{ "Event": { "published": true, "date": "2025-11-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-12", "timestamp": 1762992182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6a0ce6b2-98f7-4b76-974d-7ddd511780d4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a9bdaa-bf96-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762931288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931288, "uuid": "3cb23be1-0897-4832-a998-b1b044322865", "comment": "Malware payload (QuasarRAT)", "value": "8d823e5b890ba5fe64bc2f378fcb0400", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931288, "uuid": "67238600-4cf7-41e5-a11d-cdafec604431", "comment": "Malware payload (QuasarRAT)", "value": "021a02dbe5a2258713659732552c3bbbb243c2ca1c07b18b2c46b47d4d40bbed", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931288, "uuid": "fe80e3e0-01b6-42da-8390-1caa769391c9", "comment": "Malware payload (QuasarRAT)", "value": "26c99ddb33cc5424bf15c3a7a6c0f860299a9a38", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931288, "uuid": "91c0c723-8f05-4ae7-8a5d-4f445dbf897c", "comment": "Malware payload (QuasarRAT)", "value": "8bbd72bc77ea9b7de35d7dec9864e3754c05464924fd3470b4006bbbebac58fbfc484ab727b0ea41dee1042f0fc8969d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931288, "uuid": "8c82c020-07e0-49eb-bac4-4d101c680b78", "value": "T1A3761136CA31BCD8871C3700A7251C9F21A96557D3F74E28CB162CBA3D72B52EF65988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931288, "uuid": "c47e0123-4f61-4633-bfb9-a724caac5dbe", "value": "49152:kY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+C:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762931288, "uuid": "4df18aeb-4d7f-4a01-a777-c03086554101", "value": 7159921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762931288, "uuid": "aa86c830-d2ba-42dd-b4aa-dbdf6aab80aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931288, "uuid": "67713f66-3d0a-452a-a0d8-744c45dacf53", "value": "2222.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf93e6f-bfa1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762936209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936209, "uuid": "14272bf1-b00f-446c-9a1c-2a6e8d71f5f2", "comment": "Malware payload", "value": "c9d7088b591deccc9c83e802c3f76ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936209, "uuid": "f254cceb-0130-4853-89ec-b3f24aafd857", "comment": "Malware payload", "value": "02a4330bdd545d29502454937717e80a587fab5029a265a1609b571c0ab448a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936209, "uuid": "4fff6d53-f3c3-4652-9cad-47251b463cbb", "comment": "Malware payload", "value": "79d1e2c790b0276ceef38c7a0904686899aa6769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936209, "uuid": "c254c6c6-3c8c-4ae6-9fd0-f65945cb0659", "comment": "Malware payload", "value": "21426da57539299031a4cb53ed5b2c5d0e15bee129ddfab93ff53cc569f6f1bafdb8d00ecfc5d44a8f34646df3e7af1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762936209, "uuid": "69f43f4d-7b21-4f5e-9102-263bb147c520", "value": "T101756D3BA1A3947FE677C07F00A61B2084B932B911E158F760E4D6B62F13A4257CB677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762936209, "uuid": "68b5c90e-0974-4f32-b677-0516600c3a6c", "value": "49152:XDy8BQrhXTIVuo+ioBsqb6P9ycQmACpPInM:XDDBAsG6P9ycQmACpPInM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762936209, "uuid": "11e1a690-6fab-4c63-b226-084100ccf51a", "value": 1661056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762936209, "uuid": "2977fcd7-0eed-4348-b9ef-bbf79d02c54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762936209, "uuid": "ecf5992a-0aa1-4dd8-be9c-e2ff9a8c5129", "value": "Suited.rtf_license.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfea3a8-c008-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1762980503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980503, "uuid": "1c7e6b56-8358-42b2-ab9d-f9615cc3d66d", "comment": "Malware payload (ACRStealer)", "value": "0154477d16817501d9c094dbf8fbf793", "object_relation": "md5", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980503, "uuid": "070bf64c-066a-4930-b2e4-7b406ba44e18", "comment": "Malware payload (ACRStealer)", "value": "0423c772d418ab41ac6626d32e5187fb51c3106c5ddcdb48a8655d582decdde2", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980503, "uuid": "57a259e2-b8de-48bf-a378-7c68371bc419", "comment": "Malware payload (ACRStealer)", "value": "9d5d67be576d470afe4b3052065979bb0e5172e6", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980503, "uuid": "31cf75ab-d649-4ec0-8477-8179a704620d", "comment": "Malware payload (ACRStealer)", "value": "0ce2b82743f78a04385bbbf47cb5605ec5c6f0af4b32ac5eda70a2ccfac1a6095e2e817e3487a14804d5ae48d6fcbc28", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980503, "uuid": "4cbe1d76-90ed-4d6f-ad2f-1a03629832ee", "value": "T17F079EDEF5D38598E027C8F047BEF7237A187D5C0154196536CA9A302E63EC86B1AF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980503, "uuid": "8a85d74e-e553-4f56-a1d3-994d5fa18e7d", "value": "3e9cc72a04e75b7304bf6d3fd872277a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980503, "uuid": "2b3ac8c6-bba1-4e76-90bc-6d73a794ffcc", "value": "196608:+xXnKUuVicZ1F16cwqtXG/Tp38fdVoZklYp09EjZp:+x6UuVL96cwqtXG/TpsfdVoZklYpxjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980503, "uuid": "49d51e63-83ce-4e63-a32d-7401775982ce", "value": 18153824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980503, "uuid": "8ba7b47f-8200-43c1-9ce9-0d6a17bae5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980503, "uuid": "e83425ef-8b9a-4fa1-8a1f-b5fb8dc01f18", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b5344f-bfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1762956323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956323, "uuid": "a95b1eb9-1387-475a-9bf0-3319917a5b29", "comment": "Malware payload (Formbook)", "value": "e6e6289554720373f3619fb99159ef3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956323, "uuid": "300eb2c1-2ec1-4514-9a32-cf11edd40770", "comment": "Malware payload (Formbook)", "value": "04921bf47a65f24bcaab41a1ea31653bc61354d7478a21624b90d3eb61f25690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956323, "uuid": "cdf6b2d8-c3dd-4ce4-bd6f-daa899713a2f", "comment": "Malware payload (Formbook)", "value": "1afeeaced98000edcc9ee900bce1efc5364759c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956323, "uuid": "046cc81d-1050-4149-b9d9-3bb744e711e1", "comment": "Malware payload (Formbook)", "value": "312e7babe0797ea12d57fefaed3c704f5f08b35d5f37cd267e728ce04abeb49e7cd591c31a25e5631ee8e2879e1f933f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956323, "uuid": "71892169-573b-4694-b910-22f61320efc0", "value": "T18B45C02373DE8361C7725273BA25B701AE7F782506A1F96B2FD4093DA920122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956323, "uuid": "820d1565-a6db-41f8-86dc-416daeb171e7", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956323, "uuid": "9079fe8b-96a0-4c55-b607-3bfeed697510", "value": "24576:htb20pkaCqT5TBWgNQ7at98g/kKdXx8/77b6A:yVg5tQ7at9NTXx8L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956323, "uuid": "0b2b10bf-a678-44f1-bca4-7a844b5c90bc", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956323, "uuid": "fc3d4780-0283-44e1-ace7-890fb3616399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956323, "uuid": "4ade1653-8449-47e0-bbc2-d7383208c101", "value": "ADNOC ABU DHABI LNG RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b28823-bfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1762955167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955167, "uuid": "0067de1e-10a4-4262-b89a-50c5d7233c0f", "comment": "Malware payload (Formbook)", "value": "fa6031a3bfbbbf8ed7d9edcf7d53e235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955167, "uuid": "4c9ea940-c2f9-4875-87e8-8b2717ac82fb", "comment": "Malware payload (Formbook)", "value": "0736bca6f642df69654f042e4ea38fe03d11a9dd6ac5e14fc5b6cba2a1facdfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955167, "uuid": "aa989a17-1a81-4065-ade1-1f67dfd7d1b5", "comment": "Malware payload (Formbook)", "value": "2ed4fa0f72b9867d9dfa8a949c9a158d0e363798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955167, "uuid": "3cbfd7b4-1714-40cf-ad8d-3e8a5afcba24", "comment": "Malware payload (Formbook)", "value": "2c81144d51929eb3536ee375d6363c1c28ca851a7bbeb7755c4bf027dbfaf3c99635d73c803ec68e3c95dccae53968a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955167, "uuid": "fb379f0c-f9c4-4014-bc78-9d02653ae202", "value": "T13F45C02263DD8361C3B25273BA667B41AEBF7C2506B5F46B2FD4093DEC20122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955167, "uuid": "3434179a-f12c-47f4-acbc-ffeee50ab8ef", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955167, "uuid": "035ae80b-ef42-4572-8bba-eadc7f2f9e68", "value": "24576:Vtb20pkaCqT5TBWgNQ7aEn1xJqK/BBXriwk40vr6A:GVg5tQ7aEn1xJbbeP40j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762955167, "uuid": "8a5a3f00-418b-417e-b4e6-b0fe8070a61a", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762955167, "uuid": "ab47bb76-a6e1-4291-929f-5f4055bb338e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955167, "uuid": "2426657c-c9d9-43db-98d6-102bb504ebe9", "value": "INVOICE 24-815 PO-VPI01-250138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0d8687-bfc9-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1762953279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762953279, "uuid": "8ebc0b60-ca71-48fa-b52a-81cbc4120f67", "comment": "Malware payload (GoToResolve)", "value": "6228793823c2e3605c035e1d5b312716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762953279, "uuid": "02e3cd70-e8e3-4130-8e49-2e7f38d480eb", "comment": "Malware payload (GoToResolve)", "value": "075cb30664c4cca7c5467557baf3a431c2e584d2287fc5b7c5ce45439eb349e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762953279, "uuid": "4cf48920-f487-4cde-a3fd-12670fb6a07d", "comment": "Malware payload (GoToResolve)", "value": "e2e8c8b86e0c28759d9cfc9b7f9a4751872849c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762953279, "uuid": "e8d60d5c-928e-431a-8e71-53b1adea414d", "comment": "Malware payload (GoToResolve)", "value": "a99c15dd8f4b0655e4788fc339a0f40ef13b994299e7d7433533d8c657aaa7d88cc7ba1a9970bab3b35118091f4c665e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762953279, "uuid": "77ed3aa3-b9b0-4f53-b65a-5ca70f6b50f8", "value": "T19037333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762953279, "uuid": "1c23e813-75d5-4acb-8224-75c86e9a0867", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762953279, "uuid": "f190fe8f-d7db-4fef-adcc-36361f98d7f1", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpL:q9WtLzgOTbjZvk/ekS/mcpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762953279, "uuid": "ec2ec0a5-e8eb-4916-ae9c-e483696bd6b0", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762953279, "uuid": "2edb0686-a294-432c-b6bb-e31a9e8c5718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762953279, "uuid": "46c86805-0d0a-4251-8cce-0834c3d7793e", "value": "go.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab84cdf-bf63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762909308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909308, "uuid": "ec3088d4-6cca-479e-90fa-6763ca0c0a42", "comment": "Malware payload", "value": "de20a2ebcf2b77e20ee69e52ea1b25d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909308, "uuid": "b55bb9fc-a340-437f-acc2-364760e52b2e", "comment": "Malware payload", "value": "07ddef2fde289218f356264bdf1d4409ffa44168c8e98c03ae3c5015ed62fbb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909308, "uuid": "5d0fbdcc-5c88-4a66-b8da-9485c43365c0", "comment": "Malware payload", "value": "b29a34253d23cb3675f3ead0ebe561462877f2a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909308, "uuid": "26df24f0-3f2b-4453-9756-76d6e4564794", "comment": "Malware payload", "value": "76b8dde4198cfb3ddb530bf8299862268796d2bfbcef4de7d1de5cfc7e9182585a537220625bccf1cf80ed178c7e8426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909308, "uuid": "2760ec62-d476-4d7b-9c05-21b5311dcd8e", "value": "T1CB732902B7A294BDC096C5B486AF9577FA327C582215393E77C0BB742E32F215B0DA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909308, "uuid": "d493b495-05ae-4afd-80be-29275012d0d6", "value": "1536:FJe7LfRHDagoBIVVXAxSpviH+dzO6xC20aRV8GGc/orSU:27LRjaVImSa+dLxl0iKGYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762909308, "uuid": "b96e3612-4a22-44ff-9260-ad87a652083b", "value": 79736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762909308, "uuid": "dbf4d333-1d0a-46ec-bedb-7b2c7d195c4b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909308, "uuid": "f04e4170-8a00-46dd-98a2-595dea44c144", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfe162c-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962219, "uuid": "c01662b0-d0da-416f-a405-c857979f9481", "comment": "Malware payload (Mirai)", "value": "46e780c32b0ecc0648abf92742923c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962219, "uuid": "50debff0-2a13-4805-a315-c232fdad3c26", "comment": "Malware payload (Mirai)", "value": "086527432730aeb2a1f749cd460c8e908bc8e56129e79ee606c3c31f321ac519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962219, "uuid": "4dde94e2-298f-4a8c-96ce-9eee2f09e38c", "comment": "Malware payload (Mirai)", "value": "2ea6326f4deefb21d6812da5b9f6fa57897ba764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962219, "uuid": "4caf2342-b169-43be-81b3-2c4d83afeb74", "comment": "Malware payload (Mirai)", "value": "490bccbb3252b706aa8b5dc3cbd1b95d2f159e6da191e24889b96a119dfda17c1b2890a57a657795c56fa3dd98c01826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962219, "uuid": "597167db-7bfb-4ccb-bf76-660c58931faa", "value": "T10F530847E98880FDC18EC234277BB63A9876756D023DB2BA6BD4FF17688BD611E0C544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962219, "uuid": "54a87e4a-3381-488b-8a6e-9d9a2a49c55b", "value": "1536:0Aig0uzilzbji3TqZxvOWRiisSFYtj1GQXyzfeXZ2h1cpvjiqsOgFnmNL5C:0bVuzozbji3axv/Ytj/Xyz2XZ2Upvmqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962219, "uuid": "cd63b4bd-ab2a-43d6-8d89-146532346083", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962219, "uuid": "170fe9d3-a766-47c7-9e37-44984be80670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962219, "uuid": "d95fc64e-5060-42c2-a705-00a10bd04488", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e676af3-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939943, "uuid": "3d7930e8-9eea-42da-884c-4d1244c3bebb", "comment": "Malware payload (Mirai)", "value": "2e7c2107ae96e89859caa67304f2b59b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939943, "uuid": "2aaf89d0-1609-4d86-a20f-fac44eeae86d", "comment": "Malware payload (Mirai)", "value": "0879febbc4d78fe9b85b378f609db1b7f58a4dc85cecd2c32130754ee55d89f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939943, "uuid": "3f3a65fc-fd22-4452-8b77-9cc2e89a6a09", "comment": "Malware payload (Mirai)", "value": "e402ef33a5fda1261ce86763144c87e379d1af07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939943, "uuid": "53176412-f104-433b-b6ef-adc2e593d831", "comment": "Malware payload (Mirai)", "value": "5c03910b813a8d2b1906dab6aab2fcba9236a598beed8006e54cb3e6f631e1c36b0b9494d9286f5f21b81d8352e3a719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939943, "uuid": "8dff7b9e-f8ee-45b5-99c2-f635011de1e5", "value": "T1F7137D7AE4AE5E54D0460230B4649E341F13F6C493536EF71EAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939943, "uuid": "6d30cc84-41da-492a-8817-9a10cfedb9a3", "value": "768:WaRH4ge4hYyFDinQT3yMILrzCideITC3o9C7N8C/ww:WaRYghh/FmnQyMiqid9Tf9e8C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939943, "uuid": "7726e3ed-b752-4028-8122-cbf7baf2a90a", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939943, "uuid": "cd6ea111-8ab0-4848-8424-67658835b820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939943, "uuid": "4712e8bd-6986-40e6-9ae2-c6c9c779f1b3", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16aeec35-bffc-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762974988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974988, "uuid": "b857c090-6d86-4695-83ac-0e0a6f80e563", "comment": "Malware payload (RemcosRAT)", "value": "3dfc48c2247a2870e620fba544e3c042", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974988, "uuid": "b9c0732b-7eff-46b3-b6ea-0cadfdcc5082", "comment": "Malware payload (RemcosRAT)", "value": "09edb8565e9902955f79e4fb24145c8b7436e1e148ab17e9ec52a2372b0f6fee", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974988, "uuid": "4463f8c9-7d84-49ed-a015-5ac8af3c7b14", "comment": "Malware payload (RemcosRAT)", "value": "25c1ac069347b296b909448a00db1ee5b35ec3c3", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974988, "uuid": "e835cb9e-eaf2-4fcd-ba0c-fbc65c227cf3", "comment": "Malware payload (RemcosRAT)", "value": "d4fa79d279c019ac11a2a3023a0e10e138ff351bbb14e0ad3a5749c4e154abc7b01e904e39afe72a3f9e053cc754ff3b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974988, "uuid": "15bae2d5-a0ee-4853-af3a-b530485cbb1e", "value": "T15D96C6152BF0D49ED5E6AEB1DA2E2690AC4E391728D70C4BF529F5EB342E40CF610E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974988, "uuid": "d023a289-9c95-424a-96a3-ef36e567af0e", "value": "196608:1AkefhQNZ3fDPbcaYqnyqMng44T/71PqxEATwhZ:2kSkdMgPbJPqxXTwhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974988, "uuid": "67b4a30c-4c6b-411e-a192-62d00d89c69f", "value": 9293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974988, "uuid": "215d4461-466c-4b78-aabc-72da9a1cfb1c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974988, "uuid": "40a7b85a-4379-498b-87f2-0d0e323527fe", "value": "RICEVUTA-DI-BONIFICO-BANCARIO-ISTANTANEO-8373900-PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb2f6ff-bfd6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762958762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958762, "uuid": "63262d6e-b857-4b97-b033-636dd6f163e7", "comment": "Malware payload", "value": "c8701fe1fcf13b86399015caccef0d37", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958762, "uuid": "c6c7c66e-426b-406c-b1be-214451b07030", "comment": "Malware payload", "value": "0adc824fafd5844829d8fef43c8f25b3e1bdc59f7b136715d9a9675ddfecd7c4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958762, "uuid": "1b1582f4-4983-4f8f-ba30-fd4762271a7a", "comment": "Malware payload", "value": "147401f66ad04a0293bac89080f89dde70e76167", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958762, "uuid": "8cbf3df5-0c55-47df-8bd7-91d56e304ee1", "comment": "Malware payload", "value": "1656f843e3a1a0c72e31540ae095906c6f9c13993f06a3e7576a9ae78ab2866c53909e22e24e677c5b039d73d7db5e7c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958762, "uuid": "8500f903-8508-42af-900d-b19ae9d96d17", "value": "T15311E38ABB090046C2F13FB46D865E361164675432129E17153E05661EFF355D94D5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958762, "uuid": "76611055-e8b5-401a-95c7-5749a7fac238", "value": "12:5juSrrLNsmruywUPkbnmVqB7wEmruywUPkbnmVq+sTHrrLNUs4MtwoL:9PlsmPynmcyEmPynmc9l0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958762, "uuid": "f354f5f0-df2d-43bb-8f3c-a90663fb3279", "value": 884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958762, "uuid": "d1fd97a6-04d5-4d53-b687-b8f23b349503", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958762, "uuid": "5aed7e34-6361-4890-ab4a-b4e6e2fcaa60", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ffb71b-bf94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762930314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930314, "uuid": "a149c5ac-df16-4311-944b-2a9f59f4c60e", "comment": "Malware payload", "value": "b201916d19d05fbf564ac190e0325c17", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930314, "uuid": "0d40aba2-b63e-431d-9afb-e44455eed14c", "comment": "Malware payload", "value": "0b13f2e3ed677d313a4870bad88a0a8d30f60d54d8fc980430ad4696562897a2", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930314, "uuid": "c42a0442-a888-4087-abff-2ebf0a33d2b9", "comment": "Malware payload", "value": "30d6931457b90689a765da050561dc4144aa143c", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930314, "uuid": "e7d2197c-4543-47c9-bd72-5153080edc4b", "comment": "Malware payload", "value": "76f7bcab4c56fd66f82fba220f81a0373491e023b59736baf51445c5467f23f54c364ecbeb62f64afb1dfce8e1e04408", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930314, "uuid": "a6f3a7d4-1de2-42a1-af80-3e5348284c1f", "value": "T1AE1423917BD6110C2BA2BC2B1F984F65269687E4CF30AB977CB609C54D61B06F8C5F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930314, "uuid": "5bc4dfe2-6d60-4021-bb20-27cc5e4d3be0", "value": "6144:xzY5L8XEHL6PnWGfe7GvrXPcRcPCh5ShxCe:xzYZ4SirXPcRcqhuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762930314, "uuid": "c1b80032-5bc9-44ee-9d56-a3698d6a39fb", "value": 199714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762930314, "uuid": "ee8ca74f-ebc0-45d4-b33c-b8a2d9848a7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930314, "uuid": "5e47ef4d-977e-437c-96fb-eb7de56dfb7a", "value": "cqyd3f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d42685-bfdc-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762961373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961373, "uuid": "a0efe863-5131-41ca-b31c-474c3605b30c", "comment": "Malware payload (AgentTesla)", "value": "be9ef8ae16189dc0f352566ee1ebb8e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961373, "uuid": "70a7a2df-6fa9-4408-bb5d-ec76152f730b", "comment": "Malware payload (AgentTesla)", "value": "0b62b3c2b133b53c915390198978412669b2baddd1ca2bae28bea537ec35a3be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961373, "uuid": "1a3441b2-befc-4032-8dc0-64b27f62f409", "comment": "Malware payload (AgentTesla)", "value": "8c7f2e48b653853d6d00e43f0ff97346c74f9f23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961373, "uuid": "27520442-612e-4da2-a29e-6df2ff60a680", "comment": "Malware payload (AgentTesla)", "value": "1497197d23526385dcc967d84b95851e2b97b930610f1bbdb3c942c7d23143915dfb0ba5ba6e9c5f777b7196cb91e119", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961373, "uuid": "7f7cdd77-01e5-4e62-9912-2de31d876156", "value": "T1314423B045B25C5255F18C11B6096D5148A20C3EFA86C9F0F68EA7FD1A974F0ECB06BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961373, "uuid": "9034bb18-330c-4ee9-8cbb-500a92c50dfc", "value": "6144:WZvA/8k/LkwocWEcAE6fy9A8hCbvSdhbqSGJu8sMgdhTCTNxNci8V:nz/LkwocW1AETEvIh38hgnJiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762961373, "uuid": "a0467e6c-0d93-4bef-b7c7-6c849a945fde", "value": 254190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762961373, "uuid": "8b7f7a69-7517-46be-83dd-66c57b740a7d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961373, "uuid": "7509463f-7b31-4713-bcf8-064d714a4967", "value": "PO-011024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a4a4db-bf5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762907657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907657, "uuid": "109fa880-63b1-4138-8ec7-3f24e4bafcd2", "comment": "Malware payload (Mirai)", "value": "d0f851837fee48e2e9f8cbc0fcd4dc0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907657, "uuid": "96e30ee1-ba00-4d50-a174-f4142985b4a6", "comment": "Malware payload (Mirai)", "value": "0c6fb267aa73a145ea88f34c282bc0deac82aeb1fc199ba2b7c471f66481c2e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907657, "uuid": "70e204bf-2d4f-4e6d-a39c-8e47cd650e85", "comment": "Malware payload (Mirai)", "value": "1d86c4693a96bf8674d6ac63f5a1ab5ccd3dde0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907657, "uuid": "60909925-35fe-4559-9822-2072591b235c", "comment": "Malware payload (Mirai)", "value": "450f4db8fde3fba5528daba19401e16fb9c5076267004e417fc171586f450661d0c32d79266d051b1bbcd3da7431d365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907657, "uuid": "8e76969f-7475-47bf-9420-36d2d458fbad", "value": "T12FB338C0FACB84F6D50B88306176F63FDA31D5A94071C75DEF9AAF36DA376818102689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907657, "uuid": "5a61cfe2-8417-4d27-be0a-9791b4f63283", "value": "3072:qFdFmuw5QbMWC60RUAQtSZcKdgnFwE1peR:mNQQb1C60DQt+L0eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907657, "uuid": "7ec6d0e3-9cbc-47ba-88fd-efc6e082707e", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907657, "uuid": "0cf8b02b-2c5b-431d-a628-d2b76973556a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907657, "uuid": "f8ee3eac-edae-4c9e-82a9-91f76cd6527f", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c927e6-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991822, "uuid": "cb3077ee-0696-4654-b6b8-6edb3fabe18f", "comment": "Malware payload", "value": "94047a726fc7e0d0e9438ee25b4bf6f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991822, "uuid": "e7e9fb73-c8ba-4748-bb35-630adc4a43dc", "comment": "Malware payload", "value": "0ca4e6fd9ab8da9824cc1ef5dd30d5635f505b15f115b12aaf1fad3cc946c5aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991822, "uuid": "4de24a61-9ea6-438c-9792-7bf208935734", "comment": "Malware payload", "value": "2a312c84371fc9220274fa10c0e27a528e9699cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991822, "uuid": "127e759d-15c3-480a-a716-2527de5dc8a9", "comment": "Malware payload", "value": "b718183e7f48643e282e55ccbafce42be10616b6a94b95e5952f3b861ea75e9d468a596214cebb631b369cff02688cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991822, "uuid": "77f566de-a35e-4814-a87f-eef0aa6e74aa", "value": "T10683F955F880CA61C2E165BAFA5D528C73230B78D3DE72029D24AB343BFB9560F37946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991822, "uuid": "33b47aba-39b6-4fae-8ba0-d517f1276c89", "value": "1536:zVddUbVkpOiJGpC+I47CTJn3ODTYDLtPwZyjBTEiJOd9Mx1Ir:zWb2oieI4vDTOpwc3EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991822, "uuid": "7e8a3dc9-616f-45a1-b345-f5137ae4b79a", "value": 83216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991822, "uuid": "568c87f4-a7bf-4b89-b2be-1c6a92e6fd54", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991822, "uuid": "0702efd6-7b5e-4056-8875-b99013585c8b", "value": "frost.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24575c1f-bfe5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762965132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965132, "uuid": "5b368b75-63d4-498b-b9ec-e34d25c7ef95", "comment": "Malware payload", "value": "0e4d7b0c07e95d0f6f5d216a1434f1bf", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965132, "uuid": "8439f3bb-1ffd-4edc-bc6b-0ef60ef58bd6", "comment": "Malware payload", "value": "0d19b19191c00a2860878221c7c3c99d86f7e77b4bd5692acb3069f069ee5e72", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965132, "uuid": "37bb873d-13a9-4e61-830b-440578a61ceb", "comment": "Malware payload", "value": "3d8bb201cdb5424ffd278657151ccee99966edbb", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965132, "uuid": "c3daac8a-7355-46ba-a11f-96008b9e91be", "comment": "Malware payload", "value": "ca9f869dd68c2b963d2d22e2428fa81b87076afacb0e8c7aee09f5f7716c9dad7c516f468663a2d6d6ef0f1975040c2a", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965132, "uuid": "f4500cbf-9f18-488e-ac22-6e435f16033d", "value": "T1CC75330D3E567F36E5A8973B23FE10BFA2180B9CD14146C2C2C44FD7D6A65F2EA91248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965132, "uuid": "2b9db526-8052-4923-820b-ee9f0ee21338", "value": "49152:SRFntDCYVlZy0UqNiSaWfFeDZ9MLKHKY5BEb9x:SRFnTTZBaWfvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762965132, "uuid": "ae695535-e691-440f-8515-b7309f61b31f", "value": 1609242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762965132, "uuid": "71a9a96f-20c4-4143-a053-48c305ca4d43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965132, "uuid": "5507fe60-e196-4227-b4cc-26ba1b1290a9", "value": "SWIFT COPY 2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b129621f-c010-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983837, "uuid": "c192c1fd-e963-4d79-a74b-36b13771e3f1", "comment": "Malware payload", "value": "04bb7e0b9a6b71c7f62cf1beb581e964", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983837, "uuid": "46b27565-10cf-43fa-ae2e-538f2861572c", "comment": "Malware payload", "value": "0da788889de28ceefe09df55634c021d1a96b64d4aa697cb294d51e77efb6188", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983837, "uuid": "a99f8c08-bf2c-4555-9a35-78cea41bd57e", "comment": "Malware payload", "value": "f455bb3f45385902fe7f81dea6ab1912dd236d89", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983837, "uuid": "ff9278fd-1ae2-4af1-8b88-4b55496e5440", "comment": "Malware payload", "value": "1e5bfa07bdb18d67b84787d4589013d506b56c81caf8a2d8a5118a9e7b4e5ff8b1c1f125ce0910c82f9330275e058509", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983837, "uuid": "9c149b31-6446-4ec1-be35-944197e36ca0", "value": "T1C7861203F78E092ECDD2BA784E5353716615ACAD2820828F4952F318BEB76D95F16FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983837, "uuid": "c7335258-e28f-481d-a12a-023cd292edef", "value": "196608:8r7CnAXHd7v2AuOtWXs6qTGTBJvhiumopV+pLc:8r7j7v2AftWc9g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983837, "uuid": "191ce0fa-0959-41ae-a1f3-14b3f84ea557", "value": 8512708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983837, "uuid": "7bcba2a7-9278-48e3-a25b-8d70ec468459", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983837, "uuid": "d8b7c791-b9eb-47df-aa46-bc7099c7bdb0", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cbf413-bf5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762907604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907604, "uuid": "97c24fa7-25ff-4fe4-8f34-8036213502ee", "comment": "Malware payload (Mirai)", "value": "b0ff5717c09a0373dbd7dbbbae49d249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907604, "uuid": "237a2143-5db1-4e9c-b46c-74acedbf65cf", "comment": "Malware payload (Mirai)", "value": "0db352626bc28e48b3c83b52ef26a4dae05d43d2d0584414e62f29c2fd2f668a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907604, "uuid": "6c29ee57-c6fd-4cc1-9eb9-6daa4de46d5e", "comment": "Malware payload (Mirai)", "value": "798b3ac6f295e7bf4bedcd86ff9a5bd6cc9986b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907604, "uuid": "324fa973-a9fe-4b75-a373-36173dba9d58", "comment": "Malware payload (Mirai)", "value": "ef8ca46f4be2a27dbbfb7f54bc67072cf64299ccfc88bde47a66cc550c32d648005d9f9fa6358a4a66d8878694f31930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907604, "uuid": "c79b4389-2f48-4fd4-85f0-87f4d46a9028", "value": "T14A23F236D0BE0B97CDBB137949C3BF060410EAAD468904D5969D75B9E423E3D2FBD882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907604, "uuid": "16a4dedc-730b-49bb-833d-764d7cc12f56", "value": "768:iTzKqT/RyAAtK0iJxgyro4THuxIA96w6r8e101NHvxBZO8KDHBbqdTrRG98mx2nf:iTzT5c0uyrNo/deq1FZBkFBbqdBYonoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907604, "uuid": "1789db2d-216d-4866-b679-5320ba7a8aa5", "value": 45864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907604, "uuid": "bfb13789-df9a-4b51-a600-02588aa0cc1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907604, "uuid": "a9ebc8f2-1048-4a06-a009-618f3f3ec38c", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d664c48-bfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762960557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960557, "uuid": "bc57cc2c-ab3b-4e21-8771-1deadafd2efc", "comment": "Malware payload", "value": "9eaa73f6a6ac3d57c968cd9e255f151f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960557, "uuid": "67ebf750-72f5-4b90-8e1b-e024fa62ffce", "comment": "Malware payload", "value": "11294cea49dcea4d6a08bcb76d7bfa2094a51250c38baf5778b10df6d01dbb3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960557, "uuid": "bf7d722d-473d-4e43-93ed-07ffd7bbd6b2", "comment": "Malware payload", "value": "5fe81358f8d4e6878737b9bf7b7fca5376604d18", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960557, "uuid": "315966d7-c5a6-444e-ae9c-1cd9a3967e66", "comment": "Malware payload", "value": "18d28c6ef78d5b232122c1280cca91e143fc2a3e06887c4be69fe77a3913eee58f6c00f9b30ccdfda0f36987fd52b342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960557, "uuid": "2a6c828a-ff3d-4fa0-9806-73d923a8d70d", "value": "T167533A48778E8997CB6D8ABEC491A162C3B1F6E6E60EE74E2FCC50E938517D411012DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960557, "uuid": "ba24cd7f-a7cc-4b8d-a4e4-a6db5f1a6b76", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960557, "uuid": "5ba5fe91-cd83-4bb8-b11b-008605df97ff", "value": "1536:OmpMpspYpFaq5rVIDKXlc50ehVuSI9hzbuxJRS:Omq2W6ArVFeiJhzbuxJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762960557, "uuid": "99971770-d928-4108-99f6-5e2f29e0f2fb", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762960557, "uuid": "f28e266a-9a5a-42b8-b567-d3240aeca26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960557, "uuid": "375f9878-2622-414b-afdd-b7df20689100", "value": "11294cea49dcea4d6a08bcb76d7bfa2094a51250c38baf5778b10df6d01dbb3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b65752-bffa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762974256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974256, "uuid": "ae8c5602-5eb2-4e1e-8213-455eba1a5a1b", "comment": "Malware payload", "value": "b9c4f9b576abae30cb2378af01b92d9f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974256, "uuid": "a00079bd-4e13-4304-adca-16f128fc1113", "comment": "Malware payload", "value": "13a1da072a072572d8f18be415f956f504686dcb44616b2a73f2b668e18506ae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974256, "uuid": "9b9365c3-2a13-4c33-affa-394952bd7199", "comment": "Malware payload", "value": "62305d8d00dbdb6ed087b0a09b33e5d7e1e1ee3d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974256, "uuid": "26e499bd-bcd6-4a86-8066-3d80d0907663", "comment": "Malware payload", "value": "8cd08af8616781e8d25f31706934d5c8efe3375ce0e3761ea1a3b93940756297029141ec078b28b6deafaa0cae4079f8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974256, "uuid": "2cee3165-9931-4c1a-b712-1101726a5683", "value": "T1AF847DE7B2A1F5F8D1768279C4B00A50E375F4F93B505B6F079486961F232A19C3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974256, "uuid": "3b8e2f8a-e300-4b57-8b4e-f190232f52d2", "value": "bce2a0d514e8b4a118f4e4173cf76e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974256, "uuid": "7a44d60e-1699-44bf-8eb1-99e23aeafad6", "value": "3072:XRywD/5qNWmWp37Axjpx3qhWx9g/2AmVLh7/6rsKrb:XRnj5qNc37Axj/6EwwdbKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974256, "uuid": "3d610ad9-dc44-4f0c-84bd-2792b65ca855", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974256, "uuid": "97af179f-167d-4cb8-b6da-62d614e0d426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974256, "uuid": "94c6b57a-ff83-4138-9c0c-74e378f08968", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3d9b65-bfe1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762963726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963726, "uuid": "e2b42e73-bd70-455f-993e-b72825a6e2fa", "comment": "Malware payload", "value": "b7f64e5e57c5f91b0e592f8d2c0a804b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963726, "uuid": "6c265c99-1d7a-4cf9-9a97-c1fab0a6523d", "comment": "Malware payload", "value": "14094f203057eed466676ef9b4baf1d8a60cfd1a089bb7ede6a2312a56a775e5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963726, "uuid": "c8a73d84-2d7c-4c41-b6ad-f7af119fa27f", "comment": "Malware payload", "value": "91add8741598e472fa9e463af311a3f0e2e50744", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963726, "uuid": "314d2c4a-bfe5-4e2d-95a9-3dc1179f2700", "comment": "Malware payload", "value": "d47bcd771dfff5b7ec9376917569654f840b09755041165d4cc1c146686915411380aa7fcdffc90d2018e32a52e44da8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762963726, "uuid": "df2f7288-1188-407b-acfa-555fa308dd2a", "value": "T12806E0DBB788593BC8B7097285A96271568B8C128F879F836C44361C5CBB6D42F4DFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762963726, "uuid": "7ec92658-0c94-4a11-8ec3-5b82894a717f", "value": "98304:5xKcMAiwDFMcIAZ0YFgLCr+6AREb1nI1MJp1nZrdwYM:jiwy4FAOZKMPtHwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762963726, "uuid": "0c241335-d2b7-453d-bc3f-c8d8c81f22c1", "value": 3669497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762963726, "uuid": "c46073a7-c3db-4c22-8089-3d727baf4a0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762963726, "uuid": "afeee865-3107-410d-b093-1e7204b141da", "value": "out.