d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539486, "uuid": "f18a3ec1-6a82-43d8-8e26-12558a52041a", "comment": "Malware payload (Mirai)", "value": "166a57f02b4bbb18b7b43549241c045a86ab3e72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539486, "uuid": "b586c081-9ffb-4d22-a0eb-4ac8c557e597", "comment": "Malware payload (Mirai)", "value": "53639ea325a7c762385202f5d8f37502058df32ce1170a512388363ad74c9ebee264d5eb2ae1971254a3850d5d461999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539486, "uuid": "9f59c5d7-6f19-4179-b073-5ab9721460e1", "value": "T10023E161C4141DA3CAF62D700EEF8E4857AA0BD6B3C39E66A451CFD33107876BA182D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539486, "uuid": "7e59379b-48a3-42a6-90c6-f40910182179", "value": "768:N6vVsElZZk8foq9xTnuiA3fxBcBMUMpvHaiANgXH7RPtFKOfhE9S4uVcqgw09e:NyVsElTk1q9lf+nmM0iANgXHVnhIS4ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762539486, "uuid": "86e1b194-8544-4236-a41b-cdb686100112", "value": 47712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762539486, "uuid": "1031c69e-3062-48de-9ba3-8aa42a61812c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539486, "uuid": "2ff1995b-79b7-4910-a64e-659f69d7928e", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440ca955-bc2e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556734, "uuid": "5b4e46e3-4f2f-4fec-906d-6e6dee394c0f", "comment": "Malware payload (Mirai)", "value": "cfd579a8a368226e4d5c684237a9f1e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556734, "uuid": "8d99d93d-d89f-4121-9810-4bed68aba068", "comment": "Malware payload (Mirai)", "value": "b3741a85b48df1a118b97fc257d4e5382a70e3997de6cab75f343d0d50f21fa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556734, "uuid": "00fbaafe-a766-4b11-b2b0-244d8eda3d8d", "comment": "Malware payload (Mirai)", "value": "4e81631aecac6cf3aa591d4416c5e3c9ed8c05e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556734, "uuid": "dffcf455-e0d0-4600-932b-95726bac769e", "comment": "Malware payload (Mirai)", "value": "16287c3a5ab358fae38b672fd5a5b6e00cf48e15cc81f64a050ab3ddef8df36c2d0074ec85a33b488dd4389433efdfed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556734, "uuid": "95f09109-cc1f-4b87-9bcf-826456ce6687", "value": "T1158339C1FE8BC1F5E91B88304076F23FCA32E96950B2875DDF5AAF36DA335415212299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556734, "uuid": "2d78a2ae-a947-4658-9cfe-d0e036394423", "value": "1536:KKz1LffGPJL/Hch9qkEyQbW4cjJTaoLEAQkfsaFO:KKRGJjHBkEMRjJTaYE2FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556734, "uuid": "a4628c54-ee24-4c0d-b256-f32c2561b063", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556734, "uuid": "22e9f31e-de58-4ea6-85a8-6ba81d3f970b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556734, "uuid": "46dd8d30-744a-41bd-bd34-65bdc234f974", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92134b1-bc0b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762541898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541898, "uuid": "c29703a9-e84d-460c-815f-9f5e2c6d0bd1", "comment": "Malware payload (Mirai)", "value": "3ce187120ac246b2b7da2a87f3392994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541898, "uuid": "5e7f0da0-bac1-4ea8-94de-3880474a9073", "comment": "Malware payload (Mirai)", "value": "b3a491d481458dc3141aa7a083151faad9fa501d8db8fd865785d2b831bb5d5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541898, "uuid": "27d11906-bf0c-4ab8-949c-10f2f83826c6", "comment": "Malware payload (Mirai)", "value": "7e7e541ad44dc3c20ee192aa953401ed94e9e4a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541898, "uuid": "779a33f8-7299-457f-aebc-0f68578d2b09", "comment": "Malware payload (Mirai)", "value": "071fc84273cf24395c4d1a155fdc24e97c8eb4f5d6e57f8b2406e496f56a06d3190c7004a8c26cdbd5b7eda1fb457e0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541898, "uuid": "d8e3f91f-7ee3-48ba-b52b-76d3c915b677", "value": "T1FD03E130D11D3E45EEAAA6210AACDDC73FA486925352A6FB10C7D72690D672BF109F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541898, "uuid": "85afb98f-e964-45b0-87f2-1c68615616d6", "value": "768:cMUkUr3bac12aVUkJYVnfz7kw7ZudfPlJJaN6JOhbTCvx4uVcqgw090:2jF2aV8np7i/JOhCJ4u+qgw090", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762541898, "uuid": "b71314b0-fe26-4eb9-811c-bd71a74ad9d3", "value": 38172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762541898, "uuid": "af550339-72ce-4efb-808a-87e979597dad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541898, "uuid": "10106a95-bbc3-40ee-a331-1a82aaecbc87", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdddac98-bc03-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762538470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538470, "uuid": "e1c10c37-bffc-4f1a-8226-650afa78f2ca", "comment": "Malware payload (ValleyRAT)", "value": "48666f9b88c92404643b0714dad8f372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538470, "uuid": "bcdf23f5-2d2a-49a0-85ab-09502b177462", "comment": "Malware payload (ValleyRAT)", "value": "b6376310755d16c8851f17f12b897b4d97a9243d2c9a23147dc88221ae044c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538470, "uuid": "34e3e9f5-6f77-4c68-bc30-1f22c3433590", "comment": "Malware payload (ValleyRAT)", "value": "fabbdabd4f165e248fb54d6bef03186e569f162d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538470, "uuid": "805ba085-b451-4cc9-bfbe-0c0df9cc519a", "comment": "Malware payload (ValleyRAT)", "value": "48c3b23a43e54d6fd1e785c0e49380aec9d948be4dbc9e390e9caa3a930685732627f352b6d59f3c8ad940f7ed5c4b4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538470, "uuid": "2fe8391c-977f-4818-b1af-dda4fe67d4b4", "value": "T1D2630829A3A220FDC05AC17966D757B3EA73F83111317BAE0394DE761F98C906F6E610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538470, "uuid": "ca339058-2bdd-4be2-9b9e-33690f86d019", "value": "1e81bbbd3c64d04e0cbd249a934e2ee7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538470, "uuid": "6d836e05-3a29-4bb8-b6e8-3fbf2af5f399", "value": "1536:vCyoJ272PV+Xh6hiHENZRegUrGeafKuByW:q/2sUx6hFrohaiu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538470, "uuid": "2c70b4e6-c562-411d-b791-5d91c842e3b1", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538470, "uuid": "c881bb37-c266-495b-beee-0dfd35a5cfc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538470, "uuid": "f5ee2846-a8e5-4dc1-8f6f-2cd3b567d149", "value": "HONGYANG641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4803ec2f-bbc9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762513361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513361, "uuid": "00f851a9-2f33-4abd-8588-44c8b065c048", "comment": "Malware payload", "value": "6238844401f8aff02d953a77b401e4b5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513361, "uuid": "d7abbe81-82f2-4360-9f37-ab52175d616a", "comment": "Malware payload", "value": "bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513361, "uuid": "0ac44910-c08d-4526-8ba5-00e4c2a488ba", "comment": "Malware payload", "value": "dd57cd19231fa739c72b64a82b79565a57012c13", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513361, "uuid": "6d659f9a-dd9c-4599-abbe-541c10ecd495", "comment": "Malware payload", "value": "f22d0e0d8a119980efa21b797890e5edad399d966db5561ea7701a30cbc6f5eac7c5f4a07de12c2f4c030e61153fac35", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513361, "uuid": "8592b5dd-6c41-438c-825c-d2f94bc08c6f", "value": "T15A167C596AEC00E5D4B6D03AC91B891BD7F27C421730479F02A0769BAF737A50E7E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513361, "uuid": "c296a174-e46b-4217-9454-c3176b6dbad8", "value": "792d67354831cfbbfdde94753d96a116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513361, "uuid": "3c65f669-aa1f-4036-94ff-fdb1ca5cf975", "value": "49152:3zMByvUrn8JzFg2xG8jRsoWdr20DeC/HTg2mO1qkSKxqHD52MSgvz0qDS9bU82+w:ISxv48aa5KxqH/Sgww82+/kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513361, "uuid": "0ab1bec9-9fea-4649-878d-b5401d28a15f", "value": 4248272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513361, "uuid": "d720459c-0c8d-47a5-8e7b-492f4d9d1417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513361, "uuid": "a7e730f2-534e-42ab-8146-79f64cd62773", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a280e712-bbef-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762529834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529834, "uuid": "9e3a7e0a-3ca1-4816-ade7-f23d158dba63", "comment": "Malware payload (Grandoreiro)", "value": "add6a9bc6313ccfdc0a0eed57f60980f", "object_relation": "md5", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529834, "uuid": "0c850478-ed0b-49df-9318-76abcaffde05", "comment": "Malware payload (Grandoreiro)", "value": "bbe12f84f261623757de14cf0bae2fe2abcfe7d62307405cf2590cabf0596a9f", "object_relation": "sha256", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529834, "uuid": "6eacfefe-8002-45dd-87d5-c4b27f7ceed7", "comment": "Malware payload (Grandoreiro)", "value": "a18fb9f4034c94fc7a95347a4b5329e7f7dbaf7d", "object_relation": "sha1", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762529834, "uuid": "06ca0924-d374-4ad6-b720-7af6ad99b98a", "comment": "Malware payload (Grandoreiro)", "value": "141aa2fd23329d6688ea9d6ca68202b78869e7b01e10bcc0fac0ddf4d3783a3af8942cf2e50073c083e614b52ea21f80", "object_relation": "sha3-384", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529834, "uuid": "72cc7843-8b99-4e5b-b040-fc9fcffdd084", "value": "T18718422438FF501EF073AFB59FD9B9A68D6EFE32250964AA105033464B33E81DD5253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529834, "uuid": "e1cd8f6e-4590-4dfe-afee-079e33d40a92", "value": "8a913729fbf05263a156089cb1de905d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529834, "uuid": "5dc40254-be59-4d33-bf99-06649caa2c4e", "value": "786432:ykIqR6rNTdKq0rD0h9Ja18fYs3t/EIvyUHhzYAhHUPs:ykIqR6rNTdKq0rDSfa1j6t/EPUBzYdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762529834, "uuid": "6b3b9167-4150-43a4-94e8-73f22228279f", "value": 85267968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762529834, "uuid": "eaee07a4-a6ad-4089-bba4-5fa5a80aeadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762529834, "uuid": "940665ac-2e28-4945-a344-de2240d0363a", "value": "AccurateRip.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4b5924-bc23-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762552027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552027, "uuid": "2b492b87-2a00-4589-8d0a-05780add2ff3", "comment": "Malware payload", "value": "ae5f34e4f2d7050a30e55343616ae6ec", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552027, "uuid": "eab0831d-5fd6-40df-a72b-bb3e81de312b", "comment": "Malware payload", "value": "bbfd88a3102722503502810aaf93a6e0e91227b020432bd71e7cf7043d06e1f7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552027, "uuid": "a7f9517d-f0c8-457b-a0ce-b6326290b59d", "comment": "Malware payload", "value": "8d2320c94f6cbf90c71b37e66ef4a56a633242b9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552027, "uuid": "662d914e-b2f9-462f-bfab-c19145c38a3f", "comment": "Malware payload", "value": "a39a8d5efe58d1435a754c4c7de4d081136a0f7619f4979142a8f00f258fb8cf5dc1f30cb1e8917c8877dc4ef3e44e49", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552027, "uuid": "b2eab68b-92f8-4ad0-92d1-d40e41723973", "value": "T160862222B38BC526E25D0277F92DFE2E14396E63077001E776E97D4D5C748C263BAA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552027, "uuid": "2e414156-0833-4a56-8043-90c6feda7f10", "value": "196608:9xF4FM8chWwNWmDiB1OfUX9sjkgUZDalFGxq0E:F4FM8chWrgUXSUZhI0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762552027, "uuid": "4f275b66-87f3-4ee6-a9d0-e71532eab11f", "value": 7854080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762552027, "uuid": "b2b929df-b909-45a0-9467-2dffe4e1fc99", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552027, "uuid": "ea9d3b75-529b-4a06-9160-af59196e56f4", "value": "bbfd88a3102722503502810aaf93a6e0e91227b020432bd71e7cf7043d06e1f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ab8845-bbd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762519985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519985, "uuid": "e19456f9-debd-42db-919f-b8b51c57ca66", "comment": "Malware payload (GoToResolve)", "value": "c6fccdaddc3091354e65e9328039289f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519985, "uuid": "3b333cb2-0a3c-44eb-bf2a-7c02330f7451", "comment": "Malware payload (GoToResolve)", "value": "bdcd1657a5264f0bd85ce4cf6063d372fdf2e70ba7c0d151f5149ed0d0b4b240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519985, "uuid": "92582b08-588e-4eba-9bb7-0f69cca9fcff", "comment": "Malware payload (GoToResolve)", "value": "3aab131fd9acdb473ad70e68331db1f552a0ee48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762519985, "uuid": "97ad25e7-53a4-4a0c-b9e8-7418039be496", "comment": "Malware payload (GoToResolve)", "value": "1fe5ae13d1e8d7aa73e489d798727689728119c3893d93ce114131979bae449011f7da1974aad111ab645020e8833296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519985, "uuid": "65d27021-f925-4db5-8063-05c4d3c12cbd", "value": "T1EE37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519985, "uuid": "b20ae668-3b58-439e-be7d-c29721f9a978", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519985, "uuid": "27433a68-c41b-4fe9-9a6d-28ffcdd6a8e4", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpC:q9WtLzgOTbjZvk/ekS/mcpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762519985, "uuid": "fe9e72f0-9d7a-4e24-a302-c5bc2c7480ae", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762519985, "uuid": "4fab3ee8-4dc4-4860-8747-37bdeba65bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762519985, "uuid": "717995bc-066d-4b86-89c7-2bdb91a2179a", "value": "Documento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254c5a89-bc0a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Hajime)", "timestamp": 1762541220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541220, "uuid": "25bfe09a-3a75-4e10-acda-bd9f03d71537", "comment": "Malware payload (Hajime)", "value": "7dff56c77e40c578d6687c7611ba19b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541220, "uuid": "a567490b-b85d-4309-8dae-b0942f6c1d71", "comment": "Malware payload (Hajime)", "value": "bdd7e13e31e13596d5df4caf68827934fcca52023e7f299de77d74bdc7275d7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541220, "uuid": "2e9a50d3-a7c7-4188-9421-d8e48472b57b", "comment": "Malware payload (Hajime)", "value": "f4aa79f77dc51de404031722e5aa4f3d0e77d8d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541220, "uuid": "5ab90f85-081b-4c5c-aea3-65d4f1afb075", "comment": "Malware payload (Hajime)", "value": "3348d732b3d80e0a945c8a5f678ab5950ad919543c5819da48d661f00c6c60db4aa51d89ac263f543bd053200a19440a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541220, "uuid": "99dd38af-aee5-469b-a4c0-7eb894807469", "value": "T11803F24732953F33E12248F4D3FCAF8A6159BD54EFDA142BA4113A61B07225D28CE82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541220, "uuid": "b25ec29c-bde1-4819-9bb1-2e9104adf457", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04X:yYI0ARqw1qAEW67UIWi7M8gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762541220, "uuid": "1495a052-3b24-4b6b-90d4-c136164212fa", "value": 38880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762541220, "uuid": "e30bfcee-5f51-4dd5-9cb3-7c2a18f89341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541220, "uuid": "84e0591d-fb70-44ac-8567-f8bd50efbe64", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fc0bb7-bbfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1762534863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534863, "uuid": "992c3066-01e8-46eb-ae11-224084e40238", "comment": "Malware payload (HijackLoader)", "value": "137452f7f8cb7d554f02b748484a29e6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534863, "uuid": "fda6b2a3-7416-405c-821e-c837eadee45e", "comment": "Malware payload (HijackLoader)", "value": "bf6e0c343ec5053da9bd0d0fa577839f017edc9a6e760bb611fb13424e621351", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534863, "uuid": "c6fbd8f8-3cb8-4f24-86df-2dbabfbbe3ae", "comment": "Malware payload (HijackLoader)", "value": "80b1694d2d19220faf6dbe43cb281cee5852aaff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762534863, "uuid": "d3505ad3-5a9c-410b-96b5-5007266499e0", "comment": "Malware payload (HijackLoader)", "value": "6e6ec0e6588c0dcb367d2ecfca9ebb317f83aba27ff194ee02994720359df3ddc995eb339f84e31f44bfbdbc4d427040", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534863, "uuid": "8c750045-a832-49db-8713-ba27df3a88a4", "value": "T128461213F24E633EE469563659729A10953FBE60651E8CA3C6EC3E4CCE391601E3EE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534863, "uuid": "55aebedd-881c-497c-915d-cb3d034b0e56", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534863, "uuid": "e19d9e9b-7dd2-45c9-b24d-bf60d17fdde8", "value": "98304:rDblFQ4I0p9rmppUGX2Y3gNroRM+DPhGBoTpKJ0JNf4faxe:rDbLzbppm3UQV8roRnhGYpKScaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762534863, "uuid": "beac413c-1cf5-4c5a-9419-858a4f37bd21", "value": 5428568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762534863, "uuid": "07cbfb00-bc4e-4c3e-be87-897e8ceffeeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762534863, "uuid": "2ffda355-aa37-4c86-a957-d96aad487525", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2246655-bc33-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762559066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559066, "uuid": "ee779a70-a937-4c3f-a9ed-75f64f85cb75", "comment": "Malware payload", "value": "2495b280719c1e4a14d8b8366b0e33d5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559066, "uuid": "fcb5f6ca-dfd9-4b0b-bcff-1bcc8272c4bd", "comment": "Malware payload", "value": "c0e2c3486379820692442f7b416262975c531f750e83b07e5ef3fd259013c2c2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559066, "uuid": "741befef-4b44-48ab-8697-1312b8641653", "comment": "Malware payload", "value": "0854748f2b54781731f1867cf7bcf1cd33f27243", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762559066, "uuid": "ec8a9568-a861-425f-bf83-350b07bf4a9c", "comment": "Malware payload", "value": "842a7c10770ab71c8d47ab13f78a35eabde112b8438f6f5ebccd2ca020b3e048bb16e495673e272577ef60e81d9b82f6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559066, "uuid": "f917d9fc-aaa3-41d7-b612-a7d8ff2ff442", "value": "T1E5241A17F36368FCC866D13445976332A6727C290174BA2F57A0EE316E22F50BB3AE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559066, "uuid": "f546d6b4-7feb-4747-8870-a4029d60fda5", "value": "a0daabc3a80e7d0785538c2055dc8341", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559066, "uuid": "fa26d227-80dc-41f8-9017-18c215c9ec54", "value": "3072:4PURS3I9jiTwZ25o2dL9oVakGs88bHZOjF/3Oea3kQR2E/BcU++bSOLE0TJ2/fEg:SURZjtJ88tiQR2EZ+YSOLEnDo8uxFVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762559066, "uuid": "c0ae48ed-3035-46f3-9d54-623a8327aa80", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762559066, "uuid": "de7c3dd3-d412-4cc5-8901-39798b88c7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762559066, "uuid": "d9e3378b-bb0b-48b2-9350-1cd4fe0ef9e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c35681d-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513744, "uuid": "094d4670-5034-4559-b46c-83035b77405f", "comment": "Malware payload (Grandoreiro)", "value": "c32d6649209398aedff5d1c0fa0f92bc", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513744, "uuid": "2fbf6051-b486-45be-b281-90295e4c5414", "comment": "Malware payload (Grandoreiro)", "value": "c4dc670713a0ddb33d3f152e44ac172d61a969fe033e740a6e6ba3a2847e4df8", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513744, "uuid": "1168538c-5e7d-4561-8aba-b48424740024", "comment": "Malware payload (Grandoreiro)", "value": "81e952e8787051ffcb1fbf1b8688b61b0ce89cf9", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513744, "uuid": "9f5daf49-12a0-4afa-b753-3ffc8691c169", "comment": "Malware payload (Grandoreiro)", "value": "73adecfb26bba1914a4b569df97c63438719d97b660a3c8a4b5515e211546c34d5276cce9ba9428e0e7f2d4bf768b27e", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513744, "uuid": "271f8d62-4d08-4a1d-94d9-9cda8ca0dfc8", "value": "T1AC3623726652293BC5A10735F04E33B29E3F895B8B0C92EAB8CCD15937C65E5863E4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513744, "uuid": "bdfd05a2-8f6a-48bd-848a-daf27e61fe83", "value": "49152:SsDlgsYwzbL3mMBWA9Zf6NkUVwyOR7fIMTOqiGIBe2B6nTduim3Y:sMuim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513744, "uuid": "4c3344ed-9448-46d1-8b5d-cbd80981b3ca", "value": 4976640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513744, "uuid": "e88fbc27-fc00-4675-861e-33eaf7a79bee", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513744, "uuid": "99332628-d2e3-4b88-b2a1-c32cb42e689f", "value": "QBN1892484N2539071.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc68d0a7-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498578, "uuid": "567378ba-9b49-4efd-811c-a592b9738232", "comment": "Malware payload (Mirai)", "value": "aeadfcbf433013fa6ce202632e83e77f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498578, "uuid": "e7d3b00a-191a-4413-a624-ce15c71598f6", "comment": "Malware payload (Mirai)", "value": "c502541b8c071c125f0d54a309afed5910b84336d4ea27c10f9bcc3d32693910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498578, "uuid": "be319267-9cfa-4bd3-8dea-236fc280d7d2", "comment": "Malware payload (Mirai)", "value": "2293b1ea790597ba7ce66db2f643e1053f57c622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498578, "uuid": "8799d385-2608-42c1-978a-778b4caa0bda", "comment": "Malware payload (Mirai)", "value": "2d84a9b99827f9dcf1f998beedd5eefcebe249d13b3ce01ab44fa067b0941276a9519a2abd0ea9b7b5a9ef90a8342f43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498578, "uuid": "d1a0d88b-9b87-4ca8-8f04-532227934b31", "value": "T11DD2D06FE89D570AC66C1D3D32DD17711D22759131991FCEB312C8C9EAAAC46BC88435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498578, "uuid": "eb7787d1-1dbb-4d58-b269-10de6bfc1733", "value": "768:6jW4+PAbDlMn5q/oApCrvhcJzV1IIRcWFl:yHBM5q1xHRHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498578, "uuid": "c0dd6137-bbad-4dd3-a8af-b91ba4cad08e", "value": 28824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498578, "uuid": "a34559eb-2ba5-491d-a42a-8407e5e14487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498578, "uuid": "e904cf2e-6cb3-419e-bab2-5aa48f8d85c7", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e24b715-bba9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762499682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499682, "uuid": "b74021f4-7f01-41b1-9ed4-d9b5fbe42af2", "comment": "Malware payload (Mirai)", "value": "8ca798ae39873240ab035fb60d30b919", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499682, "uuid": "69ed8e29-4df4-40ab-b127-3e26589d5dff", "comment": "Malware payload (Mirai)", "value": "c529bb8355e49b04a26d5b66f51b35e7c7e0a83fa76289009de95fe5253822f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499682, "uuid": "2cf7f76f-ece7-4da2-b7f5-a3b66916449f", "comment": "Malware payload (Mirai)", "value": "a620cd82ddff69f385e456c6148865d947b60e15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762499682, "uuid": "a6536537-e865-44f3-a709-20c7ab07484d", "comment": "Malware payload (Mirai)", "value": "3dc75a419c39439b489c767cc0245b1d3f93e335c005951a31d924161dfe5b0fc599b5a9e83d353bb7aef0c94dfa2717", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499682, "uuid": "c0aae118-b8d5-419e-8d70-7c095c7bc12d", "value": "T13DF32A56FB414B03C4D22779BA9B824633239B64E3E773059928BFF43F867A90E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499682, "uuid": "d2ab5c01-9824-4cce-be92-8ab883f62e31", "value": "3072:nxQKmZ40BKjjPa8uNJnLFwVpi3Bgg2Xav3bxPjM/9UVt:GKu2jPa8uNJnpwu3ugSav3bx7M/9UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762499682, "uuid": "ede9540b-f05b-4101-ba76-28b8279c61f4", "value": 162147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762499682, "uuid": "a89346d3-dc94-428d-a89b-984e4567f9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762499682, "uuid": "b057e54e-ac6b-4c47-b21f-9b925e41d39f", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499b0856-bbf7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762533121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533121, "uuid": "b4f4e594-f81f-451c-962a-57b123dd21ce", "comment": "Malware payload", "value": "e47852c33675a9031a4fa52108c5bd02", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533121, "uuid": "7d7cfd79-6dd7-45a4-9aa4-ea132a4f83e1", "comment": "Malware payload", "value": "c55eebd3f387929d36a6dab5f38acc04a5f3d8697929795c0b68c0fe24e64a95", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533121, "uuid": "a76e90b0-2929-4823-87f6-050100d49f49", "comment": "Malware payload", "value": "44d92560b6572c2d7bd43ce6298737434a32fbd0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762533121, "uuid": "4701a382-3ce8-4d8e-bda0-053db7a382e3", "comment": "Malware payload", "value": "8b7808915ede7009ecc961e0d28cfeab6c6efad7d1201a62756907a5dcd3f54d20b48b899e80343b178250a82240a9e9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533121, "uuid": "44c6be1f-bd8a-4a7b-b5f1-bcd69062e554", "value": "T177B20964AE37BE449B21059252DCFCCA390FAF1B36621EAD937F1155EA485D070FCE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533121, "uuid": "95d69115-89ac-484f-a942-1019100c132d", "value": "384:ifoFGw85h5UJH1yfAGkUxDCxmMP7rP4lLabk/qReI:ifoWnOV+8zoMTSml4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762533121, "uuid": "49586341-4924-4fc1-9c3c-b527586c70b3", "value": 23461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762533121, "uuid": "900a3b32-a069-4cf1-8578-db77d514d69c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762533121, "uuid": "a76fabdd-5288-4515-a96d-306055805edb", "value": "PURCHASE ORDER ITEMS 11-07-2025.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32578b7-bbaf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502455, "uuid": "f386d457-eff6-4578-82d3-468e8b51cce7", "comment": "Malware payload", "value": "9643f276878c4e1fcf3220b8e0d63ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502455, "uuid": "e246b64e-783a-4d63-a8a6-8eba3597880b", "comment": "Malware payload", "value": "c56c2dc825e3d4907530d5bb6785e71fac1d7e5014119ef9fef46a4699139666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502455, "uuid": "5467059b-e431-4d3b-8097-fe43f52fc3f3", "comment": "Malware payload", "value": "70560f47845ba3b0a724f556396bdefd17069648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502455, "uuid": "e015032e-dd80-49da-a6be-bb7a2e2c5e1f", "comment": "Malware payload", "value": "3c8dc47d3509891d14d2b595e8ea913807e66675eee4bcb11785d3e798289720ecfffc862e3400cac902626f8c69ade1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502455, "uuid": "7057b877-8fe9-46d2-84a8-2ca027dc6360", "value": "T1EC053A17E59040F9C02FE575835AE322BA60FC5D6574B70E6EA4BB913E31FA09B2E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502455, "uuid": "053c72d5-e04e-4cbc-a267-b0c0d954b76d", "value": "d258469d021ee17408b89fccbbb08a0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502455, "uuid": "5a8e359a-24a3-482d-8931-df9b2bad5207", "value": "12288:12ZMmRA6QEo6neA9SXrkNrIyg3vyEHyOirYQGMv+HK7mDk3RpCWHjtxt:oZhcSSXOkyIyOirzGMv+HK78k3RpvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502455, "uuid": "4b509d85-605e-4fc7-bfb3-4a0c87a48d1c", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502455, "uuid": "d58637fb-dcd8-4ce2-939e-41793e4484b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502455, "uuid": "4415c48b-1425-42fc-bffc-12d695bd8dcf", "value": "DFSShareSync20251031183017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb86a6b-bbd3-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762517775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762517775, "uuid": "a76a6ed3-7f71-464b-8253-a3533b507b8d", "comment": "Malware payload (AgentTesla)", "value": "f4ff79fcfd70f184b3e719220fa16d2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762517775, "uuid": "646346f9-bf0e-4f39-8038-0955adda53f1", "comment": "Malware payload (AgentTesla)", "value": "c57363ae2c9f953b27654bffad7acc42b011c793bed8894b15442138ea45c490", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762517775, "uuid": "bdaa8b3c-4200-4102-b220-f50721e3f26c", "comment": "Malware payload (AgentTesla)", "value": "e7fa101fd184dc4dce3e86b0bde5b3a87bd0b739", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762517775, "uuid": "d8c55411-5dfe-464a-a2bd-e37b786bc919", "comment": "Malware payload (AgentTesla)", "value": "10348746f7385c55c34724c0132f2063adb24abae937a485c19b05ebbd820e4f89e228809efa7453c8c62c039726f174", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762517775, "uuid": "3ffd7d90-11cd-4285-a4f8-ea0efcb49417", "value": "T1A8352311B3E0D99AE4524939DD2BCFF3A1B42C01C4E41AAB37D27F38BDB5E299E09115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762517775, "uuid": "246ff9c6-efe6-4040-87b8-371fb0182792", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762517775, "uuid": "7f2cd7ab-a119-437f-85ae-b20db1d7b1ad", "value": "24576:6XgZsOomeWg3hr1HAtHbPEsjJ9jEOj1zIBgFtQue:wxmeH3h5IljJ9jqgRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762517775, "uuid": "aeccd391-19ff-4f5b-9640-cd093f241cf2", "value": 1131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762517775, "uuid": "afb0c931-ec61-4088-ade3-146f3a68865a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762517775, "uuid": "6717a7c1-124d-4886-b008-f71b3f0b6d8e", "value": "Conferma di Pagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd680ee1-bc07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540214, "uuid": "cee3fce5-6c9b-4c97-9ea6-8735acfc2afa", "comment": "Malware payload (Mirai)", "value": "3f948e3f7244801f5325d76ccfdab001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540214, "uuid": "bf99680f-d0e3-4a39-a183-607ea3199714", "comment": "Malware payload (Mirai)", "value": "c784445ec4f1e8f4a33a61383b565c3fb3b583e70b924343a2f981c6d011fa73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540214, "uuid": "381cc36d-a67c-40a4-bf2e-9c211cfe9c50", "comment": "Malware payload (Mirai)", "value": "8d73d03308e339003580a91b0cfdfa495ceb9ed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540214, "uuid": "5caaa85f-581d-41c8-8777-f4695d19eea9", "comment": "Malware payload (Mirai)", "value": "875db87ff04ec6036267723b94e8bcadcaa41e372d649439112c85570790770939b038bff45d26794249095328c61ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540214, "uuid": "bbc9f977-bceb-4b52-8346-2e6f90778bee", "value": "T1A7C33A8DB810FF7EF44BDAB68563090AF421972236931722775BFE93BC312B44816E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540214, "uuid": "da66361d-f31e-4acb-b70c-796a1404e7f1", "value": "3072:ADLRscS3vcrFsDEU7fC9kH9qBKD2/dAoNZSszTJRNO:AST3UrFKTfgS6dDNjTJDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540214, "uuid": "0751d1cf-7554-4973-a24e-f4a62baab76d", "value": 126576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540214, "uuid": "abd64b9a-7732-4f41-9368-76b4d0553b00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540214, "uuid": "88e4e15c-f732-41d3-a0a8-9f89dd012716", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e676196-bbf6-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762532673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532673, "uuid": "b0cd5b40-9b99-4944-902f-a0b6f0f99520", "comment": "Malware payload (XWorm)", "value": "7dc15ea4b265fdc37318fa184aa89eb2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532673, "uuid": "d128aae1-a48f-49c5-983c-5eb9b173fe53", "comment": "Malware payload (XWorm)", "value": "c86af5638f8a1873ab1fd9b212b63f747b7bc920a45f0b0be32d946f794dd9ea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532673, "uuid": "c09997c7-32ba-4d47-81fc-5d9e62bc61e0", "comment": "Malware payload (XWorm)", "value": "3197277437e0fef56e76d82227a346ef3064fbc7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762532673, "uuid": "c9d46780-b7db-43c3-b58c-ef5595baa009", "comment": "Malware payload (XWorm)", "value": "fc1a80b310768e1bdf6472cb91b4cca62f7de12eb71209284a3e5d72b9508cb04fa8ff94362480027b50b074f334965d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532673, "uuid": "1d2002c5-ccb9-467d-b18e-c8f8c5691137", "value": "T1DC14C27119717CC8727B508F176992F818CAE9B86768025B84FA1C6FD29348A47FE0F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532673, "uuid": "3897dcb1-1cf8-4399-a2bb-f4d0b39f1488", "value": "3072:wNa33qMNeNFg0kpWog7MsY8RnNHFUfj/JV:w833q0erkAog708RNHWfjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762532673, "uuid": "fe2c8df4-1d9a-4984-8780-aab67b1ea55e", "value": 191740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762532673, "uuid": "4fa5f3a7-6d3c-486b-9159-e1d950bfe473", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762532673, "uuid": "df14e8cd-3eca-4f7c-a71e-9be2a5984134", "value": "Invoice_Challan.