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659d7775-bfdc-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762961376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961376, "uuid": "627cb458-e5e3-4463-a114-2898ef4495f6", "comment": "Malware payload (AgentTesla)", "value": "f2460f2c3a8c5bee0a42a2a085f54b24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961376, "uuid": "c3b44e8d-b8f6-4620-8e3a-1427acdc2ed3", "comment": "Malware payload (AgentTesla)", "value": "1450efecdf624138116afe7a62047b1d650ae2b5a2d87de565df7d341727b181", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961376, "uuid": "e5e4f8fe-979e-455a-87f0-7179150e5ffc", "comment": "Malware payload (AgentTesla)", "value": "585af7aa31bf5172bcf06513effebbff9962180c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961376, "uuid": "e20036a3-adb0-4b18-8c10-2591482fb668", "comment": "Malware payload (AgentTesla)", "value": "16b66c8ecccad7205f74171c1c57b56a96ff6e44bd09621febf27f5846849e58700655874a91730bd47120e491991c61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961376, "uuid": "ab7980a9-b886-49dd-a2c3-3f2e36fbbd21", "value": "T135757F8DA0B05DC26410FD70EA50E796C8DA07851A279F521FE2B4A96316C43FFAF7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961376, "uuid": "778b2b95-fab8-484f-997a-f507b2a80c9f", "value": "24576:hTqw/4FMuCEyV8ho8lVy58WOPsdDoxztdlx2mh1nVj/28LRDVghXX2Lx4KMQDUGD:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762961376, "uuid": "dfdf6fee-819c-4a14-8256-9b6397fd7db2", "value": 1578504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762961376, "uuid": "58ea31b3-5464-4db5-a3c8-546ce9147c65", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961376, "uuid": "4f75c39e-007a-421a-8a2c-06f93cf1d162", "value": "PO-011024.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a528f5b6-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "88a9c79b-ccb7-45c8-8849-fe7711128480", "comment": "Malware payload", "value": "044b0795676d113d87b59411b83c5a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "f2f9cafe-dcab-4d14-8872-65c9d7a01910", "comment": "Malware payload", "value": "152c3c0bdffb9b62ad00b0ffe64ee2aa48ffbb05079e40560620d3efe451d179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "6db156c3-0d60-4d8e-bc43-ba553373413c", "comment": "Malware payload", "value": "44d49a6e0d45b018897c66068af0c8f88439adb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "5e29b50d-5dd5-406d-a80e-20256bb6f75e", "comment": "Malware payload", "value": "6661e5d6e6e1754791eda7baf3c16f5ba4d32525265a63759f0f2baedaa07310f0a0b923fc7114bc6a6f9365a6efb6dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "ed645d37-d452-4d58-8604-170e558d3ead", "value": "T12D6733876AC742C9FE28FFB052230C6202777F395D78678EE945F11A3FB36866059219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "5d84d019-bad2-4eb0-9f90-535cf1671f3d", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "5048b28f-ad78-4338-94a1-e6d1777cc7d5", "value": "786432:DHvxOpgIiL995ilJb/oMULLebaKCLA7yS/1RmKfIshpS:DH5OLip95rVaWlsmSdRmKAshpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935284, "uuid": "88602876-91e7-453e-b79c-7fb1a4805c76", "value": 31001539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935284, "uuid": "a8beb300-a51b-4bab-8a18-bc8c6e2db3cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "c127aaf4-50c9-491b-84cb-f7fcec57d89a", "value": "CEREX_PCUI_1.3.1_20250102_PRD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a285ac5-bffc-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762974967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974967, "uuid": "212c78b3-798e-44ac-ae4c-98c17e717ab4", "comment": "Malware payload (RemcosRAT)", "value": "ec3272256f01c31fbe9ea510f73f0ba6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974967, "uuid": "6fad40e2-ae29-4e4e-8fee-f70733e49fac", "comment": "Malware payload (RemcosRAT)", "value": "15362938ec99fd7d7cfeb694a0c0c2a2e02416163bf21f681193e1a063758a5e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974967, "uuid": "56cdc492-f6e4-4814-aea5-63ed69bcd9a1", "comment": "Malware payload (RemcosRAT)", "value": "8feea538fe4574078a1e8095fd8c8fd1f923e019", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974967, "uuid": "3405863c-df04-42bb-be04-a7080991ae9b", "comment": "Malware payload (RemcosRAT)", "value": "4876fd41d7c01c068090d7aeb13da55d9774e5d11a7ee91974f1f0b4b3a60ddd6e6dbb7961f84c2ce8f318d5966d2321", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974967, "uuid": "a525ddca-3aa2-49e4-af5c-8a265923caa6", "value": "T1D2A5339E282EC137CCB1077E43927B27D0F2221641CA8FD0BE2793A47AD79F559A46C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974967, "uuid": "06b01bc5-41e1-4a9c-b69e-87f7f3e0e5c5", "value": "49152:avtPo3bml3s+WxoStDqq24JUUwmXYGcCqC5IyCPXG7+4cGZW2O7eaOZ5yf:avJo3yl8Lu4qcXYGcCJ5IySGZW2Rbwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974967, "uuid": "c7c249b9-b5c3-487e-a008-f5fb3789fa33", "value": 2103757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974967, "uuid": "40c24ba4-54e0-458c-bcac-23414447dcb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974967, "uuid": "06a8833c-1ee0-4c6d-9667-bd4d214b3d51", "value": "RICEVUTA-DI-BONIFICO-BANCARIO-ISTANTANEO-8373900-PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4d8cba-c002-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762977898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762977898, "uuid": "7a554069-5da0-4dca-b0c7-683a6ccdccf6", "comment": "Malware payload", "value": "da731ec259884b1d1712dee24f8839ad", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762977898, "uuid": "63ac90b2-5afb-4af6-8c2b-77f33cbc6552", "comment": "Malware payload", "value": "165d7f4bc117a2992cf91238066d570ec6e69b4325edcbe69017414792f0f84a", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762977898, "uuid": "5a4f5444-57f2-475c-a068-f3c2d51a3fd8", "comment": "Malware payload", "value": "263ea0aaa71153005d46e5275c61c8dc459fd478", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762977898, "uuid": "d08100a3-ac76-49f7-b734-356ac268f420", "comment": "Malware payload", "value": "36f46d99928ab3f34a244a8fa0172c45821cef2aa0aea69ed099fd9955e7ef926a03d68c80c9a20103e9f9562c7c041e", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762977898, "uuid": "1d8de83a-4ef9-4c35-8ca0-18bd1a22b65f", "value": "T1C1457D46B2B501F8D1ABC2788A46960BD7B274461334A7DF56D0875B2F33FE16A3E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762977898, "uuid": "d3c66ed1-8610-40ce-a482-fe2412e6ddd9", "value": "1a1975a7c9c848c426cfed519cf3ffc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762977898, "uuid": "530e1fb3-5419-46f9-bd4d-b7573885bff1", "value": "24576:uFSxrhTsVU5gjyFruu4fEDd8wn5SLU+Zrv6Us9WlStsiZ:uF6rMggjk+EDuwnib634fiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762977898, "uuid": "65fa16ad-4c19-4dc4-b0ad-70fed7e9da6f", "value": 1230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762977898, "uuid": "fe01317c-df74-423e-85d1-c5bf7ecb1997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762977898, "uuid": "adb7c986-95e5-46e4-9dc6-4cee593ef39b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5932be8c-bff5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762972093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972093, "uuid": "1cbf14b2-0c7a-46fc-8578-648f2eaef893", "comment": "Malware payload", "value": "c5c51832c8ee5f7ff19cd29fb571bf90", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972093, "uuid": "d7783f61-4ce7-48b9-bca4-2be5435c111a", "comment": "Malware payload", "value": "166ffce34fd49a69076a31cc5c7eb23584b47c153f744936e240f871144990be", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972093, "uuid": "7e1b6c6e-47f0-49e4-830d-cca6611de70d", "comment": "Malware payload", "value": "b53905e35b41ce3695bf1d1f8ef6f0984e06bd92", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972093, "uuid": "5ebec421-7c06-4413-bad3-31b7eeda4e18", "comment": "Malware payload", "value": "5e907b9af5b87997a74606309216c9d130f149ec112780035ab31230701d071442daca496a9b82c1cf7470ebb6a6c36b", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972093, "uuid": "827bd643-3871-4e4e-8fca-1b372df07b94", "value": "T14BF7330C3BBE525FED850D1A480A90BAAEC3266DD93C59C5C740D34B4F8C7CB6649BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972093, "uuid": "b2d57682-ec90-4a97-af35-7cc8378e625b", "value": "94e7aea3d2e237d4bb8f35712a6425f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972093, "uuid": "caf85cac-bb4b-445c-aff7-6fbc36476e39", "value": "1572864:OjyxPOO3Ehl5iDZC+l+9/ovk+HNZ7l13bvrvjsVQCyMTzxn01uezw9U:OjSR0BiE/iH37vLvvNCt7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762972093, "uuid": "647361ff-49b4-457a-8d8d-7190c14308ba", "value": 71183360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762972093, "uuid": "b15fe398-d0e4-4f2f-b15e-2f65a8650d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972093, "uuid": "0e8f6a2b-348e-43ee-9681-56d022953fbf", "value": "Qual#uerVi#us.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be07f12d-bf5e-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1762907408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907408, "uuid": "d923ae36-110c-4ad3-9707-8fda12edda40", "comment": "Malware payload (GuLoader)", "value": "4f20bef7ba4c424a36c7cdd0c28ade2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907408, "uuid": "7f181441-43a1-4228-8f28-4829d2a14089", "comment": "Malware payload (GuLoader)", "value": "177cfa885f0765b9f144317458a981980d76e123ecc2db7f5b93168bcc8a50a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907408, "uuid": "1bb83aa3-abca-4ae0-a0df-1ac720a47eab", "comment": "Malware payload (GuLoader)", "value": "48b07a5bf44d6860b0f488ff0a4b6f998756db3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907408, "uuid": "fd3480fa-716a-4c07-b90c-6c3d10af6da1", "comment": "Malware payload (GuLoader)", "value": "bed83182567c43eb31bc77aa9478424a2a92b02707e5859c85da42b9768c74ddc888f86dbc66730710c653f2e7ecfb24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907408, "uuid": "5309fb55-5694-4593-820c-2993c87cc1bd", "value": "T131D402303544F45AC90EA23D4B5EF32E57B9EDE8260791979F50BF2E7D752838C0A889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907408, "uuid": "015f2448-4f3e-42b9-a795-27f67c3e4d82", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907408, "uuid": "617847c5-04af-4d51-a82a-7c04efeaf046", "value": "12288:qX4j6f40DcylpOb/WVq5N99psmICxmGqzyJUalTt3a4+1Du4HkGQZ:04oD3lcTkOXFngGwyJ1Ft3aXJu4HjQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907408, "uuid": "f06cf7a9-de19-4e08-87ff-3bbe6483ac96", "value": 601304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907408, "uuid": "0b56ca12-fb9e-4a3d-b518-8767023818de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907408, "uuid": "e4acf888-3d4a-4b62-be3c-148e7b591771", "value": "rShippingdocumentsB112-1935ED085-19301939.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bce544-bffc-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762974959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974959, "uuid": "0a45313e-c338-4926-ab37-9a3126a10c89", "comment": "Malware payload (RemcosRAT)", "value": "7ff93836c1cb91f0409c8fbe8de21d15", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974959, "uuid": "539e62bb-7cb7-4d22-8d3c-c41891b61ebf", "comment": "Malware payload (RemcosRAT)", "value": "191b3c117e665886e26c604c52574cf3c0a134395271a044ee3a43e204f16e38", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974959, "uuid": "e27cc638-78ed-466c-a4f7-4f83bbd5e470", "comment": "Malware payload (RemcosRAT)", "value": "2cef2e80b9db2b5b8167c0131292fbea060aa3a9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974959, "uuid": "c74ac4ff-9625-46dc-b897-8309eedb20e4", "comment": "Malware payload (RemcosRAT)", "value": "0b9fbe5aee0299ed4f0446299fa6f95d48d1a0be7afdf4c59239f75129cca8e15a114524f90ca30a0f9874599d445285", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974959, "uuid": "d0bcf191-6f95-438e-9556-d09eb1b45e0f", "value": "T1EA03F2D837ABDD4A89948FFD2CF948979042CCA3440DDD95DC4F63CB5098B483E6B5A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974959, "uuid": "7a693be7-e2db-4605-b5c4-6aab8702daa3", "value": "768:054f0ZCMeBs+CYzh/u+yLDMsCGNll5fjCaMeNeytOxea1NPMncn10duzha:05WBs+RV/bynDtfsaMTD9Ei10AzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974959, "uuid": "5351d683-efd0-405b-8db5-a41bb3a0b1dc", "value": 39991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974959, "uuid": "aa0156d6-2026-4eba-bd0d-3c8e5ee78b05", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974959, "uuid": "c7f12e7b-464f-4ff5-911f-0558bdde51b6", "value": "Copia del pagamento 09876535645768798009876456-pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa75850b-bfa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762938863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762938863, "uuid": "9429bbc9-3e43-4aa9-896b-94480b82b31c", "comment": "Malware payload (Mirai)", "value": "c69e9b41f5cbe98752587ff076f22a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762938863, "uuid": "039c2fb1-6418-4d7d-819e-37bde51c3735", "comment": "Malware payload (Mirai)", "value": "1a4cafec6506d3c09d2b933a86741a5fe23b7cfea3081d73abf8f7876b910303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762938863, "uuid": "28cdba14-0df3-4bb2-87e5-34018b7a1953", "comment": "Malware payload (Mirai)", "value": "f652c3744dd9318803c7565b28259c6b5fa66501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762938863, "uuid": "98f81906-d2ac-43c2-9ac5-dd920d8850cc", "comment": "Malware payload (Mirai)", "value": "fbc113e85d3ba7f3ac4d14e48df5b7161ae68210d7eb0dd97e3d5dc365edf87ce5835878eda10710fce24b2fd01072d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762938863, "uuid": "5392b6e7-5aa0-4dfa-a4dd-60ce5404843f", "value": "T1A1D3CF32E0086DA0DD2017B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762938863, "uuid": "d9d0a416-578b-44bb-84f1-c130bede064b", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZH6:xOFgpOEoVv3MXL5NhGOH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762938863, "uuid": "73ddf993-c2b3-43df-9cc2-6c1367f545c9", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762938863, "uuid": "b846846e-e900-479d-b9c7-27cec0e870c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762938863, "uuid": "d56bfd8b-21c1-4f32-94c7-9af8238eb136", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40df5dd6-bf65-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1762910204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762910204, "uuid": "6ea87e36-5a09-48ca-94e3-febcd5c25102", "comment": "Malware payload (Ngioweb)", "value": "bff3e7b0ee8a2e8e3ff0c0513a5af193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762910204, "uuid": "3540fce4-2233-497d-82ee-c57cd170b6ef", "comment": "Malware payload (Ngioweb)", "value": "1bb57d84b79bdca142f788f2317f6afa1f8071386ac4febc7529214ed995e964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762910204, "uuid": "a0bb35ac-8ccd-40eb-87f5-a4cf7732b580", "comment": "Malware payload (Ngioweb)", "value": "ab5426cc661808850c56beb6ffb2503de52d4bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762910204, "uuid": "5397a192-78d3-4750-8ff8-890f88a21f91", "comment": "Malware payload (Ngioweb)", "value": "7a11bcaa9671d3bebfe495c7d19ada90dee20ce02902cfc49e8201032c6d8c8c3715c6e584cc7cc39c5644bfe3db578c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762910204, "uuid": "bf142ad3-ca05-497a-bf32-1be3f316a578", "value": "T1BE936C68FA0EAC41D2D7E37DED558BA272273C94C31AC1717C01A34DD8FAAD4CA61917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762910204, "uuid": "6e13bb4b-cd99-4bfd-82b2-66d0b41b7ce1", "value": "1536:AdBFeTM50ReIILlSIYmTgGOPx+n1+wE5oRy0/oVVKauDvJIrw:Ad+TMqRi5SE0GOePOEy0/WVKew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762910204, "uuid": "b8574146-db4a-4c04-b44f-ffd4b88b52a0", "value": 91792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762910204, "uuid": "9dddea44-d081-4284-80b8-91e7210ab6e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762910204, "uuid": "89821c71-1021-4d19-8857-9b826780e44e", "value": "frost.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f920f5-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1762981087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981087, "uuid": "30df0fa6-6a6b-444e-93a7-f35dcd8ab16a", "comment": "Malware payload (Stealc)", "value": "f44d7d05acd8fb10b8ab1284783c6786", "object_relation": "md5", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981087, "uuid": "e241b1e6-4104-4cad-9162-4122ea81422a", "comment": "Malware payload (Stealc)", "value": "1d7bfe3d808867b7f311117707909b4bebc651ae610d50e8548f25917811ec48", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981087, "uuid": "b1a44e44-6105-4adb-a99b-95f3b3207d49", "comment": "Malware payload (Stealc)", "value": "9320a1719a70dd2f755a78a4e7b17b948a5056f9", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981087, "uuid": "ed3eb867-1bdb-49af-adc8-1bb8342758cc", "comment": "Malware payload (Stealc)", "value": "4c6312c6ba4434ca0df01708b09e41d080c07abb9bf621598280abd514f4e8fd36417709abe67296227f14e42af79d91", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981087, "uuid": "458bce0c-09ab-41e7-96f5-5626d4549d16", "value": "T1A3E6E682B39CC911E4B676B94BFE5820A75BAC01BF63C7AB296537EA48713431D1071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981087, "uuid": "ae093bec-cbab-49f4-b8d5-6a2bc91481fc", "value": "d99b7702a637813a23d602fe095f8320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981087, "uuid": "e9373bf6-d8b0-4dd2-a922-af84a6c13338", "value": "98304:UvlvKuPPyzUxEOxyDNGH5LgS1HYJEstbwZh9LNKUYYU:UvYWJxyDNGPYHbGLtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981087, "uuid": "d9f39ab7-2e02-4508-9393-c4fd9b1d8c2e", "value": 14378768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981087, "uuid": "faece28a-2abb-455d-a9fe-58d95a51a3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981087, "uuid": "fefd34a1-84bf-4167-8fd4-12e97feca8b5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865bdfef-bfe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762967015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762967015, "uuid": "41342f05-3776-45cf-ab9e-af91957c1b32", "comment": "Malware payload", "value": "55959667f5b0f20966d2492ab17a0694", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762967015, "uuid": "cc475965-af95-4121-827c-01cfcc9e2ab3", "comment": "Malware payload", "value": "1e3260b6b4174a920ba19cb269d9171da83daf315b0dfbcffdb7e0e427ff5da1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762967015, "uuid": "e11ee1af-8ee3-484f-9f83-51e442b63431", "comment": "Malware payload", "value": "fa9c4ce23577d30626ab9715e4486a91373ad2f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762967015, "uuid": "cffe80fe-a375-4b75-81ce-4559b5fbe9c5", "comment": "Malware payload", "value": "2e32157d692e2e143fa49017631071c2b4ebd8f01a131e1815074d9890d11f0e9448f738d2daea3feedb4f664154e923", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762967015, "uuid": "521260f9-e96f-4c30-83ee-4cc920b0ed58", "value": "T180E282642F44598D230E0AFE338AA4D6F2561EBE694D4C8FE1293C7C649B217F5F9231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762967015, "uuid": "18e81101-bd26-431e-a915-52ad00765555", "value": "768:SeQwIdJ2NfKpTewIhGJ+dSNzNKj1wZXTYmWVxFtAYbW+cEh:uwIU2Cdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762967015, "uuid": "7affcf63-871c-41b5-a7c1-5eb44d9d161f", "value": 32873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762967015, "uuid": "af86e969-6bd7-4db0-8016-14822912c114", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762967015, "uuid": "491b91e4-4505-4065-bf92-1c438dd70c4a", "value": "latest.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0ccf12-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939944, "uuid": "ba7c1de1-d9b1-41cc-a699-a9cf76224b0c", "comment": "Malware payload (Mirai)", "value": "808d992eed5a198dcb9a7bd552466955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939944, "uuid": "e7ae038a-70c8-4529-b9d3-cffb408b6dc9", "comment": "Malware payload (Mirai)", "value": "1f25a9707b7f7e94c5dc9c49f778523110ce1a02104209b25c244471ba6e89a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939944, "uuid": "006f538d-92c4-458b-9f50-0c24915f2038", "comment": "Malware payload (Mirai)", "value": "d34e909e0add7ba5131a153d6338a3be6c008375", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939944, "uuid": "ae320cfc-d4f2-4f56-bb15-8bc127a536e2", "comment": "Malware payload (Mirai)", "value": "c24acb4b211433f233e87073e8dea4128a8dbf527a8218e23bf9815d115ab112c95f02d53ed8d30ee7dbaa192284f5f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939944, "uuid": "90e36434-3d6d-4bbc-a191-dea5a9a3ee58", "value": "T1E592C06CF0FFCE0FE0A9B2B19133155A82BB7F0A86ED2305DFC138866552C1851716B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939944, "uuid": "8b412f47-2653-4176-9721-06bde226c466", "value": "384:1nuyd4vRi2xA7C5DZBPMr2f8shVs3Ma+nzMFVjnbbx0o9U/oxLx+xzLScOiFqcJS:cm4vRi2xAatlEshVNnzudx0tO+xSnsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939944, "uuid": "f9194951-75a3-4513-9289-a1f71b3da834", "value": 21228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939944, "uuid": "2e8490e4-5d5f-4300-a6d3-3fad3bc22dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939944, "uuid": "05e62301-11a8-4052-9b82-dc6890d9b798", "value": "mirai.x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e408e7c-bfd8-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762959753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959753, "uuid": "6ba6d5fb-5cac-487c-a378-f68b515c586e", "comment": "Malware payload (AgentTesla)", "value": "1b06244e75bcbb28033cbc206336a5c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959753, "uuid": "809d908f-0fae-4d70-ab88-8e58c1481459", "comment": "Malware payload (AgentTesla)", "value": "21b3215acee44182b208aa31414b6e5241a909934b7276a1bca1001db56b31ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959753, "uuid": "a9f72fe9-b4dd-4aba-9f10-b873c94d1ed7", "comment": "Malware payload (AgentTesla)", "value": "b32116ecd8ee1f34528961d376b6513749e7d945", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959753, "uuid": "b366f525-97b4-476d-8295-f1f4b3716064", "comment": "Malware payload (AgentTesla)", "value": "d3d25057c55dde679e2142a9243a761aa531af34917553d1f90e9a4873ecc80b8b8c44edb59fe8603e109e8cd543ce4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959753, "uuid": "e29541f0-f76d-471f-bfb8-c7f4549a26ce", "value": "T1E94502158D842FB5CFBC8A1890BE160E93E04A9B5417754AFB37BD4BAFFB604160B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959753, "uuid": "941b8dc0-6373-438e-b820-7be1053c8cdf", "value": "24576:8n6pKIOEjTEJUH9YqGJatMdUS8vAvcpSVboeVJ:lt42yyYjNvcg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959753, "uuid": "4065727c-4332-4a10-8372-14e5e1670c2d", "value": 1264564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959753, "uuid": "7e5359de-975a-4e82-bf39-7b86dd6ad112", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959753, "uuid": "1801406f-a44b-4277-8dd1-ad8b296f1c00", "value": "disposizione di bonifico.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be85df0-bfe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762966809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762966809, "uuid": "447b6e93-1de7-4789-a835-7b871abd469c", "comment": "Malware payload", "value": "a5173f4c289131724274d2a66d8cc781", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762966809, "uuid": "ed23fab4-ef3e-4b45-a5e5-2a78fe9deae1", "comment": "Malware payload", "value": "245ad7ccb866f23a5d065c464b56c89b2d4a9fa38ae7a8014d17b12b2f58b595", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762966809, "uuid": "cb2ceb3d-21f0-4f56-868b-c2a8ff524c16", "comment": "Malware payload", "value": "e5429e65c125b2fae884c414008201bce530d64c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762966809, "uuid": "ede29a5b-cd4d-4072-a294-3aaec02b7940", "comment": "Malware payload", "value": "01b904b431669952a81c006826d7388608aafc1f845951655ad7b24b87bcf134ad27ebb477569cb8249ce4bbf9e358a9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762966809, "uuid": "59d84833-a111-4a1e-b8ce-cd49a22458b8", "value": "T13505ACBC8DE14D9C035B32D2FD5BBE3A035B95718533EADEBB5024B60A5D3808BA1758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762966809, "uuid": "5238e43f-8a3f-4c2b-8264-02c575aad5fc", "value": "24576:CH82EEgBXPNLHZ/XAdMi309A6ea5laTOQ+:KgPNzFXAdxQ5laTOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762966809, "uuid": "e2af948d-aade-4198-bfe5-1e5b9f915bff", "value": 814448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762966809, "uuid": "df2d3764-750f-4bd5-b0f0-06d24041abee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762966809, "uuid": "a9143057-b4de-4991-bc18-9c562a1ff32c", "value": "rPedidourgenteG.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811a9a83-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762939947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939947, "uuid": "c8acbae1-c487-4ab2-8fdd-8fa65cca5e07", "comment": "Malware payload", "value": "d5318bfc2371cccfe341448b3c5ee66b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939947, "uuid": "a656cea3-629e-4a89-b22f-5bb82f69c751", "comment": "Malware payload", "value": "26f3971ee12a4dfaac9db6d941621f1489363969d7158328e9d40898785d4976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939947, "uuid": "cccb1ac4-88d1-4a1d-8097-95b198bfbf81", "comment": "Malware payload", "value": "f8f32366b270c282b202405ea3016c9b3a5a97b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939947, "uuid": "683039d8-24bf-44ea-8ee7-d20712aa99aa", "comment": "Malware payload", "value": "6685cb9f66d4165399c535fddf54d590fabfea0bb7ff3b452efd2e7279b4d076fdc06a692ded432ea66d93c11e604f13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939947, "uuid": "f43741bf-2644-4c2d-a00c-08b0413b7e4a", "value": "T1A42328AAF8028D7DF85BE77E54164E09B93163C152831B2A13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939947, "uuid": "60c001e0-bf0b-4c39-83e5-214686cf29d3", "value": "768:CK0eoVJdxD8xY2xXkCltdSxumlDx3MMYiP4Eq8DHwOGwJ:b0BD8xLVdSgm/3MMFP4X8DQwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939947, "uuid": "f8db8e39-cdfe-452b-a4be-fd0367c2bf65", "value": 46676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939947, "uuid": "b2cc047d-3699-49ca-804d-28268506edf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939947, "uuid": "123e39ab-a590-40cc-96dd-f018bd881ed0", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f73dc9-bfc2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762950126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950126, "uuid": "3370420c-9503-496b-8354-01deef184406", "comment": "Malware payload", "value": "2ec23e83e2f63ab27c25741b1f4d7f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950126, "uuid": "23d7436d-60f5-4ea2-9f5a-6fc28594a9c6", "comment": "Malware payload", "value": "29e7e1c1e1a7e5f26f6961d8036cdd04ee4557dec0a7dcadcd8e7651f5e53f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950126, "uuid": "1d247037-c042-4db5-a9b1-a31064d34d4a", "comment": "Malware payload", "value": "bb231b274bd66393fa830a44e6d4447d4399eeb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950126, "uuid": "fc73f267-6d53-49f7-b3fa-54b40bf41f24", "comment": "Malware payload", "value": "68981f1b5d829b910757cfa0d48335809efae174ac7a5c5d92aa225e4c3c005832471fa27f7e096f9a14b438156267ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950126, "uuid": "2a859a67-df99-47fb-98d3-0e67e313acf7", "value": "T194C35B5B77E430F8E4768238C8610A06DBB7B47647609B6F07A442550F273A1EE3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950126, "uuid": "7e128d28-b67d-45d6-9a8a-d0638a9f6db0", "value": "259b0b4410b8a622569d646d1f3aca0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950126, "uuid": "5e5fc12e-63e0-4fb4-bd97-e60e297c2914", "value": "3072:ej/4h74pM/Uw0AWWNKRItdiY94z9u6xlnU/:eE7w+Uw3NKR9hU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762950126, "uuid": "1c489180-75ac-44e4-945e-017ac045935c", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762950126, "uuid": "32bbe601-8778-4ac4-bef0-e18888836899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950126, "uuid": "3c0070d0-a77e-41c5-ba6c-c400b117f3c2", "value": "29e7e1c1e1a7e5f26f6961d8036cdd04ee4557dec0a7dcadcd8e7651f5e53f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33be998-bfb8-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1762946125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946125, "uuid": "82ab7f72-829e-40ff-938a-957b8b9ebdd3", "comment": "Malware payload (ConnectWise)", "value": "2f2ccf69b2b4dcda0b9460896d3f2eed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946125, "uuid": "079e2109-cb9b-41ca-96d9-078b2aa3801a", "comment": "Malware payload (ConnectWise)", "value": "29ef0043dfd8c1e642c559976201c44823757eb8cb2dc9c5e9f6183dd9678883", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946125, "uuid": "e31b56a2-33fc-4542-95e8-2c5fa59210c1", "comment": "Malware payload (ConnectWise)", "value": "61a61cb5db433bc2b8758dc287c6ff5b6a09b4e6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946125, "uuid": "d336aded-0a1e-4fa5-a8e0-63056d15f301", "comment": "Malware payload (ConnectWise)", "value": "3624074bd78ed3200d830fe03db0b10dc0de3406517a0c080636d6a89fec918598673c9ce80c0734cdf37e3ba6c7fae0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946125, "uuid": "8567ef2d-57e9-4408-8e3c-e7b8514a20f4", "value": "T114C61211F3E592B5D0BF0A38E87A42665A75BC049712C7BF5790792A2D32BC09E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946125, "uuid": "e1217744-9562-418f-b118-d5b70e2fbb41", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946125, "uuid": "4ed2da6c-b231-4d13-b584-19e4fffcfbf3", "value": "196608:w3fefPGKgnsvf73WsH9BHgnsvfYgnsvfXgnsvfo:wxwT3t9BAw5wYwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762946125, "uuid": "52ae5f63-b27f-4e69-997b-fc581cc054b7", "value": 12572728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762946125, "uuid": "d5512e86-ddcb-4465-b2d2-9880b520bfee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946125, "uuid": "80fcc4c7-e67c-46d3-9681-b2f70963fa91", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29b4b45-bfad-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1762941400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941400, "uuid": "d9e3095c-89b3-4bb8-8a04-b96293414ae3", "comment": "Malware payload (XWorm)", "value": "92f951511352307d262e52366bf9e7ab", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941400, "uuid": "a3ecf6f7-fc0c-4984-8ec7-6df3675fb8d2", "comment": "Malware payload (XWorm)", "value": "2a93a3dd84f04f745620b491ccece930df4157037f710bac9020f1e7ca908ca1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941400, "uuid": "c7c90529-756f-41e8-81b5-36c0d7014cb4", "comment": "Malware payload (XWorm)", "value": "1b82492afab8981f636a9482a3720692e1091599", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941400, "uuid": "308f2cbc-7601-4802-a12c-5242e6a7b14e", "comment": "Malware payload (XWorm)", "value": "d60ea9b70f9b9608dc5ff5c1b6fedb769685ca6684109a9c783ee6b98db03858263e5d9bb59addb723a1e4440d336f1c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762941400, "uuid": "17bd06bf-e1a5-4e30-beb8-b92ce8f296fd", "value": "T1AA634B35F36E6503B55F2244782E8D7F22CD74809023619CF060B6E62F8F961BFE6999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762941400, "uuid": "17f01dcc-b38d-4a65-87f1-fb4a3f867fb1", "value": "1536:LLsiS+ozmdmZAAwsP82vKK4qU5kfIV5oty166j9MWY+DJ:LLL4zmdmZAAg2vd4qU5cIvotjKMWYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762941400, "uuid": "a5aee36d-81c9-42ae-ae69-eabbad8a24ed", "value": 71537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762941400, "uuid": "7b2b4eae-5106-4e6d-9c7d-cbbbcc2e550e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762941400, "uuid": "66cbcb4a-b175-45c2-bb73-a6cfdf556f53", "value": "PO.documents-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec33fb0f-bf97-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762931967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931967, "uuid": "8397c1e3-d81d-42f5-a2b5-b65da24b2eb0", "comment": "Malware payload (RedLineStealer)", "value": "28d60cdc88c31bd6fe61aeada1375d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931967, "uuid": "d05f0245-e634-4775-bfa0-4681ba7a5241", "comment": "Malware payload (RedLineStealer)", "value": "2af765eda09831851e8d69b1d4d52ec87429fe40f8d03f533e75464a8caaf60c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931967, "uuid": "e7a8b89b-6b82-48b3-860a-ef444ae89ff0", "comment": "Malware payload (RedLineStealer)", "value": "6df1db2983e568d8d017504200afbabfae93b7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931967, "uuid": "f00a4396-1aef-49f5-8338-f06864f4b504", "comment": "Malware payload (RedLineStealer)", "value": "73dbec3fe5a1a6a0016edf6512464c935f6c9ed5c6145f11fb471f580880306f56412db31184e2502503b5d0bc63442a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931967, "uuid": "a69d7bdc-cce7-4195-a146-419dbdd15dd7", "value": "T182E412A9620EDF17C8821FF44C91D2F423B8DEC8E521C743DFEA6D8F752A644A5452E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931967, "uuid": "3b3a6b1b-0165-4fae-8759-3096d7e2be8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931967, "uuid": "60ea7967-ef5f-4cb0-b6df-b06b4df71b35", "value": "12288:7E0f/1P1su7BorrnZnsGcqSDXScHc6q9YwButgCoGUlMCom:7lTsbrtSDXtc61wGGMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762931967, "uuid": "67e05771-1ecf-40a3-834d-1fa93393356c", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762931967, "uuid": "c7c2735d-8495-4e7e-a9bb-b9a2dff3041e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931967, "uuid": "382bcc1b-1783-4b92-90ea-64693d40fee3", "value": "SecuriteInfo.com.Trojan.Inject6.15207.26342.15605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcd91b3-c010-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983855, "uuid": "ce876b7a-3be0-43ff-982a-a13946d02a8d", "comment": "Malware payload", "value": "c86bac6fd2f901234ba330680510a1cd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983855, "uuid": "eab5b376-bd15-42b9-88d0-d9afbf3c612d", "comment": "Malware payload", "value": "2c3b1450f54e8e6e33b1431833cf10e97378f127e82c6b3f0021afc55b615afc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983855, "uuid": "1b224411-0599-46bb-be57-bd5e7ee472bf", "comment": "Malware payload", "value": "5edbffd97cdf5e6a36119e35a070124f537d9927", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983855, "uuid": "08c30fcd-5d39-4e2d-927c-4d3c41a7aedc", "comment": "Malware payload", "value": "87741ee52f4c594ab854b8564186cf9e02e8453275c5624be63d268996d364f7b913bf487e691bef5f1f9856455e1321", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983855, "uuid": "9fa483ce-1e64-4e69-b317-ff29f11bb4d4", "value": "T1189733199E4C78FBEAF37D7BCF74850D7E41A152DACBA826BC9589CC4387A2044069CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983855, "uuid": "df022d0f-de86-427c-846e-f8f9b7e2b22b", "value": "786432:Vep1UENT72EC0TkvC7le5Sz61LTTPR9gTZ9L+RMkvUUImHhm4V:2VuekQl1mZTviEMAImHhDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983855, "uuid": "146a3fb0-32cd-442b-aa09-13024222ef9b", "value": 42579019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983855, "uuid": "a71e9de7-84f8-4e1e-82e8-c660d7d4f78f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983855, "uuid": "55324834-2d43-4320-b296-c59696fe7f11", "value": "fire-kirin-for-android-2025.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535a1366-c012-11f0-a129-42010a9c0007", "comment": "Malware payload (FleetDeck)", "timestamp": 1762984538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984538, "uuid": "261dafb0-11b0-4b36-acc6-b3e9019bb6ba", "comment": "Malware payload (FleetDeck)", "value": "5a9c27c2fa404dcc58956c48c371bfbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984538, "uuid": "e9fe48ad-3c3a-4770-9211-668bcc460e13", "comment": "Malware payload (FleetDeck)", "value": "2d8da501082c932fbd064686d3d35f4bdb2da0a074e443590ac54392122d89a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984538, "uuid": "fb7e59c7-8f89-44da-a4ad-fbadb1eb42cb", "comment": "Malware payload (FleetDeck)", "value": "a03496804b04e8b513a69d8c01bede217220f112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984538, "uuid": "03eed131-9add-4d0d-8efa-54675e856387", "comment": "Malware payload (FleetDeck)", "value": "bfa5ea1b679e4fbd08b11cef18143f0be3067d76524f51da5d6e7b2583b68d603d668b23c1f1b1e250b66137a2ae2861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984538, "uuid": "7f59d4f8-4172-4fcd-89c3-d5c5e2c82d4f", "value": "T1B016CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984538, "uuid": "a1307fa5-5cc9-4813-9ac8-ae76c1aa84c0", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984538, "uuid": "298dab69-9bb7-47ea-af1e-6d897a650932", "value": "49152:oP0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snU9:oPtZAl3XzKnaIcDgRjOli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762984538, "uuid": "97c3ef2a-f13b-491b-a7ae-5ad138d8899d", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762984538, "uuid": "b532c3e6-812e-40d9-a200-259d750bac14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984538, "uuid": "d449bc7e-151a-4472-803d-904167c64f78", "value": "AdobeReader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192ebdb5-bfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939344, "uuid": "deeb8d95-c85e-4852-9110-434c6767e91d", "comment": "Malware payload (Mirai)", "value": "f8f7efb723e2e29b6b10c89625b8c131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939344, "uuid": "0905a145-a047-46e0-b8fa-8c7b375f4def", "comment": "Malware payload (Mirai)", "value": "2e4a863bd16421e1bcd6c7f07128549901cf1d8d9bd8f740516921ff0948a7b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939344, "uuid": "af9533f6-6cdf-4579-88e2-f312055d74e5", "comment": "Malware payload (Mirai)", "value": "e5f1a076014eae6dd4485b36b3db1921248a9e66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939344, "uuid": "4856eed0-dbff-41e9-b0c6-dbe2404e2b5a", "comment": "Malware payload (Mirai)", "value": "e19d71cd77899a023c73acda646d86bf960a6d513d87a806960a8bd53439069ef937b85d32492179543f8d8da7dac0e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939344, "uuid": "9d5b5f8c-a6df-4f93-b6f6-6dd9793e609f", "value": "T1D8F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939344, "uuid": "8f171e3e-4ddf-447e-a2e9-5901ec514646", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHgfam:9FJMgWPZr8IaCWReS1WpPeZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939344, "uuid": "69e999cf-d455-4a5b-9489-3c3f5db1f742", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939344, "uuid": "e6a0ebd8-46db-464c-af2b-dc10e3bcbcc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939344, "uuid": "18800b94-08b5-483f-8524-da1f2dd742a3", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75b0eef-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940012, "uuid": "a424acd0-0de8-4cf1-a55a-bdad52803e28", "comment": "Malware payload (Mirai)", "value": "12c9ea41fd84fa4ee22ffe2022673424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940012, "uuid": "b1a4b976-9e0a-47aa-89b4-3a49201b209e", "comment": "Malware payload (Mirai)", "value": "2f83326a27f9ddd01b99139b491bd92d032cba16646c41012e2fd7b0808990b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940012, "uuid": "0b7c68c1-f1ca-4182-be3d-899dbb69db49", "comment": "Malware payload (Mirai)", "value": "1b2a06eb0b5e50908f63d167cdc683798e2f847f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940012, "uuid": "69451509-50fb-400b-8982-958ff62a7f25", "comment": "Malware payload (Mirai)", "value": "ead2a2c22edc1e9b8ed7f67b487588faf6df24b86857f79a22443e2716e736708124e1009729d5948cc00ae82c0dee5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940012, "uuid": "61e52a70-1f22-4fff-90b5-368d7415b0a3", "value": "T12223E807F54380FDC09AC274066BB93EAC2675FE1238F2B67BD4A7226CD5E225D19C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940012, "uuid": "fd26b52e-ae9d-47cb-b7a2-6a9febd5f22c", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjikQ5jvI04Wx2fEj1sAKhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBFUIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940012, "uuid": "822a5eb8-42f4-4a88-9945-6f1b87ddae48", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940012, "uuid": "e65df527-d1be-4405-9dac-c587f2a84889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940012, "uuid": "9e3ea0bd-bc81-4007-b87e-5c15bebfbca4", "value": "mirai.x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f1ebdb-bfd1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762956632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956632, "uuid": "7dc3cfc2-3ad8-49c0-835a-660136ae0cb7", "comment": "Malware payload", "value": "4627a2ea09923e8ae87b43108dcc9319", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956632, "uuid": "6dd53c7a-d813-4816-916f-a8aa2a80761a", "comment": "Malware payload", "value": "3135c74efb0d6489586fb225cfe502314090fd69cbdeacaef343c34fbe74b345", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956632, "uuid": "c4b8c834-4d43-4872-9aa4-9a06cff86018", "comment": "Malware payload", "value": "a6dbebe10ca8c4fb8dc5ddc765249516bcd965d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956632, "uuid": "871ce385-897a-47c5-84fa-bf5268e60aa0", "comment": "Malware payload", "value": "d986b8133c061e4411a173e6d0eac2d4209cc9bab3c1563fe66d009de98b48e08eede02017978d39213881c2c9894b4a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956632, "uuid": "44f08b98-bd76-445c-98e1-7b16b7c01609", "value": "T170F41211BF96EF13E83755B5E8BEA2843674FE132D41871730987B0D2F3235049A6E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956632, "uuid": "899b6549-4d6c-446b-908f-36d72eebf48b", "value": "12288:nRW1QMdn2pDPFdrpcBoDOe+0Ch6xdxnxTfHM1Oi8KJx92tffzo09U4N8g:nRW1Qf7KSCcpM1OpKJx9Mfs09U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956632, "uuid": "44bd2896-11d7-4580-8cc9-3b81ebdcf704", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956632, "uuid": "4cbb3c7e-fdfb-4800-92c9-43ce7cc58dd5", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956632, "uuid": "fc3016ee-c934-4755-b0c4-467f7b715990", "value": "lotter winning.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704b3d73-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762959247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959247, "uuid": "2ce9b4e5-68db-425b-9ae9-dadc284db4b7", "comment": "Malware payload", "value": "04c786d0fc97eadbda7fe8ed86f06d9c", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959247, "uuid": "40d8af5c-10e6-40bb-bd0b-46da86ed0c29", "comment": "Malware payload", "value": "31e7ddc5e0da4a829a01e968d96a6fd568b16bb5c6177dccfa5d9ae91917433f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959247, "uuid": "ab2e2918-ad9c-4a64-a240-2c68df7d1a22", "comment": "Malware payload", "value": "e7bc65e277cd2fe73e7590ac9237d28d1dd2d5a3", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959247, "uuid": "cd1e6db5-1d04-4b7a-a3a5-5412523fdbd4", "comment": "Malware payload", "value": "bb2daf66b169b310397a48fb220189930c7eda6bb41b73e2e46529eb318033011768ab26c5f255591f8d3eb6d7ba85ba", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959247, "uuid": "4313a481-2e03-4af8-95e1-8c0802a814c4", "value": "T12715233755D330EEE03C26FBA817A83AB8E44F94AE753A55941B13EE0A0115F1A254FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959247, "uuid": "72944b39-6601-411e-b295-3461dd9d0442", "value": "12288:XuHgnDhA4F9WKLo4YGujbapMIp3sWKP3tTZNXLzJF8C1m9gQgo0+eHl5RvqUALDM:X2gdrFt1WypMI6WKftHQCQ9gV3oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959247, "uuid": "b2623691-2647-4bc0-92a0-b00a7b349f0e", "value": 935932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959247, "uuid": "d3c05ee6-c80e-4ca1-af3d-a6e1cdb62e19", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959247, "uuid": "6230abc1-4b6d-410a-ab98-f1c65d528f1f", "value": "PO 13337642.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0cb303-bfb1-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1762942888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942888, "uuid": "12dac668-7e67-4f1e-acd3-233c2ad6b3f8", "comment": "Malware payload (GoToResolve)", "value": "de099ca3676ad43877273bc9b92b54de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942888, "uuid": "ce1914c9-46ae-47e1-99ce-83dd2d3ba301", "comment": "Malware payload (GoToResolve)", "value": "326df03bc6a7846dbf85c3e4ac4d85bfe2f3d2299b733c983979bc3ea3ef7240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942888, "uuid": "343645f5-c15b-45ea-8cac-6e089ce8b63f", "comment": "Malware payload (GoToResolve)", "value": "268b0569ca2149c55385279d35e3e645343c1133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942888, "uuid": "b449612f-54b5-4d43-88cd-4ce770f074d5", "comment": "Malware payload (GoToResolve)", "value": "400b39b30619f1ad4b9ebbdfd0d18491940d8a4f988078972003393e07cf79344dc04bd6a568181540ec15e85773cd48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942888, "uuid": "484f6cf8-8992-4b81-90d6-6433762bbde0", "value": "T13A37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942888, "uuid": "a991fcbd-22dd-427d-b3a9-0f38268de2a0", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942888, "uuid": "daebc09d-2976-4404-a19b-d45129b38a18", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpG:q9WtLzgOTbjZvk/ekS/mcpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762942888, "uuid": "19adb7af-f713-42ca-b8b1-e89b7c085c3e", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762942888, "uuid": "cf2d71cc-29fd-48d7-a4f2-4b34d6d56842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942888, "uuid": "dec31f70-6962-4273-b5fd-89fd209451d4", "value": "ZoomInstallerFull.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c28582-bfb9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762946566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946566, "uuid": "529a1bf8-3775-4ae3-b68f-11b9ca107abc", "comment": "Malware payload", "value": "cfee6c068409efba2e88c5dcffb12200", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946566, "uuid": "c513249a-bb9b-43d2-bec9-d92a0d8432ef", "comment": "Malware payload", "value": "33488761849740223f6b61c5332f4bf2ffc7e9dd615497cd6a453a163f89c6b9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946566, "uuid": "b53df442-ab54-4403-af7f-dcdaee0bd467", "comment": "Malware payload", "value": "ac8976dad4c669f53f94a0d5802cc3918ae05eca", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946566, "uuid": "932a5666-2152-40c5-8fd5-b07c60c5b6f1", "comment": "Malware payload", "value": "cfb3dff1d8521b368746554a2f50501bac94303e5c6f95557e9ce7d74d9c92fb4b6e722619a740a4929c0fdc8f6761ee", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946566, "uuid": "69a24589-dd40-4b91-a26f-9990b8101292", "value": "T1A2761203FB8F492ECDD2BA784D9313716619ACAC1910828F4912F618BE736D96F25FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946566, "uuid": "b21b125c-7041-48b8-b7fd-38fc037933f6", "value": "98304:8yi7LbILnAYXKp8C1Fijyj3Ww73iXISklqD/eXAJ6at3j1gylqHV:8r7QnACMTLRbieIYS3BlqHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762946566, "uuid": "fa5e3d56-c642-481b-9e7d-4cde62f05504", "value": 7128260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762946566, "uuid": "51b7f1f0-46ff-4e53-a8ff-5224912de666", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946566, "uuid": "60c46dc5-6668-47f8-a427-6898da7ef75a", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ed741d-bf5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762907176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907176, "uuid": "af9c4d7c-f2a1-4c42-b23f-5828cf82886a", "comment": "Malware payload (Mirai)", "value": "7683c80e37305407025c72aa1beb703e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907176, "uuid": "b15ae60b-41c6-4e23-8e91-56e5db79223c", "comment": "Malware payload (Mirai)", "value": "33869788df4e4318b8b21f4f188e706a8dbb68e2c24d1e79af610c21796f311d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907176, "uuid": "70bc5602-7c03-4b8b-bf55-440d4eb052eb", "comment": "Malware payload (Mirai)", "value": "ed9c3b36445d716fbaa014c210c6eb7ee925c465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907176, "uuid": "90f33005-995f-482b-bfc2-5dcdefbaeea2", "comment": "Malware payload (Mirai)", "value": "87f42b79de94d404014b68430e08f623e1e48f159bf2943018300a5aa515cc702e9492c470531a23455660eec47f2aec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907176, "uuid": "501430e0-a8b4-4341-b8a6-07cd161ed29b", "value": "T108B33C0273180B47C1970AB02E3F6BE587BFE5D121E4FA89655FDB5642B2E37144AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907176, "uuid": "e7da302f-e879-4cdf-9c0d-8e0e361f830f", "value": "1536:3ef4+lYlzc96dBudfat2/8pnOKPHh0GX9y+DayBqzav579ZU5:3ef4+lYlX8at2/rG/9raRaY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907176, "uuid": "5d3c9af6-0410-444d-ab13-0e8e8a04c15d", "value": 108108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907176, "uuid": "943f1d13-69d6-4f90-8758-ec5f7e65d71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907176, "uuid": "e4cbf873-afe3-4870-b640-63aa479aed7a", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64f28f4-bf9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762933272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933272, "uuid": "6e77e4b0-af92-4382-a2bd-96591b982355", "comment": "Malware payload (Mirai)", "value": "13f676056d0fe3df5f7fb2f3e96d4455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933272, "uuid": "de88248d-ad9e-43ab-bab7-feec03741712", "comment": "Malware payload (Mirai)", "value": "349d2a4ef7d1928bb8c8c8db8aa1114e48af7a4595e195bda21e0e3803dc13f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933272, "uuid": "cb7bfccf-2276-4324-a52b-7626204410a5", "comment": "Malware payload (Mirai)", "value": "ddf7c51bedc6b27ef96e306d46857dcad1043f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933272, "uuid": "e0b4954a-f1ea-4166-b483-7f57e7cfc191", "comment": "Malware payload (Mirai)", "value": "a7fbf27680ce5ed0fd5849d137c8b7a385a24ad2f68dcf2d26eebb2653fe767362884efcd2870fcffb841bdc2a738f6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762933272, "uuid": "6800e2c2-2862-4c4b-808b-873318c330bb", "value": "T162D3B021E4006DD1EC2129F578BA96B80350EE740BDE1582EFFDF95E747BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762933272, "uuid": "4b1bc2d7-69a8-44f2-ae97-3812ac172651", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xj:PiySSGp+PMmT7zMplt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762933272, "uuid": "7231efbd-5708-46eb-a0fd-e30d50a17fcc", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762933272, "uuid": "3e2f6e8b-0acf-4a63-928d-1309d9bf8a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762933272, "uuid": "4f8ccc18-f337-4003-a549-1730b9ea2c5f", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affdf484-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940026, "uuid": "852f7c54-79eb-4cb3-9d4e-36d65c6458f1", "comment": "Malware payload (Mirai)", "value": "09cff2b23b1f652cdeb9a161ded2090b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940026, "uuid": "44f86e4c-8dd1-4480-ac05-10fe314b2e91", "comment": "Malware payload (Mirai)", "value": "356840f5d7258f5261427ccf0b77ce0facd9f82e0922985a6ed28de6c463c2f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940026, "uuid": "c01e88fc-3a75-4141-8bd4-ba8659dac447", "comment": "Malware payload (Mirai)", "value": "42a837f256ad4362a03127ef4cd239c1a95116ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940026, "uuid": "82975383-f651-49e9-acfc-f19eb5ad8593", "comment": "Malware payload (Mirai)", "value": "6ace5f67e27b411267c39c71c6197e7824907c739c600ee42240a5e02626284ea65af5cb0df0701abdfd2b5660d99250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940026, "uuid": "aaa38a3f-b258-41ea-b9d5-ec102d642962", "value": "T18A43F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F247B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940026, "uuid": "e9372d51-b830-46c9-9576-85266abb95d3", "value": "1536:RJng2Ke3tTQZoSgLyUpja5X3ez7IMix3JihBJ:Y1edT+dCWn3JihBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940026, "uuid": "1ff159b5-b2c9-4b45-9e93-ba9d2aa0849e", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940026, "uuid": "a9d3a48d-cd85-4f0d-ac9c-e2aa81665018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940026, "uuid": "1ad8f1ec-be22-4d64-ad14-181481fec1a3", "value": "mirai.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26227293-bf5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762906294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906294, "uuid": "bf3ab686-ee61-4950-9f47-00d9862c0c43", "comment": "Malware payload (Mirai)", "value": "9630c2a1933e0f689b1148d9c21e5562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906294, "uuid": "59d0a994-37c3-4418-aada-06a2da599ccc", "comment": "Malware payload (Mirai)", "value": "36d0c7906d51e365f772c5dd0eed5d968f17c8839e7f967eddd28d809726cd1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906294, "uuid": "68b80169-5415-4ce6-a54d-6cd8e51e513a", "comment": "Malware payload (Mirai)", "value": "766b1a5545ee9eca1569df6abd5632ae11f27fa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906294, "uuid": "57319d0f-a331-4789-ac81-cb277b953068", "comment": "Malware payload (Mirai)", "value": "7b6bf2841d2729ce6f9af625e7dd5b008839418576c84f3d6d11306c9c9646b3bad9437ca6380656302363e7e5e22f09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762906294, "uuid": "5c6367e9-fc6e-46a4-9892-571c9bfd62da", "value": "T1FF0301D11322178C8366EB79397E701A8538122B32E51E003D93A64EE64F725987BEFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762906294, "uuid": "7d8c0744-ece2-41cd-9468-60ad54c5688a", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGy:87vbq1lGAXSEYQjbChaAU2yU23MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762906294, "uuid": "1ad9bc5c-46e7-44b7-bea4-d009bd484b27", "value": 40600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762906294, "uuid": "a67be7c7-01dc-4ed9-b29b-6bb277520416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762906294, "uuid": "70f58c37-cbc8-4b07-a580-e03e7de73ff1", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd4bfdb-c00b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762981816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981816, "uuid": "d89af8ca-c52a-4e11-a70a-7abee22efb47", "comment": "Malware payload", "value": "86b8336717f960168b0f9e75f9b9d5c1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981816, "uuid": "3d8afdf6-941b-419d-b533-fed13a80500a", "comment": "Malware payload", "value": "3893c530c33100f70cd316096593689b556afd9d0faad7ef2781621aafc16511", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981816, "uuid": "f9761d70-ae1e-4203-924a-39e5f2fea292", "comment": "Malware payload", "value": "e273c912f938fb26ba86cea7f4c804eff1147c97", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981816, "uuid": "59cf1c58-790f-4388-a6bb-0069c6e80571", "comment": "Malware payload", "value": "8303505ad276abb5fda05a0dba7469d501b7a1b71915460158df0a80a4e51d94d421a5954fa205c29d63cfb6f299c1c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981816, "uuid": "ca3ee121-68fd-4aba-80df-b10dffe276ca", "value": "T195A63331CC6C704BE42B78305452CC6B8A8CCBB03E55FA9E9DD4918ABD53A9C7B2D61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981816, "uuid": "cb0fc565-6215-4dfd-a792-a65cc8524aca", "value": "196608:3nuj7NLghXxEzwZNRR1smXhOfOQmzQDn3prb4D36k4j+dF8c8aAIZlaM2dU:e/NUhhEzSlPVzI3prkG/gA1jMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981816, "uuid": "10c82716-c07d-4c43-8f37-6a861a008d75", "value": 9548157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981816, "uuid": "e8db7837-3864-4098-beee-d6a2d5ae2044", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981816, "uuid": "4c8a5e9a-6d5b-4843-afe8-20dcf45fb61a", "value": "nmdwocccuo.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aff3854-bfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1762950218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950218, "uuid": "1089cf19-ce3f-4673-9848-3eea08c99c83", "comment": "Malware payload (BlankGrabber)", "value": "cb317894aeb05bd6645f45bb9f41be2a", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950218, "uuid": "89abcbb4-ec73-4621-9717-4e1b8889e206", "comment": "Malware payload (BlankGrabber)", "value": "392de99bfb9c2afaf632f8f5319e536e095e3a458d9aeca66b6c9c70ad43b7f0", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950218, "uuid": "dac0a873-0607-4c97-aa18-43af9b48259b", "comment": "Malware payload (BlankGrabber)", "value": "e7e32ac117f873e352cda292efec0d37f9a5d92d", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950218, "uuid": "6288e6fc-a575-4098-88fd-21c712c1eabe", "comment": "Malware payload (BlankGrabber)", "value": "8d28ab0e291fdfe54815e647069833dd66df1ee1c06a478f2f209be7e922a117a74f3a6670f60b9104750994e5f6fb71", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950218, "uuid": "6ec5c4ba-d3a5-4c46-be4c-60da467151fa", "value": "T1CE76331472A449F6F4B3917CCCC2A80ADF77B8545F40C6EB43A003666F67AE14E3A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950218, "uuid": "fe752013-0e0d-42bb-aa82-6f2c9290dc4b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950218, "uuid": "4edef097-9d3e-45d7-a5bd-976c54f36863", "value": "196608:KKuWiWDOYjJlpZstQoS9Hf12VKXEOysC2VZ:jpVBpGt7G/MXOymZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762950218, "uuid": "f3433f7e-d5d4-4264-989b-7dbf6fba0ce4", "value": 7134988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762950218, "uuid": "a2d56ea4-4206-480e-bdc0-9f358075ca85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950218, "uuid": "5a7cdadd-1c35-4d95-9643-e4e45bfc703f", "value": "uncext.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5319f2e-bfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762956329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956329, "uuid": "699dd3bf-1a8b-4873-964f-64cf96d4b8c5", "comment": "Malware payload (RemcosRAT)", "value": "a40ab7c1031e7d361ab47811344d9403", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956329, "uuid": "b77c9efb-b77b-468a-a2f2-3e9a47e6d1b8", "comment": "Malware payload (RemcosRAT)", "value": "3937e4805c217565c9ad28b7a99d8f1cdef327c8ddeaa864927db72ca3daea09", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956329, "uuid": "2dd66680-385a-4245-95ae-d5dfb0dfc565", "comment": "Malware payload (RemcosRAT)", "value": "ca8d58cc6fc7455e36fcb65820dc4552422c2202", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956329, "uuid": "d91d826e-4dca-45ae-a6ff-fe27abe3b5ce", "comment": "Malware payload (RemcosRAT)", "value": "e8ab334e635f92e6c78b0aec77bb4779968d1f3f0e3db2b71abdf34142457cb43b5804ca95609078178713c0b9bcce9b", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956329, "uuid": "ddb1c438-b214-47a2-bd21-faa9c1a44277", "value": "T1C4F43383B1E0D682EA87753B177DF5AC06C4AC2436F814F8FE8BEB88A121537847D591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956329, "uuid": "9f5de842-e419-4982-9680-61d69930f995", "value": "12288:sVMazJMMR8AoZDyX7hjfYj532/xlzcgMAXfCdW7idCl4cvBKDDEEuYMN5hjBRGMp:UzJMhhFuatm/QyXD7iElr5G1UpB9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956329, "uuid": "607334a8-dd9c-474d-ba1d-28c3ef7fa9b3", "value": 793268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956329, "uuid": "4e4c2c09-b69a-4897-804f-4fefcb1055dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956329, "uuid": "c553ee2a-31e4-464d-b90e-19f554f7b633", "value": "PURCHASE ORDER-2025-110010_xls.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49886f29-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991823, "uuid": "f7b34f49-e4cf-41ab-83f9-bbf49f89558f", "comment": "Malware payload", "value": "7ff3d09e70c997aad627f12904082b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991823, "uuid": "7cc33b48-9f4c-4fe9-86f7-7b1676675267", "comment": "Malware payload", "value": "3ac2952c0a1f755baa86d7acbac01a08be67beec8cf286a5f59fc9ca2f4e0231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991823, "uuid": "8b10c482-2a75-4965-8dd3-63e922d4146f", "comment": "Malware payload", "value": "c09443e63bd2111fb9210b8082f45879c1a1da95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991823, "uuid": "3fe95d89-1977-4e88-8fbf-c069c85cb30a", "comment": "Malware payload", "value": "22d68b9498a907e13e04344ac31f40ee9359a9055716912dfbc7dcc8625376712bd242852785f27f9fbff92535038fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991823, "uuid": "88d6a3b4-bb13-4f3a-bd90-eb37b32831fc", "value": "T18B834A44FBC3E1F1F6A305B1061BE3AA1770AC198015FAE1FB0A776ABC767128D1A15D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991823, "uuid": "02394b9f-3951-4039-91f5-a277daf269f0", "value": "1536:AlkLLw2b0vOsthUOYqzfcDg0XZ8WVqTaDG/tLSs0EorLUtCdRi:Ay0IpssODzfc06ZVQaDG/tSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991823, "uuid": "e026448c-7db1-4b97-b003-65dd08248aed", "value": 87280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991823, "uuid": "32494150-fa51-47ec-a17e-c93ba25048f6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991823, "uuid": "600941a6-3ac8-4892-8ed1-0ac88c17154b", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fe621c-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "82c57c12-cd69-46f2-a686-19248c5f432f", "comment": "Malware payload", "value": "c872c407aee0fc01b963b30ade68938f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "725af150-eecd-49d9-b3a1-a1ef68247395", "comment": "Malware payload", "value": "3b6a4cb657b016bde13deaadf63e92be40d981ab4c83135c6fc58bded3abfa14", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "dad02678-94ba-45f4-8d94-22664023f0d3", "comment": "Malware payload", "value": "2b055faa18a42d359f34845d1a7bd808a87dd611", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "ff30a494-a92e-4e60-a18f-b2babb171a1c", "comment": "Malware payload", "value": "6996a0accf0eddd786a670f2448054acb56a2753276c9c091be8c54bd7f55f5f7e41c38893333f278e6a1b450035bb0e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935292, "uuid": "3c63a0ad-246e-42b9-8fc6-4616c195e21f", "value": "T1FE46F1C6F7D8A92FC8775072C9BE52B151874C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935292, "uuid": "de8df5b3-0ed7-4d47-a671-a8ecdbb18657", "value": "98304:9WP5boTwrYpKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltg:oRcKOfyaIbaciAFvrEZpXqmY9XrF/mpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935292, "uuid": "cd9d35ba-90a8-4950-b0f7-43e2504f53c8", "value": 5861355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935292, "uuid": "de436987-f766-4f80-837b-4d87be8719ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935292, "uuid": "888ae871-5b8c-4c5d-a702-e0b33e9a44dc", "value": "Olympus178.