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b312586-bc2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762555860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555860, "uuid": "7dfa83b1-4249-4728-b632-db871b0e323c", "comment": "Malware payload (Mirai)", "value": "d2e865453c5e80ee09326a2d24216912", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555860, "uuid": "39cde963-5124-4edd-b3ce-c181705f5594", "comment": "Malware payload (Mirai)", "value": "cc3b129045b9810dbd7012b6da00909028dafaa42b60fe2ea143c8ebea4b5fb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555860, "uuid": "9a5c8cde-977a-454a-a92d-d9a49a9c3cc3", "comment": "Malware payload (Mirai)", "value": "d157d55052f86d143a4a3de999e896b9be1abefd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762555860, "uuid": "efa65b8b-8489-4e02-9799-b7598ecf5007", "comment": "Malware payload (Mirai)", "value": "b8d7c1051e4782284abc82635894437bc795bdb4a0bb1ceb7723096f829711c0a5c817bb9373a2c321462f3c915bbd14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762555860, "uuid": "24ce1306-5703-403c-accf-70a4042f83f9", "value": "T10FC3E80AEB540FFBE86FCD3705A91B0634CC681A12F57F767674CA18BA0A51B4AE3C14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762555860, "uuid": "323e2f5a-0c30-4997-a942-bb02633f68de", "value": "1536:nMrp28M+/Dnld5oYVAddGTBoEAKZ4+CVwQBZJ1KwgNQIF1taGpuR:nIMuTV4QTJ50z4JtpuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762555860, "uuid": "2f881cf1-4ac0-4c15-abdc-a247761892ae", "value": 120144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762555860, "uuid": "5152ba13-f879-440b-a42a-9112a3c8078d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762555860, "uuid": "7331acca-3ebd-47f7-a460-72e674057204", "value": "kvariant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc132d-bb72-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762476198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476198, "uuid": "98753212-6b1d-4dc6-9343-917a1b12795d", "comment": "Malware payload (Mirai)", "value": "247f9bcd0a56d17d37b163a7e790d474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476198, "uuid": "80933c8f-6fc8-4813-bd86-bf643061a039", "comment": "Malware payload (Mirai)", "value": "cd1683e75a1612f2915d38776453913a4fb9c42e533ab91dbf9cf252566186eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476198, "uuid": "9fe9a797-12d8-4e3f-9740-91d2ffdae295", "comment": "Malware payload (Mirai)", "value": "d2af597e3cbf0fe84823e438bce58a9ca726b97d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476198, "uuid": "94e6386b-bec0-443a-9951-1e2eae78bf2b", "comment": "Malware payload (Mirai)", "value": "e5ac1618bca717645cc7f82c9844dc806edc4fb4f71291c684643bc54a13ef4e34d40165cbccd329ce45cfafc8c76f8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476198, "uuid": "7a588c7a-303e-4955-8b7e-9dfc4fecf036", "value": "T1E1834B42734C0D43D1A75EB42A3F27E583AFD99121F4FA89654F9B4681B2E33158AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476198, "uuid": "b7959f20-2e7b-49ff-8d91-f93127b06546", "value": "768:54LXANbBEZ67iyIkno+AtpO+eNWw2Mk07btsA/AtG9paZIoo/cu+0c5DeFb2t2W1:dDEYttosAtwpkIQu1cdg2sWSMHVrDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762476198, "uuid": "b5724e21-a7cc-4229-9f3c-a5f8eb520512", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762476198, "uuid": "30a1201c-bf91-4f68-af4d-3c35a4efe217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476198, "uuid": "46290b07-635e-47b3-a998-64847a01369a", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e124c24-bbfd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535652, "uuid": "0dc6b120-cd0e-4dfa-a77b-1ca699cda8ae", "comment": "Malware payload (Mirai)", "value": "b50005618d8e889c2e6c392693e4d5d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535652, "uuid": "c7cacf8b-940c-4fa1-9c7d-c8bc96715658", "comment": "Malware payload (Mirai)", "value": "cd1a417af21f423ce837d8b75ac4d79cfe00dfefbc710e3e90c6e0a8f0848ee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535652, "uuid": "4103de4e-e80c-4024-8d73-3f96290fa365", "comment": "Malware payload (Mirai)", "value": "226673fdd990097239fc13da29afa089fef3ff89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535652, "uuid": "aba44caa-76fb-4677-b3d2-e839a2b661fb", "comment": "Malware payload (Mirai)", "value": "5d005d862764623649c39ee1fd297c716f54f9c5fc61e1a49dad91ea8f9f4503dc679840869f841b67218463ac5755c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535652, "uuid": "f79340f4-c04c-41c9-943d-0a06bb973d49", "value": "T1ECC35B26A57D1B37C0F4D47B62F34325B2F6429D14A84A6EBDB00E5DFB21260279B3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535652, "uuid": "8f36c246-1e74-4445-a57b-e20963736008", "value": "1536:FOH97XlhXSlbQfmV82YNpLMFQzLvk52MjwZjl+Ybfzbt86HYm5TI4soeZJt7yWVw:F+97VBSY8T0XMKj0YbfvK4YOT1/ohE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535652, "uuid": "1c078512-8b94-4976-9965-807b42755fd4", "value": 124408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535652, "uuid": "cbbd72d4-a912-4272-8104-1bac1b072c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535652, "uuid": "756e8434-b53a-4f44-9b1b-49d35953cb39", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b2d636-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762502761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502761, "uuid": "a1133fbd-a05e-4191-9281-4c5ba16f5a11", "comment": "Malware payload (RemcosRAT)", "value": "c4f72b3412982fc5aafd0c2aaea244e3", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502761, "uuid": "250140c6-904d-4c09-aab5-e01fa70b129c", "comment": "Malware payload (RemcosRAT)", "value": "cdf18dce59da13a347c6d2d60a0bf6190228b46e595863308769a1cb34ca5fd0", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502761, "uuid": "e40cce68-9a85-48f3-8f14-3e621c99d84f", "comment": "Malware payload (RemcosRAT)", "value": "6d91b3d22422a376ccc0560ee3894b1a863ee6db", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502761, "uuid": "6c9c5ec7-21b9-444f-ac9a-2644e3995fda", "comment": "Malware payload (RemcosRAT)", "value": "0a70fb5535970ee253358dd06c2512f0738efef584aaa4056c7df749b55a3b17967bc3f1e95d307f593f4b9bcb684e6f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502761, "uuid": "146a12f6-c079-4785-845d-037a1b727809", "value": "T1D1164C43FA9F421476E39B16584950758F27E3CEAAB499CF449C90E0C7AB304CADFB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502761, "uuid": "f8ed1147-47b6-4170-8c41-7ecab34b87d9", "value": "384:abebebebTbebebebTbebebebUbS7X+Bbebebebqbebebebqbebebebqbebebeb6N:gbS7X+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502761, "uuid": "dc18d176-ff97-4ef0-9578-3cc87ea47dcb", "value": 4353564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502761, "uuid": "3d17edeb-c671-4a71-a60e-4fa4ea867d80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502761, "uuid": "6900aaaa-37b5-4aff-8bbd-4b7ccfcd6ddc", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b09c4ea-bb78-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762478712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478712, "uuid": "83e4a7cc-919c-48e8-b21a-1117cc088671", "comment": "Malware payload (PureLogsStealer)", "value": "f105b3ebeaccb1c5a2a297229e1b6146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478712, "uuid": "42622e0a-6c32-4d09-9d39-9c5190b4d040", "comment": "Malware payload (PureLogsStealer)", "value": "cf3810352dd12c9332bb34cfcbb6a586f6736f663cdd9bdcdc090e193eb11139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478712, "uuid": "55d722e4-4d2d-4134-85f6-ca50f39f489c", "comment": "Malware payload (PureLogsStealer)", "value": "4ed86a2bebf4e7e22ab081ed83d15af5ac4fb702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478712, "uuid": "f3a821fd-0e44-485c-9bec-04cfea75c9cf", "comment": "Malware payload (PureLogsStealer)", "value": "a1300411a957c07d02c0ddc727d4a524b810ce36305b89de9850862efd198aee967e99f59797b8a504cfe97311b3d08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478712, "uuid": "e5ebf95c-0a5b-4776-8e50-24e1aa1b0d74", "value": "T1B72512502B3AE717C5A58B7049B0E2BA877A3D5CB830E2496EEA6DDF3971B104D40B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478712, "uuid": "e9d37b44-df7a-491d-a9ef-8c67a261d9f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478712, "uuid": "2994aa5f-7c73-49f3-85d6-b62c9435ba70", "value": "24576:GmAiCIo6qy2Sz/HaugDsl1A1crgTC0qEzGdZS:VAj6qz+icrgTVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762478712, "uuid": "79d745a5-04ff-4e6c-bdb9-ff8ff591d17c", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762478712, "uuid": "8d0f37af-de6b-4694-9d00-dfd1de725f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478712, "uuid": "a685e4e9-99be-48a8-9c78-ae648a94fac6", "value": "F105B3EBEACCB1C5A2A297229E1B6146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169dc6b9-bc0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542484, "uuid": "0617d8d1-3e38-4803-b9fc-fa755fac08d9", "comment": "Malware payload (Mirai)", "value": "b8fd035ce30439eff03d8963ad5b0d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542484, "uuid": "9e22e281-ff42-4c84-8e94-7331c55c3839", "comment": "Malware payload (Mirai)", "value": "d0755b6d730ce1897a34e2de5c23eaf7eccc8fd2fee38a924a144290dfbd463e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542484, "uuid": "cf7a784e-d64a-4909-b9e8-3333e0165be8", "comment": "Malware payload (Mirai)", "value": "52b13a65cf179d397cd720dd1bbb76ca1a334669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542484, "uuid": "a7516ac0-e0f9-4428-81e2-b2448186cf0e", "comment": "Malware payload (Mirai)", "value": "eba49f384d54d8641c9759ce75ac01e3c453cf8f435e99bc87f89091a88aa400d6334a2754d9ce7cf91adde364a8fe09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542484, "uuid": "33065b10-7603-40c5-bf4a-6ee400cdc88f", "value": "T12303E10598E58341C56D1238ECEF96E05A03E5F5AEC7C58BABD41C3AC0A37797618FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542484, "uuid": "2b73c1a2-1636-4f12-858e-770c2294c6a3", "value": "768:9Sbw8FwnvKqLSnjiYOPurv80RBCpnd44uhnL7mU1S35RB8UnbcuyD7UHQRjR:0bn4LIMu80LQ64uhnv518RB8Unouy8Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542484, "uuid": "d84b538b-d817-431c-87e0-e165de46d8ec", "value": 40028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542484, "uuid": "5337bf85-b7bd-4f1c-a321-fa326d25fb2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542484, "uuid": "020084b1-560f-4e82-a80d-3cbb65b10273", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db69e136-bc0b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762541956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541956, "uuid": "d1e73537-6cf3-4263-836a-fb89d0df4b44", "comment": "Malware payload (Mirai)", "value": "b803eb17bab7c6d62581ec97941d5939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541956, "uuid": "1f6c8e9f-2fde-4dda-aeae-6a91009d9744", "comment": "Malware payload (Mirai)", "value": "d2f6e816273809bd517258cfa096ab898eca6a0d0fa280864e3030943681c7ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541956, "uuid": "e1891277-ed55-42d1-85e2-bc6f8b0a6333", "comment": "Malware payload (Mirai)", "value": "8528e53e0810e2c06658959caa0fdcda7c00a458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762541956, "uuid": "c1bea95b-ac06-493a-b340-7c09938a2082", "comment": "Malware payload (Mirai)", "value": "7cd100111e7086af01cbd019602d788dca5041333c7cd14751d74191654d873b16b5d21e667008d439fb7e7ea91461e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541956, "uuid": "0bdd4f20-ed55-4282-a67f-d83ac6a9b720", "value": "T130834A02734C0D47D1A75EF42A3F27E593AFE99121E4FA89650FDB4681B2E33154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541956, "uuid": "c4145e82-7587-4dfc-9ac5-1fd01f6d63c6", "value": "1536:0qixvHp+OV2KQusg3O98+wu9qKbGE+KdCz:XixvkOgs09KuW/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762541956, "uuid": "133ac9bc-45cb-4c56-a01f-0cab7e11ed41", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762541956, "uuid": "f6f7d5f7-4081-4a09-b2a3-c0cf9068407b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762541956, "uuid": "b9b92e55-5bf1-4d40-a1ba-d43731b182b5", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f2be18-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497946, "uuid": "38ab6183-486a-48d0-b1f2-a070f17a8ebe", "comment": "Malware payload", "value": "8abc7624b2d9e6ff244aed7590f3c359", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497946, "uuid": "c44b2daf-60cd-4f99-a85b-47219fa8fb75", "comment": "Malware payload", "value": "d4260c77a075c50ef7a740768331a7f83aac07c9b2737ba0c02c5e4dc469c5ff", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497946, "uuid": "a57bd8fb-9601-4858-8315-689684f9afcb", "comment": "Malware payload", "value": "5168d10f2a5f95b296c0c81c8adac463ba32124e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497946, "uuid": "a26bc0a1-2a0b-403b-9a22-2984debc39d9", "comment": "Malware payload", "value": "a76ea93756960f6279512f43e96dfe40563b510686bda2d4ce52d2c695a53fd34d4d6b6f62f9231ab37a17c3426dd04c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497946, "uuid": "4dfbfad3-49a0-41a8-9ff9-4729de9306ec", "value": "T1EE46F2DAF7D85D2FC8771072CDAA52B1125B4C128A479F476908371C78BB6E80F89BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497946, "uuid": "49c67eaa-a6ec-4cd6-aa99-4d17d0c1bd41", "value": "98304:bf0RSsvJoUGaiiZq+7DCfAtaIF0robT7usDt0uchKkWo+PJbKm/Kr6L0s:T0R5miE+7DKRo/7usBbch450s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497946, "uuid": "7d0111c6-f632-4c73-a437-601d565d7e1a", "value": 5877564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497946, "uuid": "26b193a7-69a9-4421-a28f-f6e4841a599c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497946, "uuid": "1fe34537-4ff9-4f2c-afb5-4822fbfe9551", "value": "1xbet.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f689d5bb-bc0e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762543290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543290, "uuid": "1f9e77d9-95c0-4abf-97b2-1c5a9f0b6b0a", "comment": "Malware payload", "value": "c9b97915cb06211be86d2678547e587f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543290, "uuid": "45719113-a653-478b-92c5-72210a0ef650", "comment": "Malware payload", "value": "d46e8f3e4426d96723eff7a0cea229355ab1e51725df5eb633132f10f35df406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543290, "uuid": "a130a68f-dc50-4968-b485-fb2d870ee515", "comment": "Malware payload", "value": "e0171d8e2f905ea6b4ea03c8d2df701e24adc077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762543290, "uuid": "029ea5a0-c010-443f-acf9-02f2956178c0", "comment": "Malware payload", "value": "77595abde0989db33aad537b5a08954f801e21623c466ccdbc18e9391a5a11d4dd915d0a2f19b0c7610c9505f570ec01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543290, "uuid": "406c74be-ea40-4796-8647-d348d66c0666", "value": "T16C17AD21A252C03AD88511F0DD3CBF7F472D6B69077486D7A6D81CB86E315C2373AA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543290, "uuid": "24a6a805-d728-4697-a893-50cd8860c200", "value": "2621b857dc4b3267842fde5336673621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543290, "uuid": "c04f91b8-9216-431a-899d-aa14415883f0", "value": "393216:zXICjfIGR8CjraSf5VIZK4rQUE4RrqNqR:HjfXraISEUE4XR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762543290, "uuid": "49d8bc27-6bf5-42ce-89cf-2d3172155f4a", "value": 19007336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762543290, "uuid": "4b0a16c6-0bee-4774-bd3b-a2582c1f4b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762543290, "uuid": "fabda42d-423c-4247-a3d6-ee04deb977ea", "value": "getscreen-149018000-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733952bc-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762497972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497972, "uuid": "84f480fb-ab4e-4318-8516-e52ffcd3374f", "comment": "Malware payload", "value": "83762620219f5656e394caa8f6e205a9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497972, "uuid": "00e7b6f1-86b3-482c-a76c-f279f6c4b531", "comment": "Malware payload", "value": "d5704d5e103be01ad86683b6271edb65ce7949ff121dc964a4276bf30fb7622d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497972, "uuid": "80e53644-efd9-40be-836d-1a762420c1ba", "comment": "Malware payload", "value": "12a56073db02f708ea8916ebd585b857f8ff6249", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497972, "uuid": "ae7148d4-bf58-4834-9d77-04eb2b8316f9", "comment": "Malware payload", "value": "0b9a74168bb5c95591b737b75dd6a9a500a5699ad66592a9e43916f1a8a1ef6417ebe4313c0f1424fa5d0ee3c581f0cd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497972, "uuid": "daebb91b-efc7-4aab-af5e-c51832f4a4a9", "value": "T105C62342F399AC1FCC3791320AE607657A524D0AC946E35788A8B5BC5EBBED40F45FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497972, "uuid": "3d4fb95d-2685-405d-b4a9-0a3d77e0741a", "value": "196608:uxyPNwFVwnA3pNVwIGNI9/T9Awr+jVsCkwfaNU2SdGhRMm6BKZSKhGqRAB:5PNwQnAbVwIUIjAwr+JscajSdOt64uqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497972, "uuid": "bf3b04ed-8fe5-45df-ab0d-19e1782220bb", "value": 12521865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497972, "uuid": "e26bc7da-f35d-4153-a230-0009babec2d8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497972, "uuid": "ad09ce36-6297-4d22-9a22-116a9f712752", "value": "m.