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97db5dd-bf77-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762918138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762918138, "uuid": "055f9c6a-998c-49eb-8225-e66b867d23f7", "comment": "Malware payload", "value": "a1a4fe5ec1bd523034d08ae26b812a5a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762918138, "uuid": "0d04ac52-c9cf-40d7-a750-b454c2b2d31a", "comment": "Malware payload", "value": "3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762918138, "uuid": "f21d480c-732a-4d3b-bd50-f26cc18be6c8", "comment": "Malware payload", "value": "157744af9745209f418f732d301965447d8dbe66", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762918138, "uuid": "4b5628fd-6081-4bcf-9b5b-7c25fb8365bb", "comment": "Malware payload", "value": "ac5005c16669ff4823ddacb226a1d4be592d115eebdd5cd2a44f3b5423309784b6062f09bb9a84bb5c92960d035b6831", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762918138, "uuid": "65ebab16-48ab-43da-a2b9-110db04210d6", "value": "T19317229BBF4CE87FC43A5073CE669133327B9E164142A7737508B20869B35898F59BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762918138, "uuid": "0422ab21-affe-4505-bfc9-5d9a78d66db2", "value": "393216:PMG3RgnY2bbdHBUQm+SPSqhlaVeAZzqrz+umPIlE2pEPnx73wmoMPKlIw:d31ySPSqhsVeAM8IlEQmZ3dPK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762918138, "uuid": "d59a0f15-a9b7-4a8b-964c-06e68a6b7523", "value": 20015973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762918138, "uuid": "441fd36b-5293-4c5e-996f-31c4962e964e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762918138, "uuid": "b2bd0991-552f-4089-884f-ec18153cb1b8", "value": "Junk Removal Cleaner_1.6.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c35bbe-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762939949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939949, "uuid": "3780c283-a90a-43a1-ab58-49a354a1a38c", "comment": "Malware payload", "value": "400844ad68fdd48c3782f827a588b4c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939949, "uuid": "7e7c6c4e-8138-4708-bc7a-92b0eb281b99", "comment": "Malware payload", "value": "3d0e374d1d4209280c2d3c13daa8c4d559fd770aa580cd119df23f9684a829ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939949, "uuid": "3114a196-849c-47b9-9273-17bdb2b2786a", "comment": "Malware payload", "value": "e438d3ec906ca4b015b2eba4f059d50f57673529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939949, "uuid": "aa2364c3-ea93-4491-8ff3-983e9c94e228", "comment": "Malware payload", "value": "fdb2a1b2f91c31b8be7eb96225b7e3c9686ce7d4e3b987440942bfeaa1843d913f87ea7760fad65bb27f5ffc9ffea372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939949, "uuid": "01ac2642-ee6e-4df6-a2b5-e73ff52ae8df", "value": "T13192D066E0376AC3EBEB9DF18DC4DBC9ABA06E0A67558E9031427F310E028261221DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939949, "uuid": "1d2d93f4-9d5d-4b92-aa59-b85ec2676fda", "value": "384:o/eAWcBI5aIUGqvVmP6tjWwjBhRWjeI24Ytj5bp3eloi1n32lM4uVcqgw05VxJT:xwI5TUGqvG6t6wjBhRlIxYDdTi132K47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939949, "uuid": "a92e3c30-1483-422f-b63d-0c6f98f93d24", "value": 20304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939949, "uuid": "597b8eef-56aa-4847-ba5c-6f42c4e3d136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939949, "uuid": "d0328bb0-8732-4e5e-a923-5ee09c0d2b27", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895d34ac-bfe2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762964013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964013, "uuid": "8ca4543a-2954-4efa-8f47-652915a5c2a6", "comment": "Malware payload", "value": "65759b957a9254214ef2f1160c5c9e78", "object_relation": "md5", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964013, "uuid": "af37f600-ff57-4822-8c35-a191d6777567", "comment": "Malware payload", "value": "3e7af8568e9484b9210e311f7a90c2347a83be6cca2b594e63d161f5c70a7f26", "object_relation": "sha256", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964013, "uuid": "2d506a85-effd-45ab-a4a7-0dfb8a16c515", "comment": "Malware payload", "value": "44a719c4584cfc0a2d72314651b078fc4ee8aa63", "object_relation": "sha1", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964013, "uuid": "d3ecf423-a0dd-4004-b5bb-cdeb66e86bc2", "comment": "Malware payload", "value": "371695f7bb352a66063766bc0154b0e80c8fc9044e3417601d5c2dac254c652b117cdd15ca20a02674070837a84abb30", "object_relation": "sha3-384", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762964013, "uuid": "fafc98eb-a561-490d-a437-5f56c29a7b85", "value": "T1A9857C47D6518FB1C8AE833F94B7876A3335A5097B43430B220AD6F57EC72D56B86388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762964013, "uuid": "48cdc63e-c8af-466d-bb74-c75441c643a0", "value": "24576:VN4IfhISu40Y5gz78p1YdE75tftCmas6u0emLvj+E:bmS90Y5gz78pSdoCmiu0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762964013, "uuid": "df23ef8b-adca-4f74-9505-8487579ccb65", "value": 1742836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762964013, "uuid": "c7ba717f-fe72-4501-abf0-ddac86a11e94", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762964013, "uuid": "f28a6c97-336c-4eac-84b9-f41b38acd644", "value": "classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def39ffc-bf67-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1762911329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911329, "uuid": "d0367f82-00a5-40f0-80ce-1cf70c7555a5", "comment": "Malware payload (Ngioweb)", "value": "6b273751f0db3eb1a75dacdba37a8cf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911329, "uuid": "a2853920-4e49-4505-b606-b377328e5438", "comment": "Malware payload (Ngioweb)", "value": "3f2c0e2becb201a5b2cd23b66deaa39b78fbea6cdc64e539edb442b99f5373d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911329, "uuid": "3a2e94d5-4d49-46f6-85e9-60ff49232252", "comment": "Malware payload (Ngioweb)", "value": "865022847be812e1258532ec002ef11dc7155973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911329, "uuid": "50432b0d-ce0f-4388-9c6f-2333836a7f00", "comment": "Malware payload (Ngioweb)", "value": "0a8b3d5aa464fb2bba440a68e8df4a853c1814cb43348a03f7f5339c3e5b22af12321958a068c51f67eccb2257d32d44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911329, "uuid": "29e933dd-b83b-492c-aba7-1e2e62ac4904", "value": "T1F7830955F880CA62C2E565BAFA5D428C33231B78D3DE7206DD14AB353BFB9560F36842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911329, "uuid": "a68008a0-5d88-4373-8f21-80272af60067", "value": "1536:UiSRlJXWziCe/vpPX6ujLnBSb+0jObH+NIvzqQzijGlaySOD9I21Ir:Uicwi5FTrbHiOq3J6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762911329, "uuid": "7987a314-cf3e-46b5-9b94-057f5d147054", "value": 83200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762911329, "uuid": "19638437-6eac-43e3-93a3-602ccee46b7b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911329, "uuid": "94b91bb6-1bf0-43c2-8e7c-c5e8f5b6068c", "value": "frost.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a550b193-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940008, "uuid": "5183d10c-eea8-4700-9f95-295af21187a1", "comment": "Malware payload (Mirai)", "value": "7abade88ff5848a9655ae9ad8827d546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940008, "uuid": "864a0cea-bd89-4a86-8179-81c0860c6209", "comment": "Malware payload (Mirai)", "value": "40693d11d362928b2475706e8b2a6026a7d16d2df81b769c2bd156c73fcd4f1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940008, "uuid": "2b794a5d-d4db-4d32-b70a-95ade81c2f1e", "comment": "Malware payload (Mirai)", "value": "26be2e7d112a9d551b576b5c3006c690656cea98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940008, "uuid": "7a5774f2-db94-4c1c-9b57-64844dbe3ec5", "comment": "Malware payload (Mirai)", "value": "61a8d6d34dd38d0e7348626ebc0c9393e7fd2106cf695936d2c13e10a02865b2d19bf892bd8fca20f87af9fb8f43309d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940008, "uuid": "7014df05-53f7-479d-a5cd-1ffaad3db54e", "value": "T15803D651F8825A27C6E1127AB6BE4A8E372073E982CFB617D9214B103BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940008, "uuid": "50f1a0f5-d80d-4e13-be67-d8afd8f2faa8", "value": "768:RqILBdhxPh9NeftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMyfE1JomcI2/Nkw+kE:k0z+f2G5dmSBWjV8kZbJqK1x2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940008, "uuid": "43e0e5d2-7510-40a6-95ab-52981e5be490", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940008, "uuid": "558e0b10-bff9-4bb6-a9d5-7ef8962a1a6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940008, "uuid": "eb75e9ab-e321-4e93-9fd3-4663254cf3dc", "value": "mirai.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d507e77a-bfc6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762952114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952114, "uuid": "0979b9fd-ebdc-42c8-a3c7-f0fa6a88e89e", "comment": "Malware payload", "value": "763ce4aecb5b7c8aeca88d1a850924be", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952114, "uuid": "3fd0cd75-ddb1-4daf-984e-f750b8faca2d", "comment": "Malware payload", "value": "427c9c4806ed284b5a1c49c394435dcc861a629dd9746e8d4d74c245fb72b8b9", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952114, "uuid": "2d92f320-6fcc-4cca-bf6b-d10c539f5e9f", "comment": "Malware payload", "value": "db31e4dcc9b208d317a3c40581328836cae02c09", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952114, "uuid": "c184ff3b-1ccf-4bfa-bdc3-0a80b87df39b", "comment": "Malware payload", "value": "58e1ae8842e19bb8eb933ff93416603891f98409f2dde9428a2ee7b050ff9c0ce5a0011bd0517781a0704d752680e96a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952114, "uuid": "8eefc5fd-064a-4b80-b79e-b1c37de2257b", "value": "T1AF5399052FE5262BEAB48B700AB17B3492B3F44294F69B0D300D61150FA3F915A46BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952114, "uuid": "b6f0f2f7-f840-4ab0-92ce-d6e0179481a9", "value": "48:5615sjsCYW6PP6ogePQi8m2zkZUbDl0qdLXuHiT:5M5sYCY1PP6or7nCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762952114, "uuid": "9b968b31-4d5e-4579-ad7c-87314e6cb6f7", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762952114, "uuid": "0e25b300-33f1-4be7-92dd-39e7530dff5a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952114, "uuid": "c2b45eb3-8dea-4076-859f-cdbb95f4d5e3", "value": "DANFE1918476.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ad83a2-bfd0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762956090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956090, "uuid": "ebd7236b-c4b9-422f-9278-54c5f05f587e", "comment": "Malware payload", "value": "c5eefa5adc0c9f33f75dae56d48eb988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956090, "uuid": "441afcab-a0ea-4f75-ad54-cfec605c70cd", "comment": "Malware payload", "value": "42e9d618a72fd2181e0501b57759f73cbd875c40d67c5864143822fd8e3f9a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956090, "uuid": "e997cdf7-22cb-4074-9893-c7409854af3d", "comment": "Malware payload", "value": "874d3c4ee45d6d8ce2edfa6e31d7767c2dc1a037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956090, "uuid": "2a3c0448-dec3-4160-942a-59535b42bbe6", "comment": "Malware payload", "value": "b26d4dd8873a9794b8186d1eb3b8a63cb540ef26ea286a70a959a52db155e015edcfe89942505d0617d07c29c8a41f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956090, "uuid": "7b4bd485-b8de-4ea0-affe-ef0be1a1eb39", "value": "T1C4756D3BA1A3947FE677C07F00A61B2084B9327911E158F760E4D6B62F23A4257CB677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956090, "uuid": "643a01e0-7297-49e5-9678-0108d697c741", "value": "49152:cW7yvu8q7FDWXg8GIPBzCtPYNGV1sgsPL7dD:cWuvqECdAGV1sgsPL7dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956090, "uuid": "786b9c16-2b83-4d65-a6cf-168fcf12063f", "value": 1661056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956090, "uuid": "e0e87f4d-34e3-4e8b-876d-368187f12b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956090, "uuid": "f25e067f-7b88-41b4-ad34-4b9c009a1506", "value": "license.ini.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5657da9-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "5395b88e-88dd-4b9f-a8b9-f860f7a50d47", "comment": "Malware payload", "value": "72028410a49facf582116993801eab36", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "733b9962-5577-4b8b-9b4c-f77d1e8eb0ca", "comment": "Malware payload", "value": "435badaaeaf08f425a6918f343f079507e7f58fd9b72779ad31341608248a0c8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "446eff77-13c9-45d6-9ec5-e928cd7e772a", "comment": "Malware payload", "value": "4fdfca08f59aae4326e62f47ef7e7cfa40ebfbdd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935284, "uuid": "400b2cf1-d1ca-4489-871a-d8bd4dbc66c6", "comment": "Malware payload", "value": "b319f9ec7894267cff3cab1f1c6cfb52f5628ff6738b0bdd66ea53143a7f1cd3c9c836b098ef8711eedbb5d09fa3e73a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "dd828850-3aff-4b5a-b587-5040b2508f98", "value": "T199660203F74E492EDDE2BA785E9313716A15ACAC1420928F4902F318BEB36D95F15FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "f34c4c03-4b12-4cab-8199-b61a0c42a7c7", "value": "98304:8yi7qbsLnATEbBgTZ4vALAZzbdTQ8mjrAl94s3WwR2c532Ums9pUkKWxTaBp:8r79nAUgVYl5bdTQM9JmwR2o3ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935284, "uuid": "ef91b57a-4bb8-4650-a7e1-2822001a336e", "value": 6984900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935284, "uuid": "9aeede6e-7b43-4f7d-9955-7b27fab2ac55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935284, "uuid": "a8a54122-38e2-4d9d-9416-1887850d008f", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d762af5f-bfdb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762961138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961138, "uuid": "e5753572-7d1e-4190-94d7-16ef6a170cfd", "comment": "Malware payload", "value": "7d94215e764e407d7d429687a31ae133", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961138, "uuid": "6e1ed045-3f0f-485b-a32d-fc1cc42c38e7", "comment": "Malware payload", "value": "43fcf71773d142f1bdd5c1db636d549eb4d2155278058703941eadfa8fe89a69", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961138, "uuid": "5f7315da-477b-4ab0-a704-00a30e914667", "comment": "Malware payload", "value": "4e4f5223779be3c8e269eefa2ff6ea7b63f86534", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762961138, "uuid": "83633e57-e4b6-4e52-8a9b-33144c7c40ae", "comment": "Malware payload", "value": "edbd610b6490ea2143530a2fb5187c23615c1eae22570139aaf7796dde30f78af6e3ec18c4ed36b005dc647c3b1975bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961138, "uuid": "3a9cfe60-7649-4773-8814-7f33aa555f38", "value": "T10411E34334028486E1D3673365C0CF51DB5047663B4297570E6140A75FB9BDA5EADA3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961138, "uuid": "5b67c03d-b5ff-462c-b359-5a2e1e7bac23", "value": "12:5jRrrLNS7nQBpqd8D7RbdW4IYtwa7nQBpqd8D7RbdW4IYcxIHrrLNUDJwot/:95leQBpqmVbMj2QBpqmVbMwlTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762961138, "uuid": "f1c6dd54-bda8-401b-b1f0-c540674c5db8", "value": 890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762961138, "uuid": "51749ae1-abb8-4bfb-b42d-c98673b3ab17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762961138, "uuid": "7bd87985-6db1-4b40-b940-a0a52b6d4bb6", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b22fc8b-bffc-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762974995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974995, "uuid": "688abea0-95a5-4f3a-bd57-fe695ef8f438", "comment": "Malware payload (RemcosRAT)", "value": "4bfc84ee21a181ad8f411ed890c83c25", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974995, "uuid": "696c61f9-e965-4391-867e-71ea382a765d", "comment": "Malware payload (RemcosRAT)", "value": "449e2b9d32a2c68bf24f9662cd23f06deb4a704aec9d00e6ca155c8b48cee993", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974995, "uuid": "074e5eca-c1b4-44b4-84b4-e79b252672d8", "comment": "Malware payload (RemcosRAT)", "value": "2b90188fafafe8daf7683782bbdffc90accd8284", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974995, "uuid": "1a362975-6ca5-4f0b-b618-9ce87af1eb0a", "comment": "Malware payload (RemcosRAT)", "value": "f5ea27644ba756ead01c5b1b6b4281abbf053757682c710a3d96ccb66d45b1836c48b2446e0197e12cb8e3a4815f712c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974995, "uuid": "603213fc-fdc7-4015-8388-d54531c81d56", "value": "T12896D7152BF0D49E95E7AEA1DE2E2690AC4E391728D70C4BF529F5EB342E40CF610E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974995, "uuid": "3bf3af81-a6d4-4637-a550-f6e2b1fe107d", "value": "196608:SAkefhQNZ3fDPbcaYqnyqMng44T/71PqxEATwhZj:dkSkdMgPbJPqxXTwhZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974995, "uuid": "3bafede9-fc09-42ca-9fc3-a05b1c8d6d50", "value": 9231472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974995, "uuid": "845cc9db-d29f-4a1e-a079-6824fdfcc277", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974995, "uuid": "7bef31eb-8669-444b-bda9-4789f1a4a53c", "value": "RICEVUTA-DI-BONIFICO-BANCARIO-ISTANTANEO-83739-PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d745c90-bfa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762935942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935942, "uuid": "63f83643-23c0-4582-b024-27591a012d90", "comment": "Malware payload (Mirai)", "value": "ff5072aa03bd8cb229e6df57ac4fcc7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935942, "uuid": "953024fc-9859-41a3-86a9-0056685a0862", "comment": "Malware payload (Mirai)", "value": "44d0be52dcc27a5f62edc41d93395ad90c8c143bee26d292b3e44b3dd06d3fa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935942, "uuid": "4c8ffe67-e27f-4db0-b737-d3147d51cddf", "comment": "Malware payload (Mirai)", "value": "4a832c85a9638e188cce09965c7cdf676b3cf45e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935942, "uuid": "e0753325-0b66-4780-88d0-ac20e3ff505f", "comment": "Malware payload (Mirai)", "value": "9332fa24d3763f3604ac491ea01a3ba38d7c89f0b1ecf652cdfff913e845224f6a361f650b0183e6cb8e0ec943ffbcac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935942, "uuid": "42f71a58-c27d-43d7-b8d5-c48cc5cb784d", "value": "T174145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935942, "uuid": "f0058741-c7ac-4665-a7f5-e35dd98803ec", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXjUaN:HZ15BTYCrYq1QDY6A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935942, "uuid": "519cdaa7-7ced-470c-ae0a-53128167c128", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935942, "uuid": "5f575ae4-a3dd-4f35-97e0-f1e9fb589615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935942, "uuid": "e6ba72e7-dc93-4079-a2a8-88384a670278", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f286ab5b-bfd5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762958606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958606, "uuid": "529682b4-43ab-4a97-9357-720af316cd63", "comment": "Malware payload", "value": "4f86c3106aa2055f28e68b84c7858367", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958606, "uuid": "bf499c58-72b3-4fcb-8539-5cf272bb3fe6", "comment": "Malware payload", "value": "458502ab96c2cfbf6987331515ead57bcc0891e49ffbcc643617f207c9abca71", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958606, "uuid": "ee595a78-4394-444f-8956-f296c2551dac", "comment": "Malware payload", "value": "541a0af632c39c6c99bf6c01a7b5c7a4f9cf433c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958606, "uuid": "d7008de5-eb01-4848-96fc-f3c9c118708f", "comment": "Malware payload", "value": "800dd5728e4084e17734f25bbefe4eb32a902190fddbfe23fd96c40d30e8ca90c546e5698872030c4005e90a2170451a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958606, "uuid": "07fa88b7-a036-4af7-be66-a203388230e2", "value": "T1CC118CD67E01D8A7E1D213F636765EF8143080511A02AA3F86B515321FF6F983F5C0AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958606, "uuid": "371de703-5200-4f56-95b2-db84987c51d5", "value": "24:9K6lsIDwsXzKKopHeEIDwsXzKKopPJlvjc:9KyAsXmKopHtsXmKopPfvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958606, "uuid": "b13cefcb-b65f-4a7b-9708-ca03abf0106d", "value": 890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958606, "uuid": "53eeb3be-a759-493e-9460-ed1ca5c97706", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958606, "uuid": "440cbd36-8c37-4a8e-966d-06905f369fe3", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76794145-bf9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762933487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933487, "uuid": "f336446d-2a06-4396-970d-c6956a907f63", "comment": "Malware payload (Mirai)", "value": "21d5d5b944538f38be4d2497744fcd1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933487, "uuid": "5e4df692-ad4d-496f-8bb1-a10db8aed5d6", "comment": "Malware payload (Mirai)", "value": "45c425ccec3efe9935a7e80568f6fb212142bf8ce0bae2492d553d86e17998de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933487, "uuid": "29f72826-5a78-49e4-8720-7db7ff87467d", "comment": "Malware payload (Mirai)", "value": "89a8b530c6eafdf8dc4a11eed8640719e28d25e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762933487, "uuid": "4902c82f-9abe-4d43-bc87-844196a99c8b", "comment": "Malware payload (Mirai)", "value": "e1ada795ef083f7df8fd14cd145b73ce1014f4921018f253f66e6948d06c29541d1d994a15fdec7a225be312c23dc76b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762933487, "uuid": "ceb22382-5e14-453b-be6c-2fc8c9cafc7e", "value": "T19D147220FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762933487, "uuid": "d3860de2-75b1-4b89-8133-74508f11a52d", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRiUKG:IcY5JpMByVs9jSRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762933487, "uuid": "e6b76445-90e0-4af4-aaa4-510d67d998e0", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762933487, "uuid": "94dfde72-752f-4a58-98f0-dff546184d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762933487, "uuid": "6da38492-2c47-4705-827a-49f13cd05e6d", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb83234e-bf7f-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762921577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921577, "uuid": "a1869b78-eb4e-4de8-a56b-c013132404dd", "comment": "Malware payload (CoinMiner)", "value": "1aabeaf6681e26da1734dc78bb0e1c65", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921577, "uuid": "3e46d113-6139-4d12-a7c5-25ce3e08b9ff", "comment": "Malware payload (CoinMiner)", "value": "4686bf588858db5dcdb60ff8b04a95624acd668c03dcf5f032fec070f5c85b8d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921577, "uuid": "ba390700-90d5-4410-ac20-f463b58fda30", "comment": "Malware payload (CoinMiner)", "value": "86b32ffcd11f405b5dca37a3a6f366657c7b8c25", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921577, "uuid": "c5d4f857-ece1-4ed9-a489-0e38a7e82347", "comment": "Malware payload (CoinMiner)", "value": "66c5c3c83baa9993ba6052d4e8d7190b9a67ccce5db65aebaa94cee130e413e2de30ea82a296f3b5f92e881f8b3a0220", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762921577, "uuid": "add2b125-7058-4c8b-bcc3-cd7fbda58c1e", "value": "T146365C4BF1A364FDC19BC434475B9963B931785802257EBB66C4EE302A23E705B2DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762921577, "uuid": "9fb75dde-90e5-427f-aaf5-20142077c70a", "value": "98304:bmf0190eJBZkZS72ZMaY/hu7mFOMTrHM7/zmJnvK1K74jJlsEEQqG++p:bm8owOM3M+zGJaG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762921577, "uuid": "341dd1a9-ffa8-4728-b9ef-8f490d8b4c5c", "value": 5040328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762921577, "uuid": "94729963-7878-4144-9e5f-3c3e548bf3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762921577, "uuid": "685446af-fd42-4876-99b8-220a1cda6210", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb43d503-bf8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927268, "uuid": "a99e0bf8-40f5-47cb-88a4-e1f8973287bf", "comment": "Malware payload (Mirai)", "value": "f1c251022ffe5eee13acd7100cc0b61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927268, "uuid": "45d08402-26a5-4a38-ad07-f9c765baee11", "comment": "Malware payload (Mirai)", "value": "473451a2351b841864e79eaa8042f067e2cef079e79740bfc0cd1b2abcd03459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927268, "uuid": "3dbcfb14-eaba-409e-a837-4f1b0f0b95f5", "comment": "Malware payload (Mirai)", "value": "883cf253ae7692325b38964169801c68cea9a7d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927268, "uuid": "e2afd2a0-0df2-469c-b175-2c603e340c7c", "comment": "Malware payload (Mirai)", "value": "6e473590d15da03c8557a1f3d8931f6cb0390ade4312c3fec5d1125bbd9716d34dffb79af8af1fa03cbb589ef2991ac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927268, "uuid": "11f2160e-d28f-46cb-9576-65dd7ad6fb7d", "value": "T121148D68FE4F68D2D2C7E37DAE4A0FA230277D749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927268, "uuid": "0a92ca3a-f065-4302-a417-54813fad28d0", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxU:bOVfbEdxm4iub+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927268, "uuid": "29d3ff23-4c3a-4795-be50-590accd928dd", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927268, "uuid": "44dcbf27-111a-4008-9294-e5d45eafc4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927268, "uuid": "fb68cbf1-663b-49a4-b16c-1437ee8054d5", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d320ba-bfd1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762956620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956620, "uuid": "b2bf12df-007a-47eb-897a-05d3f5f08275", "comment": "Malware payload", "value": "76d10318e315d3d471ed2e0349596a67", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956620, "uuid": "c632d920-a5c2-499f-9c8d-2243141bcce3", "comment": "Malware payload", "value": "4767a32dd639a2a2f8ef6173703c0e7ff73d1786d5c17f6baaeed95bc79d802d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956620, "uuid": "713288c3-cf2c-467b-9d59-c24eff5b8aa6", "comment": "Malware payload", "value": "a4259215a5383754311d12ae96c07d49c632032b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956620, "uuid": "a59a7aaf-8e7c-4d64-8ed3-3957ffa4ddcc", "comment": "Malware payload", "value": "ff80dc145a0f07dee9cf0f5ecb9891754b7ffcdee9e7dda47172188b953b8db6294818265462cbed3e7c78b2fcef8245", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956620, "uuid": "8270ca1c-9035-4bec-ae1b-acc5d4c04266", "value": "T123F2E807EF87DE0AC15BC17095EBA31CF63C7D229E268A0F3169376E2A351B4674D905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956620, "uuid": "f6c9be51-6b4e-43cf-a12f-e82a23da35eb", "value": "768:x7R6XjJtu1zf22ObP2q3K4d+AxkgmDMz46+1o9sMaDpxz99:xsODMz1+a9YDp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956620, "uuid": "f25fb35c-8950-48b2-80f5-233c738bc2a6", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956620, "uuid": "05ff356e-37f1-404a-88c4-994931c87d6b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956620, "uuid": "bf020be3-93e3-4dd0-82fb-e3697a5cc3c7", "value": "BLANCO ABOGADOS Y PROCESS LOTTO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87612bb-bfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762955046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955046, "uuid": "a4c8e2a1-730a-4ef3-af95-bac012115773", "comment": "Malware payload (RemcosRAT)", "value": "bdf09b38dc18c803e4e298508fdbc936", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955046, "uuid": "62d84527-d91e-4cd3-bfee-f4239c88c893", "comment": "Malware payload (RemcosRAT)", "value": "481745ac5675a825ea1835635c095dfafaaa312700219e9dc903a4da9452fab9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955046, "uuid": "85c3bd61-b83b-4fc1-bc11-b37ac5166794", "comment": "Malware payload (RemcosRAT)", "value": "722e02dc08dd394736ba159e28dea195c02379aa", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955046, "uuid": "0cc5d1b9-4ff7-42f8-9f00-9e9af9d0655a", "comment": "Malware payload (RemcosRAT)", "value": "c2c94dd69c0a41ee97927c5e3c3d8167ef8199b5e2e61ba68d20e6d96ac71f6cddb49700cf1de0d9af55094ea8046552", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955046, "uuid": "5488d248-43f3-44da-82b4-5235d3cd7869", "value": "T1B8742337973D3CF566AAB0B20688597011D2DE07BE6F20272BEE993EC673BD85251031", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955046, "uuid": "b6507201-e24a-4b26-bb5b-79c8a52e0219", "value": "6144:9NctwTUIWz7mak9f93wlliukrfi6hN+U8wsFZJ/Aon/zJOszkkP:AtcUIXj9f93tusi/WoLJOeZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762955046, "uuid": "28338820-9f2e-44d4-b35f-f2459f0325c9", "value": 341510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762955046, "uuid": "302a63e0-eed7-454d-baf2-481f386005b7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955046, "uuid": "5ac82541-67aa-4f07-a833-ab36d3ee41ac", "value": "BOOKING 2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03565361-bf6c-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762913108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913108, "uuid": "eec6cc0a-12f2-44e1-b61e-25cb7c2c7dd1", "comment": "Malware payload (ValleyRAT)", "value": "ec59260deb00ca7acca3578e23395d35", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913108, "uuid": "b2f3a8da-db2e-49b8-a60e-b74789ae3e8f", "comment": "Malware payload (ValleyRAT)", "value": "48ed24dd4e4d9cf84fa73ed3740b71c321a0fec1ab6090c0a272f6baa6169e93", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913108, "uuid": "fe79c46c-beac-459c-bbac-c3f19695993f", "comment": "Malware payload (ValleyRAT)", "value": "73b0d55cb7a77e0ec74362e180afa3a9d818fcc1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913108, "uuid": "fa87451d-1772-4080-ba08-19dbb451feb6", "comment": "Malware payload (ValleyRAT)", "value": "f29e4ea52eb22f7431eb7f4a68c0fb4cb40cda3638f7d39161d266b272431283fa328b126e95d566676f356a4401682c", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913108, "uuid": "8ec0c8b7-2292-4c03-b469-2b95d567c25d", "value": "T1ED53200AE72761F6D0B3D27652E2222EF9BA306813782ECB131717EA5751AE4753C3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913108, "uuid": "c7c897a9-25f6-4a80-8ea3-2defef2d313b", "value": "b910125c91b4d1dc38b7b29659740528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913108, "uuid": "90d010b8-93ea-44d7-aa68-88899505b38a", "value": "768:E6TTjH232d1YG4g/rQZApak/ZUbxZ4LApu7s10SHSLmhfr:E6TTTUk4g/rQWgkRUbxZtk7s10SH9hD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762913108, "uuid": "744e3b29-13ac-4abf-aa4c-b0ccd9e9959c", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762913108, "uuid": "14a19ec0-eeaf-4d02-8bfb-d3692898a428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913108, "uuid": "c21b2b22-6aab-46cb-a46e-26f192d2927c", "value": "2025.11.11 \uff08\u540d\u5355\u4fe1\u606f\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d433791-c009-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1762980770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980770, "uuid": "b0ffd8d0-f234-4a69-af57-f390991db2c3", "comment": "Malware payload (ACRStealer)", "value": "317a081fa7e9b766b93c912854892773", "object_relation": "md5", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980770, "uuid": "8ad06e63-fa92-47c8-a0f8-234d6175861f", "comment": "Malware payload (ACRStealer)", "value": "490819094f79f21f73feff99eacc1f533a2a4469b600915755c1e959cdb61100", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980770, "uuid": "7247ab5b-e882-47df-8c62-2c644e93fff3", "comment": "Malware payload (ACRStealer)", "value": "81818cd2cdb71b8adbd08f955b94d36248dfd2d4", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980770, "uuid": "60285d10-8547-42e8-8366-3afed52b4ac6", "comment": "Malware payload (ACRStealer)", "value": "88d6723d2a4f449c3dbfad2047426b0e36752c98d07e6c387b4ff6073663310a186340b1ce7644269ffd112f02f620c1", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980770, "uuid": "211f9096-973f-486c-86b1-e68755f843b2", "value": "T1F9178E3B72A18128C16EC23AD5634B40E933BC750B36C2EB2E5537995F366C4DD3E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980770, "uuid": "6119264c-f1ea-4c8f-9dc4-306ec59bca5d", "value": "b74a442bcc142f837ab68d11981311e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980770, "uuid": "0e74c378-cc03-4f41-bbdf-ebe573afabe7", "value": "196608:dYTHlVsCozwMW+egJSRQQidVtwkpjPVnLFDtzuo9UcqBiEKm9UQ:dYZqQMW+egJSRQQ96jPVnzuUUYEdUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980770, "uuid": "25c5028a-0475-432a-ac0f-6b036d88a647", "value": 19218416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980770, "uuid": "cea1dddf-d0f4-404d-aa4f-16461e43ca03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980770, "uuid": "b598050a-f47f-403d-a45a-784e43355c92", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83086c11-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939951, "uuid": "176ceca9-411b-4a1c-b7e9-fed349958118", "comment": "Malware payload (Mirai)", "value": "d5d2e5987190c9b9f8917d3002d8f6b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939951, "uuid": "c3db8ab1-0219-455b-b472-451e5969d1bf", "comment": "Malware payload (Mirai)", "value": "4ac232a077d4a4e100a11c314a3dac704d2c048466a4e54b49e252c9663274f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939951, "uuid": "5cdbdfde-6027-4b7d-a21c-bd48d80e6b0d", "comment": "Malware payload (Mirai)", "value": "1cf0c68200fda8281e150c7de528b627360d1a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939951, "uuid": "29269de8-8121-4ef4-9887-77e254f77dc6", "comment": "Malware payload (Mirai)", "value": "87532e7160ba5ecb4a752b59d9f2309642d5501929c709327a6dae1dc5decc9e5041a8cd1c53303617faa8134283a6f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939951, "uuid": "da46dd3f-7c27-4675-b9cf-e7d213d88d20", "value": "T1DEC2D06CCBA92501CF313632FCBA94C4BF9906FAF0567402A27677752ADB689C52C1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939951, "uuid": "63433b1f-2b74-4b58-ad6c-a5cd021ce10d", "value": "768:nFqQKUjeWTqy083TVQ/dkXy/oXNBjB9q3UELot:FqQvjeW/3Tu1GFdBALE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939951, "uuid": "4080dc97-37d7-45a4-b443-8b4e3737c502", "value": 26268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939951, "uuid": "124c6676-3c97-4813-a05b-9c1862616db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939951, "uuid": "e712ff77-7cfa-4d94-bf7c-aa6155d8f731", "value": "mirai.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c936d86e-bf93-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762930190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930190, "uuid": "29570e66-db14-4521-988f-774f4a762f4d", "comment": "Malware payload (RemcosRAT)", "value": "09b2dcc90b932f52947c3f46fdaf80b2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930190, "uuid": "3d1ef54c-53c5-4042-adb2-99c2cda00295", "comment": "Malware payload (RemcosRAT)", "value": "4bd1a1b1e3051ae3d6fbda64171ee4234742a7235aeec24081d4f63aa6ef327d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930190, "uuid": "3ef40234-c187-4602-a4e5-c7097e4739b5", "comment": "Malware payload (RemcosRAT)", "value": "7a1c22a469ceb74fe7c1fe29ed0d6fc8e9e4aec2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930190, "uuid": "7ec0ef09-3f99-42eb-be87-fa13caf6dea9", "comment": "Malware payload (RemcosRAT)", "value": "e019e3f11f82aab4a39f039ebbc6781f298ff0d0411cef5808decdfdded3b1d138c76a5889549a5297f7ce9376ec350a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930190, "uuid": "9ca35235-f4f3-4fb0-853e-1aec560db802", "value": "T16603F2D837ABDD4A89848FBE2CF948979042CC63440DDD55DC4F63CA5099B483E6B5A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930190, "uuid": "f9b4e766-ce9f-4b37-ae96-fd57c1cd6f2a", "value": "768:y54f0ZCMeBs+CYzh/u+yLDMsCGNll5fjCaMeNeytOxea1NPMncn10duzh+:y5WBs+RV/bynDtfsaMTD9Ei10AzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762930190, "uuid": "becbf7d4-22e1-42ed-be1e-7f8522c46a73", "value": 40003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762930190, "uuid": "5d1b74b4-8d94-4088-9065-163a9983c9cd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930190, "uuid": "f4d7da21-b883-448d-9e5d-cf7783a4436e", "value": "Caso aperto 0987653564576879805678989786576453409876456u.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc2f5a0-c00f-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1762983271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983271, "uuid": "03a3e58d-3e88-4939-9536-b955d6b27164", "comment": "Malware payload (GoToResolve)", "value": "e17ab486c940820f166254276ed09726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983271, "uuid": "33c07424-9150-45bc-a80e-1dfd4fbfee47", "comment": "Malware payload (GoToResolve)", "value": "4e11647fd8aac5d6062f79627144473ace0cc360d1506b3cfca7034ea4419729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983271, "uuid": "8cee999a-d9a5-4495-b4cf-df3ebc034da2", "comment": "Malware payload (GoToResolve)", "value": "8b8f83a29fff068639469c9a73ba02e2c013bd53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983271, "uuid": "28a74472-7663-452a-b3df-5fdf19cbd9d9", "comment": "Malware payload (GoToResolve)", "value": "734dc6ba2b5a88bd52a240c45a45237484cdb74753389d778a6852c798aab7f6924b1b5e92b202d37db86b9f52e75221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983271, "uuid": "bfc3c5ee-8c31-47a6-a767-b196f2ec9aee", "value": "T1CB3733317156C171D48711F19D28AFFAC2ACAD35877948CB73E85F2A9B709C26B32A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983271, "uuid": "4c09a4ca-8fc8-4632-a9a3-b7bda1345f49", "value": "5077e3f17a4376dcf6421ee6917bf4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983271, "uuid": "971186d5-1904-4cb4-afdc-622c1852bb06", "value": "393216:YAwoMOd/9DYp3Q7xwvcqMcfuIp6HIaW947I3Xon91m/FHVP+zTLy3qOZXMdtW6hV:4oN/98pg7x62In947T8ZkHe3q6F6hljT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983271, "uuid": "2e6b750c-b905-4664-9e1b-13a6ab81fa5b", "value": 24473624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983271, "uuid": "b62438bd-e928-495b-b979-eb4cb4c9edd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983271, "uuid": "180ba967-4725-4052-b2dc-26e196117f12", "value": "ZoomInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01c6068-bfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762958468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958468, "uuid": "9d4e856a-7288-48ad-92bb-74eed4469187", "comment": "Malware payload (RedLineStealer)", "value": "679907d3f7dd55c2487fe991f50424a7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958468, "uuid": "0059c8e8-d234-4905-9ee4-b6b4fa8c53f1", "comment": "Malware payload (RedLineStealer)", "value": "4e297e01b110326b32c30168475b1a26ec864cb96631df0c1e99aa8f237cca12", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958468, "uuid": "4d58298e-dfbd-45e7-91f5-05d964120b13", "comment": "Malware payload (RedLineStealer)", "value": "cfa7dcb63678d95157ba07286a11e376551ca4e0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958468, "uuid": "447e6dd2-b08d-4bc7-b244-8876f499cf73", "comment": "Malware payload (RedLineStealer)", "value": "a167a06e7d39cfc1e901f07f35db2dfdb507eda1d1a3ed2f05e61bcf114e7165a93bfc99b8645abfe0b83bb91b276753", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958468, "uuid": "417e1530-b769-43f0-a500-eaeec8bc55f8", "value": "T1E2D423CD236ACC77DAB463AA87197094EC7BCA9F5C05D9A68592038353B55D0F8C3B0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958468, "uuid": "23f19267-15ea-431f-9fa5-2d89709169c8", "value": "12288:hTEKfPi7ciqmM5ncA/aUoGfDqce1vjUwbloFblwqmmAr26/BLQTll0u09iIkI4Yf:FECPi7PqmM5ncFUoVLnAIzrp5kTgJ98c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958468, "uuid": "1c25ce34-ab08-4098-bd88-6c172ccb02df", "value": 633647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958468, "uuid": "b2c6921b-bc8d-4284-8161-9f98787581b2", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958468, "uuid": "6476cd3e-6547-474a-b68a-515a072c7643", "value": "PO MARKLPO147012025 & 1476t4564548.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c01bf45-bfa0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935671, "uuid": "8400ef62-cbcd-46d3-902d-b9a6df496511", "comment": "Malware payload", "value": "f96b5024b5c1752b6e169729c462b533", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935671, "uuid": "4f3d3038-e7fd-4a1b-8ce8-959f5c93a266", "comment": "Malware payload", "value": "4efe3ebdbf79630bda1a3f0280d637613f9fd03f65773a9fa1d1fca183a61590", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935671, "uuid": "b05addcc-2110-46f9-bf96-fdcfe31939b9", "comment": "Malware payload", "value": "695ae00d9385df7c9dbacf509d0bdcacb74e9db4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935671, "uuid": "875a63d4-4967-4fb9-a577-2fa33ec28d89", "comment": "Malware payload", "value": "b018123bb59e2a14931faa6c14c528cb5be7e2ae30ec1dfd03585708acb019c36dda2fe0ae740271c32e0e7e5f09a4e3", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935671, "uuid": "73d91d59-08a0-43e8-b3ba-cc3e278ebf3f", "value": "T10915227349E67C3DC03C8AFF6463B9BA79680E848966790A294F63DC4D5538D42068FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935671, "uuid": "ea57f43a-b9bd-443c-861e-b2f52ed6fd37", "value": "24576:y2gdrFt1FoFVrLO0bw0rTld74BQb4qXeJYv9J3R4JK18:GxtSVrLOArj0QHXG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935671, "uuid": "2883bd1a-8162-48da-87b6-279de109b095", "value": 936032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935671, "uuid": "9a0fa267-cff3-4768-97c1-587a7b745707", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935671, "uuid": "826e1bde-de0f-4128-9491-6ec37f1c6f9e", "value": "PI-0008102024002REMAP.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cd5ca9-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935278, "uuid": "00e6ac7a-af21-4db8-99ce-8b4d5248f117", "comment": "Malware payload", "value": "11b2849485ed784bd014a4a1f925b789", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935278, "uuid": "c2b377da-bc16-47ae-8766-780f5ea59a74", "comment": "Malware payload", "value": "51a24f9c488e0246f18bff1529dce77bc711a81c2b2e1eb3b437b7af16e8e02f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935278, "uuid": "04374e46-02a9-4979-907c-f4bd54905e10", "comment": "Malware payload", "value": "749f94b5162625439853c6571ccd0a786a7f01e9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935278, "uuid": "a1936e99-3273-4248-b08a-9841061a944e", "comment": "Malware payload", "value": "682cab343547fb24bbf6fb831dc13083acbaa335ed6c5db44b4af7a8973128f5a365557162c0b8deab5aae743a2b2c43", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935278, "uuid": "eff95541-8eba-4eb3-be47-f503aed80eab", "value": "T1B7460186F709947EC4FB13360A3612656263CC6A8F43D6836928773C69BB6C85F24FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935278, "uuid": "2830d269-bf24-4bfe-b55a-e5e761d86cbe", "value": "98304:7p4m4y9W2RYiaS4f1Pwu2H9MaaflH3zGwE3Uxs7pqw1Gs/4tGCJ/ck3q+:76m/Yiajfdc9joJ3zYosYGGVGC1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935278, "uuid": "1f14ccb5-6954-4fbd-a6ba-53f3ef9d2b9c", "value": 5608215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935278, "uuid": "ac5d317c-2a0c-411a-845e-3130b68cf5ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935278, "uuid": "3fc7591e-e02b-4e05-8c22-962a84e8641d", "value": "SoulSync.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5473890-bf91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762929351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762929351, "uuid": "34633cc9-b12a-4931-a3c3-8f348241f670", "comment": "Malware payload (Mirai)", "value": "971baeba59bcc2069494896cc9031b59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762929351, "uuid": "a0baa676-e488-40f8-8c8b-64465718d9d1", "comment": "Malware payload (Mirai)", "value": "52af6dd63be1b558d11570db5111b06a4fe6707593167c3a91f69f5e6dc156fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762929351, "uuid": "900581de-0f7a-4760-9dfd-b1974b9ea46e", "comment": "Malware payload (Mirai)", "value": "9bc99aa564f1435514bf644f1788109b1b84ef2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762929351, "uuid": "7aeaf99c-09df-407f-a937-c7c88fe3dfbf", "comment": "Malware payload (Mirai)", "value": "c86b68f96ffb6acbc3b6d0fca9209522013cc0eb4d5296dbdbb635e76f5308c5579484da0989b53c0ed998c38ee32c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762929351, "uuid": "3f11d7e6-2049-49b9-b8e8-877ba828a666", "value": "T17704392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762929351, "uuid": "a1c5b121-0271-48c2-b9c9-70276a12f51e", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wsUXS:7eJpJUVD1A8n0YNgEJi5adi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762929351, "uuid": "4afac757-7512-43df-a67d-a111eb0e6a4a", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762929351, "uuid": "5c402b2e-0c1c-4a43-bd41-ac3278801b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762929351, "uuid": "e4c59b24-0a5e-4340-82fb-188249f51686", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bafe7e-bfdf-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1762962643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962643, "uuid": "74eae3fc-1cb9-4f41-a91a-a9172c671f86", "comment": "Malware payload (GuLoader)", "value": "0700d64d4d0b584cddd7eb7d7bea1c4e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962643, "uuid": "b20fdef5-ec8c-487d-acf4-5f6b84f49abc", "comment": "Malware payload (GuLoader)", "value": "53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962643, "uuid": "6c20463c-8da1-4985-909a-e14d0061c5e4", "comment": "Malware payload (GuLoader)", "value": "4926f59b3eceead82b0ac51aa4ee2525f6c020bc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962643, "uuid": "65921192-4f28-4b3f-86cd-3078b7783b91", "comment": "Malware payload (GuLoader)", "value": "4000efaf7445ea109204ccd99255978d10d92a78e0de0cc4252b4ded68530a5a7fbe4689a428856f073ee02bae29e467", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962643, "uuid": "4c47501f-ee45-4999-9f75-ba23ccb521f5", "value": "T1E005330507F46C5E37F86671808A6AEDBD4DD00D60DB57363DB7298AC8169CF4BF2A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962643, "uuid": "5d7f6560-ac55-45eb-87f8-f32490a8de22", "value": "24576:GpHiAvsuatOb3OeQQzMRY0/0lnm6GVuLt:GCuatOb3OeQQgX/0ExVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962643, "uuid": "7456d43c-073a-4947-b642-a1e40c2937b9", "value": 817749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962643, "uuid": "c865aae7-f7eb-442e-9d5f-06fb1ac491d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962643, "uuid": "9bffd700-ad1c-4128-9f79-d65e17587b88", "value": "INV CAT-26104.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb7b388-bf98-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762932159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932159, "uuid": "0dacab58-7b08-487c-9579-b05d62861274", "comment": "Malware payload (CoinMiner)", "value": "f7e74b2f0b9484163a35ffd4e86a9768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932159, "uuid": "230e383b-ab69-4f64-af24-140c96a422e5", "comment": "Malware payload (CoinMiner)", "value": "54b2d5f2a6f711e3b9d6d23466b4d841137b61518d49d432d265af931a797b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932159, "uuid": "82aa0fcd-9dae-413c-a461-c53503472a87", "comment": "Malware payload (CoinMiner)", "value": "eac38e7792018f4490c33e38697bf70edb723741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932159, "uuid": "5ca4687f-a3a9-46a1-bbf0-af9b27668927", "comment": "Malware payload (CoinMiner)", "value": "e4f384d91ba37834a5c1fc895739ec7aedf938a12405e20a0bd8c60f1097afc08b1a24ee6837d6681da496e908a76d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932159, "uuid": "5536715e-7969-40b3-bae8-9fc940a8a3be", "value": "T13C75333D71E807729086A16195020E697068B9E955FCED749F2FC7F360E12D30BE70AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932159, "uuid": "0f8bd11c-6555-46f2-8b43-42c2ee8b9309", "value": "24576:niFaMYEceyMG3UHCz6QQe7QeBB3ehHm0PrbEUSFUfMu8EpoqRCpXBw9dxBZ:nydOMSUHCOIsYBuhHmwvozXBwXxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762932159, "uuid": "0b7f5c18-1685-4efa-9c08-76ac96779cfc", "value": 1561288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762932159, "uuid": "f0f35cef-ebd9-48d5-9005-a0de5202be46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932159, "uuid": "8e7603b0-e614-4431-b269-0b25b87595ba", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa466e43-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "79430498-8136-4db3-acfc-95c9e5664a4f", "comment": "Malware payload", "value": "ddf3230c588f307d33787ed87b5ee717", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "ae253f00-1ac2-45f8-9916-d0679d5c1124", "comment": "Malware payload", "value": "55bf1dc80fcc7f0a7ad4399141e0293f1b5faed06eff47df1d526e30e2bd9626", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "7c2c5dba-e26c-4937-8699-9387c70b4c63", "comment": "Malware payload", "value": "ce04b4206ce79521b1b18e6fd2625afd118a1c88", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935292, "uuid": "e00d7afe-cd0f-4694-b882-29fb7a7d5f66", "comment": "Malware payload", "value": "1fc634a4f85ca5ffc3ef335a00cae65073dec035a86061e915f60a82306585e68c7ffea1ae4a39883e4b59156dc6a877", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935292, "uuid": "3d418029-f9ec-4c61-8b42-97a718eea7db", "value": "T143762306F769A10EC8F3D3325975133A5162DE228B43E78B651473F8A8BBBE41B417D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935292, "uuid": "266137e2-f705-4df7-a6ec-8e55548281cf", "value": "196608:b928t520ZQvqHH6c9OnOtwWU2VnxcwTwQ/43mr8Zq5TDxw55:b92I20uvtcOnUxNDUQvrs4Nw55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935292, "uuid": "92badb6a-deb2-4b2a-8740-fed98206f4ba", "value": 7490075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935292, "uuid": "83e9f9e0-d737-4ba4-abcd-358582e378a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935292, "uuid": "2c2cc8a5-1466-40e4-ab7e-3039621b985c", "value": "iranian.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ba05b3-bfe6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762965889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965889, "uuid": "5e434c56-4f1e-4897-ae72-d3146996dcb2", "comment": "Malware payload", "value": "993b49b689555961b6c183bf661ee5a6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BAT/TrojanDropper.Agent.", "colour": "#EAB175", "exportable": true, "hide_tag": false }, { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "Trojan.Bat.", "colour": "#29FE38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965889, "uuid": "cd202842-5fce-4fea-aade-25d2558da72d", "comment": "Malware payload", "value": "56451fa5e787062b362698fdc361281b4fad6d66eb4db95b5906b5f3ce8b9de4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BAT/TrojanDropper.Agent.", "colour": "#EAB175", "exportable": true, "hide_tag": false }, { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "Trojan.Bat.", "colour": "#29FE38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965889, "uuid": "d74976d2-feb7-41fb-a033-97a7d6ca1ae9", "comment": "Malware payload", "value": "1e561a27cfa8685475bfbed55a4cca48c6feb00d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BAT/TrojanDropper.Agent.", "colour": "#EAB175", "exportable": true, "hide_tag": false }, { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "Trojan.Bat.", "colour": "#29FE38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965889, "uuid": "4ea4dab4-d7df-4dc9-af3c-0bff6486ca79", "comment": "Malware payload", "value": "426392ec55a4e478703768d01321bf232a6d5c2c3875f5bf79bd0f4f89154764d0ce3c334d390b4f9569daef35cebf17", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BAT/TrojanDropper.Agent.", "colour": "#EAB175", "exportable": true, "hide_tag": false }, { "name": "NetworkReferences.Malware.Generic", "colour": "#C60C00", "exportable": true, "hide_tag": false }, { "name": "Trojan.Bat.", "colour": "#29FE38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965889, "uuid": "7fe68d9e-b58d-4ef2-bde8-0b3f02293ab6", "value": "T190D17D5CAC7DD9307D9AA258BC7EC40CF14B42C24312EC9935EB756C27C6BCBAA0D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965889, "uuid": "a8c55f1f-3ca6-41cb-a7bb-622ec76bd1c2", "value": "48:s4KsYDtGeDPDTG6pgPKwDr4RTD0WTYezATOWJNJlXuJz3utr4KsYDtGeDPDTH06X:cVDfwyJcezATHh7VDfRwyJcbzATt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762965889, "uuid": "0ff2959f-f6c1-48a8-8dc1-5b40dcd40f0d", "value": 6674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762965889, "uuid": "78c525e8-3b64-4344-a94a-7af9b6afbbbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965889, "uuid": "541cddd1-b8f0-464f-a163-bba58f2ca3b4", "value": "hello.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d7c38e-bf62-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762909186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909186, "uuid": "603c9e35-b03d-48df-b62a-706a1f9fcd1c", "comment": "Malware payload (QuasarRAT)", "value": "c9de91a1ca632c11f65080c8d886e987", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909186, "uuid": "0d21bde5-3667-4ae3-bc9f-5b8f6542e310", "comment": "Malware payload (QuasarRAT)", "value": "5796230cdd9dac9064551b7e0aeecd62ff2c25808dfe854e774c54815f66c741", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909186, "uuid": "5667417d-b721-4c12-8927-4a5664e7957c", "comment": "Malware payload (QuasarRAT)", "value": "7bd21266a054b36d9d3266c97ef4041d9cb733c0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909186, "uuid": "f32a4a07-f89d-4e8d-95c4-f859b15d5a19", "comment": "Malware payload (QuasarRAT)", "value": "217d41c6c480f37f84254d611ff32d0a9f1a31737f328bbe5de840ed7c9f3cf6a84d0d4bb6b287a5f4573228bdbe52ec", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909186, "uuid": "6c1cba41-d65e-4ec2-8185-dda323fd5b5c", "value": "T1AC25C09177F4850AE1FF1BB5E5B609494BB3F912DD36C75F0988A0AD0EA33848E513A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909186, "uuid": "cdf401c0-d3e1-4e4a-8988-b27bd2cb1f7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909186, "uuid": "ac223086-a547-42f5-9c5d-617841b23f48", "value": "12288:TgkncybQ5GZ6OIJzckfGGv5KTpEyxW/yFot2wkda7EGgMBjsfl2QnTmiAC:TTncyAxJzck+uGW/yFoBkkARl2QnTMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762909186, "uuid": "7005ed4e-74b7-42bf-b9f8-6770013cc322", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762909186, "uuid": "2464b523-cfa3-455b-b264-b0fde8d2c7d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909186, "uuid": "8df34ef7-2284-42ea-b535-8f46938929d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a8907f-bfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1762950129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "39f7f3b1-29f3-46c9-afd1-2396cb6eed8b", "comment": "Malware payload (Vidar)", "value": "f64c830c73cfe9154b46e1d488c06122", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "78e9c2ac-9c8d-47cb-95d0-dd8e7034bda7", "comment": "Malware payload (Vidar)", "value": "58c842f86041e4856fdd0420dff607b4ad4560e7c735a7c25201bc76c76f0635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "3d69f1ff-5bfc-402b-9d9c-c811fa518549", "comment": "Malware payload (Vidar)", "value": "839dbfef2e38818dd8b65cac3b59551ad9b79773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "f5c310f2-a6b7-4145-bc3f-3c83155506b8", "comment": "Malware payload (Vidar)", "value": "1f04292003bac0f99164823c329d5d5402aa0b30d3cab2cacd94f99233dcca91e49ba5316a61acbd189e146fb3e2d265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "8e013819-1274-46cd-b033-8e9f4ea936f3", "value": "T11065BE7462CC24B1F2B3A130798C7AA4A737B5365FE16E8613ACD5711FAA6D36F0060D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "9f4e7c4c-41ca-4288-a0ac-b9d9e12947c9", "value": "24576:JEtTdoH+N8KH3H8gXeMUTGvEgDS/lkdEb4FZGjCDRmRNT2yI5tB3858uT894DZf2:JEQH+i+0GCbCGelEJfIPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762950129, "uuid": "2680cb0c-806d-47f8-b7fb-8f0644e9361f", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762950129, "uuid": "ecdb6bef-b98b-47f2-8d50-584b80573916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "7e39aae7-db57-498e-9dfe-63c5867ee0de", "value": "58c842f86041e4856fdd0420dff607b4ad4560e7c735a7c25201bc76c76f0635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51965ef-c019-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1762987816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987816, "uuid": "7daf4a14-44cf-4475-93a2-7f84f7f30c20", "comment": "Malware payload (Formbook)", "value": "ee3d30ef93c2b841752005bce00d249d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987816, "uuid": "96e4d876-8adc-4cca-94e5-a8f0bb7f7e73", "comment": "Malware payload (Formbook)", "value": "596659ee30f06ef3555d025a1865bdd9018b9a3b1649b06fbbe701e7daeaf9be", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987816, "uuid": "ba820f92-3149-4c83-b1e5-1e83e0c30357", "comment": "Malware payload (Formbook)", "value": "e06c957209a7f028696e7a422a2768553b147b09", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987816, "uuid": "0413e7c6-8a2c-4f33-94da-1f651bccab28", "comment": "Malware payload (Formbook)", "value": "cf4514c03b855fbc1cd0af25978984847ef385b6f2c5ff117cadd6dff6fa86e830fb36ab2e4b6902569bb0f835a96c02", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987816, "uuid": "05720c9f-3c98-49b9-8f2e-1637fcf39268", "value": "T1A12233BCCAE5FCC08B1B72E079DAF6D710969703AD7B596CE99814650B00354EBB94CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987816, "uuid": "51559e37-7522-4b7b-8740-7e4ca8701d1a", "value": "192:AcexhSCoDX9OggmCw74O1sV1vqh3ldKdm8jIVhMk3zCsBI6olqeGDYGQYd/Lz1Le:Acexh3A9OjmCw74C4vqh3ldKdm2IVaki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762987816, "uuid": "07b20787-2c03-421d-96bc-0f3aaaf72b67", "value": 10338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762987816, "uuid": "36e9cec7-8961-42fa-bb04-03e36375e1b8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987816, "uuid": "b5e84fe9-c5f9-4f9c-81a5-2fa77f24b3ae", "value": "546__DC_00_generated_script.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f97200-c009-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762980919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980919, "uuid": "a09497bc-a0fc-47c4-ae0f-6c0302def9d8", "comment": "Malware payload (Adware.Techsnab)", "value": "c08b2680c3ce3f301066bb482b795444", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980919, "uuid": "a470647e-28ea-4a8d-a7ab-6b0f37e3e2f0", "comment": "Malware payload (Adware.Techsnab)", "value": "5a4cf378395a7562377f407e63cb574972ba5ac7a765fc32abd22ab0dd16286f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980919, "uuid": "ebb95afc-8e22-49b4-988d-1b35bc359f86", "comment": "Malware payload (Adware.Techsnab)", "value": "0238b022a5155019d90ecc89036884a9a69435f1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980919, "uuid": "3bf96d3a-01f9-4b99-9935-a25e03d29d49", "comment": "Malware payload (Adware.Techsnab)", "value": "547d28d07e9dcc48f95882699f33b9321ba331727ddb68a20893a64ad5f6c707383f1643f90770b8dcaf753dc1501990", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980919, "uuid": "df5e3e15-1f8f-4705-bc9d-965c052c3a6b", "value": "T119182309D34CA7F5BC5B787989631C6FB0637E8E18A5CAFECD19A9D7B2603653D0A004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980919, "uuid": "1fa2e000-fefa-47ed-9a25-d0c3b517628f", "value": "1572864:++z0GXU7ZdF4JBWfpwUhIqd169v5FUV7toe9ZthYxQNNOXS8nbX:IuU7qJBWfHPd0yokZt6wNOCCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980919, "uuid": "632f5f95-4545-4a4e-a620-c042a60a05f3", "value": 85177136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980919, "uuid": "e07953a3-cddc-42e8-9edb-944d8b801c60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980919, "uuid": "b8ae0cb2-530e-4183-a6b5-25bbd71a99aa", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d83ad1-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1762981343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981343, "uuid": "7750aa7f-dbcc-4ee0-b349-073caef0854e", "comment": "Malware payload (ACRStealer)", "value": "19119a8845d4280df40c52c4a45423e1", "object_relation": "md5", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981343, "uuid": "c380b470-1422-4c5b-b6ac-a7db5cc63c04", "comment": "Malware payload (ACRStealer)", "value": "5a64eaec9c6f4a491f9f965e92d3630da471e714042f8c7d14de0a447c931f12", "object_relation": "sha256", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981343, "uuid": "cf2b1ec0-9f51-422b-bbb4-3d83469a2d1d", "comment": "Malware payload (ACRStealer)", "value": "0f6bc4db3f64e32730486e8213fb8647e0e7ab2c", "object_relation": "sha1", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981343, "uuid": "1bd09022-2d97-42ea-9202-bf1c02a8bb6a", "comment": "Malware payload (ACRStealer)", "value": "3b21622c9a94052af335b50d616a974bef07f5dcfd27f085733fb483a008699af5c534b5fa9a9890737172b407df77a7", "object_relation": "sha3-384", "Tag": [ { "name": "5-78-157-244", "colour": "#9FCDC7", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981343, "uuid": "c9c12fed-e15f-4ff0-ae41-2e4f24932ac8", "value": "T1D007F17263618A7BF46256F1293C9D6F50287D610774B8CB82988C29E8BDEC24F35F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981343, "uuid": "4902d23e-b034-48c7-835c-411e8f643242", "value": "f27eeb7d7007baabafd4efab8f8b8d36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981343, "uuid": "870cd5c4-8a40-49da-bba0-25e95172a1b7", "value": "393216:/6Q13Keg0YIC7gcnRKVdVhJPRE2yfL3m31+ikWNyXc:/71ae7w7gcRKVjfZ4z+1++NyXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981343, "uuid": "07597fea-c9d4-48cc-a735-94da82bd126e", "value": 17701568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981343, "uuid": "e145a740-e66f-45ce-a3db-f92737c581be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981343, "uuid": "f5a813a8-4228-405a-9584-299000edaa65", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61fdb3b-bfec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762968464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968464, "uuid": "23bcda16-32a6-436d-b33a-96ed65c20168", "comment": "Malware payload", "value": "f52f583c314702bbfe3b7d804469351c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968464, "uuid": "0cf1cc90-a088-4fde-bffb-8e98be0ca280", "comment": "Malware payload", "value": "5adec34dbd4c68769ffa5abdb7c0424b5cdf56a4f925e8b87c53cf4a5294afe6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968464, "uuid": "31f7ac45-2b68-4f7b-b036-aec423506408", "comment": "Malware payload", "value": "67020f2f8e494bb2a56807e4a3354120b4077b8a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968464, "uuid": "7a6c1906-85d8-4abf-82a9-81d0de51814d", "comment": "Malware payload", "value": "c2fcb4ef3522046ff55567d3f6a7fc127ba61e9443d72c08ea2e9c98f108a8b3562f846f6e3221c119b14e8aefe072f8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968464, "uuid": "9ce986ba-f55e-45e5-ac5b-a988d114e2f0", "value": "T195D5335377A900F4D6F316B0206653AA5D7F9FE12B2606D712883B0B5EF18C7923739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968464, "uuid": "86e268a4-c2df-47a9-9d2c-86399aa8fa8c", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968464, "uuid": "0e03eb93-fc33-4ce9-ae4e-b87aa207895b", "value": "49152:IgwRV8UhSoTsnfN9kA0K6zocCchjZcKCKPcYfhVT9Zns80Yoh7M17+PmOv4O3nu4:IgwRV8U6ffr6cCjdCwcyVbnxXoh7OSmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762968464, "uuid": "0550034f-94c2-4421-850a-9105f41d0de7", "value": 2955948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762968464, "uuid": "48563577-c1e8-4c52-92b5-7130036542a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968464, "uuid": "fba844f3-3794-4091-92ee-870ceed0880a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a41a6dc-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991825, "uuid": "7d6dfc69-278c-4d76-bf9f-9ecbd9aa54ec", "comment": "Malware payload", "value": "5cbbdcb216cc97e1fa2d739287e1d9e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991825, "uuid": "6383db76-4980-4295-9645-905561030e5e", "comment": "Malware payload", "value": "5bd31c712bc667714d6abf1823c3abd23c909831aa83e5597d9e4c8a280da029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991825, "uuid": "88058181-80e6-41c1-a164-79c413ed92f2", "comment": "Malware payload", "value": "67595c830401a7b53053984b9242971fd37a97b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991825, "uuid": "d2da255a-8183-4f63-817d-ccede794b11b", "comment": "Malware payload", "value": "c0e654b668c83c19bf58f51d28cb9960413187338ff81e9df23fb4c97f30b60096d93ee4fcccf6a4e08c8fbe0268c858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991825, "uuid": "4b1f0d5e-86bf-41eb-9e2f-5c6e38a605fc", "value": "T1D583F955F880CA61C2E165BAFA5D528C73230B78D3DE72029D24AB343BFB9560F37946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991825, "uuid": "ef1e35c4-1067-4e22-92ff-4ac36e090e89", "value": "1536:zVddUbVkpOiJGpC+I47CTJn3ODTYDLtPwZyjBTEiJOd9ax1Ir:zWb2oieI4vDTOpwc3Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991825, "uuid": "e33d7c6e-fa87-464f-87ee-4d090b90b151", "value": 83216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991825, "uuid": "230d34e5-9b0a-48aa-b20c-1a9e4ce2f348", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991825, "uuid": "c69882e5-123d-405a-9d83-480bf419a9a0", "value": "frost.