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abdf88d-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498656, "uuid": "69aae5b9-11a6-496a-aa7d-944029d2d6c2", "comment": "Malware payload (Mirai)", "value": "bd1fe6c6f1f6d07804a30d7b16adaf4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498656, "uuid": "559fb206-1208-4f89-9906-788ab93c0bc3", "comment": "Malware payload (Mirai)", "value": "d573f2e1f9a8bde5c275feb1b644747e8e0c45450fe4b6f6f2a1268e73f08d34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498656, "uuid": "5b351724-3dbc-4a02-bcbd-53bd2c7b6b99", "comment": "Malware payload (Mirai)", "value": "1547a9fa6b5aab4bd37915ad7ba0fc74fa6c465c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498656, "uuid": "861a6aa6-0828-414a-89c7-094db9eefe9f", "comment": "Malware payload (Mirai)", "value": "652343a45abecb3ae69ee1f69c7ea897157c6fa5d251f4b80515893139521fb7564e24b5e8aa0b86467ac7be973b48b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498656, "uuid": "e2b7c85a-5901-40e4-b696-8995490fde20", "value": "T1D0531941BC819913CAD01376BA6E168E3B2133E8E2DE72079D216F6537DA91F0D7BD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498656, "uuid": "b685b6b1-052f-4225-a272-4415e93be7e2", "value": "768:TDRoDYC4RMuswaz+aO7SUwn3L/FUh1tG4OT8oB8QOrJX4gtihBwA/BNO0vHXcixO:KDcRMx+atL/6/k4OCJxUL5s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498656, "uuid": "7ee1f4bb-3524-4f92-b62b-a55a68093173", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498656, "uuid": "737a7098-ceac-46a0-9fd2-dc418832b147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498656, "uuid": "9406d34a-c26a-4ed7-a6b9-2d3481ee81fc", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9b1a19-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502711, "uuid": "b7a815b8-02df-4981-b638-506665411b44", "comment": "Malware payload", "value": "c25ab33ecdcddbe57ce980bac75530c0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502711, "uuid": "873fdf76-1db8-4cb1-ad12-732b06d351c1", "comment": "Malware payload", "value": "d59a855bf4fe5d54d91211559f991ad2f7fe2691e0345dd44f04fd6168fa9084", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502711, "uuid": "f452ca61-f6e5-4970-b085-e34bdd8e3590", "comment": "Malware payload", "value": "452faf15c0d34e0fe89db174c0a3d60832fd53c6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502711, "uuid": "c0bc5781-6921-4994-b977-e2c0d0d408b3", "comment": "Malware payload", "value": "091ff7b6c8d9ce997366868917f0c34abfe53aafa101269aeab0295aaaeef07eb41e850b0a66b9f0d0d572e3450d4300", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502711, "uuid": "ce7e0c9f-fb4f-4c91-95b2-39d10e126aaf", "value": "T1A6945B40779EC52DE63988329B47EB803D6DED30671AF20636E7A91FB6F4D2618B10C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502711, "uuid": "785a598f-805d-4ca2-9628-b0fa7552dbc7", "value": "6144:pX+1yYPGH/84e1SdgbVIkGuDQMi2cSkVmnD:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502711, "uuid": "e829fd84-f6ea-48da-b841-85d8ef4d4a53", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502711, "uuid": "cff92298-690f-480c-93c9-4661ce5492d5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502711, "uuid": "972ee96d-3d04-4b02-8360-d97dbaaa6ad3", "value": "Auditoria 20251030141513.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32b14d4-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762556571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556571, "uuid": "2f12c472-8854-4667-92df-c05daf0626ea", "comment": "Malware payload", "value": "09dbbada80f0198936d073fae9d1fdf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556571, "uuid": "788b17e8-d1d9-4c76-8276-f1b15a130990", "comment": "Malware payload", "value": "d5dd5ff3f7cdac526cff6dc8aa166e553665656a31ea331c8634dff60f52525e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556571, "uuid": "4ce938af-03db-4678-9c82-7b170eb850b0", "comment": "Malware payload", "value": "963fcff34450200cf31dd76069df56c2c6333c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556571, "uuid": "36a2d8f1-bb59-49f2-971d-d170afebdb99", "comment": "Malware payload", "value": "c582ffd6909c01b676573e606280fcdb3c5d3985c058d2a54745816122eab04152b60f93e863067d0e6bcbeffaf7a2b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556571, "uuid": "c0b473c8-ef36-48ff-934e-3bd61a926d7a", "value": "T1F1520903FAA719DADA76C1704463221EB5B6B95013A46FCF83D040411D33FA836AE3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556571, "uuid": "0f48868c-6476-4630-8b2b-607f70013253", "value": "c9db0404a1e6c69aa0c6c42c6479ebd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556571, "uuid": "790617eb-f5b9-43aa-94f8-6bf8401d64f9", "value": "192:y2FatJaLrhrzKKZSXGh8eiLaQFRUz6wYhbZwB55tfp15cmYzPRm:fMaLFrzPZGZXLznwYpZyYJz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556571, "uuid": "777ba19b-0250-46cc-8fba-ee873f358200", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556571, "uuid": "1ad3e743-1ced-4124-93d8-a363e846d8c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556571, "uuid": "6ca48d4c-451f-4d0a-b770-ef4160df9812", "value": "DocViewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd1d1e8-bc23-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762552049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552049, "uuid": "877e0dfd-fb4a-4dd2-8d23-c1ec2886dc41", "comment": "Malware payload", "value": "f0c7df0d6919cad6a54c3e0f8a6382ec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "phantomcard", "colour": "#D639F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552049, "uuid": "8e407a26-fbf3-4820-ae3a-68000334627d", "comment": "Malware payload", "value": "d6255e71bcde2dafd48dd1abea311cda13e5b6aa1f4836831621c9ff06d695c3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "phantomcard", "colour": "#D639F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552049, "uuid": "e03b17c4-81d0-4691-a423-e98542a6d064", "comment": "Malware payload", "value": "223d7aa925549c9c657c017f06cf7c19595c2cee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "phantomcard", "colour": "#D639F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552049, "uuid": "3bd18165-a58e-4458-85ab-ab3e8221ad95", "comment": "Malware payload", "value": "9a76e1b4b135f06a5913b462a6c02b6b71bd62b4a6f563f9151e5f74fa7b298360f4734ad10fd540a2c7c0e8628fb0f1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "phantomcard", "colour": "#D639F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552049, "uuid": "29be6c76-1dae-4021-ae7d-a22806b6f662", "value": "T15495CF86BF58A52FC8B704334BAA537536579D168E839B436448332C6C776D80F6AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552049, "uuid": "86c953ba-f9b3-4e77-90dd-6121dc645829", "value": "49152:rulcut7TZVYp2No69qYeG4srnVMuCAilqmegyJ3hG9:rulVTIp2C69qYxVwAzJ3hG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762552049, "uuid": "0f46a60a-a24b-4365-bcc1-cd1754f94fd3", "value": 2042801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762552049, "uuid": "ff9efd3d-2ec0-40dd-90a0-b4e29a5676e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552049, "uuid": "e4dd1530-d30d-4e5a-af9e-fe4ee3c2a3f1", "value": "d6255e71bcde2dafd48dd1abea311cda13e5b6aa1f4836831621c9ff06d695c3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d0d21f-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513806, "uuid": "0a820490-01f7-412e-b9a4-9c1677e5ef66", "comment": "Malware payload (Grandoreiro)", "value": "8f255f06b785be246609be41d104e893", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513806, "uuid": "727f4f95-af44-4e0f-8333-571f5da6cca4", "comment": "Malware payload (Grandoreiro)", "value": "d775258c83416170724a400e5965c0852a40e4c02274b7386a9cc3a0f310da29", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513806, "uuid": "19485742-b60c-4a1b-81c9-bd6ac1de1c2d", "comment": "Malware payload (Grandoreiro)", "value": "12478dd77168c5c32b072236b9fe200d8e037146", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513806, "uuid": "ecc7449f-e885-4d4b-a5ec-19c3ed473299", "comment": "Malware payload (Grandoreiro)", "value": "36a83e9a75599594224a6e7845c005744f8bd9f0eca744581eaab7b1e2d526bc8e4d44cab50135e5491896fe3714a435", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513806, "uuid": "ba2ba48b-3adc-409e-a026-06ceae4a906a", "value": "T15466237159982937C6720335B00E3372BE7D9CA38B4C91DBB9CCB15A329B6D6443F4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513806, "uuid": "56fcbf34-34dc-40b5-9b02-fc199addd66d", "value": "49152:nzcyjnMfAtNar7wVCmH3+Oqn2z1lTHGV4e0Nj5KpwgwRl7kfixgw5Ks3188tYfu2:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513806, "uuid": "a96410d7-7bbf-4614-95b9-465a13d273f6", "value": 7096320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513806, "uuid": "30c0904c-2358-4e0a-a305-ad11a43e2013", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513806, "uuid": "885d5331-4a6d-450c-9aa2-4d581767d72e", "value": "QBN136808ZF5UML98610.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920835b2-bbb2-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762503607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503607, "uuid": "dc15ebfe-98d7-4d7e-9119-770ef0c71d8e", "comment": "Malware payload (a310Logger)", "value": "f237b5b222850ff92686c437676906f7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503607, "uuid": "c8d27a57-12ab-4b0d-aeae-18a84c177db4", "comment": "Malware payload (a310Logger)", "value": "d7911c750b95eda25760d99dbc911f231f831492be7f55ee2620c25e85d01dee", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503607, "uuid": "95869668-0819-49de-b7fc-39a987917a03", "comment": "Malware payload (a310Logger)", "value": "83defe3374e1b5f0f2e56e5fd19feefd9bf85920", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762503607, "uuid": "d536979d-cb71-41dd-8007-fadb27eb1330", "comment": "Malware payload (a310Logger)", "value": "680514249dd0ab07737cad75b3dbf629258acd96a7e8eedb73a91a79a7127d43109a2feb761fdd2f22952383f42d7334", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503607, "uuid": "005e8648-2168-4d9f-aff9-1139bcc98fa5", "value": "T1371522913E94C313DA79A7F64865D2B923F16FAE7510C3528EEAEDCFB4297028051393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503607, "uuid": "b8e674d9-1bb5-48b9-95fe-d47a85dec6c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503607, "uuid": "8b3a812b-bfe2-4dce-921f-f46dd9dfd5c4", "value": "24576:V41YfcYjM61hHHm3J2ZvH33MwqctIJmCZ/6Fkr+:VBkYo6PHI433MIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762503607, "uuid": "15550474-c336-43e6-ae1d-e689ecf8c972", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762503607, "uuid": "bcfba960-7c24-4a34-acdc-44cc3a472665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762503607, "uuid": "b650ade0-1ceb-45ab-9f3c-4ce22ba3263e", "value": "SecuriteInfo.com.Variant.Application.FCA.2785.3630.7671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de67a6aa-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498581, "uuid": "b331c4e6-5511-4f40-bf44-e3a70cb076b0", "comment": "Malware payload (Mirai)", "value": "12b62545faa792d76f2291d0eff82335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498581, "uuid": "ba0bc22b-2fb4-488d-ada5-6cd2bacb2825", "comment": "Malware payload (Mirai)", "value": "d95a9d245490273e520019203bc27880ae3a4676a4818c75499822eebaae22c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498581, "uuid": "b64d1832-0896-4c0d-acfd-5f6929d3152c", "comment": "Malware payload (Mirai)", "value": "dd81c406622daf4ecee171de767f044d2a17777b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498581, "uuid": "6ca410b2-8da5-4101-826b-652c1fe62a0a", "comment": "Malware payload (Mirai)", "value": "8a04bad0d8027a6cc5c5d2be2567e3aace6bb5ab290ec992092256c04140bbd07403157140d823b70ed7fac9ab99bc17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498581, "uuid": "6ffa3b2b-e1f0-4cf2-b47b-08ad84cd5f12", "value": "T12CB2D0A8E31E1E89EF3AD7201C82E7D6FFD14B453276CFE60252DF016879153160AAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498581, "uuid": "9c7812ab-d8d2-43ca-8114-f52f58547c73", "value": "768:MsOHeHucMkbAkTsyfqT9Q4ajuXdATHWV4uVcqgw09i:MHH8uBkc0VqTtfV4u+qgw09i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498581, "uuid": "e456f2fe-f9ef-45c5-a19b-170e4e75031b", "value": 25232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498581, "uuid": "7bbef600-2ea6-4a58-b728-745403ef9af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498581, "uuid": "68558c6d-4674-49bc-9a35-ed381d9939da", "value": "xd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0e6a5f-bb77-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762478311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478311, "uuid": "15d0b663-15df-4c06-9104-f207721c76e8", "comment": "Malware payload (Mirai)", "value": "bb3a2524689c193f43c221901bcdaa0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478311, "uuid": "1a03299f-4d77-466a-a3a3-abad5e6a4f3e", "comment": "Malware payload (Mirai)", "value": "d9cc05bde5bd473e5b5033065a40b6a53eb789f80485be5912c765d353917c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478311, "uuid": "41d2970c-6122-49dc-9203-6a70155b2a6f", "comment": "Malware payload (Mirai)", "value": "0b5b7f2d6e41d689d7939e963750cf4ad7857f27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762478311, "uuid": "34a49129-d896-40f6-80dd-f9d656083f19", "comment": "Malware payload (Mirai)", "value": "2ed477b8babcf8e395fb8b9988fc358c55a63188eec3270420f69d36921f5f9f44a29fbf5b661101e49206694cbbd599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478311, "uuid": "c4edc5bc-c6e1-40fe-9a1c-117990f9befa", "value": "T1B6B3AEDBF70B21A1D86147F017C74B9E3A6323019F9BA8E76C0F6A7A16360DF5916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478311, "uuid": "4d955a43-9fea-4151-aea6-026f940637d9", "value": "3072:izjih/lCAcT1kLRp+t4bhLTufWAr2SDgBq:izju+1+Z1LTujkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762478311, "uuid": "4669d5f8-e24d-4e7e-ba94-aa59f770f583", "value": 116156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762478311, "uuid": "242a5b18-83cd-4476-a0f9-e76a9a4393f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762478311, "uuid": "6d1faf87-446a-43eb-9bbd-823ffde3b755", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51be988a-bb70-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762475153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762475153, "uuid": "e964fb3c-d735-4fe1-b0fa-29447e161351", "comment": "Malware payload", "value": "be0211c3dfda97f8801d2d1f5380ce6e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762475153, "uuid": "ad2e69e0-05e2-4e81-945e-785a5ea46c04", "comment": "Malware payload", "value": "d9f40d0c3ed39fbd3fda93182af0ce2b3c54c2de9d698b9c41aafe8f2ed2f827", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762475153, "uuid": "06551a8e-d8bd-408d-a98e-19a6d282396f", "comment": "Malware payload", "value": "0e1b6f3c074ca6c160d60faeb961bed07dfd24be", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762475153, "uuid": "e955ba11-e157-441b-b96d-655586f4a825", "comment": "Malware payload", "value": "d301b4f3e75b46743d6b0d34332a5275071906ccdf901a6cae10148a7e166487f88046243f7e5ba458c78e6388469225", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762475153, "uuid": "136c0d0b-90b0-4fab-b530-0c81a7d08838", "value": "T1721319043A98C26AD6BF0F7CB8B20E6152B29266C102DB453D8C55DE6FB3705CF1639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762475153, "uuid": "08a540f7-db2e-44de-b4a8-32d7629fb4e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762475153, "uuid": "e1ffc8e8-844f-4908-bd1b-82552a930c40", "value": "768:WCnWZWFTwL7wuikjZO6W9e+HHolkgeIOt7BXAY0Q1C6XbYC1OkVeY:WOpwLXzJ+HHolkgVY31C+b1VeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762475153, "uuid": "c88d36cc-c598-4fbb-98ba-57871b64ffb6", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762475153, "uuid": "9cf27c5e-02ae-4fe7-a3e8-92e0035d2d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762475153, "uuid": "d901b149-8693-4f1d-85c0-e6b1f5e7bec4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae34d6a1-bbfc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535437, "uuid": "09ef50b6-ec07-4607-8d96-82c5de9af737", "comment": "Malware payload (Mirai)", "value": "01c34cf06ab2620c6634e761b8bd12a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535437, "uuid": "f2fa7525-00fc-4b86-a92a-bd99af3a11d1", "comment": "Malware payload (Mirai)", "value": "db5d47d8fd8645176f1a4dffe1ffb763aed90d3c2afcfcdbbaaa7456accded7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535437, "uuid": "ce7ca895-ad90-4f5d-adde-1273c41106e3", "comment": "Malware payload (Mirai)", "value": "1cc1ecb04c0e7573d27e352da2955dca0a486a64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535437, "uuid": "e776359f-31a7-4ecc-a1b6-a12e49e8b27c", "comment": "Malware