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d3b642-c00e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983007, "uuid": "dc4bade5-cdb1-4297-b8d9-5d00ad67272a", "comment": "Malware payload", "value": "eab4799dc7222f2b2586891012f7ca41", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983007, "uuid": "b24f9fb3-3c4f-47f5-8f7d-286ae86cf469", "comment": "Malware payload", "value": "5e1d1462ddef8c1924fe363464708834f3e55d2073cd70f1911766bdba16001b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983007, "uuid": "08a384b2-7cd5-40fb-ac47-8425986b0071", "comment": "Malware payload", "value": "5b2e9c8ea473aab7f298bf2cda4885848771e2d2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983007, "uuid": "64dede9b-e28e-427c-bda5-8803691a2fcd", "comment": "Malware payload", "value": "e0480b55d046d91a06f6d58df4b0814e1e5d9edfc4366f40453332384977e5c1899944de8d63c7e09efaeb09e881c4e3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983007, "uuid": "f3368464-3946-43d1-b62a-914e2b2649f5", "value": "T105D412224D58DFCE43A0260654DBCBD98BFFCEB56B6690CB698710C6C08F607F6649E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983007, "uuid": "603adae6-fcd5-4b9d-a58c-f5cf67c892ce", "value": "12288:ZDbmYHYZAAc2U+yukVmaSKHRKFRq2AD5zSG8sofPQiFQ1oA+sZdRCgEDWwonDL36:Z2YjAlU+yukVCUpgzPQiFE0szRCgEKHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983007, "uuid": "2e82fd22-b3dd-4f37-ac6c-2c48ca0ea5f2", "value": 652001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983007, "uuid": "c583254f-6459-4859-ae9f-6a29e02241c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983007, "uuid": "f71d0c2e-b307-4f7f-a540-489785f9be53", "value": "r74cced1f-07c7-43a0-8a50-d91a52fa421a-1_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf10dbee-bfe6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762965848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965848, "uuid": "7c1f35f4-e16c-4c62-b8db-67b5764c219e", "comment": "Malware payload (AgentTesla)", "value": "2ba30eb803e941b36d9549332308ab84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965848, "uuid": "0ea94cac-f150-4972-8dbe-17a9e0216f20", "comment": "Malware payload (AgentTesla)", "value": "5eb8fa04e2d7d059f7d82dad9f8b9c44a61a4d46473bf5fe5e353aaca8ac0d7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965848, "uuid": "89b0f22a-057e-4106-a6f7-c17edbb6f023", "comment": "Malware payload (AgentTesla)", "value": "4dfd526a42aac1aca63219f1313dc829c241caa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965848, "uuid": "35861150-c600-4687-84b8-4174dcfc1b7f", "comment": "Malware payload (AgentTesla)", "value": "0e704f4c057c3774a4d85feaee72cf7ddee765a2c7fa097b9f993281c6a9a75f5857c61bf2d9c90c192cc60e696c1f66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965848, "uuid": "d7a8c5d6-fe10-42ae-afd6-19818571623b", "value": "T1DDF4F104B6B4951BCE7996F10C31F6350BB92DEA7511C3C98ED87DEB74EAF084A04A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965848, "uuid": "948ef83a-0ddf-4bfc-8326-ad63ce6f6fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965848, "uuid": "081efca0-a90e-49be-a926-c0b900498bd2", "value": "12288:3SfRuFx/ux/GV7vdVotdMx/Q/MghvQnI5mqdScKIMF3sPaF+5iyhkz8+wc4Rx2W/:3PxWxeVzdyMxIMuvGIrSjxsPaF+5Vhky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762965848, "uuid": "907fe0a8-a934-4303-8128-0b90bf8c477a", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762965848, "uuid": "5e7e516f-4a8b-420a-a470-b5c57de64be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965848, "uuid": "597b73d0-3f52-480d-be17-3a7790659973", "value": "HAT-PO-2025-149 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a74b3f6-bf69-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1762911912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911912, "uuid": "e243ebe0-f5ed-4e17-b8ed-aeaff0ab0fdd", "comment": "Malware payload (Gh0stRAT)", "value": "8b284d2c6ee18c04ab9cb3cbd1bb6905", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911912, "uuid": "31bcfe90-a34a-4da8-8699-559089e3ec0e", "comment": "Malware payload (Gh0stRAT)", "value": "5f4b9c4493cad0f82ab4ff986a0fdd5ce93101334349ba8f0a9188a109af34b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911912, "uuid": "510028db-0aad-4e9b-a61a-7a1faf704ea2", "comment": "Malware payload (Gh0stRAT)", "value": "212663dc1ab63f5d1177039014212a3f90ffe738", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762911912, "uuid": "310759d4-0797-443f-814c-e2e597fa5db6", "comment": "Malware payload (Gh0stRAT)", "value": "a00549ca12baafa5957b2e0b4fb25f9987b21ac3539d6e65f4b3b742cabb953d02691fd677592875adc2403154b3a67d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911912, "uuid": "dc2b8454-f29a-4701-97c6-9065a617f17c", "value": "T10C248C02E69005BBE9B720B454BF7B379E7A95A40B4C5ECBB748D7A104211D1FB3638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911912, "uuid": "bdca1971-eac6-456c-9c49-cf93895e1fb9", "value": "a9208cbd352be04e687a14e0dfc18846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911912, "uuid": "ed622142-535d-456b-b282-884fc81f19d6", "value": "3072:MdQo6wtIptugitFof9zCPc4Mn77IxZa39TtsAneb/eZJH3tt4TSOB3c7TLby:iQoPIHi0zYOn77aZQ10/6JHzWSOBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762911912, "uuid": "6d975751-7ebd-4b87-afec-43175c5fa291", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762911912, "uuid": "e9a99f23-62ce-4af6-9513-857784e79793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762911912, "uuid": "b924f268-a3b3-4433-aff4-b364c372d45a", "value": "8B284D2C6EE18C04AB9CB3CBD1BB6905.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe1e25c-bfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1762958414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958414, "uuid": "531751d2-2759-492a-8b5f-484534811cc8", "comment": "Malware payload (Amadey)", "value": "cc851d214467277e4622d21ab303beca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958414, "uuid": "62bec63a-8a33-4c78-b5a4-8617742f3538", "comment": "Malware payload (Amadey)", "value": "60298bf861607375b48e7eb097a3a0721ed24e540e8823e06a3c539bb3667124", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958414, "uuid": "bb331e64-4745-4c23-b1e9-652236771616", "comment": "Malware payload (Amadey)", "value": "d427717f223c66c601b7cb33e1d95f7afd2df8c2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958414, "uuid": "5b9dc8ff-7e08-4bd6-a836-0a00ea94b2f3", "comment": "Malware payload (Amadey)", "value": "49a80073ad6a735b2d816175b1211cbf90ec460495292c652b5a11999bb0da5a9a73d89b813ea9d624368c14ef037a54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958414, "uuid": "5e5c6796-4ac6-4f00-b478-763c4c75c4d8", "value": "T130944B217817D032D66191B11FB9FFF285ADA8259B7109DB7BD00E3699202E37A31F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958414, "uuid": "fdd667dd-175b-4bf4-93ce-9989aa506045", "value": "75a7b80b5210b3ca22710e4f9427a4e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958414, "uuid": "afe4c79b-fa00-4c4c-8f10-5188c8ebbcd1", "value": "12288:oEsNCEeacL+uWmloFmOLCdgsP2fq5kx91:o0LOFfC2C50z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958414, "uuid": "4753e321-d043-4874-b8c5-1c6942b4fa65", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958414, "uuid": "766372ee-59b6-40ca-9b7e-fb1d6002b870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958414, "uuid": "ff1d9b9e-d479-4898-8b6a-b42ba7800f76", "value": "2025-11-12cc851d214467277e4622d21ab303becaama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea1be41-bfd2-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762956962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956962, "uuid": "bc68670f-679c-403e-ba63-d3212c79d394", "comment": "Malware payload (AgentTesla)", "value": "9f355be9b95a45fec1763ae21b6597b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956962, "uuid": "1809ef8e-0e54-4c5e-a4aa-9efd9135076b", "comment": "Malware payload (AgentTesla)", "value": "60c380df8415924e3bd08b3238cb8f8eefb21e54d4f68fa6f50b2ff567304201", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956962, "uuid": "e4838680-bf26-4f7f-bff9-397334b0ae78", "comment": "Malware payload (AgentTesla)", "value": "b1bc587c57c257ea5201dc5f1ae90d2864fa0cf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956962, "uuid": "f0216592-5d26-4985-9566-19331bb49012", "comment": "Malware payload (AgentTesla)", "value": "3e84896677e809562a00d35d214316dfc785de4a794e3427d7bc8d4dbc17870fda982af8ba4c12d46f1d3db80f8e3879", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956962, "uuid": "db8638d9-9012-4cc2-be9c-57d02a9e7f35", "value": "T11342C0C8BFD2F2A5537354A32C1B3059A36B6D91F64C5184F23892F4BCA471CD5A7878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956962, "uuid": "4e6dc0bd-ad77-44ba-85c5-7ace8b0f75fa", "value": "192:KCNBCywlbb+cVJsDxsEFonr8djcXbXOJ2qouEUAjC7eIgx7i04:7NBCywlmcvsVsSo8GbXOJ20teIgcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956962, "uuid": "155b3425-e5fb-4682-86f1-557a8e5396c3", "value": 12246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956962, "uuid": "5a157c28-346c-4ecc-bce0-39be363502ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956962, "uuid": "e5e2e608-9b3d-4d0d-af21-0d1a0fac0ec5", "value": "Product_Specs_for_Quote_Nov2025.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dc392e-bfbd-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1762947908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762947908, "uuid": "4a1cd928-a991-4cb5-aef4-541270c98ce3", "comment": "Malware payload (njrat)", "value": "9484e82d6cad8f9f64139926d21ee9eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762947908, "uuid": "c870a819-6ee8-4ff8-afc9-e62123afd114", "comment": "Malware payload (njrat)", "value": "6195d75325aee7b1502702d0bc156c9588b0318b03d6914e362746ba6fee2214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762947908, "uuid": "2bea1c31-630a-4765-97ca-c16d871117fb", "comment": "Malware payload (njrat)", "value": "2bf621922d9ff9a6ffc82ec3bd0535cc2e1aec5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762947908, "uuid": "e2966d4b-c81e-496d-8f27-967b95bda8ca", "comment": "Malware payload (njrat)", "value": "429aae49bb37127be933aed401c3a6b21164ca9b2f918482d76a02b1ce88a4a1b7b98ecea61ab389be1b5863b20e2c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762947908, "uuid": "a4bd3304-2026-4c32-b5a2-08b892221a71", "value": "T1EA24E77BB6488F01DB5129B1C0DB513087E1ADDB6632E74A3F5A326D090237BED497CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762947908, "uuid": "fa8c8092-5ced-425e-a4c1-6d2bb9a880e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762947908, "uuid": "81de2379-f1b2-4b2b-a03c-a685832e90d2", "value": "6144:GNgpLHV+4xxqDgN/vSWN159dKeOQk3goDA:nxxggPwQcgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762947908, "uuid": "a3fb2c9d-8d63-4fdb-b96e-65f50a2c2ddc", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762947908, "uuid": "a47417fe-bf6b-4b2f-8213-6d3b2d6ace8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762947908, "uuid": "7199ce27-d2eb-4fc2-afaf-fb6e4ceb7f16", "value": "freeversion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cd9396-c009-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762980602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980602, "uuid": "4f563aa0-1fb6-4fcc-88fe-cbd7d1c171c2", "comment": "Malware payload", "value": "d8295e51563920cc080d90590616eb47", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980602, "uuid": "53e3bc81-79ad-407f-80b5-8f79ba146b61", "comment": "Malware payload", "value": "6314ccc20bb119f6e9a6e785a445fd4132719651cc793205f14afa7ef2e81841", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980602, "uuid": "ee8f9126-3cd6-4562-bf32-95e5a96aa087", "comment": "Malware payload", "value": "f14388bc2863256ae47fa3edd539d120fd0757bd", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980602, "uuid": "4facfe85-7101-4b20-89a2-37b7298bb684", "comment": "Malware payload", "value": "8f55485efe5791af6b06207685e67a7f5be80f88a8a3916be53092e05659423af162ec4fd391af6c0524b6d7d97bb34e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980602, "uuid": "439162bb-b458-4e98-9764-856ce8490a8f", "value": "T159A63360E780BC5FDF97D873216391894E46D71295B18E5C7A4C4432BBBA98B9E2C333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980602, "uuid": "e9e5beaa-1b5b-47cf-81d8-5dbdb78e4d12", "value": "196608:EYpsUiysF9aNoqrHh7P63rCUT+jW+HEPBRryF6ca+Q:EusU6vaNoaB7POMirPL+F6D+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980602, "uuid": "ea521d8c-cec2-47cb-9579-cf328485ff69", "value": 10389504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980602, "uuid": "43ba203f-0924-439c-ae07-1d80b96db508", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980602, "uuid": "dbd4773f-dbe0-4735-9b3b-2619ecf0f076", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ea3a8-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762940020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940020, "uuid": "2d4ea584-ae48-4c57-8ff3-0fa70910dd76", "comment": "Malware payload", "value": "c2eab4bfb2eb2da3cbedf2fd53e29cc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940020, "uuid": "71b4a94a-e309-4689-a096-4756771dca38", "comment": "Malware payload", "value": "63b51a2c01293b063d5cd464869a68c58d78f00dc527ac99f5fbf8718e7a1985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940020, "uuid": "50d5e864-2230-4577-b9e8-0e553b531007", "comment": "Malware payload", "value": "9717cb0fd6f024547278a9eefe7453711a372915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940020, "uuid": "be294d00-95e7-4185-ae13-b4bcf05eceb4", "comment": "Malware payload", "value": "015b3954750a5cce3b564c772d323f270256d8ed048f41641a423db038d616bf9147232c88709050d2b387cb1690837b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940020, "uuid": "2b4ccec0-6a76-4c46-8df1-1e2cf7057679", "value": "T1D4133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940020, "uuid": "85d66e2f-e8b5-4e71-969f-a39ddcbbe3dc", "value": "768:U40J4bzio9RfQRW0qRGQ8Jt8h/VsBKltn2susfzFuMldW41LFfwn:P0JOC+Qqh/FxjMMlddLGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940020, "uuid": "98887996-0405-4c4a-91a6-e5dd2a8debc9", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940020, "uuid": "e1cdf5bc-2981-4918-bd43-3c37cb95ef8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940020, "uuid": "e45cfd2f-f9f8-4796-9f16-4e3bd6e3aa5f", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f6d8c2-c009-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762980704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980704, "uuid": "15824e59-f4b2-4400-9679-b36f8dc076e4", "comment": "Malware payload", "value": "6b269ac174010e8de84cd62382b8ffc8", "object_relation": "md5", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980704, "uuid": "f08c315d-75bf-4b88-b0eb-c7a26bac7d23", "comment": "Malware payload", "value": "6475fe48fa67212fac4530cc835801fbd2af59f82d6e66e91b6acc7588300cbe", "object_relation": "sha256", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980704, "uuid": "b42b8a7b-f4c1-49fd-9e29-d260d7759c36", "comment": "Malware payload", "value": "d7dc8cd7031dd1b2db0b386ae34cd069ac127c79", "object_relation": "sha1", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980704, "uuid": "c1022a6f-d7d2-4be9-986b-3d232448d45c", "comment": "Malware payload", "value": "4706943ba5235ec1c9037ff2e45e9e742ec5941a8f9217bb258082ccd22f858e455a9f40a4d5dea9b3eb437bd3825c71", "object_relation": "sha3-384", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980704, "uuid": "cedd7861-3679-413a-ab2b-a65116c853c7", "value": "T1CCD633A839925895C63C84B841D77F33E4271C12EBD3C2C87785D286C4B7FAA5BB4C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980704, "uuid": "95578e5b-a27d-4f99-b2db-7c3c47f7e787", "value": "393216:LQwDpHQwDp97WWFRxd9j663XtBjskpXKuT55T5ROA53/j12oe:LQKpHQKpRHx6IVswnbOo523", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980704, "uuid": "172493b1-e8fe-4d16-b3d9-8f184e33a6fe", "value": 13728649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980704, "uuid": "550a73ef-ce9a-4baa-a8e8-17b517666b07", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980704, "uuid": "8d094fa6-c298-4767-9eb1-fe97ffde7ea3", "value": "Setup_1762945382867.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ea9855-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935286, "uuid": "2ee27a0a-09ba-4802-8773-2dc037557835", "comment": "Malware payload", "value": "0e29dda0e221c7d842371d33c7a55578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935286, "uuid": "182b366b-66ee-415a-8088-a4a19e796c35", "comment": "Malware payload", "value": "649111dc3d49e65fdc664e7b59555818846159173015df71bf98f0bc4b5a50c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935286, "uuid": "3a28e624-119c-4cff-807b-3b4553740060", "comment": "Malware payload", "value": "db9362780a6bbcd7ca5f2352f0b677a284a2893a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935286, "uuid": "a936b945-d2d0-4f87-b56d-d91c1056e746", "comment": "Malware payload", "value": "308798ca2de0304460ae184d88a5b754363f7707e4ec909ba981fea6e0f3933c902fa68bd17c286d624d7b2c0bb13a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935286, "uuid": "4f80e089-0c85-4568-ae50-a1c21ee43a5e", "value": "T117461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935286, "uuid": "f0f8e4f1-d5cf-4ea2-bb43-75959b0dffd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935286, "uuid": "f3891366-8dac-454e-89d4-bc09d8237465", "value": "98304:fh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:fh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935286, "uuid": "d896ee20-a6a7-47bc-90c3-e53f4f171c62", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935286, "uuid": "21281073-b74d-4ee6-91b4-893eca556b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935286, "uuid": "a94ddc32-b2cd-4c3c-bacc-64a66ee430fd", "value": "atomicwallet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b094062-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962217, "uuid": "c96ff1df-0509-48cf-b5b1-354ae9343989", "comment": "Malware payload (Mirai)", "value": "da5efa00c1def35bbad48d3e489321eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962217, "uuid": "1dae787c-2658-4db8-94b1-b9c212ac7cb5", "comment": "Malware payload (Mirai)", "value": "659d93171cc95afe39c1b37bd9ba240eba34be8d76d7c3a5661a9154813ac73b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962217, "uuid": "2a926fed-1c45-435a-9eab-a0bc67a17812", "comment": "Malware payload (Mirai)", "value": "071e1bd9e22bb5a7601a90f846ea520cc5d67a3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962217, "uuid": "cd92cbe2-98b7-41be-ae80-765856103021", "comment": "Malware payload (Mirai)", "value": "f2326a127acd9e76b9074d02d52bb943a9f3a09238e5d1b760db68b7cbcb23e6b52fd1d419c9ac5560116cc76daee96f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962217, "uuid": "367c5d20-85af-482f-867d-3ded08706987", "value": "T10F73A80E6E258FADFB5CD73447B78E25968C33922BD1C281E15CEA005E7434E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962217, "uuid": "ce136483-bfee-41c5-9f97-f963cb0b6472", "value": "1536:Lcev5SdILFk7vWg/XBCer4EGH94EG4ggDHOQrKlOiKAW4w5JcO1wxtxl:QevaASD3/X/QtgIkW4IJcO1wDxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962217, "uuid": "38744f71-7864-4fa7-933c-faa18487f6ea", "value": 79840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962217, "uuid": "6e551aab-7b6d-4ef9-b3cf-d8819929caf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962217, "uuid": "193d2596-0744-4c18-8d67-548c1625caaf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73785d0d-bf5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762906853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906853, "uuid": "5b099d58-bf00-4683-85ef-de6e0e519fce", "comment": "Malware payload (Mirai)", "value": "d8050ec173b9eaa91901d380896623ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906853, "uuid": "742bf991-780e-4965-917e-a5f4be2c4240", "comment": "Malware payload (Mirai)", "value": "66399f695954db7bf91e7e52e7e8f1331b4e0fb091610c5b22a4c1172b942531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906853, "uuid": "27df2683-cfd5-4fa2-897a-88936595f812", "comment": "Malware payload (Mirai)", "value": "d50160ee7f3284feca74ed580a3116d073921693", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762906853, "uuid": "826fa8b6-a855-47b8-b8d1-7130d0aa0d6e", "comment": "Malware payload (Mirai)", "value": "6a33c927592663de946bf761db1b9f55c6ed32cfdfa79c3bf8c6cd6c6fe99a3296e93084b4284871b0097375051383cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762906853, "uuid": "f1380cd6-c878-42c7-9f68-8caae40e39eb", "value": "T16AC3AE92D4302C98C2244678B4F5CE795333DC226197ADF122A7CA799847EDDBE2D3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762906853, "uuid": "01feb1ea-4e78-44ec-9b07-d302588ec623", "value": "1536:g/aoKX4+9PzsEd9q2Jhap6P/m8LKcvVz7MhoumCA0V5RZFm2mkU7yiBB:gpKX4+1wohGa//ucRkoumUb4lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762906853, "uuid": "fbf2ba22-4b64-48a9-a43d-bc485b8efa80", "value": 120564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762906853, "uuid": "63444507-c39e-4e36-92c8-3fb47dd9472b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762906853, "uuid": "8a10e1d9-50b8-4559-80ce-8161daabb474", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fdc48d-c008-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762980439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980439, "uuid": "5427adba-337d-4cc9-af8c-b3196267f529", "comment": "Malware payload", "value": "1d4812aef381b0e2baeb1a258e543802", "object_relation": "md5", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980439, "uuid": "1a181a8c-65ee-43c8-aa6c-efa2b66ebaf5", "comment": "Malware payload", "value": "68648fd6bddf0fe80767ab802c411ed53c7df27ceb1374a435bc8cef785ed813", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980439, "uuid": "e5bad61a-8229-46d7-8ac4-11b61e880bfd", "comment": "Malware payload", "value": "d5a92e39c07a06c30edca585896ca66665598383", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980439, "uuid": "591ca2fd-2524-4c57-950f-39bd4d3b8839", "comment": "Malware payload", "value": "6a2c353cb5315f4871ea31ddbec48f071d0ae4b42e607a13e227b0c0e0eda49d1fbb8e2b14af783dc3372599bb1981cd", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-43", "colour": "#66AACC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980439, "uuid": "5e2dc7e3-bdab-4914-88f1-4c79ff28b70e", "value": "T164070233338B8365C236433158D7BB65E27DA9281B3692EB227037DC1F361D14D7A66A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980439, "uuid": "12c96408-0f3d-444f-bf07-6bde249e7d9d", "value": "1dadc648da309cc09eb73480f2812b35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980439, "uuid": "d88a09a4-35bf-402d-aaa6-2d60ace7b7a5", "value": "196608:/3gI98qC1l4DP8N7vCXxkUKf77WDS+9iVl4/Wj+PJZcTgmAwAEZkGWh3q6pQPPZN:/oqC1Kyf77WjIb4/S+xJmiYCpo+86+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980439, "uuid": "bc286704-ed46-4d8d-9db6-568d82818df2", "value": 18434464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980439, "uuid": "773519a2-cc62-4a19-964a-25d09add4dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980439, "uuid": "3e30b8f6-3e11-40c3-ae8b-ed66307e79d0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb34b025-bfb9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762946568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946568, "uuid": "b4774761-e120-4abf-9fca-83e9fde9ed14", "comment": "Malware payload", "value": "dd1e8f2acbf21c497d657e29dc57e2e2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946568, "uuid": "c1f152bf-bd52-4190-bb4f-7cfdc7d8f42d", "comment": "Malware payload", "value": "693e0c43650ae82f3450b6fa293d91eab23614f71e90994390190cec536f1c52", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946568, "uuid": "ed1897c8-429f-4169-b75c-b0833ca7d695", "comment": "Malware payload", "value": "0ba2b9938b35066e6d44bd9cfb0d639b2cc0ef90", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762946568, "uuid": "48bd89a0-d874-41e9-be17-f8918cf1d75c", "comment": "Malware payload", "value": "58674ab7991a3240044d738b230fbd31d01ebc29537f56c1a9580fdade56a0e3a599ac983a49c1ff2d8a16ee06cd67be", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946568, "uuid": "0d62fc6b-3ed6-44d4-ab26-a36d4f8e008c", "value": "T1335602DAF7E8592FC8771072CCAA5272125B4C128A479F576908371C787B6E80F89BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946568, "uuid": "f8db403e-3a91-4b2c-bb66-12a131b7cacd", "value": "98304:bf0RSsvJoUGaiiZqu7DCfAtaIF0robT7usDt0uchNhIjUYm/Kr6y5GbcQ:T0R5miEu7DKRo/7usBbchNhIj55G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762946568, "uuid": "a80da443-dc54-4492-80b6-0bbd70b82ce1", "value": 6465397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762946568, "uuid": "eada0316-39ea-45ff-a717-97d8ae2c832f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762946568, "uuid": "8a11715b-6524-4337-b38d-2a1430339586", "value": "saraeco.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82376bd4-bfa3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762936943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936943, "uuid": "16a5ceef-e079-49a3-8f77-009e7fd4e234", "comment": "Malware payload", "value": "d6d1e1c0f3ef62ce0c01b2ff20ee1665", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936943, "uuid": "16130293-f107-461c-b2e8-f9fc7cd072f3", "comment": "Malware payload", "value": "6aa9741f8b8629d0398049fa91dc5e7c28fd0d63bc76b3fd9be2dc196265263f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936943, "uuid": "2124e803-bc2e-4baf-a12a-d73328092ecf", "comment": "Malware payload", "value": "c45e118e8378a308afe523c7216919ce22630801", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762936943, "uuid": "a59aa4aa-dd43-469e-8948-d327ee966a46", "comment": "Malware payload", "value": "5924e583c847d03ae819c4a09127e3e2f2ec5343edd8a89ebf088f1f1485af2368002ea104a5b230bb511794de443832", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762936943, "uuid": "a04ccf28-f58d-494e-8fba-d11e4c235a6a", "value": "T111412B9E6DBC92C7D242B231CC952B6B3862180255DC15D359D444E6C3E54F9F8202C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762936943, "uuid": "555e3524-7d1c-466a-8172-8ce993732929", "value": "48:ZSCPnnDZAOuRphe62shSLEuKVSQqNlzFwGTTVBAtjPvZUl8cs:ZSwD0Rfe62nFKV2Npy1PvZUlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762936943, "uuid": "ed70d03c-8ebf-4951-b8ca-152a5b0a86f4", "value": 2221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762936943, "uuid": "5ffc6810-45b4-4780-ba73-9a5be7b00747", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762936943, "uuid": "dee5e341-ce9d-4a80-92ad-2a4047dffeeb", "value": "2_1_1_7755_11.11.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fecf1c-bfb8-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762945806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762945806, "uuid": "d106b45f-2140-42d1-ba0e-fce5ad3ac77b", "comment": "Malware payload (RedLineStealer)", "value": "12ea227b6ba8b085826d9d00b9386d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762945806, "uuid": "619cb7bb-2621-462a-a133-fce96078dd71", "comment": "Malware payload (RedLineStealer)", "value": "6bb84eb8bc64f6281154e1be583775ec1c46da9d7167adb87f121251a791acb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762945806, "uuid": "ad60202f-3d9f-4343-8786-914989dda7dd", "comment": "Malware payload (RedLineStealer)", "value": "2274f64bda07a65fee7198d7dc17f433d3a0b23a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762945806, "uuid": "b9c07ab5-519b-45be-821e-bf2f65a457c4", "comment": "Malware payload (RedLineStealer)", "value": "fc4f2dcbc43de47d427db5302d099deb41536557c2436a2fc544e2fee1eef64d21efd4ec9b6a07b0cecd80b1b09915ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762945806, "uuid": "02510888-0663-49e3-8b1b-c2975e6d462d", "value": "T1A7B40245234ECF1BD0A60FF42960D27253B4AE7DA522D2179EE62DDFB475B004A827E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762945806, "uuid": "695df149-90c7-4e42-82d1-007970933efa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762945806, "uuid": "43ce0316-669e-40e8-98c5-e7eab3bdcbe8", "value": "12288:O4fXRX2lC06C0TAurZn4nPEPuxFQqxIf/1P1sQ:hZ/0oT1tn4nMWFvITsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762945806, "uuid": "c8041664-a4e3-4322-9576-b5bb3b5aa0b3", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762945806, "uuid": "51e07b9e-6cde-4cfa-a891-2ecf71f1bd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762945806, "uuid": "61a35bcf-ae13-4f07-a34c-bb1c9477b051", "value": "ORDERLIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231717f6-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991759, "uuid": "3330b7cf-2c59-4974-ba27-3f1b54216e61", "comment": "Malware payload", "value": "b85e8c89f6cd68b5b6cc4b023131189a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991759, "uuid": "c336d9ac-0d0d-44aa-bcf3-9527c82b38af", "comment": "Malware payload", "value": "6e506f968ff88fb4eddbc0b99d3c24627b5b8d64a4d8f72e6003586e40f6b37b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991759, "uuid": "ee148238-d34a-4901-9781-866594c9bb05", "comment": "Malware payload", "value": "dacf649ae0008ee05b0978634411592f727a76ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991759, "uuid": "8805cadf-8c64-42d3-af6c-d002693d7643", "comment": "Malware payload", "value": "a36d499988f3ff873c87b9e8c0e6d240b010dbf993db766b2a095d494878b5e69eedcf852c47d40cb21a41e9bf4a06e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991759, "uuid": "f79e75f3-5d16-4b6a-8be7-6046faf9b59a", "value": "T115836C68F90EAC41D2D7E379FD858BA272273DD4C71AC1727801A34CD8FA9D4CA62917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991759, "uuid": "80759e2e-48cd-481f-bae6-a21b1939f501", "value": "1536:lnS3VY8Pnc0YUsvn6Lg5hfFzR+fVIPVUH6OEDERiatoeFKaukkJIripN:lSY0Ywg/fFENIcD84iat1FKQipN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991759, "uuid": "b416886c-7483-473b-b02c-9deff02eef46", "value": 87720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991759, "uuid": "4bfd7b11-0404-4a60-baa7-f7346b91b56c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991759, "uuid": "b1a1a2f6-33a3-4b07-bf38-ac6868ea5a94", "value": "frost.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b27134-bfb5-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762944701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944701, "uuid": "bfbf441e-50b6-43a0-9068-edfbaac4546e", "comment": "Malware payload (PureLogsStealer)", "value": "d6e7a65a344935376eb8aadc3a294deb", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944701, "uuid": "c37501a4-59bd-44c0-be7a-109d80bd6648", "comment": "Malware payload (PureLogsStealer)", "value": "70239684f01e37692087c05f6f355daae3bdcdbc4bfa2fcb786dbf8ddf1d2966", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944701, "uuid": "8e13c54f-96a7-4dec-b63b-e3ea5deeeb63", "comment": "Malware payload (PureLogsStealer)", "value": "e31091cb9d9e52aa2be5ef1aea8f141f604d68cc", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944701, "uuid": "a84b7639-1238-47d4-a06a-a9d1ad943717", "comment": "Malware payload (PureLogsStealer)", "value": "e93f3082316ebf7803fb95a8304383c9d66c836a27371918daa47ad886a0de5d1df867b6331be68723f76bdb74a49bad", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762944701, "uuid": "0fa8f507-beec-4c4d-8ce3-b0271c0e0603", "value": "T1DBD423CDEC215C16FD4723BC7F4229A8AD24A96F25FF392828E16464ED554336B14C8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762944701, "uuid": "bb0d871b-7321-4aa8-8e06-4c5ba18648f5", "value": "12288:bUrToXufXsMTq6wAcJmTfoEvFOdsOXen8Au8/JLbNQMD+w6H1SlEk:eUXuf5q6wAcJwf5vFb8A3MMD+w6VOEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762944701, "uuid": "de4f4e05-157b-4009-9411-bb3a8c3fae84", "value": 638562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762944701, "uuid": "9bd6c067-8959-498c-b540-f13583c27102", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762944701, "uuid": "5fb7e5a3-75fb-4360-8c5a-19b863598ad0", "value": "aaa.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd240815-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762981387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981387, "uuid": "5080b8b7-e741-4c79-8710-823b580fefde", "comment": "Malware payload (Mirai)", "value": "2fd55854392fa8d90f0c50c117a40990", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981387, "uuid": "0e3518aa-04ca-4256-b955-6fd33831c3ef", "comment": "Malware payload (Mirai)", "value": "703df7a9df7c58c7437ecd6f7cfeed8033aaed406b7a9dfeadf14a2c2014eb3a", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981387, "uuid": "cceae6c4-ccfb-4b4d-8885-89ccca5113d3", "comment": "Malware payload (Mirai)", "value": "12d69443df073d5f6012639908277d3ea77e503f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981387, "uuid": "47951260-73f7-4e20-8681-9e2e3ae034d4", "comment": "Malware payload (Mirai)", "value": "222af355df36a84be64a83762c797a0e9f1e64c547bc37c3f74fbd560e9b99cc57dff3e2f9a1dd474e4a91a5602aaaad", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981387, "uuid": "096c14a4-895e-4e81-b3aa-0e76568aaa10", "value": "T18ED47B06EF841FEFC46FCE30852E835B15ED9D9706C1A678A1BC899CBA4D25A0FD3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981387, "uuid": "5adfc33f-5dc5-47ca-ac86-85852a56be1a", "value": "12288:nRxBDkjDjv33X3Xf1Pe6OoaP2F/UdyJKM/+p+U8Bk3fnY9SLJv4bz95P1vWlItw4:hH0LbrVWGr42hSZbxteaI+kv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981387, "uuid": "135f7252-6c84-4452-9e9a-b0344e85251b", "value": 656228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981387, "uuid": "95c3ea29-ed63-4035-909a-b6397e2ad11c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981387, "uuid": "1d83b19e-a9eb-4edf-a026-8aa3ddc72b03", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c2cb7d-bfaf-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762942042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942042, "uuid": "d4874ab3-414f-4181-9efe-76b485d5f6b4", "comment": "Malware payload (CoinMiner)", "value": "60246f2d25be464402db7bf887ed50bf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942042, "uuid": "2e9aacf0-6356-4225-a544-44059eb899f3", "comment": "Malware payload (CoinMiner)", "value": "70743867d27f52612bf1f916ef2eb517029f61dd14b23014d0c7ebbc87755fbd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942042, "uuid": "cde40802-09cb-4fb8-ad89-950503830415", "comment": "Malware payload (CoinMiner)", "value": "a8eefe098d44681fbe0fceaa1d3309499fb7bbb1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942042, "uuid": "eb193d0f-30bf-484a-8b0e-2c3cd0db6583", "comment": "Malware payload (CoinMiner)", "value": "903b354aecb1e44e9062a1444cc4ab595eb4e309336e6c9924b540a5aab3cc0c20e60640e7c8f1f87d45cd38ef44a7ca", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942042, "uuid": "5996fb88-66bd-4ff8-a2b4-b8dde44d3624", "value": "T1A3366B48E793E4F1F25348F0169B96F365300635A057F5F2EB8A6BA1B432341AF493AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942042, "uuid": "6d069817-4019-4662-ae85-bcb401cbb1ff", "value": "98304:CEYZ2UAdKoAx5KPWzZ+y/wajAZqx4nPQIQERlWOo5YVE:CEYZoUoy/TAZqx4PltVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762942042, "uuid": "8633afec-97e7-4e36-91c7-a651ef2d7d3e", "value": 5242024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762942042, "uuid": "209224aa-24eb-4b5e-be9a-414f3c2286b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942042, "uuid": "e7315952-678a-4044-ba34-f10422c96093", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc83678a-bf61-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762908721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908721, "uuid": "aedc275f-3728-4be2-a6ce-c56ea94ae0e7", "comment": "Malware payload (Mirai)", "value": "9ce99c1162a5d56f706e169c800876b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908721, "uuid": "574a896c-6c0b-49a9-a77d-5926a473ee44", "comment": "Malware payload (Mirai)", "value": "70a64a2f61de16f7c53a206ccd45ffd05129d8e176cb69a1972923fbd720a3de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908721, "uuid": "b05a3e5c-7480-47eb-b107-c98549c58ddc", "comment": "Malware payload (Mirai)", "value": "2498ed2e58a39da2b0224c77f819f9ab1c919caf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908721, "uuid": "da06ac22-8019-4208-9c3e-997c306b18d3", "comment": "Malware payload (Mirai)", "value": "0c6b9b8fe62df2f7eddba6830953508502c416270f5782e19d6ec5a0051d832e3dadd3ecc52f0be9874f21941c3b68e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908721, "uuid": "67e48505-126e-4415-82ea-683d4faeaa56", "value": "T155230261B0AEC384D98911360FB77D9D0D51FDBDA13CC190CAC6F07EA8AB7B80516B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908721, "uuid": "100e38a9-ec99-472f-be6a-53764d62318d", "value": "1536:a57/63a86rqZykN/BBkjEKaq/Wpu7V28nouy8Gyi:a5zBy1Z2jHsaNoute", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762908721, "uuid": "5faca7f3-43be-47f3-bf4c-c2757634499c", "value": 49336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762908721, "uuid": "87d9ebb7-dd2d-4443-8bef-18d394673150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908721, "uuid": "5495f43c-bc5e-4fae-a714-2bde8629bbb5", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f7d1a0-bfd1-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762956889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956889, "uuid": "2e322ac5-4caf-4cb8-a66a-23e33fc0eab6", "comment": "Malware payload (PureLogsStealer)", "value": "fbbd33522ccadf97c3b3c3b3be9ac22d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956889, "uuid": "2bccc53e-895b-4c43-a0da-8cd5cedbca14", "comment": "Malware payload (PureLogsStealer)", "value": "70c360b47a33c8f984c6739e6f3d64fdd0cc7138f7eab4ce4aa10df5ffdc5aaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956889, "uuid": "ab845e58-0a90-439d-9a58-470ab6049227", "comment": "Malware payload (PureLogsStealer)", "value": "63fee38e086a4c61439240950b1669c2dcdaf636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956889, "uuid": "5a454177-760a-4091-b4a8-cb65b6a64bd3", "comment": "Malware payload (PureLogsStealer)", "value": "5ec55887f0f33f7bcc75138e8a51e1df6d520c44bedcc1707b7c6c494bf92d3bc7a77a281348323657c4cebad6c93dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956889, "uuid": "1e4a0d8f-4bad-4849-b714-a7daa11706ca", "value": "T1ADC423419A49BD3DCDF40F7DDD9FECC14AB8C9C47C229A5970B6A707192223DDE86848", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956889, "uuid": "1c5b6907-452a-44e0-be8f-5b4da744cda8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956889, "uuid": "5e01f0c6-6fe4-4c50-8fd1-e8b43ed57b46", "value": "12288:jCdsvgxCpx0N42FJ/tFDu9QzsYgHQrttfyW1fOqVtddOS9NZqfti6wHV3klxAsv0:2CIMP0O2FJ69QoYgHQZ4W1fJnaU6wHVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956889, "uuid": "f3689fac-13e2-43e8-a7b3-a59ed65a2579", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956889, "uuid": "bfb9dc47-dce0-458b-a2d4-3c25f56cbf76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956889, "uuid": "6d586554-6427-4412-971b-060cd1b484f9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc0c248-bfc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762951428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951428, "uuid": "afd61b83-9fd4-46f0-8f4c-1c5000c32d39", "comment": "Malware payload", "value": "1ef52f3f83499eb945e630e686c2cd9f", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951428, "uuid": "81b6753f-2e18-46f7-b82f-1a637a6aa921", "comment": "Malware payload", "value": "719b5290e9dad405effdab087b9bf6ecb0c1eff219db16098026ee71c6a6265d", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951428, "uuid": "3eafe45d-de31-4c58-9a7a-0f053701c0b5", "comment": "Malware payload", "value": "c2df59ecf809c08370826a99780658b234f24d76", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951428, "uuid": "b2002be9-b875-4e71-8498-24bd057812b6", "comment": "Malware payload", "value": "59fcde85db248bc9ce30e641bcdef0901a3da11a6826957ce6fbf51641fe3924aaabfab737c6d9776602b97c3bd813e4", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951428, "uuid": "bbdc37b7-2f56-4cf7-9588-c04dd8b18dd5", "value": "T1F7C4014452EBA5A905F5CBFA229B20C5BC4188D103482C7BFF93F6C6D859662F95F3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951428, "uuid": "2306ca57-3856-4725-b976-4d3909d2035e", "value": "12288:QICSYCFB6xeSCaUTg0MOYlNg/OagJXB5m0+EQlQiYj9K2fi7xX9kerG8n:QICSYC76xeSC3pYlKojm0xQ0HK7xXyaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762951428, "uuid": "7f072833-1780-4234-93b6-5bcfa80a4172", "value": 591219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762951428, "uuid": "be6340ea-17fe-4bef-b39a-4f587d009268", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951428, "uuid": "f9cd8858-c05c-400d-ac90-d208eb87602a", "value": "43e86fcf429808de.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095c2136-bfd8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762959503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959503, "uuid": "e6d9e563-f60e-43f8-a99a-97a861fba25b", "comment": "Malware payload", "value": "87bb2ac8301de788684bdd38cad47777", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959503, "uuid": "51779bfd-26d8-4cc1-919d-565474d51a8b", "comment": "Malware payload", "value": "71b906576bc6809759b059d50c843f86d57cfcc44c9b54f07256a7e9b09f472e", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959503, "uuid": "1ea0144c-1b43-456c-aca0-38a37fc3ecad", "comment": "Malware payload", "value": "8add8adcb4c1f1339a69906af0329a1260b666d6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959503, "uuid": "43f37a5c-fd18-497e-831d-7a102543788d", "comment": "Malware payload", "value": "fc6f609cbd136e5ee0ab4d66fe02973d6cdd3e669a9f016f3ffd9f80280f7233ae662129bcaf35e2e75831bd572352bb", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959503, "uuid": "f25ecab1-e38c-4d29-b93e-633e1c28e038", "value": "T10515233B5DD2BE3AD46D92FB19173670B4790F0A9A6A3846A10B37DD1E029AF15010FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959503, "uuid": "3284e78b-3600-4464-9052-c9b293cf0c99", "value": "24576:m2gdrFt10z8ITQNNp7VWRgbd6eA/fRai/VxLB7+u8Bd4q:6xtmz8IcNB6gbdZOEuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959503, "uuid": "478e637f-8aef-40ee-afaa-4070009e4914", "value": 936026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959503, "uuid": "a190da7c-dc4d-48da-b601-d9dca984c48c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959503, "uuid": "5d7effc1-7e68-40d1-8018-b64ab83c64e7", "value": "PURCHASEXORDERXPO-2025-10024.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9610759-bfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1762956336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956336, "uuid": "a8b07804-ec94-48ca-9d9a-6517a7de1d29", "comment": "Malware payload (GuLoader)", "value": "2f5f5601bb408fdad5c867afa2ed32d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956336, "uuid": "2ed47ff7-02d3-4ab4-9ff8-49a7bfbbfc6f", "comment": "Malware payload (GuLoader)", "value": "73ebbbaee3d34dbd005e2af6745c18b905713065b463f2e1f8d06a36dad616c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956336, "uuid": "a3335a07-cda6-421f-9e75-279d8cf78063", "comment": "Malware payload (GuLoader)", "value": "d670f9cc7e0dae98a61089776c92fe9ee1c5436b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956336, "uuid": "66c20266-b6f4-4f35-9970-fc074d34d857", "comment": "Malware payload (GuLoader)", "value": "2a33df917582c95a33c25bfa6da2674adf80a012069c1e88d4609d1246a7e3005ed73a6663755e2cc0080ace706447b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956336, "uuid": "6752232e-2cfd-4362-8b5a-739ab81ebe72", "value": "T13D64F1857629D043E59047304D7B96F20AA4BE737F74921F3318BB8DBFB2382950A766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956336, "uuid": "fba11270-4fd6-489e-9e0a-a64f31a09ced", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956336, "uuid": "7ed8a912-938b-4be6-9e4c-52f68182d72a", "value": "6144:aMm4CCsD3RbmZ9gEwOt+ErFPFphm+mIiiSUTPjWifUeEq3D1j3mxQ:aMwpD3tuhrFP/hmIiiS4PjWifUeEq3Z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956336, "uuid": "fbc30759-e4bc-42a4-8cc1-3e4dd82190f3", "value": 335104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956336, "uuid": "2a76e932-7948-4d51-a162-a44844a6db31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956336, "uuid": "b4d445c6-be58-4625-9401-94b0ef58a180", "value": "Slagordenens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e950eb-bfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762955142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955142, "uuid": "ab54f0b7-299c-4a2c-a39f-f3a195c91c47", "comment": "Malware payload (RemcosRAT)", "value": "fafa79f9adf092f90b9bb19fcd9158db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955142, "uuid": "30ded774-35dc-4ebf-9766-a1041c15ab6a", "comment": "Malware payload (RemcosRAT)", "value": "7440ef0eba8981a16f223b10ccccd80671001258b5fd8e95e43161de32b1157d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955142, "uuid": "8c4b8c04-38db-4408-909b-47c52b4f2b87", "comment": "Malware payload (RemcosRAT)", "value": "3d6e1d5efc673c199cdea0909e6825e8e406f885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955142, "uuid": "6762810e-a401-4663-b839-b6409b158433", "comment": "Malware payload (RemcosRAT)", "value": "59f9a6561822a64d661cf6fabed51d610f4394f7fd61994326afd30769b4876d3c52ff4ff0ceb3b0e4289a5b383871a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955142, "uuid": "792c8970-5cb1-4315-91af-89e670398dc9", "value": "T1A155D02263DD8361C3B26273BA657701BEBF782506A5F56B2FD8093DE920121521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955142, "uuid": "ba49b9ae-001c-472d-ae2f-7a0f5a947477", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955142, "uuid": "ae05c319-f001-49f4-98a4-976fb4ea54a0", "value": "24576:Atb20pkaCqT5TBWgNQ7aFDDqKv8+rS7DL3ZWJCogK6A:JVg5tQ7aFDDdkTkJCoD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762955142, "uuid": "a9cae06f-292b-42ec-82b7-04965abaa80a", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762955142, "uuid": "85aeb4ab-cd97-468c-86bf-0f157f944663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955142, "uuid": "2f2bb335-f4f2-4d2c-8514-a75a2f8ac512", "value": "PURCHASE ORDER-2025-110010_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ce56e0-bff3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762971205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762971205, "uuid": "167a9fce-e1fd-4bb3-abf7-62ab47f3c0dd", "comment": "Malware payload", "value": "b6633551cfd059baafad49ff1f79ca2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762971205, "uuid": "afaef35d-d9c4-4844-aed9-dfc212c78601", "comment": "Malware payload", "value": "7485626e50595dfc04c3550949988e50859534f7749edb1488e0e010ab88a9ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762971205, "uuid": "af10937e-03e2-400e-b115-8d02c651ec02", "comment": "Malware payload", "value": "4590fd9bbd63a858d0d12b4d6768b0f6fe6f7edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762971205, "uuid": "27c62369-9f9c-4277-b18b-3fdf9b170fa6", "comment": "Malware payload", "value": "7e18a228f120ef6a1fd71400f2cb8b26c6ec9727ef0f307e645db339b0800ae4eda90d2a340008e3d49a957479c597c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762971205, "uuid": "e50a4351-88ba-4595-8e5e-262127bcb8f0", "value": "T13B23028623663F72C12158F5E7FCFF85A04A7D94AFE6180E7C227699A47135C28C8D1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762971205, "uuid": "46e822c6-95fb-4335-a503-fc53ec1bfb18", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDm1Xo0Wg35:yYI0ARqw1qAEW67UIWi7M8gmfmJo0Wgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762971205, "uuid": "ddfa8522-8405-42dd-88f6-d2ca3e294867", "value": 48620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762971205, "uuid": "00b72d53-a0d1-42da-a4dc-5b6209e64366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762971205, "uuid": "da6df794-55be-48e4-94a5-7595e9ed393c", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1741662a-bf7c-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762920013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762920013, "uuid": "3c04a569-7d8e-4280-8607-20481b0e8c0b", "comment": "Malware payload (RedLineStealer)", "value": "14d0222e1c5064962de11b3b50117294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762920013, "uuid": "4346ea3f-a1cb-43c0-9bb6-6e8904bcd4c3", "comment": "Malware payload (RedLineStealer)", "value": "74b6eedc5edf1546746d892eedc443d92ca67679a340088bebcba9abe5da3988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762920013, "uuid": "cf03d62a-2054-4ced-bfee-b5ae4dd6a6ac", "comment": "Malware payload (RedLineStealer)", "value": "98cc9b19b77914ff46448cdb715f234c7b0c3229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762920013, "uuid": "c9626b91-0001-4f12-aaaa-6842e3d68f70", "comment": "Malware payload (RedLineStealer)", "value": "2d94c3f9563939f58551ed649a66f037607cb88ca21424aa396f1c6b805854dd4fc370a6f052cd549ff73c1b9f1f7227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762920013, "uuid": "299b30c3-5cda-4dd0-9615-d691401a0ba4", "value": "T1BD45DF1373DE8361C7B25273BA597701AEBF7C2506B5F86B2FD8093DA920121521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762920013, "uuid": "1fa67011-aa34-4793-835b-3910d9bdd6b7", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762920013, "uuid": "d80c7beb-b9fc-485e-aab0-8c3d5e76c106", "value": "24576:ytb20pkaCqT5TBWgNQ7agwUfo+eq1Kdoe4Urhxb6A:/Vg5tQ7ag1Q+7pUrhd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762920013, "uuid": "8418e88b-e6f8-47e2-91e2-4c48e4b35ce4", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762920013, "uuid": "d45b4a0a-4d5d-44a4-8057-e4df6eb7af6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762920013, "uuid": "26f1f9db-ed3c-4f44-a761-136ae147adfe", "value": "296100753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e76af04-bf88-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762925179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925179, "uuid": "1c6957de-c41c-4a3b-92d1-c59664a6ffcc", "comment": "Malware payload (CoinMiner)", "value": "116fcc8834dfef77c65a27131c164b3e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925179, "uuid": "1dba0d50-ef4b-4314-a9d6-469d8cf5bd77", "comment": "Malware payload (CoinMiner)", "value": "74e6c68803b8f7b464076fa1df097c1e29a43b92e408d00cba065977f3fce78d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925179, "uuid": "73c5147a-f83f-4100-a803-092c0e129822", "comment": "Malware payload (CoinMiner)", "value": "daba000e14c362b8a544cd709cd1730af3027107", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925179, "uuid": "b0dc7531-a082-4f4c-a2de-af1f1ca0957c", "comment": "Malware payload (CoinMiner)", "value": "cfcbb41070f2198d06684ec4a5c61cc928c6d3cfdc9838245ce7056b3352ce8c5415aa57b944d2fe0354940d35917d46", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762925179, "uuid": "05bd1a63-916d-48e7-86fd-5ef7315c42cc", "value": "T121065C82FC419F56C5D42A7AF76E8388735307BAC2DA70069D145B3477DF89A0F3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762925179, "uuid": "a720e428-0cc3-42bd-b6f8-3d140f09b819", "value": "49152:/4hkInB4znTYGCjYu1dBrZFFOazVwEeSvLitHrpRht7+TsvJT:/4hkJJuf1ZFrKCK7ht7+T4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762925179, "uuid": "247826ad-2943-411e-8c37-0a303945f30a", "value": 3834100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762925179, "uuid": "1319fba2-4f1a-4b2b-8eba-6b02cb41689e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762925179, "uuid": "2d693587-681b-4877-895c-1a3b85a32bc3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7967de-c012-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1762984800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984800, "uuid": "6e01f860-cbcc-4f5f-a554-3dc164694ef4", "comment": "Malware payload (GoToResolve)", "value": "b7104fd03cc4576233332769b5077415", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984800, "uuid": "2c11df96-8baa-4b0f-8d51-1143e8dfca13", "comment": "Malware payload (GoToResolve)", "value": "760170a5b60bb6e3e5e058df86ff9335b58caf283bae6c1a7cd5e11105b216a2", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984800, "uuid": "2e7ab94f-be48-4ada-8ff2-117b02bc6c42", "comment": "Malware payload (GoToResolve)", "value": "7f3be0941211c52ddafd34549cfa83606327b9e0", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984800, "uuid": "a05271e3-aea9-4313-b871-914c4b4afd06", "comment": "Malware payload (GoToResolve)", "value": "030f3b49043131fc5d5c34231e17edf07e297652cc446dcd18e8e7c576707bf7d46fd6f5ff4e7f69afa6417ce824f125", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984800, "uuid": "dfa5493f-7682-4310-8e4a-1da7d9092bf5", "value": "T15537333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984800, "uuid": "3c715f30-1742-4170-9258-cffbf343d728", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762984800, "uuid": "94d6d08d-50c5-48e1-b249-d47809edd57e", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762984800, "uuid": "e39a7caa-4102-490e-8408-0f205c562d63", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984800, "uuid": "d370f28c-ab5c-470b-94f5-96d42d5ab428", "value": "AdobeAcrobat.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381f918f-bfc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762951421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951421, "uuid": "e3af06eb-8347-4b5b-9168-c12f04b9df5b", "comment": "Malware payload", "value": "e1ed18dcb3803f8d24aeaaf703966719", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951421, "uuid": "b9e23814-3ab4-4642-8d1c-feb15dd48623", "comment": "Malware payload", "value": "766668c2169db33c4ed5a406ce06c6705750636fb94f499aab679b4b535f48ac", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951421, "uuid": "2ba9e5fc-9d2f-4c39-8754-b880e0de58cd", "comment": "Malware payload", "value": "3ce6589eb9d2f89482210f6833f917be0ff97a2a", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951421, "uuid": "973c143b-88b5-4801-928d-1f85f6fcd758", "comment": "Malware payload", "value": "3d75fbf5e11c55eea55f7be2d58e9722c32794ea61c9de482c18134f4e5dadfb30a7cf9b4032c44fcec2a32acf4cce14", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951421, "uuid": "9776b699-43b4-4de2-ac67-ad8f59833bb6", "value": "T187D4E18655CA767942D9D3FE393B628EAF8F4D4101462CA2AD92FFC3D80078325935DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951421, "uuid": "353776b9-6bb4-4c91-afab-f252f4766d5e", "value": "12288:rb3FohuEPCd2DoaE0nGdshQcrxmuuhUNhbRu7goSazZq4JU:7aE0muQcVmu7hFuI54JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762951421, "uuid": "b8bd4d65-5df1-4991-9c41-0774ac77c354", "value": 615301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762951421, "uuid": "41499a94-7727-4deb-9665-e4fbc5a086cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951421, "uuid": "2319bfc3-f72e-42da-bbac-9e1218c6b79d", "value": "cf37c7887e5c7087.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d82344-bf63-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1762909307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909307, "uuid": "6de5de3c-488e-4188-873e-166bcf3f37d9", "comment": "Malware payload (Ngioweb)", "value": "b4f5b7e20a094837b742fa0e7f0ebce7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909307, "uuid": "4ad56ea2-baaa-494f-aad5-c6b0ff7210ed", "comment": "Malware payload (Ngioweb)", "value": "76e670a4333b77d5f69f0a51440618974bfb545309d57d00e6ca847e85631c86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909307, "uuid": "0b91069f-eb6e-4e2c-be0b-dded78a1bec8", "comment": "Malware payload (Ngioweb)", "value": "fe09dd5e3abf9245d530308be8e69988b7f3f6e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762909307, "uuid": "f4c18a6b-76c7-484b-b91f-1608911a5ce4", "comment": "Malware payload (Ngioweb)", "value": "82117be2908154bb309a6b38d590714f4029bbe98c369cad33f37b75bf316ca6f571754944d449d6eadca17740f149a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909307, "uuid": "aefc24a9-7c2c-4bd5-a00a-29f2851180d9", "value": "T132830955F880CA62C2E565BAFA5D428C33231B78D3DE7206DD14AB353BFB9560F36842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909307, "uuid": "4ea5191e-4fd7-4847-87d9-0476bbe48a48", "value": "1536:UiSRlJXWziCe/vpPX6ujLnBSb+0jObH+NIvzqQzijGlaySOD9721Ir:Uicwi5FTrbHiOq3J6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762909307, "uuid": "822b9b83-d0aa-481a-b49b-59d46d8bd5b0", "value": 83200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762909307, "uuid": "aabb0178-6e99-4fa2-b83e-8d9405a10e8c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762909307, "uuid": "245d8f0b-0ca5-48aa-a33b-50d256ac0ff1", "value": "frost.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a27eb81-bfb5-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762944526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944526, "uuid": "592243cd-9831-4b01-8748-28a5e0b1dfb2", "comment": "Malware payload (RemcosRAT)", "value": "aa27d552df840ef01370fbb560345dbc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944526, "uuid": "b647fcc8-113e-4b06-93af-f21e04d8460b", "comment": "Malware payload (RemcosRAT)", "value": "7b4c1da60a8b2fea779775ac3abbf39dc6badc8adc70390fddc37fbf8ddb1eb4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944526, "uuid": "904e1bd2-8303-4a10-8ace-7baf8986bfcc", "comment": "Malware payload (RemcosRAT)", "value": "dff34050e5d655c028f339ff921201473298010c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762944526, "uuid": "546ad0cd-14b7-4d66-bd2e-33310555e6df", "comment": "Malware payload (RemcosRAT)", "value": "2c832aad57f4a2689b3a2308325f4406710698f6f8c735cab82bf5fa8b1a85761a034f04535779de249ce1556cb399c4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762944526, "uuid": "79c29b2a-5dc4-4d37-8942-878181ca6c87", "value": "T1E07328B1DE3516460D0A379EFD884A52CDBC854E513660B0BDCA1359500BA7FA3FEE3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762944526, "uuid": "dfd82b92-4847-470b-a837-5664cb8fdaa3", "value": "1536:5cdIz14BFukziKjIu4g/us1gGYRTFNPvmldhWoxfKjS3AU:2aeBkkOKw8gn/NPvmlvpKjSQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762944526, "uuid": "a05e5f3c-9b8b-4c47-a24d-ab6b542f19d0", "value": 75471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762944526, "uuid": "f7096bd6-c602-48b7-a683-7cc2232e3936", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762944526, "uuid": "f96e09e6-0e35-4a00-b70d-5dfc8b65f93a", "value": "Dokument_PL6746657837588353756757355Hallucineredes.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40c5d8f-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940033, "uuid": "7acb05a0-a755-4dd2-9e07-3dd1413aa72b", "comment": "Malware payload (Mirai)", "value": "1a29a7fb69692e8bb16358891a25dc5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940033, "uuid": "8da8a9c0-d010-46ca-8220-a51b546494c4", "comment": "Malware payload (Mirai)", "value": "7d0879badffa9f4ad657e0e75d89b628f8a276e8cff931d8f4c83f4b89339f7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940033, "uuid": "f5b01b25-e55c-4e78-8af5-411faaf69182", "comment": "Malware payload (Mirai)", "value": "9358fe08ba66aee7e2876492e1d84f82571528ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940033, "uuid": "7b24d4f3-0fbb-46c4-a9ba-57ef0c7f16d9", "comment": "Malware payload (Mirai)", "value": "1f2189e37bd6f1f893652edb6d44fa65d7e93cdae1dbd24ae5e5d54c0013bb5ec6563280fdb545dfd87d04081037b644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940033, "uuid": "74fe1160-99d2-4abd-b1e7-7e5bd48f9bb3", "value": "T18E92E1F8488FA90DD8CE02359738E05FB9B04D608FAE4B8619D7CB5A7302995751D879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940033, "uuid": "6af574c7-50b0-42af-9da1-c67083886ab1", "value": "384:MwqNSJI38F0wJLo2pcUUaVwglw07Gi9FvHua2GSxmyLi4+v1RT:UNSJMaLF5zlw06i94a27RL8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940033, "uuid": "19110ccc-86d0-47b8-a3a7-6b509eb20b2c", "value": 20084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940033, "uuid": "8f8037b2-64e7-4549-bd9b-7231d72d5925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940033, "uuid": "07f57bfc-4c6e-41d2-9f13-7339e90127c0", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482705af-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991821, "uuid": "ac0684be-4244-4ff0-8131-500c73de8aa7", "comment": "Malware payload", "value": "b789f4b0835a7ff9d94acd7c6243344f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991821, "uuid": "3d63668f-7433-4f28-9643-46ac1fa951ac", "comment": "Malware payload", "value": "7e7b6974e650aa30dbc3e3c399ea9f2aeba9c3ede0fa65b4ca12589b95dd8912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991821, "uuid": "2745cb6a-cf5c-4e59-a894-e64d57359f0a", "comment": "Malware payload", "value": "5ace5578f776842e8cf2905bb4d7285cab3b9de8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991821, "uuid": "97cd2fcf-0668-4035-ad85-d3b761e9cb21", "comment": "Malware payload", "value": "f34faeb8a4b6071a3bda830e7ba14824fb423eba1e599b5eab4642b86bfa104f10e90717702e145bffe1b110162ca87b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991821, "uuid": "70c44a83-ffd5-41d8-94a8-edf239c18b7b", "value": "T120C3F7567710DFB2C26DC53049B3C3965BF926E22AD28445B22CDE0C6E7134E692FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991821, "uuid": "0e04b703-1014-409f-a22a-5b7ef0066832", "value": "3072:mjsNd2ucPWGPUuXhcWQMtH95UhG1fszTAmnptj+L:6eAMFThG1fsguppc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991821, "uuid": "942c1895-d99c-4188-9dfd-8d9d5cfc554f", "value": 124992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991821, "uuid": "be20fd30-df20-4b69-afd9-06f6fab37067", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991821, "uuid": "e5b3b80b-3062-4955-b0d3-4a45c31219e2", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1f5f7d-bfbf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762949014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949014, "uuid": "08f7334f-5540-4ba8-823d-b4eb9c2f60ae", "comment": "Malware payload", "value": "b35e1c95359f1993829d69f1aedbcb50", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949014, "uuid": "44af0918-522b-4a14-b9e3-74ff9ebab0b2", "comment": "Malware payload", "value": "812f63098324f9555a7cc08f5e3868d47ef3e14a7b981dd7f86900bb85f49d31", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949014, "uuid": "9c9adb64-3fa4-4e74-ae9b-58cd77bf0e29", "comment": "Malware payload", "value": "dc351f279673ca5da6553a1a49c2ff04f01c479d", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949014, "uuid": "5164eaad-1d65-4ffe-8bcd-4d10b2a52273", "comment": "Malware payload", "value": "55561c3cfc287a6c8a21c0f118e28c6926e7991ed3b10fa42862fa2d6ac6172cf9e2718086e4b84e5ff0c9ab56b9da1e", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949014, "uuid": "6f0baa09-9a67-459d-933d-f59f73789d10", "value": "T1C2526D715F355A1AD10D0E399B6A55AA790CBCC0D890604B3299E73E2D7AF0CCF20DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949014, "uuid": "0c25d078-7c5b-4bef-9365-428cbc049910", "value": "192:VwCZLKqbnBqRBpaMI5v5wLBB5wduMDPN+:VwSBqEM6xweFPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762949014, "uuid": "1da3bad6-9759-4217-ab8f-0dd809a48687", "value": 14139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762949014, "uuid": "8cb5f2d0-3dbd-4032-9cde-97157d43d4bf", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949014, "uuid": "d7549b04-0c5b-4e82-9e52-ffa6dc1ce0c2", "value": "wallet.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74a8ff0-bf61-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762908739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908739, "uuid": "8402f2d4-e8f2-4844-b52f-aa279b2ce371", "comment": "Malware payload (Mirai)", "value": "490801d34bf9f4285265c3d1c61ed20c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908739, "uuid": "1bd18b72-e855-4d3b-b655-a951a3c8a979", "comment": "Malware payload (Mirai)", "value": "822caa39d723e13f056f361899411a853091b002f8126c8d1f5f4c444492530c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908739, "uuid": "053d17fc-fc78-4fbb-b732-13e443494db2", "comment": "Malware payload (Mirai)", "value": "00c6f4a644e7af05cbf72ee9dd629c161754f8ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908739, "uuid": "69b92d07-7073-4749-975d-53527432f428", "comment": "Malware payload (Mirai)", "value": "c63feeb1277de22ec3f4f7f1d56bd04e18329450a0f63ff9bb67c7ed6ceb7d464249023ab72fe30265bd994e33e131d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908739, "uuid": "ee9b8721-df25-42cb-9dd6-876f97a854c8", "value": "T1BDC3498DE743E1FADC0A05B110B7AF36D9B6D63A312AD9C2D3A8DF35E812501C917A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908739, "uuid": "a150001f-13d1-4be4-a838-b9d8665a70c2", "value": "1536:oeOiybu4FJRuDUwONgHIyqBcYfvYgcc50Dx9wpd0ciE4kU7yMND4:tyVFEO6oyScOgvUE07pyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762908739, "uuid": "b0053918-c39a-40df-9f18-6b28f98781d9", "value": 118896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762908739, "uuid": "834559d4-fc53-4032-897a-7474892c219f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908739, "uuid": "8f1b0411-3c23-4022-a00e-d3941ef851ad", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d7f1c6-bf8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927238, "uuid": "6e42dcec-c18a-4efa-a548-155cde6a2693", "comment": "Malware payload (Mirai)", "value": "781c12ba47a2fcd125e61dc303b79d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927238, "uuid": "aaedae51-94fa-4d4e-8da5-4cd9fdc00831", "comment": "Malware payload (Mirai)", "value": "82fc91467ae3118635d5baf0c4a1b8e2985f81aff6f14dc104ff437a159e0869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927238, "uuid": "8c5ba205-434c-45c9-99b3-6014183d5324", "comment": "Malware payload (Mirai)", "value": "38d865b37b1169d12a09e31453e25bf4d2682a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927238, "uuid": "783e59dd-d125-41ef-a17d-3ceb4426823d", "comment": "Malware payload (Mirai)", "value": "7af1d4b98e5657f9b1be891ac7f7a241f04713007fd1225d71ae3d324090f459c42e744cec0e221cf89423186695d636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927238, "uuid": "956000c9-a449-4a23-a56a-35f114af36c7", "value": "T1E46302CF6EB02F26D0DCA1B5703855E6DC39DD8AE783869C97E1A756073943250C871A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927238, "uuid": "235e7f6a-b148-4254-a8be-35c61c962091", "value": "1536:zaxZLmYKVDNSl2y08yumeJyGYVmIMGpCvzNy:zaxZLmYKX+t08jmeJhYTyzNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927238, "uuid": "5f911ae8-96f3-4fc4-bcd1-6c4099499e98", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927238, "uuid": "aa868920-3eac-400d-beb6-c05968bbe9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927238, "uuid": "ef20f2d2-241b-48cf-a0ed-4dc5ed8a145c", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a347cac2-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940005, "uuid": "17f41822-c6a5-4883-9c1f-b46dc831b9a3", "comment": "Malware payload (Mirai)", "value": "da9af63c08aef8e04f82794f0eecfb90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940005, "uuid": "03a1e7d3-eea8-47aa-baa6-2b2c36e44084", "comment": "Malware payload (Mirai)", "value": "844c5199fb59a1c24d2ec3d4db4b85666a7e23ef20b52240ad7253a44d4c59bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940005, "uuid": "216cbe9f-b413-47eb-a202-eed2d9f1c7db", "comment": "Malware payload (Mirai)", "value": "eca45176011e6c2798d7a57959ed9236f2a34f03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940005, "uuid": "900f4246-f713-44e0-a155-853c70c6827d", "comment": "Malware payload (Mirai)", "value": "594758e0e01af782815cb62e9e43224c3e120487c87b77fdc3958f969c5d77d68cb30599f01125b1e5a8af9d2209e942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940005, "uuid": "0dacabfc-a961-468f-aa29-484f0854d11b", "value": "T19143861E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940005, "uuid": "6998a656-b5f8-4b2a-b084-723c657f3eb4", "value": "768:bvaLxUxyQpPT5rhmurrFtSmSnoh2Lt3ug+31IZi0e4fyMnup//dujgtywVz:bvJFP1PtkF+31t0lk16gtLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940005, "uuid": "185d1a35-aa20-49c5-bf02-e51c49a7dbe5", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940005, "uuid": "14a2e137-7786-4d70-8654-354b7bf1947e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940005, "uuid": "0defd285-044f-4b5b-ba23-fc2bc6cb18d0", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251b43af-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991762, "uuid": "90d50f79-5171-4a1b-a5e8-82530dd5c856", "comment": "Malware payload", "value": "dfeeb5ffea40b51d6d865eb2efb9a92d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991762, "uuid": "b5406993-6692-495a-ad7e-2ee716ac6914", "comment": "Malware payload", "value": "84f4fd11e3eb8e4202daebe02e1e45f132a8081df97d6ec853fcebe8d1b47c5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991762, "uuid": "2ea9ab42-1c26-4e0c-8019-18d41cb0454b", "comment": "Malware payload", "value": "1babc7af325bb5988293edaae133ee75a81b74ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991762, "uuid": "ca319047-ee50-413d-ba4a-fb406d931dc9", "comment": "Malware payload", "value": "33f9186aed0765efbf73af4decbf438c2ed58b6a7b9dbf49fae44285e83946a2c8a9442a291a518abaab12df7cd20c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991762, "uuid": "7fc464b7-e160-4574-9926-de76dfbe784e", "value": "T13B83F955F880CA61C2E165BAFA5D528C73230B78D3DE72029D24AB343BFB9560F37946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991762, "uuid": "23667d4f-19d6-49e4-a5f6-61ae6ea8eea2", "value": "1536:zVddUbVkpOiJGpC+I47CTJn3ODTYDLtPwZyjBTEiJOd9vx1Ir:zWb2oieI4vDTOpwc3EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991762, "uuid": "b5b535fd-f50f-4dec-b2d9-0310b08dcdef", "value": 83216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991762, "uuid": "f9cbece3-085c-49e0-bdc0-527dfe0a571a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991762, "uuid": "24eb7a5e-71ba-4ac5-acb7-fd87ca6edd4d", "value": "frost.