payload (Mirai)", "value": "7ad9f9422cf1bda8ddb899f8d1d7909b4bbb0b6d60de62b3c202d8891ae271df5c22924d07d0b4bb611187cabfb4c58a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535437, "uuid": "500a3a6a-2aad-4426-9859-15983f976ae5", "value": "T168C329C0B58BC1F9DA1B84305067B33FDB32D4A84070EA99EFD6AF75E663500A52E25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535437, "uuid": "1f5b9bbb-3fac-4ac9-a725-ae662fbeff67", "value": "1536:EEHo8cEOHZOtLVXqa7r8jUdJW/JLJKxSl5QyyVWs0+ZKU71oiIzcs/1/AW8:EqgDKqURX2JYxSgoZ+ZKUJoB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535437, "uuid": "33e54c30-6028-4d43-9c56-becec8fabbea", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535437, "uuid": "877699a7-55e0-4b08-9809-98c5aaa3e1da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535437, "uuid": "c8cd45d0-ad16-4625-9ef9-58c38bd27d88", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336e224d-bbc7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762512468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512468, "uuid": "057b1812-8d49-451a-bffb-c0972ad71bbb", "comment": "Malware payload", "value": "99421768972724f2d173fff52861a3f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512468, "uuid": "174d5b00-1a93-4da4-a4b0-c4049d49f03e", "comment": "Malware payload", "value": "dca8e8fb6836227f52ede805b9e54bcf203f830e404e04a02e8fed88db646134", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512468, "uuid": "10d44f35-3f93-4af7-892a-40e124acd214", "comment": "Malware payload", "value": "31201ec1bad133a1ba4c6c1f2c3ee0476b56e5e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762512468, "uuid": "3811fe9b-ddcd-4eb0-9975-6a4eb951ddbe", "comment": "Malware payload", "value": "0d11372679304fca60df7e0d9bf36224166c305153be3daae4c61cff9e1c58e6ed8395c96aa1ef1562efc9b9d250071d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512468, "uuid": "180661af-6012-4e18-8793-18066e593193", "value": "T1C7650122B441E992E031043A0D5EEA21850BFD559F44F72B7A44B76F26B22C5FEA7F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512468, "uuid": "ed2dd0f1-ee69-4cd0-9803-ef114274507b", "value": "c4f1c5f40ed1441d4a45c10caa38554e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512468, "uuid": "063d2e82-f2d6-4b8c-a2de-e10c41fbc7b9", "value": "12288:29G/2vTChjC+RpXxLLLLhgbQaN1WiGN7iaP70PR509a+Jp9m1m3DvfhnvJBHUF2:29Zv+hu+R3ikk09a+b8Y3lYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762512468, "uuid": "bab3ec45-d651-44d9-af39-5460cf71c024", "value": 1417728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762512468, "uuid": "01dc3710-73b8-46b6-953d-ef40255d9df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762512468, "uuid": "94f377d7-7ca3-4754-8963-9d501d6e01e9", "value": "ZKIRPalmCore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c6c7f2-bc04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762538727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538727, "uuid": "496eb804-43a0-4403-8ea3-73284370bd85", "comment": "Malware payload (Mirai)", "value": "a416cae4211ba0b7e266b5d3cbf154ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538727, "uuid": "df178891-6903-42eb-ab87-9057ec6795e5", "comment": "Malware payload (Mirai)", "value": "de23308991bbd0f635407abc2473b3860176250c99e8ca7bf8048a9841bbca68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538727, "uuid": "93a83dc9-e533-445e-8bd5-d7da537d866b", "comment": "Malware payload (Mirai)", "value": "c387226ef23956d6006c6e17768d3263bf0fb60f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538727, "uuid": "351ffb9f-24ef-49f8-a166-d55b403bc53c", "comment": "Malware payload (Mirai)", "value": "304608731037629019678562c55d7c31c09903bc1c14487fe9c52eccc5208b1f275d30b4bcf37791699ab82900a3b193", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538727, "uuid": "3b27e998-3ec3-4690-82ca-8c7f5a42ddb1", "value": "T1D6F3A448AB614EFBE89BDC370AEA0B0514CD652731A87FB5B570E418B30E68F65D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538727, "uuid": "eb3fe09c-76b9-424d-97bf-7471dccab92e", "value": "1536:rU7wVlwtQeL1JXavFVldIy16CpPOQISTVX7PEmKYTpFBWYMg0mnM3EZErxpDhzhK:rUKeJmTdIy16CpZ5fjMg0AM3E4LA+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538727, "uuid": "896a0f8c-52b9-431a-9b8a-5077d580d7fe", "value": 160908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538727, "uuid": "43824711-4a58-42df-8d55-e764f0142cef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538727, "uuid": "1f86ef8e-19cc-465d-a280-6c16266408aa", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821c5a59-bbc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1762513459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513459, "uuid": "849bc748-428e-4038-9c58-28c420defa47", "comment": "Malware payload (Gh0stRAT)", "value": "74a2b366bc4d9948475ac85eba3b093d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513459, "uuid": "a4b26545-9fbc-43f0-a5d8-29a71d071581", "comment": "Malware payload (Gh0stRAT)", "value": "df31a9ca4d663c22758dcad6d7f4c7aa823c6c83e7bd688f54cd2e126768e336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513459, "uuid": "4c0053f7-76c4-4b9b-bd33-86190361ca6e", "comment": "Malware payload (Gh0stRAT)", "value": "3b56bcb603ff0fd86eb864bca9a05329bb23f6ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513459, "uuid": "41a0a20f-3d74-4dc1-83a8-22a1a1f46dc7", "comment": "Malware payload (Gh0stRAT)", "value": "d8e5b610bf77e1f9a60a3663553d906e2250ee02a8e3189bd0c966f08002f95373ac27980b084b9bc27fd5c519df2f20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513459, "uuid": "798390e3-c798-4c5c-86b7-56079a8246ae", "value": "T16707333FF1AC643FC5AB0A310973825059BB7661BA2A4C1F47F4884DCF6A5612E3BB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513459, "uuid": "32920bae-3f15-4555-a23a-71864117d45e", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513459, "uuid": "10e5f65f-a752-4471-ae85-27f73c2a9273", "value": "393216:5GThBHffG88NDVG9Hr02Lj9QlcFT4sTHEC1gWeSwxPj:5ShfSM9X6C+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513459, "uuid": "dd6d3e0a-8f1f-489c-bfb1-ebf60ed932f9", "value": 17538242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513459, "uuid": "4aa8c0de-4f1f-424b-95b9-e4d70b96bc28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513459, "uuid": "334a7e0a-4ac9-442a-b777-d0826070538c", "value": "photo_2025-11-06_19-15-09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac58fa66-bbc5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762511812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511812, "uuid": "a1c94a9c-b805-4871-89ea-b6848e76876a", "comment": "Malware payload (Stealc)", "value": "6548795d76b87630bc54508fe1b9ba02", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511812, "uuid": "897ffb2e-8982-4293-b4af-f4586025fcc3", "comment": "Malware payload (Stealc)", "value": "e0cfa6e0355c0f3fc68b77b672b4e3ed86553addbbaeeb3f1ed98f295edf6ca9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511812, "uuid": "ae97f422-de17-4a5e-a7c2-c33289d0c836", "comment": "Malware payload (Stealc)", "value": "05b5930d77bf4ff223ba9efcade2682558c70018", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762511812, "uuid": "1a8a4a9b-b166-40a8-9718-0b1557ab1d69", "comment": "Malware payload (Stealc)", "value": "9ec839cbad4f04e104d21aae2d52695938431db0a45af3525c8f6da20cf4443d5f6528c3da512387ad44429a9e96ad97", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511812, "uuid": "4fa83960-7528-4880-bec8-fd3165a64560", "value": "T1AF06335A8F26DA21C642BDF5D077B6CEE7B44C00AF658A5CF2767D39C234381BE52206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511812, "uuid": "c19ad757-4523-47a6-bbbb-8ae2f39f782b", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511812, "uuid": "d6f1dc28-7603-4746-ac7f-f5cf55f89be0", "value": "98304:tW7fg3hFNXucHLsHWnD47sMLx6XUXdCICF//q8:tGfeLDHLsHGD45X7CF39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762511812, "uuid": "06a8f8a0-a8b2-4e5a-82e3-8a3e1c6abceb", "value": 3685952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762511812, "uuid": "ae124015-e764-4696-aa60-d6b76f835a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762511812, "uuid": "783d54b6-f948-4165-94d3-529e02960d45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26c4e75-bbec-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762528546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762528546, "uuid": "5c296edd-501c-4c31-b6be-168593b310eb", "comment": "Malware payload", "value": "9cec4d0b5b1116cc0f76937ca6b1b5b2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762528546, "uuid": "5bc09a47-f282-44b6-bf4b-c3fb242dd95f", "comment": "Malware payload", "value": "e22272ec38dd8af612602aa1d2700bc542aee791f35632cb0e761f32799803b6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762528546, "uuid": "33c29e8a-9f84-4ca2-ba6a-5f6eeeffc152", "comment": "Malware payload", "value": "84b00e51432b6892ec2b6e58daee686ce566775b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762528546, "uuid": "5d954678-51c6-4085-b1bc-303c90eddeff", "comment": "Malware payload", "value": "79ae36d9058ce716644695445440b82e753617e1a72d28307273f7bd2520c98df49d11165a18bb4a7da640edd504240f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762528546, "uuid": "b9ea7ac3-65af-434a-9578-430e7ebcee99", "value": "T10A51703DA1E65B1082441DB0A977EC8203E4E1D6CFBB498BF1D2D1C60F76309CEA0AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762528546, "uuid": "6649ef76-cc31-4113-9818-b878444bc377", "value": "48:P4DY777x/p+kcSteiu5gXdm4jfZ4aoP1IAKHrXD42bMJmchtfqWt+tQi:P4DjSteiu5gXg+zo7KLX7k5vY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762528546, "uuid": "a0c3b19a-93e9-4ed8-823e-29a58228fb8e", "value": 2698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762528546, "uuid": "5a2989ea-6661-4cd0-b1f5-077abbfcc371", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762528546, "uuid": "679466d3-a8b0-4a16-aaf5-f59f94b3594c", "value": "SystemUpdate_2840.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22de7a89-bc06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762539498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539498, "uuid": "6df9c94d-29ae-40a2-9a2b-22d5a7f6327c", "comment": "Malware payload (Mirai)", "value": "6af26aac22b034ce6b5bd2a0948df268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539498, "uuid": "728511e9-89db-40d9-abf6-608db49c625b", "comment": "Malware payload (Mirai)", "value": "e40053c738cb02865378d319295de6dd44d4056587e10bd9e728d3deb555fc5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539498, "uuid": "3d34f3fd-5154-4c7e-a1d1-a6d81d091000", "comment": "Malware payload (Mirai)", "value": "57aef61381733ae4e57ba72946bf68f6eb428d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762539498, "uuid": "d51c6e40-bcb3-41c7-97b3-1864b28f49a3", "comment": "Malware payload (Mirai)", "value": "1779d8f8c6aa90c981bfdbe865a84a983fc2d4d8fa6a8e672b549d20c868da9f53f8c27ca5def202c5bb8236ff256763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539498, "uuid": "0fbca9b4-abee-48a3-875e-77f467c9dc69", "value": "T18DC36D0977084A07C5525DF01A3F17E597BED9A121E0F659384ACB4A80F2E3B968BECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539498, "uuid": "e59abea0-4fbd-45e4-8e76-7fb77c1724d2", "value": "3072:nUZGuhriRMqWnxcfs8ZGZZfXhU0o9Bzul7jpG:IriRMdnxcfs8ZGZtXe0o9FCZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762539498, "uuid": "a89ba6c9-cf7f-48a2-a2b6-86dd62e6a81c", "value": 120392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762539498, "uuid": "99cc5c87-5442-40fa-aa87-c8eb6039c265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762539498, "uuid": "b551028c-5fba-4703-a3b9-cf5bf5ebe65b", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fde1fd-bbca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762513736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513736, "uuid": "8b663dc4-51ed-4371-9b82-22728c83c588", "comment": "Malware payload (Grandoreiro)", "value": "a78887c6c833b31cb1fd8f2811686091", "object_relation": "md5", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513736, "uuid": "de86d6ce-7e15-48a0-8ecc-7e14d20043eb", "comment": "Malware payload (Grandoreiro)", "value": "e61dc597b3b35de047dace5397e385817672182ad63a847c32002d0e95c7dd7c", "object_relation": "sha256", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513736, "uuid": "d6d44d19-c0f3-40f1-9a48-3b7b67cb8476", "comment": "Malware payload (Grandoreiro)", "value": "2178a21f59586a27b8eea82c500f5ce57e5212f7", "object_relation": "sha1", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762513736, "uuid": "abf497a3-2418-4672-8d31-875b441e08f4", "comment": "Malware payload (Grandoreiro)", "value": "c062c60aae882c6f78378f57672431390c7a4f3dc15bf5a2849c8aa208b15568fc3517800669a112291f035f14a9b00f", "object_relation": "sha3-384", "Tag": [ { "name": "AEATNOV2025", "colour": "#EB791F", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513736, "uuid": "07143561-c22b-4e4c-91eb-2f12b9dc8417", "value": "T133362332AA55257BC5A20731F00E37B3AF7D88574B0891E7B9CCA14973AE6D1893D4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513736, "uuid": "ee379c5e-07f4-47f7-a05e-b87c819d11e8", "value": "49152:VYipApU7Z/+V70UGDirpaa16oSUUrZUzfNi/3UqraVIaaguB+8i+AJuim3Y:6Juim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762513736, "uuid": "b7e03370-2cce-4a65-92a1-74b70af216f0", "value": 4935680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762513736, "uuid": "a11a518a-0051-4667-8272-844ea82dccdd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762513736, "uuid": "4cce7215-eef6-4919-8818-8d318cd30d06", "value": "QBN266506749YS61308.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b9d926-bc31-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762558156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558156, "uuid": "a13ef441-8532-4ebc-b059-1bf68b563da5", "comment": "Malware payload (Mirai)", "value": "e4b4c61db2bbfbff59079a8129731008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558156, "uuid": "3e5a2054-e920-42b1-95da-f159fbfd7b0d", "comment": "Malware payload (Mirai)", "value": "e73a2d1398c6915d3ce9b9d40afb6259b37358c63d6e146bd772ddca4ab678e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558156, "uuid": "41924166-9a5a-47ec-9e94-77412158f189", "comment": "Malware payload (Mirai)", "value": "ffbcdf5c343ac6efb56f6e342d4261704a986409", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762558156, "uuid": "0b5ce3be-fcef-42fa-ac53-51bf157a8aa8", "comment": "Malware payload (Mirai)", "value": "2e7fd742204251eff5c5840999a47f2a7c8aa59a3eeaf6fc1c60bf71e7231a5de20090d69132add63fb699721a0c2aa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558156, "uuid": "752f6657-3756-42a8-9c16-ae51ce8e2694", "value": "T186A32C47F9928E12C5C212B9FA5E514D33136FB8E3EE3212CD24AF6123865DB0DBB516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558156, "uuid": "5f4db9a6-3ebd-4d76-9b44-8dd5b2d96d52", "value": "1536:1An+3IsJ0KO536EcFdtO901VSpW3lz7WaSp1SXzDgRiYm13eiC7SN5wYR02:/YyleiSQVz7WaSbm13eiCGNiu02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762558156, "uuid": "3955335e-47ac-4161-bd9d-587b248b1b3d", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762558156, "uuid": "331f699d-3477-4216-9119-9d359db778a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762558156, "uuid": "d2a7fe23-0b49-4027-9c73-ea63ea948217", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f27e30-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526476, "uuid": "4ac9342e-f66f-424f-a98c-044a6a15ede2", "comment": "Malware payload (Grandoreiro)", "value": "dc27bc407c180c5540daa7b74543549b", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526476, "uuid": "ed7a4096-9fb6-4e6e-8293-7ca226974903", "comment": "Malware payload (Grandoreiro)", "value": "e896aaae848540f5fd57a8fea150c564adc7c5163abc873b679ae8479e6c2ed0", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526476, "uuid": "00c8d31c-a141-45e9-b320-29ab3e824bb5", "comment": "Malware payload (Grandoreiro)", "value": "459c85f9ac8d2dbdaa2c971d61986c0479254e50", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526476, "uuid": "2803c399-3834-499e-a99d-a97205a4ab7a", "comment": "Malware payload (Grandoreiro)", "value": "2f03a734e45800bf2f4d5c7cb99c99038aa092683057eb2d8bbadc007f0f39e7dd37233cab97a2161ffed752c720a9fc", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526476, "uuid": "b70b2e5b-e516-4d6e-ad88-8fdbbe9cb314", "value": "T1F15623711B8429ABC6610B35F00F7B315E6E9C538A4C91EAB98DD14A328F6C7C57ECB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526476, "uuid": "3b95c1d3-9fa9-4650-9cec-893d26d86c7a", "value": "49152:teaZbIsvbcd/0H3NNJ8Q0XpnqzuwgZOimeHKLZ96Zm/bHnle7AouwrdzF4bxjDO6:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526476, "uuid": "6b5eec92-1c14-425c-af5d-b971a61beafa", "value": 6176768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526476, "uuid": "61269753-8070-491e-b08b-7732d0b94268", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526476, "uuid": "c10d9f89-928a-4dec-bb6d-a422e8b20bc0", "value": "TMS3836I3C880124.