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfa55dd-bfcd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762955189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955189, "uuid": "fbdc5e90-0991-421f-9997-b8fcf7d50f0f", "comment": "Malware payload", "value": "56c3cacb0fce3eacbae496ff257b5b81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955189, "uuid": "5f9dab79-b790-4e2d-ae2e-a6f28194aa9d", "comment": "Malware payload", "value": "85d16b6c1be9c3b905c2076713cc9b2a469ef1edaa79897e0da52f676c84121b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955189, "uuid": "c40be41d-9668-4dc8-9529-bce203027a63", "comment": "Malware payload", "value": "59095a6adb8fe9a7ad8696d2da02baf7c68bfb1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955189, "uuid": "e5d6c966-114a-45fb-b9a5-1e0b66f7bc09", "comment": "Malware payload", "value": "2936d18a7bf3d60b9dfe9a09b49b63ccd802cf2760aa42506504ad60187eb662e8c0dc723ee28e4bf77d5542376a6af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955189, "uuid": "ca62541c-d785-4686-81a9-220e87f353e4", "value": "T103152268622ADE0BC4470FB68A90D2B173BC8FDCF152C51A1EE87CCF7636B064596395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955189, "uuid": "23a7c100-8ac8-4e9f-bc8a-a673e5d4284d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955189, "uuid": "4205e949-4638-4651-ad78-4e985b38dcc7", "value": "24576:FLDbTsfOXHk/6nuzcQhkgnZ5QcI0pK+yo2Mg:FDPWnSnMagnZ5QAioJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762955189, "uuid": "0622bf1f-b9ba-4b44-ae3c-56b8b4daec94", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762955189, "uuid": "2de0a16b-019d-422c-89f9-25f22c384d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955189, "uuid": "069724dc-e242-44e2-af15-0db128fd15df", "value": "Outstanding Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bfd9aa-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935281, "uuid": "3ad9616f-60ec-4f34-ab66-d6f38a487e9f", "comment": "Malware payload", "value": "a8b53722ce46378fa730f23899c52aef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935281, "uuid": "d10b266a-aa5f-44b8-acc4-c8993892069a", "comment": "Malware payload", "value": "867be8a83a12a1524a59969b6533c7a99d37ef936b2fd17d9e7a93f0180d8ddf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935281, "uuid": "5b090c75-0dc7-47d2-ae45-3d16479b8a96", "comment": "Malware payload", "value": "35325f0ba41efcf649a7bbd70e958ada5756175d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935281, "uuid": "1c0b6203-a509-460c-8391-81f30cfb2883", "comment": "Malware payload", "value": "d1ead9b199184708f2eeef96652015adb4cc61cdd130c4f2e3f0fd0d479e332a4a57a13a06d9bfea2561516cb827c26f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935281, "uuid": "1c75a2da-7a4e-40c3-8752-5cf7a989c208", "value": "T1B6572287F389182AD6F612F740BA563416475C3547C3AB8B2E90753C5DB3AE03E68DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935281, "uuid": "12668dbd-c9ba-4b26-b753-e061cf69c544", "value": "393216:Ra2O9cr2nf1dxRHfXkSKhk+G9wjkDV+jYpK4rwmaqUQ1FvGOmw3gM0uAyXEzS4if:YI29tH/k+Hww/plkmUQLv+Mey0mf2wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935281, "uuid": "98a793ba-6000-4cf3-b8a8-82a08b01792a", "value": 27949626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935281, "uuid": "74bbeb19-7217-48dd-80df-f66a8a3a5e2b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935281, "uuid": "d85413e4-ab66-4c0d-ba1a-78318f102e14", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7948e5-bf97-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762931591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931591, "uuid": "6f50858e-475c-41ee-9424-a4c185af4bf3", "comment": "Malware payload (RemcosRAT)", "value": "610e8f414e5a67fe8c31314864a053a8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931591, "uuid": "6a77a377-bddd-4a81-998d-c0a9a8d1ca51", "comment": "Malware payload (RemcosRAT)", "value": "86dd646accdaa0176fa86dc74d8fae695d3e4cd6d317b433130ebabd0050a5ed", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931591, "uuid": "4cd1a2fd-0941-4311-a1c5-c7d7febaf02e", "comment": "Malware payload (RemcosRAT)", "value": "75b89b3d1ca601e5e8c5cbac7c0417535008e2da", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931591, "uuid": "e3cf30d4-a33a-4a82-bc32-2e94e609a98f", "comment": "Malware payload (RemcosRAT)", "value": "e71471dff03e073312b1df6908df27dfc8b57ffd599bbb82cc71c7c79d8ffb44c40c6792615b911c16db2215b1110a8e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931591, "uuid": "c2fc49cb-1e41-4549-89b7-039fa3654738", "value": "T1CD03F2D837A7DD4A89848FFD1CF908979052CCB3840DDD54DC4FA3CA5098B483EAB5A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931591, "uuid": "67881125-c0a5-4de1-a434-64cac4fe9923", "value": "768:o54f0ZCMeBs+CYzh/u+yLDMsCGNll5fjCaMeNeytOxea1NPMncn10duzhY:o5WBs+RV/bynDtfsaMTD9Ei10AzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762931591, "uuid": "970984b7-deca-4d43-85a3-19a7015d4689", "value": 39975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762931591, "uuid": "4c61a414-3f3c-484c-a055-46456af55054", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931591, "uuid": "430b7ac3-7076-4c8f-91b0-99e278373925", "value": "Swift bank transfer 89765465678-4656765647.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc628ead-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762981386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981386, "uuid": "5a488abb-e81a-464a-8e3c-2cacd555fc5e", "comment": "Malware payload (Mirai)", "value": "8f6b16d817f0d79d4ddbdccb3f22cd61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981386, "uuid": "c5e6b62e-d332-49d3-bf31-8c901ff1ae8d", "comment": "Malware payload (Mirai)", "value": "897d0d2beeb4c2c13bb9e033091b99ebb17c1b39636201232a9c15586c708194", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981386, "uuid": "0a144dea-d9a4-4415-9288-4659fea8f0cf", "comment": "Malware payload (Mirai)", "value": "2aca2a295303da7ce8a65040837a5d74a7dcf93f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981386, "uuid": "e2c38c0f-f8b6-44f9-995a-8660565937bd", "comment": "Malware payload (Mirai)", "value": "b405b81e47b0ee8d53fd2d4e18f85805ba201b25e89851be7c5990731dbcbb5dc5a17dad086b075b71207b444f602970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981386, "uuid": "951fbe6c-aa3f-4ff5-a6c3-cbd4a593dc2e", "value": "T199F47BC1E6C3C0F2F55340F0115F9FEA1A35A1269057DAFBE6801A67B8B1BE21B4636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981386, "uuid": "dfc4edd9-4c4d-4633-9533-73901b0fb56e", "value": "12288:Y+eeuk60xGLwaZivyhEdh9gjrVfMMKmLOEKI4LNXlOHtoPgyaY66rIVt:keukDxGLFiKhEdhvmLOEr4LNXlONoyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981386, "uuid": "05aeb223-2523-4110-914a-fa01a61467d8", "value": 747200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981386, "uuid": "d00e9eb3-83c5-4c03-be56-eb94a44732cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981386, "uuid": "aa9348ab-17a1-47e5-aa33-7774a5101f62", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb7a2e4-c010-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983834, "uuid": "1ea936a4-ebd5-4b11-b767-54fd03a447b1", "comment": "Malware payload", "value": "2aaee9098bfe9531fa127a9de4cd8915", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983834, "uuid": "053c78cb-d7ed-4a88-8e77-da9595d227c0", "comment": "Malware payload", "value": "8b8a5ac56d6714c66ee2c9827d4349e2efef5df612e7cb34e0c04adf6145fa6b", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983834, "uuid": "7eb0e087-3dd4-42f4-92b8-dcd668131027", "comment": "Malware payload", "value": "0286cd30902c0f40ac279a40c75e28004ca1709a", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983834, "uuid": "fc50ba26-31e2-4fad-bbbb-11905828efa2", "comment": "Malware payload", "value": "969db705b60e98d84538a13442c5356e05cf7de93641145dac57e7cfeeaa6ee54333e15f9169f5e7304c3211fc0cf887", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983834, "uuid": "1360ddd5-1a0e-47a2-8e98-f4e1bb17fd57", "value": "T1A8A5E1728502BCD5EB760E78F88925A04C09BD73778645F8BED445BDA6FE008CE59CB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983834, "uuid": "83000b30-394e-45e1-ae6e-07e23c65de93", "value": "24576:8+EhkjixLXR+bG/f29mFusqa+n0tkR5JoZh73VVPYDlJ0K3x0cG7ePIxrd6JAV39:8UixbItdTrJoFVPMvXGB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983834, "uuid": "b6350d17-666f-4f54-b4ba-edd7b40be777", "value": 2082992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983834, "uuid": "e8257028-a66a-4f78-b109-aa3e334c7a1b", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983834, "uuid": "0b7ba297-526e-48d6-b8ce-c6b8a1d9a4af", "value": "MSI_PRO_with_b64.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15663f51-bfc8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762952652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952652, "uuid": "12ae8970-8000-4a18-9b1e-031c3264aeb8", "comment": "Malware payload", "value": "57469345c0832415c84abfb97e41f0ed", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952652, "uuid": "0b3cbd45-10bd-4703-9e6c-699589a9dde1", "comment": "Malware payload", "value": "8bbc0b45edb265a0ba51d6b017e0bc3b883382e29e70db5a52b11d1ccfeb1458", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952652, "uuid": "a75964b7-078a-4215-b556-458697cf70d4", "comment": "Malware payload", "value": "2fe3f6ff97af1fbc824c1ed59caaceeb54ee08e6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952652, "uuid": "7d76f8b2-f577-4ef1-b3f2-b16814cd4238", "comment": "Malware payload", "value": "6e302ab0234d511a9c181ac64dce7b58bbc65924dda5d6c58c9f31d45b3c6b7697e1c7d8e8e6e313031758f7a462af01", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952652, "uuid": "3634f149-6008-4d51-8204-4b7c9912c2ec", "value": "T1C321D777E8A7104CFB8B8339A579E63B216AC7725C7097E174E66520A8B193E400E225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952652, "uuid": "f886d7d3-935b-40b2-a566-2d5925ea5724", "value": "24:KAxETDFNIBsozQy0Opb4FiCotQHV3Z5lxEd7Rwb:KAuHFaBsok9FytQVrlxEd78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762952652, "uuid": "fc3f77a0-d3fd-4895-bf23-41ce698320b5", "value": 1217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762952652, "uuid": "da59df65-c195-436e-ab74-2f679291c62c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952652, "uuid": "b0ce72e4-adb2-4eda-8985-eb6cb88fc777", "value": "CC Development Document.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb8e940-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762959378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959378, "uuid": "5c11d970-344c-4c25-ab31-327d87cab604", "comment": "Malware payload (AgentTesla)", "value": "88a11e48d18f76d1ac77e15379cbd0c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959378, "uuid": "fc255b1f-132a-4632-8568-0bf448fbe36b", "comment": "Malware payload (AgentTesla)", "value": "8c7e252439f26d58ff9c7b8920ec4d38c72329cdeb140fd83dfc6f1a5a8dff9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959378, "uuid": "e89facfe-fed4-4e53-b740-f30add879c15", "comment": "Malware payload (AgentTesla)", "value": "eec656b052a1a3e1b854cff22608063c051d2d76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959378, "uuid": "966e36d6-bf27-49f0-80bd-1a57d1d281fa", "comment": "Malware payload (AgentTesla)", "value": "6ec8e0e4d26092553f0064870071fcbd23b9ccdabaa50c51846c6e97f320a56e6b2db3b741a5548893b61b2babf9657a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959378, "uuid": "3a88f117-7ff8-4424-923c-93cceb422988", "value": "T11245F2108DD86FB9CFEC4A1850FE161EE3E05B8F5517258AFB27BD4AAFB7644020B194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959378, "uuid": "132cf0c9-75ed-4434-b88d-9a8f623c26cf", "value": "24576:D4M7gqWpxY5n2Y2PqB8H2X2X0fCEXkTlO74p98mM+h:pgbZfq9GOkJO74VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959378, "uuid": "3413243a-22c1-4ecc-a18d-eb05856889ee", "value": 1265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959378, "uuid": "5b237746-24cf-4406-a744-5f8a41a864bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959378, "uuid": "ef5c9254-7ea2-4923-8a42-157c41d41d47", "value": "disposizione di bonifico.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e1ab5c-bfc8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762952866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952866, "uuid": "33859bcc-be3a-4d3f-8650-b65cf755ed83", "comment": "Malware payload", "value": "139ac6048efec70e779ed5eb657dd462", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952866, "uuid": "399dabae-a985-473d-89b4-f62d0d1240fe", "comment": "Malware payload", "value": "8c8b5795b454569c511f4a99c52e0e375ba24191f338934f6995b56433b30308", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952866, "uuid": "58b83a68-69a3-40b0-b9b7-1c90166a09ae", "comment": "Malware payload", "value": "7de4427a98beee6e9826ac2d62e0a2fa7205359c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762952866, "uuid": "605150b6-e10d-48e3-bce2-3b3aed37ab22", "comment": "Malware payload", "value": "f18603f9990d6e64dbe4a740ff717a44d44c8edd4ea31b5004a1d97df18b8a92dd4195e2ae881ef2e646a245d05a72f2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952866, "uuid": "36bae6e8-5dd5-4235-8214-cceb69d0eeaf", "value": "T1DF353334E9680235C84660F95266D7D42B7CAC1982E546AD3B7930DE8FB360C73AFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952866, "uuid": "6b1373d4-5407-4b47-a61d-33e72abb4e21", "value": "24576:EBVjroYoBAXmFofOb/Q6oFx0J18Io9hDbUMpG:KWAJfOsZFY8VUMpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762952866, "uuid": "f4b19026-9cfb-4594-a11a-91438de2df75", "value": 1127139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762952866, "uuid": "9a2a5788-937f-4fef-a49d-81dc6384d5a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762952866, "uuid": "a917bb98-e730-47b0-a18b-8340f5a26280", "value": "Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6470edd6-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762981131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981131, "uuid": "519fb8e5-183d-4ad7-9f9f-0f622975daab", "comment": "Malware payload", "value": "713a79e081010777efbadc1e86fbadfd", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981131, "uuid": "b5230514-cea0-4aaa-977b-1c0cad3b1783", "comment": "Malware payload", "value": "8e3c3c78d1d18cc6f3cd779fe7e68ea2403f40911e630f5d67306c661679992f", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981131, "uuid": "6d77f747-13f5-49dc-a3e0-1b9a99b55b29", "comment": "Malware payload", "value": "e1641f7c61c6d3e228052e2619c8a3982b88a158", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981131, "uuid": "06091fdc-6643-4253-9030-0e08fa13866f", "comment": "Malware payload", "value": "7a58c9608e56102147f41b74c9ad283952dd8e1eecc538b9b4bea8aad931bac667f8b216dda4c95f791517d191084da0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981131, "uuid": "76b3cd4f-ac9e-486e-a1e1-96230d82510e", "value": "T1B7D633849AC012A9C9B34178DFE1CAB4D2203C9D6761CA8F62F57F133DFF391592A196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981131, "uuid": "d7935e29-59eb-4a92-ab8a-77a812dc5304", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981131, "uuid": "12ba25c7-0fe7-428d-9591-ef1d338a2de2", "value": "393216:afMJUHL5X3E0Ia4QoXMCHWUjGhcuI3/PjuUws:af1HL5Hlx4QoXMb8rH/rAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981131, "uuid": "b2505acc-d473-4bdf-b06f-e4039cfa8664", "value": 12769240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981131, "uuid": "e7e0784f-618b-4e75-85f0-85a69a810db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981131, "uuid": "bd313faf-2516-419c-ace7-fb4624b8ea3a", "value": "e\ud835\udc1f\ud835\udc53\ud835\udc1e\ud835\udc1ct\ud835\udc60_\ud835\udc29or\ud835\udc61\ud835\udc1a\ud835\udc4f\ud835\udc25\ud835\udc1e_\ud835\udc631\ud835\udfd2\ud835\udfde\ud835\udfdb_di\ud835\udc1f_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2aba7b5-c010-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983839, "uuid": "7f3526b9-e079-4f5f-8bcd-c630edc2b0dd", "comment": "Malware payload", "value": "7cdfe5b8981cf594ab9cb513430f817e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983839, "uuid": "878ee417-b295-40eb-813f-5c2bc230f14d", "comment": "Malware payload", "value": "8e414e228263e1520cce08ba7d455e2d5d0ef2e580e6c52316275c681a5c58b8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983839, "uuid": "7c8a1f06-7a0e-4d6f-92e8-1137efaca0e2", "comment": "Malware payload", "value": "5fb5ae2426b1cff626dc47faa641714c8c5796f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983839, "uuid": "60d96f29-ed8b-498b-86b1-2bed125ad655", "comment": "Malware payload", "value": "4b8326ae41f75a85366336cb895b7fb0301de8e42229cd6ba653f449cd4f93fd181f466a4f12b43b21bea2a46020ac8b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983839, "uuid": "aff53ad1-efeb-41c0-bbb1-2cfdb49243da", "value": "T1BFB612DAF7D8AA1FC4775032C57A52F1164B4C168A839F876A18770C6CB79D40F8ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983839, "uuid": "86c3e047-f81c-4b72-bc92-2af9e5473eb4", "value": "196608:nLGRtVYgd/GW9OUb6HlrMWYladRCQoQCzb80FKJhMpivao:LdwrmF/IajIVciKJhY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983839, "uuid": "74048f5d-2caf-4675-ae47-4160ff942a19", "value": 10747075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983839, "uuid": "9cdfd867-f2b5-45cb-b22f-ccc45daf901d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983839, "uuid": "a4a741f1-753d-4629-bd99-c9d85dd2d601", "value": "guruji777.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b70f8f-bfcf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762955746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955746, "uuid": "d07fb899-fa49-423a-9f06-15f6b2bce1ca", "comment": "Malware payload", "value": "6f2e18ea5acfce887025efd3f4156228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955746, "uuid": "0d2c6ffc-761c-4dc4-80e6-15956edde507", "comment": "Malware payload", "value": "909e7fe39c6a7edf276ca03981dfa93bb6ba331ac290c7930b4218a535a62152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955746, "uuid": "4d8c2a2f-f8cc-4592-98e5-ab669d548c88", "comment": "Malware payload", "value": "8d876d9fb06e624d6c0ed74dda5e6c0c5e4e6810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955746, "uuid": "17febdf2-9bab-40a2-b4dc-78a11cf4ec1d", "comment": "Malware payload", "value": "b4d1d5bc3396b0b64ef5a6629737803f1d3b4596a494aa3553d7478cdef27f4a4952b268f7d90802a102211bdebfbba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955746, "uuid": "7e8cc1e0-a4ad-4122-8905-3adacc94dba8", "value": "T1D25672A84DE41B11E3D7C2C97199FDD0A97B3813A9CECE84B77ED45018ADD21BE05B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955746, "uuid": "d24abdd4-d89a-42b2-85bc-2b61073988a5", "value": "24576:15DnyOOCzV7Iplm0l2E7LVzRwNOOYuyqqz0EPzOzV0XF9SzMhNFZqTwScQRWAk9L:ZzV7Iplm0l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762955746, "uuid": "f5f356e1-5553-47b4-8530-4b3203b6ab13", "value": 6334273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762955746, "uuid": "cf7c2759-ff43-40f0-897c-e55c26745c36", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955746, "uuid": "a8d12f0b-ffad-4300-b9b6-8551dbb37a38", "value": "Pathwa.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c8e151-bf5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762907153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907153, "uuid": "e318802d-10f5-4b61-bcb3-b8cb1c778249", "comment": "Malware payload (Mirai)", "value": "7674e2dc9fff69cef750d7f6d5ea5b31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907153, "uuid": "6f0dcc1a-b8c7-4f02-b7da-cf2a85e941d4", "comment": "Malware payload (Mirai)", "value": "911c1ea18934cb8c4415b41f9898efc86adc86489086347c373b354ae819c33b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907153, "uuid": "f5357b47-7fa4-4650-9aef-63a952f78985", "comment": "Malware payload (Mirai)", "value": "f8bf12dc156a36766c871f92062a6801e9924711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907153, "uuid": "f23d19fa-6b0a-422e-bfc8-d8d4140cc4e5", "comment": "Malware payload (Mirai)", "value": "f8c53b0bd388668432c929c41c3d29cd63edc78d94a5f6394b6b9ae75acc53b50d819d19262d10414b0d0ab24cacdd8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907153, "uuid": "bed3326f-c28a-4a30-adaf-800d6d94461d", "value": "T11313F19BF58D8939F9BE7E520F189D521F622A9BF6CF8D529383EB438019F0476414B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907153, "uuid": "abfccae9-f57a-45ff-817c-ba261cffea77", "value": "768:Yq3GhGcNdHSX1yRDEvKltsyHqMQ1HJXozYH4kw3oSXYw8BT4uVcqgw09f:DidH8kEEK1HKzYY/3oIYw8h4u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907153, "uuid": "cbe1c01a-6736-4348-8ee7-5467bdb6eb97", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907153, "uuid": "4dad8386-e591-4b76-bbe9-b985e64baa79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907153, "uuid": "3ee48a5b-df57-48ad-a166-5f928b066ae2", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0fa93e-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935272, "uuid": "4f9dd7e9-4a59-4aca-90d0-e07c26bcb73c", "comment": "Malware payload", "value": "fa54f73dc699ca269819360aa5eaed56", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935272, "uuid": "8cddd1f9-3def-4b30-a711-c5e2268836f1", "comment": "Malware payload", "value": "915c24ee04e59bb49d80144da0ec2f8754c5c34bd96dbcca8c5006f2d96fe29b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935272, "uuid": "9ceefed4-c53d-4a62-b33a-e61aa3d85a0b", "comment": "Malware payload", "value": "299393be36915a91b93781b347991831f0b37701", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935272, "uuid": "19fafb4b-710d-4c65-b921-9b003b04b675", "comment": "Malware payload", "value": "23c2de8ef6a2684cbb848945a78171c1498dce52c06e0e4d114aa4f30e9726bfadf19297e2a7c5b19f99ebcf4d1da075", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935272, "uuid": "911de5fd-c49a-41e0-b37a-040b7fd76c7b", "value": "T1EA460196F719997EC4FB6732063612602263DD368F8396836928733C69B76CC1F25EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935272, "uuid": "6d35c653-00eb-4aa1-a7b8-17604a945e93", "value": "98304:fZ7/hWewMgPbPqOvMbl6QPBMaIUOLnENUzDTszs1QYqDj92CrLVd149k3qr:f9EQ7OqllPSaWnE+rszsqVDj92UZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935272, "uuid": "4f185939-a0ad-4774-9a3b-6fe38a5d671e", "value": 5620504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935272, "uuid": "f47c4ede-9fac-4dbc-933e-28a26fc0fec4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935272, "uuid": "589dbd1b-feca-44ea-b825-a3ebafa1f99f", "value": "GrooveSync.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00abfd02-c01f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762989983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989983, "uuid": "ad8699d6-d3f7-4766-80aa-5db97f73391b", "comment": "Malware payload", "value": "db9f9763a98c0841a27239fd2152a4cb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989983, "uuid": "52c54c2a-765c-47b0-ba6b-4df06acc6f4c", "comment": "Malware payload", "value": "916e3e8fe05cbcfcccf5412edd75182a65b79d53b9cab09e14869747cee11f58", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989983, "uuid": "49bdbf7d-abf6-4606-9354-4094cefb0e2e", "comment": "Malware payload", "value": "1c191a457e82244dae5a034cc6632937bff8f9c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989983, "uuid": "02b9a7f0-087f-4fea-aba9-31d0faefe879", "comment": "Malware payload", "value": "a365983cddb8607ae8fb80ee3ac6b5db106cbc8990be7c8edd1556cdd80044048ea13bf4f9154ea557f1cb84b8f867cc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989983, "uuid": "4340ea11-60f2-488a-840a-fba94fad75a6", "value": "T14E760213B28E273EE4694A365576AA50593FBE60641B8CB3D6E41D4CCE3E0601E7FE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989983, "uuid": "4100337a-dbaf-452a-b012-221d3bf21cd3", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989983, "uuid": "071bf7d7-b1cd-49a5-9216-e901ef084b02", "value": "98304:WDb5AcIjaetWuhP/tdHAAn2MW8iF1h+21:WDb+aegwP/rHAUM8IY21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762989983, "uuid": "daf1cc47-bf47-4c31-a5da-d37f0ce962c5", "value": 7423152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762989983, "uuid": "e1524624-6b04-41ea-b304-1c685322dd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989983, "uuid": "c6b2fb6c-a339-4c10-a940-e64bc1c38c69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec246974-c00e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983077, "uuid": "da7316ec-f3af-48b5-96ad-2218c8f9fed8", "comment": "Malware payload", "value": "1e19a05520cfaeed0463763bb4c767cd", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983077, "uuid": "3a6530aa-b120-463a-8b3f-a32c7def5bf3", "comment": "Malware payload", "value": "94aab2786c81c302b70fafd4f04f16ce97fdf9460cfaac2aa3893c5c8df98c5a", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983077, "uuid": "5fa3584a-000a-4182-9a92-cad5401b0437", "comment": "Malware payload", "value": "6741c1f47dccf1327302e442060e72bb7f151403", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983077, "uuid": "ff802526-d991-4468-80d5-c560ca98e9ec", "comment": "Malware payload", "value": "c2f5c265cbf274c9d0cdaa4aa26c4a91ed2921960cc017c8b91e33369f6d66e6b5e35dfd74efe2359e8d2f63070f30f8", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983077, "uuid": "554524ce-f58a-45d2-b8db-ed4047b58a63", "value": "T190A423213DB96F3B65A646437032DACEBB46D7840D2D7F4038B9BCE418499633E4DB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983077, "uuid": "daa6f5ac-c4ff-4c28-afeb-d174b5704384", "value": "12288:xM6Rl+cA/I6MMoFjod37WCy/A4RPwzFRdN5wnu9cu:xbRQh/IrTFj+DgP+V5qu9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983077, "uuid": "76df9a5d-bb9d-4726-b6c0-5b68c1b8c231", "value": 480382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983077, "uuid": "6bdfb5e7-0988-4b6f-99a3-18fb575ae398", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983077, "uuid": "69d9e8dc-365c-4e27-9431-a8c5f95d1f2e", "value": "n74cced1f-07c7-43a0-8a50-d91a52fa421a-1_pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff5c758-bf8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927705, "uuid": "a60ed748-a335-4514-8ef0-fb92e4d12d28", "comment": "Malware payload (Mirai)", "value": "9fa247892042e82aa302f4b742266476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927705, "uuid": "03e5d050-3573-49ed-bb16-eff0a8e1a697", "comment": "Malware payload (Mirai)", "value": "951ee96182d15b38334d3701c690c310f03dab5a82173f092d4bb0c18f7d8cce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927705, "uuid": "84ee0827-7c7a-4025-94cb-ec402ad6c2d4", "comment": "Malware payload (Mirai)", "value": "3263e97ea6758badcb85608b1aa56b9be19e53bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927705, "uuid": "282fd8f7-3bd0-4880-b429-41c8dfc545e1", "comment": "Malware payload (Mirai)", "value": "36edf9d50d911fc6f4d65db2b9cf4e7c070310e26d6dc209e525d113e31ec4a9d6ba4d9bbc6d1897debdb2170fe7b472", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927705, "uuid": "76f6235a-a81a-481b-9579-663347121dfa", "value": "T14CC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927705, "uuid": "d3f8945c-4479-4a97-8639-dc34e3c6e579", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyDw:VoRNjmj1VGFVrRiyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927705, "uuid": "7c4ee066-2ca2-4837-aa3f-2061e95d27bd", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927705, "uuid": "9f2f90e3-c480-46d2-833a-981fc166dd39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927705, "uuid": "2f407461-333b-406e-9613-b06277782871", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b2b2dd-bf98-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762932197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932197, "uuid": "ada4b492-5a40-4e4e-be85-841327a8fd28", "comment": "Malware payload (CoinMiner)", "value": "85675570d6c913264fb988009222c465", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932197, "uuid": "6280122d-3f39-46c7-b6c5-cd25d04ec7cb", "comment": "Malware payload (CoinMiner)", "value": "9876b83ce63edd0a9df541fef95407d95c87a124c4801206c176fe2ed5ed461c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932197, "uuid": "a869f949-c552-4c15-b61e-dfe7e6d3f7c6", "comment": "Malware payload (CoinMiner)", "value": "e86e26c2fb1d50ed5ac0697d93f9fbb5d9c71aab", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932197, "uuid": "b4bede96-e759-4d50-bf7e-0355a3ad20be", "comment": "Malware payload (CoinMiner)", "value": "a93ec01835873996dedd119c9fcb9dd1f97de7966f27d923aee741397199d603f13eb9c35fe0c709e01da355d4d6921d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932197, "uuid": "09c8ab1b-9eca-45e6-bfb6-843f82ecae12", "value": "T1D1166B99ED0F3C12F3C7F23CCE4A97E1761B75A4E32390B279D25249C59E9D0CAA1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932197, "uuid": "19a4bcee-3a0b-4163-b4d6-1b71041224cb", "value": "49152:08gQeZQ0Q7a7IaPCdvRIU7O9YpwHdY12oFEYIU6i4kVz:08gQeZQ0Q7SCdOEO9YpwG12oFs+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762932197, "uuid": "ebaf4fe5-1fa1-49ed-946a-f7d57716e4e6", "value": 4269496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762932197, "uuid": "ff1c8db4-55f9-4900-94ed-e1e6ac872db3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932197, "uuid": "09c91a97-9e6f-42c6-b5d4-bde2a75200d5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054c0814-c012-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762984407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984407, "uuid": "0d729e74-c1a1-4c35-9320-f7ce60193caa", "comment": "Malware payload", "value": "1f0537d5919f22da580f572940a8f982", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984407, "uuid": "27072a39-37a3-4fe9-a03c-b489fc0de04f", "comment": "Malware payload", "value": "98b13f8bcbbf4fc7ceb3012d285854f2489876167ead81f0584bee56c2ef02d4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984407, "uuid": "358866a5-e234-44de-90b1-3f7926b22293", "comment": "Malware payload", "value": "503fa595269ea338864aa4238f211ae07e62ec83", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984407, "uuid": "ea42c23f-b759-462f-9053-d961e92345e0", "comment": "Malware payload", "value": "f015b8f3b5f268349a1f1c38c40210234d483832ec5f40bbbda61c9eb5eb55c7172c735f918b2495b435f7cf119add2c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984407, "uuid": "60c67957-21e6-479c-bb19-4b25f5014914", "value": "T1337354880ACBD8F89667B458CAEF9C01FBF595032A1CD5D6FA4DA5A02F1143CE1F85E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984407, "uuid": "1266d277-77dd-4cce-8402-43372007fdde", "value": "768:yT3aZP5VEeKzQNMpIlDackQ5OSYu/e3oXtTPFKoYLdPcZ+faNE4fCwF9rlHpFI1F:yM1VBm4Con1bLO3nlZii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762984407, "uuid": "d3eed204-5389-42b7-a380-918c42101b80", "value": 77863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762984407, "uuid": "3713072c-82b2-4edb-a053-e4b38d867994", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984407, "uuid": "b86776ed-7d19-4409-a22f-8049802b1823", "value": "t1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6183283c-bfe6-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762965664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965664, "uuid": "e4987920-2106-4d15-b1cd-9b00f197c6e9", "comment": "Malware payload (RemcosRAT)", "value": "6996f9420153ee41871f899455868c35", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965664, "uuid": "e1571a14-9c4f-46d9-b8e2-3b0338924124", "comment": "Malware payload (RemcosRAT)", "value": "99188d1f37cf1576c65247040c4f33c21b7f0bddc5e73523bdc668b50c74b072", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965664, "uuid": "a3635130-f172-4b4c-898c-2cb42142966d", "comment": "Malware payload (RemcosRAT)", "value": "e5cb1351b6db556ff5b69f479696421b58444039", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965664, "uuid": "167d6489-7ad1-4274-866c-2dd520149f34", "comment": "Malware payload (RemcosRAT)", "value": "38814195f8610c7720738e9d8e64a05dd2dd532f1b2b5def287a464428bdc96996f00c8ab3b245f435c437044dd6c35a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965664, "uuid": "5b67d068-c0b4-4537-acd3-bd3318c29fba", "value": "T17E0533DD0D9BFC05DB046D9EB3B826CB9580806CE9231E87442435AA4D5B3C67FA96FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965664, "uuid": "b06cddd8-65a0-42fb-8dbc-717062f8d03e", "value": "12288:8NXvhdZdB1m2TR9/gf7rw+nh41q3hcki/x+0XJoVWAsI3dG6Rpk0nj:SXJdRonjrwah41q3hcD+OIWULk0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762965664, "uuid": "0e1663e