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8796923-bb8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762486572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486572, "uuid": "75893c4d-ec67-4b6e-886b-c4c7b23f16ba", "comment": "Malware payload (Joker)", "value": "71a11682fc52718c774bae1378b768d5", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486572, "uuid": "73316e04-08b7-48c0-be0e-980f2f4bc779", "comment": "Malware payload (Joker)", "value": "e8d0d3137a1add62e84d414762919c5f3583307b153f7e8de084d55b2ea88193", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486572, "uuid": "4cc2c291-1fe6-4f0c-9f90-abe39944d3d0", "comment": "Malware payload (Joker)", "value": "65cf752ce8175d9ddf44f3c7c01697505adb65c8", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762486572, "uuid": "b7aba3c3-8d4a-405b-99fd-958414c1b010", "comment": "Malware payload (Joker)", "value": "42be633fd55891605544f0c82de51d794ad668d6f321238fcb117f193f0be62b2258b0131e3482e9111857ea86ff99c7", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486572, "uuid": "f0b14a7f-250f-4c08-a92a-7fdafe5e8af4", "value": "T13C87126ED70D7826CC7AB07A9D5A363632592CBC2711D3D22501B2DD39F36E08B49BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486572, "uuid": "32b8ccac-82e2-4e14-9824-389d0cc2de59", "value": "786432:5oWNv+JWq6SqzckNA4ytWhQQbvBC3apfktbVN6T:5oWpaWq6S8cT407OBCht/6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762486572, "uuid": "db7919f2-cdc3-46d3-aed8-f3f1ffbb98e3", "value": 36023249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762486572, "uuid": "116a8e87-de9d-4e54-90fe-112ae5c74337", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762486572, "uuid": "017461e4-bc77-459b-af4f-f4a7958fc7b3", "value": "Fancy+Cleaner_8.9.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eef46ca-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762497965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497965, "uuid": "66f1a7d0-804d-4310-a140-1657d2c9188b", "comment": "Malware payload (DonutLoader)", "value": "1c4df25e4a43c0c68fb09de00e3fc28e", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497965, "uuid": "1c2c2a2f-36f5-40d5-b084-44b7bbedf1b8", "comment": "Malware payload (DonutLoader)", "value": "eaeb183d94c18fba7dd0844b0be81b1067c367b53e59f2680c7e757603a322e3", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497965, "uuid": "956196b8-41b5-44a0-b024-9458d06e1124", "comment": "Malware payload (DonutLoader)", "value": "3c47f169166017612b65dede09f2ba56c10b7605", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497965, "uuid": "01cf2cc9-8c7e-4a39-961c-76450c389838", "comment": "Malware payload (DonutLoader)", "value": "8f2f2a158a702bebf6fe086556e24054de53e70a986f5f9e42a3c225c233ec14d3eaa6e8aba5a58d53baa818e819b670", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497965, "uuid": "a4ed165c-e5c0-45da-acdb-aabee195cae3", "value": "T1D4063362F5E4100BE499A6F1327949E511C6CEFF6B48488D0B7C8EFC0EF5996B199370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497965, "uuid": "0a7fc1a7-72e9-4b0a-bb92-661f03674140", "value": "29814bd3ef8aeec7ca62eb72527347bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497965, "uuid": "d38a8117-b775-421b-a60d-9134a7140741", "value": "98304:s+NXz4UGnzScZJzaG288dp12dLE8oW9FGOalerhUeJ:d54znx3at8yp1QWW98OaQ5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497965, "uuid": "9fae452c-7a7d-4f45-827c-9af36bc47465", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497965, "uuid": "d9e48cf2-d62c-447f-b35a-875138b14e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497965, "uuid": "e73bb7b1-1b44-47ee-8d74-712dfad62e02", "value": "daemons.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbd3039-bc04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762538710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538710, "uuid": "9eae03bb-ca6d-4929-a6a6-850d858ce821", "comment": "Malware payload (Mirai)", "value": "ee4b733e35e54cf0f03e2a5674510159", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538710, "uuid": "59dad2c0-7bc1-4089-a6e3-01cbb876a7c8", "comment": "Malware payload (Mirai)", "value": "eb24d6ba3082affd3a796fcc52116aab515fcb2b3bb8110d56f2cfcf287d3b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538710, "uuid": "39a95469-e90c-4777-9b60-83e0574881be", "comment": "Malware payload (Mirai)", "value": "f216a70621d1decb0b713b9dfe9a543a6cc5a207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538710, "uuid": "95a770ae-8f85-4ec2-89a5-d2d051103b3c", "comment": "Malware payload (Mirai)", "value": "25caa0712b0ea283cc566d5fb92c32051c24cda4ae6a671c4ebf39e41ce056252d63f87ca55d222797326898e385986c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538710, "uuid": "ae2bee93-b318-4bf6-bcef-d2101972b651", "value": "T1DB3302FA91D8D0D7E5CEB8BD118A0974568022DA267B9BDE620C05ECFF3E81F304995C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538710, "uuid": "4882b699-ad26-498a-8b20-1bafa649473e", "value": "768:S8g60hSgnsrDUVh0MwpuUanXtpr3EARk1y4v0dQIYlG4CFk9WfUc//O+RScWJu:Pr0yfqCls3rrfRP4kJFk90Yzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538710, "uuid": "03c19128-06bc-43e3-976c-f493538f6b3d", "value": 52352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538710, "uuid": "a4e16d51-d300-4689-a495-fd446ae21d70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538710, "uuid": "32f329ad-5250-4a70-b8c4-e982c71eafc7", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede9534e-bc2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556160, "uuid": "6c7866be-ad87-4c00-916f-1006c78c54ea", "comment": "Malware payload (Mirai)", "value": "8d09df1e28969ead17e2593398619bb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556160, "uuid": "df40b407-cfad-4239-9f9a-7a16b89e4415", "comment": "Malware payload (Mirai)", "value": "ebb162680dc89cf4612c8bd690a26dd4c92f7386de0e9a2c026a095632a50446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556160, "uuid": "fb2ab1bf-0af9-48ee-80fb-13adc5483a95", "comment": "Malware payload (Mirai)", "value": "5f4a558093f00bfd51afd3a4ddf136e513b01a83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556160, "uuid": "0fc67c4f-8de6-49a7-9bbd-c7eeceec7758", "comment": "Malware payload (Mirai)", "value": "448f1100e3441f48d4166c9e2377e266ecb89a5a1dc3385745d3603022d36c4f85bbc4e2f20c8c4a8de59a3ec330b325", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556160, "uuid": "dbed0fb0-c540-4b05-bfcf-aae828e0e47e", "value": "T159933B41B71C0943E1A31EB03A3B1BE1E36FAE9161E4E744250FBB499571E33A54AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556160, "uuid": "f15d3a3d-947c-4928-b764-80ec91f8ed89", "value": "1536:wHhOB5rB4ayLlK4yiYqqTBD+JKs+z7txuVEVoON1LkgWAcPr3tyzMIljMtRk10tO:TyTlK4EPLlPkgWAErdwQnXu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556160, "uuid": "2d49a44b-1ca5-4691-b140-e51d55186678", "value": 89768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556160, "uuid": "774940a7-b1d4-48e7-9b53-d56b88d95c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556160, "uuid": "742c1c22-8201-4385-9bff-4104aee710d0", "value": "kvariant.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5813859a-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556338, "uuid": "15d8ab44-7a3b-4a20-8f90-15ed331a887a", "comment": "Malware payload (Mirai)", "value": "d6b48b52a7c1bb7dde3237b0c9f62419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556338, "uuid": "a7aba37c-4f8c-4189-a921-f083f328579e", "comment": "Malware payload (Mirai)", "value": "ebffb9fe4744580fe3aeeb7db39b017c353f8a2de1ace8495f2d4d8160a4bdc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556338, "uuid": "2e7627f2-b2fe-459f-b010-5b8614cbbd2c", "comment": "Malware payload (Mirai)", "value": "c9dcb60cc54c4e0bb1856c93f0c9f2146ecb89b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556338, "uuid": "f400e3d6-36f5-41c4-a670-5d8253f0be8d", "comment": "Malware payload (Mirai)", "value": "ebfd379a049df6a34ff3e68f40db972a80a8c2cbcae53dcab80cfe4db27e635cfe44abcfc2676048305ac2b08c24beed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556338, "uuid": "c7e23cc6-689e-45a4-aa70-c06569dbd963", "value": "T1F25319B82545F16CF9E05079F44330EB25224728369CF3D3B49301A2EAF5A597E9EE1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556338, "uuid": "feef9fe7-a057-41a3-aa73-d54a90ed0b3b", "value": "768:Ymai10k4wugIkFIMHNeb41uGmJkhx8Yb7YTRMpyEfu:YwudYtmdGmJE8YQEfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556338, "uuid": "2ed538e1-11a1-4c3c-b325-bb902a0e67af", "value": 61084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556338, "uuid": "e8adc63f-bb37-40d7-9587-597010b2f282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556338, "uuid": "a23402cd-2d6b-45c0-b6fc-d5ec392cdfcd", "value": "kvariant.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb33c4f-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526445, "uuid": "03e43a9f-7ec5-463d-a28d-10246b0e5156", "comment": "Malware payload (Grandoreiro)", "value": "95e7eebee0b2721f351d7c79ecaf7db9", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526445, "uuid": "33092424-ab18-4896-b8b3-6f42b93bd7fa", "comment": "Malware payload (Grandoreiro)", "value": "ec5db475d8aa4cfa56aa00130e6fca7908a32810434232d6ca805dd43def99c4", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526445, "uuid": "e5b4b285-ad3e-4551-a492-b2b3d89b121b", "comment": "Malware payload (Grandoreiro)", "value": "a1beac328645ccf9403dd224294b3d29ec9e8396", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526445, "uuid": "95df2ecd-28a2-487e-b178-d4c32f5bcc5e", "comment": "Malware payload (Grandoreiro)", "value": "5184077f630a412ffae0fe52d9bb78b681a2e19219782b9d2a6f6bcf880347a63a9127cfa8838d3c00526bcad763cb2e", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526445, "uuid": "4cbba46c-e4df-43ba-b2a2-1eb963e0ebad", "value": "T19E6623721968293BC6A20735F00F37325E7D985B8B0C91EBF9CD514A36CA6D6493F8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526445, "uuid": "5736b543-72a2-4c35-bb0e-43d455ec4e81", "value": "49152:wkdYyQkWml0dY2CkjAvXHLbw1+tzH1quUKol3CccgpdvL1Z2b3Gbhq1JZE8z3o/2:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526445, "uuid": "fba2b482-49d8-4e92-a196-eacb7a4b1dff", "value": 6918144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526445, "uuid": "04502d7e-f05e-4968-9bee-8f792437d96b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526445, "uuid": "f7b40528-e043-4157-baac-d857d3affe38", "value": "TMS725843YL3689.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19d97a5-bba6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498587, "uuid": "e295bc77-bf21-47e8-9900-ded1f688e879", "comment": "Malware payload (Mirai)", "value": "be08db37033ca4c7bdfc23542dfdc098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498587, "uuid": "2e5dbb7b-4cd9-4e17-a2f6-e05dd75f8c8c", "comment": "Malware payload (Mirai)", "value": "eeaa376e5abcae8f7919a6c4cd9cedd4a3374af590eb2a977abd2c466d4489d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498587, "uuid": "427e38f6-bec1-42d4-9782-df225c44d470", "comment": "Malware payload (Mirai)", "value": "ee92ed6646d87ddd572c04e4fb60f7749a2d967f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498587, "uuid": "a02da80e-9a60-4f03-a1df-faf49ab92c93", "comment": "Malware payload (Mirai)", "value": "ab80cdec9f4147f4040e72572eed403b4a48df371d2a04b150ad7704101baa0c596c485d014be444958de79ea4321a11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498587, "uuid": "ebb3c0aa-9a17-4b92-9400-8a399ae37699", "value": "T19323188DB4011D1CE9D758F991F68F0A9E651392A193471F63F7FED328332A5AE12C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498587, "uuid": "7d51f5af-c05d-445a-b4b9-916d6d44ff1f", "value": "768:xHMe6eOIc29s/+XzpKj2nTIiGyNt+slVsBWvm/we774:xsJe5Hq0VKqnTIiGyDjlV+f/Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498587, "uuid": "513b00cc-8258-4c8c-ada2-c8e14cbc3ddf", "value": 46172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498587, "uuid": "02fa1f1d-b8b9-458b-98d7-be0371b2a3b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498587, "uuid": "a19e2e32-feda-46a3-873c-4e0b5f5c0cdf", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2382872-bbb5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762504923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504923, "uuid": "d43e9996-4e88-4c7f-a8c2-0eaa60a9a0f0", "comment": "Malware payload (Mirai)", "value": "fcab3c26cbf8640cff5ab17e295e7fe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504923, "uuid": "19bb584a-54d4-4fcf-841d-a57b89e4c026", "comment": "Malware payload (Mirai)", "value": "ef463a09d4b889498f0f463e1158c55773f39837d890544d1bd0027ac59e8c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504923, "uuid": "d266c0aa-ff21-4135-87d1-37ee8cf52397", "comment": "Malware payload (Mirai)", "value": "3c55326934dcfe60f1fdf883629348a858bb5b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762504923, "uuid": "eeee026a-0f7a-4c35-9901-d1a0253d29ea", "comment": "Malware payload (Mirai)", "value": "81b5f7310fbede8dd2361b0a55e4c81b850e36134df16faea914f4e600e1d97d1ef293a7d19fa59367a46dc2f6b8c256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762504923, "uuid": "6b6009e3-2361-4048-934e-b13eb07a7902", "value": "T15F256E5AF2B370FCC167C030436FDB62A835F46911216E7B25C4EA752D62DB01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762504923, "uuid": "82b5f801-33bc-4384-9e7c-f0010d0873c8", "value": "24576:MWIN0NM50h8pZxnrNF64MkpqZfr8q2SJmTS:MpWgPnrf6TkpqZD8q2SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762504923, "uuid": "29b0266d-2570-4788-b3bc-501dbb69efa5", "value": 1000512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762504923, "uuid": "40948e0e-7ff3-476b-b1b2-b8057ec4cbb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762504923, "uuid": "cb3958e4-d2ca-469c-811e-6f13429e9490", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ed3591-bc03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762538296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538296, "uuid": "31525586-0b95-4b62-a263-8acb9636144b", "comment": "Malware payload (Mirai)", "value": "d23e2e46be73cd528ec21fc5eefa6952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538296, "uuid": "c1942023-7faa-4cf2-b971-6002441645ff", "comment": "Malware payload (Mirai)", "value": "f1cf642b53f15821b273f3a1f8d098c3906c8d12026cbc31e837abbd61b75779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538296, "uuid": "e96ee456-cde9-4c0f-8ef7-cfa34ff23df9", "comment": "Malware payload (Mirai)", "value": "c1b15a545cfd0eb0c637b0f6d6fdefabe5835b56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762538296, "uuid": "fed8d6cd-d240-4e63-95db-85a2a06e4415", "comment": "Malware payload (Mirai)", "value": "79e33d97b03a2a603634baeec96f4e8c39661ad3c8292b559854204edb69a74e576ec3e67e300493b12c454b0587d562", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538296, "uuid": "8b0505f3-b208-480f-9067-71ce037b8b78", "value": "T1DBB36CC1A5D3C4BEE94702317172AB7B8DB6C53A1154CE86D7EC8F70A892540C49BABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538296, "uuid": "ba75a6fa-df80-42b6-a454-d7a68e35322c", "value": "1536:xnA66QwFDdUO8L9SKMOLcYWujOdV60k8kyABbce6u3SE12AR08PwB3V:iZQwFoL99MICkOb6AkbNcc0CwB3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762538296, "uuid": "aed02b80-4996-4bdc-90da-f53814e46387", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762538296, "uuid": "d46a7ba9-dc14-4d26-aae4-ef0e8161a050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762538296, "uuid": "a0be1a06-1d64-49db-a9b8-ef1fb3c1f713", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14383067-bc09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762540762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540762, "uuid": "0713ce23-b7aa-471c-9f86-90ac590a2011", "comment": "Malware payload (Mirai)", "value": "2cd728eb180b9c8ba746a4924ea560a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540762, "uuid": "6ed0313b-073f-44de-b6a0-e266e87d39a8", "comment": "Malware payload (Mirai)", "value": "f34cbcd4526e83821fe2cb8b46cbbd9977b95658aaba8d0715f1bf308c84ad33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540762, "uuid": "b2142762-2e65-4cd1-a9d3-76071ac5f4be", "comment": "Malware payload (Mirai)", "value": "ef4a57ca1fc96ea29e4e56cedb7c7d96a184a3ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762540762, "uuid": "2a91770a-4f7c-45c6-b58a-5e3ceddecfcf", "comment": "Malware payload (Mirai)", "value": "edce66d1b2881433a4b3c8a7cc345879edcb037db0f58619a42cbe0381e0f672a8d6324aeafd3ef556bd8a6154c366d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540762, "uuid": "a5ef57bd-e79d-475a-afec-7076509d19d1", "value": "T1BB83F88AF991C689DED4AB7AB66F194D335173A4D2CB310BDC491F2673CA13B2E23540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540762, "uuid": "bda422d7-7689-49e2-9951-744df2109a46", "value": "1536:sLV2W0LH+MFHuXUOOYSi1RS2iKZobBlAcQ/Y0NZl4CIxyGw4PfP:sh6H+YHuXUOTSij+bBjQJNZiCIZfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762540762, "uuid": "9502dad5-8185-4faf-a505-fcfe89f74543", "value": 88636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762540762, "uuid": "caef73d3-ba9a-4d29-bead-3bab04b1d918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762540762, "uuid": "0e88ab3b-c8d7-4c67-b89f-0e47df7cf621", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6856ecd5-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502678, "uuid": "adb01cf1-32f1-4e66-9fc3-850ab450965f", "comment": "Malware payload", "value": "ee7ba54224176185f99818257b17038a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502678, "uuid": "4224b7f2-37fa-4026-90ea-45f634982547", "comment": "Malware payload", "value": "f451ad43e1f3f8366a1967c779e72fb6d3f53ddbe523ae8f66a58a79e23a83bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502678, "uuid": "05d6e33e-88ea-4c07-8072-4319ec1cd31d", "comment": "Malware payload", "value": "6c2efafbc88aad40c86906e4116c89ec501c23ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502678, "uuid": "16c16e5a-5d34-4ddf-8154-58d7bd505c16", "comment": "Malware payload", "value": "20a4794007d9088b99875f8731a89da240c1b73c34c3df24a3ceb26737ab6947d83b91124442e23d05c23401631d2555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502678, "uuid": "c0084302-fa07-4753-b94f-99fa395d1e9d", "value": "T1DFF51284BDCDCBF5E040C37C8C82582DB5BF37E18AB515C36F9AE6546E224B85D23926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502678, "uuid": "31f9a90f-6863-4c0e-b767-9e739666a992", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502678, "uuid": "bab16ad9-c966-4f60-ac5d-847d70aa37e5", "value": "98304:gPUvsbVQR9xJA3mLH7vJHh2wIcy08apPOCt7nPAY:gPiCe9DAmT7vLpPzbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502678, "uuid": "b6fa099d-acfd-4e25-a5ee-e4cb05d5be07", "value": 3541040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502678, "uuid": "83e392dd-978d-47bc-8296-01b5af54e502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502678, "uuid": "d7a06764-f925-4573-b1c2-07ed6ece6451", "value": "ee7ba54224176185f99818257b17038a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c86cac-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502731, "uuid": "275af746-bc9f-4aee-8c1f-0f4e569d01c0", "comment": "Malware payload", "value": "6a44c9a0b99ad81dfa656ecedddf17e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502731, "uuid": "10115f32-ed21-4a5c-befb-8f243f447a49", "comment": "Malware payload", "value": "f52b806dfa6a4fc5375a4123be66d095e8e36a768689ae3c1e1431c1d36a74eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502731, "uuid": "56a9af58-0a14-4456-b8ff-b8230fd9e226", "comment": "Malware payload", "value": "a03c9df04365a143a0633301881cf0dca029c785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502731, "uuid": "b438ca92-3e93-4a90-96d4-362e1466b90c", "comment": "Malware payload", "value": "84fd7f4506337a2efe0e7044ad2332e72166d3d05cd172ffa085f5ecca7ab2f0e10ed1ff03e821b35b2f2ca7696f342b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502731, "uuid": "72cde948-61d4-4e03-a9ae-72aa5430aa05", "value": "T14546B023F142C176E92E1AB021B297386D789FE25E2889C3D7E0FDF1AD36571876610D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502731, "uuid": "eeab1338-332e-452b-b636-33d02873e0d6", "value": "f9ab754bc9fa6a8282105e098246a54c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502731, "uuid": "a77b856b-7b2f-4daf-9dcb-e0b1c553c0b9", "value": "49152:bUBH5RhVgVNjkP4PZLhhpgng9xJbZvb6qXHUqpD/1/+s8KuqGaX0ToIBAUZLYmR:IZRhW8MZdngngP3XHUqpD/yJBAUZL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502731, "uuid": "8875e4d3-f707-438e-86be-0ef8c36884f8", "value": 5357568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502731, "uuid": "604b07c1-1dcf-43f6-a25f-849317bfd809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502731, "uuid": "3b889935-ee04-4903-ac7e-a85e22ed4154", "value": "\u00c4\u00a7\u00be\u00a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37babe25-bb99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762492718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492718, "uuid": "010ef7eb-8bbe-4f28-8758-b18585d572b8", "comment": "Malware payload (Mirai)", "value": "114c4da3255b5d0bafbdec7e57f8d965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492718, "uuid": "0c3c871a-7691-4803-9b80-e1c25bcd1ee9", "comment": "Malware payload (Mirai)", "value": "f60f341b795b873128937cde0f633cb177f8b94f772a673f091a32f2b6315a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492718, "uuid": "7c6689a8-e873-41b9-860c-e51268d3e888", "comment": "Malware payload (Mirai)", "value": "99fed87ee7cbe5e0cf552471172874cf60ace9d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762492718, "uuid": "4364cda2-b753-4c77-ba97-f5bfa59e9c74", "comment": "Malware payload (Mirai)", "value": "81f80083fc3a3c1995a1a1bc69c99ac55ce1306bf82ce6bfc0a0cb80de9c639f81f320f8b40c9570ce38a1929552e6d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762492718, "uuid": "1a9353dd-5514-48d4-aca4-5bc9c9e8ad15", "value": "T151634A66FD819613C5C022B7FB1E428D7B2727A8D3EA33079E256F60678B51B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762492718, "uuid": "d548c82e-d4c0-4399-82a2-4b99c731f91f", "value": "1536:QsJv2opgj3Pp7ZwAMsRVOpb93XzCzfOdJpHemf:Qovjgj3hZ2sRVOpbpGzGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762492718, "uuid": "8b191e7b-5f65-47ca-beac-856d4ecccdc1", "value": 72228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762492718, "uuid": "326a36c5-523a-4514-8351-1e596f18cef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762492718, "uuid": "e1fc1a7a-d138-4020-bd5a-9a3bf47c3c59", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c99264a-bb73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762476379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476379, "uuid": "f96b18c9-9717-42b2-aeaf-efee1e1afaa6", "comment": "Malware payload (Mirai)", "value": "418168d00aad130694b2892c966d8484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476379, "uuid": "beda7495-6d22-408e-8c77-028c7aa0d8f6", "comment": "Malware payload (Mirai)", "value": "f62039f00cdacaffcfbb5e4749c586c05e22ae07e0c905f20487bae5a94f3437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476379, "uuid": "654089fc-62fa-49dd-8b9c-b5aeba5c67f1", "comment": "Malware payload (Mirai)", "value": "04fc57f345dd31fa6b909d59b18fbaf5aa7ce69c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762476379, "uuid": "e1273fda-d23d-493e-8921-5ac7d121047a", "comment": "Malware payload (Mirai)", "value": "91e2d479cc5f0ab348441417b1ccfbb4d75901aa39ca54e22f1fc0743fe85c77839214ad135c8366c94e495a3380f253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476379, "uuid": "eb89304a-3cf9-4935-af95-b5e39fcfa617", "value": "T127733AC1F98BC1F6D80B88305166F63FCB32E9695071875EEF5AAF35DA33540662228D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476379, "uuid": "82cda37b-b074-4b15-b24d-47e2f77867cc", "value": "1536:q52MxYoRzKqdcQ3MXorN6Caz3v5xWlQz6MKqe64kRWPcP:q52Meqdz37rNcbSaz6MKv6um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762476379, "uuid": "3a29d989-7e1c-494f-8e6d-85adc3276b6a", "value": 79892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762476379, "uuid": "bf3be90b-e315-4f74-a037-f7d92efeff85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762476379, "uuid": "65159ccd-5bd9-4ee8-9b85-323cd77ac976", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b69010c-bbe7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762526359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526359, "uuid": "6345a024-5a93-421d-aaef-f56955603674", "comment": "Malware payload (Grandoreiro)", "value": "d53b45552f7a193a009d94928b68de2c", "object_relation": "md5", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526359, "uuid": "3633abe2-81a3-4b39-b49d-792a3952658f", "comment": "Malware payload (Grandoreiro)", "value": "f6a560ae94e3e1c1303d8fea4577059c6b8825d4dfe044c716ccc39fc88a4669", "object_relation": "sha256", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526359, "uuid": "d8bb41a7-537d-4333-9696-9b8e39c97ee8", "comment": "Malware payload (Grandoreiro)", "value": "79051028eececcdd69c110e5a1aa7d488f8b15cc", "object_relation": "sha1", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762526359, "uuid": "92bf759d-95d7-4ddf-a1de-2fa2319119e8", "comment": "Malware payload (Grandoreiro)", "value": "ad889cdd26abc41bca52c8fc25a31295d3398b9887ce5f67aca9ee9b1446748f14ca7129bab5d5bf2a01cc68f4fc5ca5", "object_relation": "sha3-384", "Tag": [ { "name": "FJDNOV2025", "colour": "#885794", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526359, "uuid": "6d98771b-7454-4b28-b381-50e61ca412f4", "value": "T16F6623B24A14286BC7910B35B01E37279FBD58678A4CD1E6B8CC914A33DF691897F8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526359, "uuid": "396680b5-90b8-42da-83c5-db532eb48914", "value": "49152:oP3n3zz/3lIum+1LYmiJPjFhP07bUB04cKzEO3g1cM/CHXOqH75iUF9McIENkNH2:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762526359, "uuid": "3fb96886-771a-4b5a-aa61-a165dc45dd11", "value": 6772736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762526359, "uuid": "45daca2a-b6c9-4fc0-ac21-34f0fd6081dc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762526359, "uuid": "48d5350c-595b-4fe6-a90c-b2761cd9d686", "value": "TMS420522PT5641735.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96061a46-bbdc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Grandoreiro)", "timestamp": 1762521653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521653, "uuid": "aaf8eb12-c615-411e-ab26-d6af558798c3", "comment": "Malware payload (Grandoreiro)", "value": "7c5d6e5792b3d9b44f3d414e203ce55b", "object_relation": "md5", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521653, "uuid": "17967ab1-3bad-4dfc-81d3-08ecfd008c7d", "comment": "Malware payload (Grandoreiro)", "value": "f7bf725a87ee7b0fea8d8c942292fcd51b148f8e8ada172351e5b98ed1aca228", "object_relation": "sha256", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521653, "uuid": "6d7bd22e-ccb0-43d9-ac0f-1fa883b09717", "comment": "Malware payload (Grandoreiro)", "value": "f83d7deef33e302e7bd1ee8031e9e5764f256f7b", "object_relation": "sha1", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762521653, "uuid": "0dca874d-e8ea-4be2-b5a4-4bc071559297", "comment": "Malware payload (Grandoreiro)", "value": "ad87ba443dbbe51db8cd95be681e60729f02e319fabe9ff9fab91c0f57b9d89a366daca484bcf1415e9b0ceff2f0b1e2", "object_relation": "sha3-384", "Tag": [ { "name": "93-88-74-111", "colour": "#9F915C", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521653, "uuid": "551e65d1-2b8c-4a34-bcee-47978b92dfb9", "value": "T1F1366C13B3C4603ED1B716365D77B708793F7A602A1ACC4B67E8494C8E39A806E3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521653, "uuid": "32a517f1-2b86-40f5-9cac-d35f5a750b01", "value": "870c6687a46b05256d1e03bb9f999bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521653, "uuid": "427d3b4f-0b73-4dd3-9329-a4d925b10cc5", "value": "49152:DJf+MwYWfS8qFR0btSR/DqzDdtS9Ik2X6c+HKTxSjRgvH8i3Wf4/PTrS:DJf+MdWKattS9Ibmu//S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762521653, "uuid": "6b459359-4ed8-45e6-9030-7ecb34cdd5ae", "value": 5328384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762521653, "uuid": "abc9410d-890c-436e-a849-d8cdf767c13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762521653, "uuid": "11c1af20-7c0d-43ac-8261-8a3aa1674f7c", "value": "FWQWQei9hgow.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08702844-bba7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762498652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498652, "uuid": "807aa614-ca97-4216-8090-c6d1e1353b07", "comment": "Malware payload (Mirai)", "value": "a49d5f55f8816935c6e6a876228b9727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498652, "uuid": "b9b911d9-d4a0-4ee2-952f-fe10699247a8", "comment": "Malware payload (Mirai)", "value": "f8968a42ce898e36101170ca3ed0b830b17e5e3c8f91b93e511484e62c35a965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498652, "uuid": "1908cb74-40c4-44b4-9fd7-c6c2e657f9ec", "comment": "Malware payload (Mirai)", "value": "10d18bf361338be13fd5dcf7d6b701a283dccd0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762498652, "uuid": "58506b50-0d90-410f-92e8-941ea0db038e", "comment": "Malware payload (Mirai)", "value": "f548875978f4881871b88fc79e5b9a85d90bcce92c188d1e70e113d7d7fca885766d181d85ae181a20cce14a5a8307df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498652, "uuid": "e6aa1f43-e284-453f-8052-b309c4b48eaa", "value": "T16B435A0177584F17C2926AF8293F2BD187BAEDD022F4F585260F97964276E33158AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498652, "uuid": "ca2f68b2-1c9c-4044-a62b-5b2864dc56af", "value": "768:zn7c+HcGBumr/JvmXVxqORl4ZcTRxtzSOjSiZYQEA4bNhk5z6aAiegZ4sHOEX2Jv:lBu2EXVBUAdSAS4YtAGbk5MhEghI/7Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762498652, "uuid": "13016ffc-b455-4e74-be07-779b65f9676b", "value": 58456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762498652, "uuid": "66e3d470-f37f-4c26-b02a-645cc6676b64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762498652, "uuid": "1804bba5-c353-4d1e-957a-0540ce1210a6", "value": "xd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d360ebc4-bc2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762556545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556545, "uuid": "1c886cc2-f522-4fac-b3f4-f232134f2fdf", "comment": "Malware payload (Mirai)", "value": "87d15ddefc6d863834ae1d50f645f34d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556545, "uuid": "eaf3aab2-c500-442d-9084-06506b1eb328", "comment": "Malware payload (Mirai)", "value": "f8b9acbdcbeeb5d59c9d31788ef5f717fb62bf728ddae01584e29b6a33d89dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556545, "uuid": "6cffc16f-24f7-4033-87a5-4ddd12595c4e", "comment": "Malware payload (Mirai)", "value": "691af39b3e4f21ded52cb13ca22f2e70ea0c1727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762556545, "uuid": "34737e7c-518c-46b8-929a-9461cd7e4fe6", "comment": "Malware payload (Mirai)", "value": "42285f35a60bd8771f715a7fa255787caa619c2753a6626d5d64bbe0808f00b176c65ba677e5e59b37c4b3d054fb63ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556545, "uuid": "1213f17b-71d8-4775-988d-2ed2bc759ac2", "value": "T1BE931985BC819A12C6C1127BFF5F428D372A63A8E3ED3203DE255F61379756B0E2B521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556545, "uuid": "af398dca-8993-40d4-8700-ddd3cdfbc3de", "value": "1536:bhUQe9qmh0bZKUvQTATKNR1P9OeK+BvNgZoM+mVbeJy36udju:bhUt9qmojvSAWn1y0FB0e/2ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762556545, "uuid": "236bf8cb-92c7-46a9-9d25-d8894e5add03", "value": 89876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762556545, "uuid": "81f5caa6-2e94-411c-ae95-4df0cd1672b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762556545, "uuid": "1491f45b-7c39-4f32-ba05-d0f4af19dd00", "value": "kvariant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206d82f1-bc0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542501, "uuid": "9fbeb440-6e5f-4bfa-906d-6b40dc08bfc9", "comment": "Malware payload (Mirai)", "value": "118ee5455a255ef0ba64e819c752e1ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542501, "uuid": "f334b770-018c-4395-abe5-a3171c2a53a3", "comment": "Malware payload (Mirai)", "value": "f8cda51b0fbe233e19a5146a480975b6eb5c086f2e4ad51a2f746621d000c114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542501, "uuid": "7ec451c0-a5bb-4c32-99c2-a6c738cd93c2", "comment": "Malware payload (Mirai)", "value": "91cb91f30a7eda7f2a34f9265458d1b9a5da8905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542501, "uuid": "9a62363b-1492-4898-bf22-b13fe35a0c76", "comment": "Malware payload (Mirai)", "value": "f948389684c4d8b2739ab1602c8d0c7de5fa5bbd25beae9f6c9deac538253d1e2e5dab4986e8d03ec0659deb4c32efcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542501, "uuid": "a2a72a7d-7c0b-42dd-b119-621cc123b321", "value": "T13C736CC6F6C7C8F6EC130A3111767B2759B3E13E32A5CB83C3A9E636D812980E15665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542501, "uuid": "9aad6afa-9fbf-45d7-8d62-20915c3efbc4", "value": "1536:zD+FnUYl4dUXbzmN2op8NW2Mzd+REYaGL3SGQAUBn:zD+Fh4dwdoONVMBEEADQXBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542501, "uuid": "428c18c2-9dae-4c62-84c3-81abf23c1aef", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542501, "uuid": "01a5847b-fbd0-4e1b-b0f2-1222b3b1cea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542501, "uuid": "f37dc1e1-1de6-41e1-8a61-fc93c4b13dcf", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d03b966-bc0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762542710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542710, "uuid": "2d21083c-6696-4068-96e4-41dcb03c6054", "comment": "Malware payload (Mirai)", "value": "0423ae793b10835c4be1ccd9b21e04fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542710, "uuid": "f116f918-56c5-4035-ab57-cccb379ebe34", "comment": "Malware payload (Mirai)", "value": "f8e9f2eec155b8faaa6883033611d839a9ec68b4d427c649682fdd025de968e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542710, "uuid": "3b5a7dde-1c14-4e75-8d34-eafa356fcd98", "comment": "Malware payload (Mirai)", "value": "3fccf8a6393cdde82e4d71d2accb1e5083f0844e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762542710, "uuid": "0a4b0b35-b829-41ae-b06b-2fcc6a54d9a7", "comment": "Malware payload (Mirai)", "value": "48005b51cd1e1797c10449c9ebd5befab9896f6d809120d2047db70587e013dce3d32d0af622bf76078aa2207b146b8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542710, "uuid": "36c9b8e6-4e69-49d8-b7ec-876d28174405", "value": "T184430260F18DFD54D4983D30E98C86E871110BBDE38E2EF74B845B3D94691150AABA5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542710, "uuid": "bc9c68ea-1de6-4d20-a3cd-45397b8f76d4", "value": "1536:nbvzOicAz4Ce6hdCNUBywkypcaa8/8zcrIDLK:n/OG4CbdEry3LUzcrwLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762542710, "uuid": "dbc94634-e8af-4626-ad59-69f390b9681a", "value": 57548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762542710, "uuid": "950371db-2889-4203-86b9-a2b5e66c3146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762542710, "uuid": "2a009529-9749-495b-8cf6-4f7aa7e46061", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53be84f9-bbfc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535285, "uuid": "2607c504-fa24-42aa-8f33-10289716d310", "comment": "Malware payload (Mirai)", "value": "fe6741a954e87da2f1b47d98b4b5bfcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535285, "uuid": "4142e707-2331-4f58-b4ca-05b5f8d19c40", "comment": "Malware payload (Mirai)", "value": "fa7488e9236ecc7f5f47b2bc730f6ac745768dde9bd681d70fd9581e95b949d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535285, "uuid": "8d13dd9d-799e-4fa7-852a-f23c8cc460e6", "comment": "Malware payload (Mirai)", "value": "f4f7cad7eb52e93fc85bffbe34a390dfe8211289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535285, "uuid": "d51ea46f-9057-43f1-a03b-fcf41ddd541c", "comment": "Malware payload (Mirai)", "value": "4b287117827b134d8a09854f0c97824697706e0ff5bc444e8c119e504ae65d326e937ee545d2440c2dbdb4aeb7fb5df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535285, "uuid": "dbc1fbf5-dbdd-4793-8ec1-943e43d4720e", "value": "T18523F10A92AE1953D85A9270B67F37CF3D62D01C59D08BB790C8902A158FFFF56147E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535285, "uuid": "2bd7777b-70c3-4227-b0c6-d65a98087d30", "value": "768:OaIMM8GdXa3rMdmGnPpE6PtqBkoC9Modsfndh90yEbViq7m+M1WAqvnbcuyD7UHr:OaFM8IhmGnPpxlO2JdWh69bV+fWAanok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535285, "uuid": "9d9b3ea4-0474-4020-8aeb-09185032daa2", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535285, "uuid": "08221daa-2f21-4e35-a47c-5b25fbc366ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535285, "uuid": "263cf6a5-4522-4105-9489-1decfc95c192", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3335ea-bbfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762535058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535058, "uuid": "62a1bc23-31b6-491a-aea8-c559a65acb30", "comment": "Malware payload (Mirai)", "value": "c23c4fc770d9675ea5163c62d2fe9f68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535058, "uuid": "414d7333-fa7f-4b58-afaa-5f76b0f39e4b", "comment": "Malware payload (Mirai)", "value": "faf35aa84f6fbb18c2404aa2622a968374b69e158f29c14113e1cfabfc731c56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535058, "uuid": "558dfdb2-41c3-4410-a952-e0da964c745c", "comment": "Malware payload (Mirai)", "value": "a1a29fcfc1bff978230f5b4c1927169460dfce8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762535058, "uuid": "a0fa9d39-cc63-4eb7-a30b-1280a82b6eb1", "comment": "Malware payload (Mirai)", "value": "e275f250460fed35cd622cab8aaa1390b720f5038782dbfe381223d0b5a15d3c73028029d40879c82940b4705363681b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535058, "uuid": "9af8f35c-693f-4c3f-b4d0-d93113d975dd", "value": "T11833E16B317BEEBBD56730B518D946D8B0E1A823E90B2F7D40C9A369995363E3700D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535058, "uuid": "f4da74f1-8f89-4c04-a377-6264f4a92250", "value": "768:SB9dmbX71ISRniIvfNQBrsOsQysTWL54ReIFHQuxlAmipTQwNRb2ujeCrQBhnBxf:KC7aSRXhQ1bFHQ7kCrwhBxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762535058, "uuid": "cc912c93-ccdc-487a-9e4a-c03eedbc807b", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762535058, "uuid": "d399eac9-ab09-479f-9d7f-35f50207daa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762535058, "uuid": "1869bbc8-c48d-4d52-932f-4d456890e825", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14945b26-bbbd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762508121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762508121, "uuid": "787849ad-7cea-4a6d-9f8b-2819de3e74d4", "comment": "Malware payload", "value": "d14fe1df97a051043243b36ead67cb89", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762508121, "uuid": "bc5547fb-636d-46c1-bec1-8f9e564128ac", "comment": "Malware payload", "value": "fbcde689ec22fb9d18061d74e32c31f056dab86878f384f873c144964d02684e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762508121, "uuid": "36339958-a8b0-4535-96df-9bacc20a499d", "comment": "Malware payload", "value": "5999b09096a0f99e70b3a2d1b0241212949c36f8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762508121, "uuid": "f7c1e41c-43ca-4799-a797-a4c3fa44cee3", "comment": "Malware payload", "value": "2c8b3af4e0d84d5e2d861835e05f222e09e4f7823b2ac8d61714b3e617ab6b342a34b5d5b848ee8357865f20e29731d7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762508121, "uuid": "62102f09-aff2-405e-aebd-25b079d48b03", "value": "T1439633F7033B5DA098784372D5FE19EF1508542A0E877D886E650E9239328BB3E47F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762508121, "uuid": "a8466b5b-beea-4ee4-96fb-fd09fbab78f9", "value": "196608:gwVJ1wN+8xabqMGmmFffhB4ZFriM0cMUFElPXrBdP1GYkAAeN1ezJf:fJTHbqMDmFfLkwh9UFEdr/At", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762508121, "uuid": "b1a6f1ed-e9ff-46ed-aca1-026485b771a9", "value": 9433901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762508121, "uuid": "51fdc7a4-f8be-4cd8-882d-610d231ca566", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762508121, "uuid": "93d69d59-33f5-423e-9874-a6fed6f87384", "value": "Nfe2025_ LUVPFG .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53cff55-bbb0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762502780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502780, "uuid": "aea9aa9a-d1c5-41fb-b8af-3d8afeea8572", "comment": "Malware payload", "value": "0047bf0ac0b050f1e73b6ebcbae9450d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502780, "uuid": "26909400-c9ca-4147-b0bd-29527e0dd6ae", "comment": "Malware payload", "value": "fbe86a2a8a1775830ae0385a238bbb82422b06b748708dff79b39a279d672740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502780, "uuid": "d46a042f-b3e9-4143-accc-151f18058ca2", "comment": "Malware payload", "value": "80465c8bb342842f1a64cdb44c2520da68ac5712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762502780, "uuid": "a8f68b8a-0f61-41bf-ae24-f475ab0c753b", "comment": "Malware payload", "value": "5f7139a6cfeab115fcd1816bff20c5403b8d909e277a34bebf77445042d73f302a315035d7f18b0dc7afb8d33d32a8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502780, "uuid": "43b327c1-4b71-44a4-b91d-0a89e4e5cfa8", "value": "T14546CF13F1128173E53E1AB019B2933D5D798FA10E388997D7D0FEB6AD36A7186B210D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502780, "uuid": "1c6e71f1-a0aa-494a-a718-e883a7daa40e", "value": "f9ab754bc9fa6a8282105e098246a54c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502780, "uuid": "a91c85c0-0104-49b6-a093-a55a44f739d2", "value": "49152:gZ2Hrh573DT21/J7iUW+fEqfnBoIGOLtb6qXHUqpD/8i+s8KuqGaX0ToIBAUZLYJ:y2rhFzw+I5fnBX3XHUqpD/6JBAUZLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762502780, "uuid": "fcaec163-4fd1-4236-8b38-48adbd994b8f", "value": 5357568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762502780, "uuid": "7ce88519-4a70-4feb-afcd-6e24ead04976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762502780, "uuid": "c8de0bd7-1484-4d8d-8588-9cf29c92240b", "value": "\u00c4\u00a7\u00be\u00a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0ac4f5-bc24-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762552640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552640, "uuid": "5823f11f-cbe4-43d0-b9fd-c233cfa120c5", "comment": "Malware payload", "value": "5768de448199007bce279c8c54f9202c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "strongwolfthorn-fun", "colour": "#CD6ABD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552640, "uuid": "fd7599e1-0d5a-442b-a7a7-2cd1313d51e4", "comment": "Malware payload", "value": "fc31dfb6b521c5cce4a13c61fe86547d12bfeb75cc8466283dfccb74250734b0", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "strongwolfthorn-fun", "colour": "#CD6ABD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552640, "uuid": "70b0323c-88f4-4962-a895-d3ac9b2bc63f", "comment": "Malware payload", "value": "ad02e4522de088efe6d69a8a7eb8494b0ef83800", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "strongwolfthorn-fun", "colour": "#CD6ABD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762552640, "uuid": "4373f696-b862-4b3b-98a7-7f08c3a579a9", "comment": "Malware payload", "value": "8b4d15e84bdc1c784363a1900a357b43b25de6844b5988c4320e75cc292d26e099dfbc56eb179bc233c31edcccc24bfa", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "strongwolfthorn-fun", "colour": "#CD6ABD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552640, "uuid": "aed9651d-07d2-4662-9f14-ef32d03eabc6", "value": "T1E5C30259F1BDC896CD27AA7CED3F3F57EAAFB25A40D03691C412988C4023EB5214D89D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552640, "uuid": "fb2a9ed3-f06c-4761-8250-5bc4627de204", "value": "3072:9UTIs4qeDOi4EmeOON6+p3B6zJmlOKvlkWpH2VEVF/cac7DikEBxpDX/EE:9UTIsteSEmQ/clmlllkvWEV7OkEBLDXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762552640, "uuid": "43bd9252-eadb-4be5-8f05-deadb5fbcad2", "value": 124554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762552640, "uuid": "62dc417f-7cf7-434c-a743-c3d15f4f7f46", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762552640, "uuid": "dd147784-4425-42c2-baca-238bdb9ded5a", "value": "Document.online_\u043f\u043b\u0430\u0442\u0456\u0436\u043d\u0430_\u0456\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0456\u044f_\u0410\u0422_\u0421\u041a\u0410\u0419_\u0411\u0410\u041d\u041a_\u0432\u0456\u0434_07.11.2025_1786607896.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2275f0d-bc00-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762537216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762537216, "uuid": "fcc48b33-4ed8-4080-91dc-f198c4215430", "comment": "Malware payload (ValleyRAT)", "value": "01c1236de16e60511c72be0280af60a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762537216, "uuid": "7bd07cec-6548-4a88-9025-e44d49db0499", "comment": "Malware payload (ValleyRAT)", "value": "fefa640efcb181ede0f59c963719648d0904be2d2e45d9c9ef7d381e50592cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762537216, "uuid": "44f88ff2-59d1-4160-845f-05c6893f20ea", "comment": "Malware payload (ValleyRAT)", "value": "22dd462d9fe3d5115a3e4370348ab522223ee056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762537216, "uuid": "919a3eac-9d27-4fff-bd94-c1704c9eeabc", "comment": "Malware payload (ValleyRAT)", "value": "25b33c24504abb7cf83122d19d3b50c5951294882ef32632fb88cc40c1318fd48d36e5a99d5ea67265eea7cdec6547e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762537216, "uuid": "5217749f-cdc7-4687-bf5f-ac71f8408c75", "value": "T187D6221552E208E0E9D5DF3BC95181F9A373AF558260877A537C3DF2FA32B9F0829642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762537216, "uuid": "07c2138e-63b6-4432-a08d-46f01d358ca7", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762537216, "uuid": "eb04c094-437f-4422-85b5-014ba497acd6", "value": "196608:18xc9VjA1HeT39Iig7auDXURuAGCTMQ4qRyyLDWLrtuwGKE5MCNfdq:GxcO1+TtIinuARuAWQ4qzLavIhKEeKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762537216, "uuid": "62993df0-ad8a-40ad-a2cf-6fe15352f5be", "value": 12742966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762537216, "uuid": "7a81b16c-6b83-41bd-b235-423e13ea8101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762537216, "uuid": "573065f4-587e-408d-982b-507cf28380f4", "value": "01c1236de16e60511c72be0280af60a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e74b3a3-bb6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762474637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474637, "uuid": "cb23ffc0-22d8-4ef3-bf07-fdf32fc3b426", "comment": "Malware payload (Mirai)", "value": "7aa4227741aa3ade4ec342b6c5549f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474637, "uuid": "93638087-4515-4f3b-9b4b-a9b354ea7881", "comment": "Malware payload (Mirai)", "value": "ffcff64dde3863ea81090eb03547bebeb05228f66b3097b763824c68f2166fcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474637, "uuid": "64caad97-bb93-4a55-8990-9ff053d2053e", "comment": "Malware payload (Mirai)", "value": "950c4e2c0c1820c1f6a32db9266ecc915cba94c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762474637, "uuid": "bcabc44c-0e78-4b9b-92cb-df2fdf651a93", "comment": "Malware payload (Mirai)", "value": "0f43b4e3ed20a1237965260e32a2bf76ef517b4cb4c057c197e1d4f554b8bb728c37ba02edd6de38cae31bc5cdf2b49d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474637, "uuid": "1a2f3798-0d40-42f8-93e4-6184edb61f9b", "value": "T18BB31B46F9819F12D4D621FAFB9E508933136FB8E3FA3101DD246F6123C699B0EB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474637, "uuid": "650e643c-27c6-43f7-95bc-884add2b59aa", "value": "3072:aMZu4dv3tiagJL4hxQMxtLMMQCVqd5W7T:aMt9iagJL4hxZxd8CsdQ7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762474637, "uuid": "792c07b6-5728-46d0-b85a-38ddb357c881", "value": 111460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762474637, "uuid": "6abb8762-0282-4871-a9db-9499f9807c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762474637, "uuid": "bff40f4d-599e-4235-803c-88f41033b3b3", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a64ebea-bba5-11f0-91c6-42010a9c0006", "comment": "Malware payload (ClayRAT)", "timestamp": 1762497957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497957, "uuid": "055238ba-feca-4b11-872e-6695b2dc4edc", "comment": "Malware payload (ClayRAT)", "value": "99343ea2524dceea051e7a918e921a1b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497957, "uuid": "0dd20fea-aa40-402a-b1be-ab846bd3cbb2", "comment": "Malware payload (ClayRAT)", "value": "ffe908b9697f064fab126514d6830ecdf7687557035d9940230086b13df6d8f2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497957, "uuid": "9b37bada-7bdc-4de1-a0d4-4af8cf88d17e", "comment": "Malware payload (ClayRAT)", "value": "faee230d8ba9694f2a8981f4d04ee07f2771dcbb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762497957, "uuid": "7de53f9e-6a4a-4b6a-9111-c10c10a1e41c", "comment": "Malware payload (ClayRAT)", "value": "5614888d244456be3f30fc7566755ade3fd4b88daaca8d32e12ec50dd5e434c8654f2d4374714abe93445c4cc76d1e65", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497957, "uuid": "d6716bf4-3963-4126-9b74-c116f3639a5e", "value": "T1B8460296F755947AC8FB53320636126056A3CD228F439783AC1DB37C69B7AC80F29EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497957, "uuid": "8efd2a8a-32b1-4c60-8183-af83e9932373", "value": "98304:k4b7oaVa2vql3W/K7+gvjvIio2U7ynsZGIQ1Vs/oFK1XTIrSDISfw5fpk3qi:kUcd2yUNMAioJ2nsZDQ1VT6THsSfqfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762497957, "uuid": "28d823fd-22af-456c-93f6-534fa6292160", "value": 5657373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762497957, "uuid": "a96c2146-de35-419e-b2c1-c4ef38b1dd9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762497957, "uuid": "e8fa0ece-24e3-4c64-81e0-2462df77f1e0", "value": "TrafficFlow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }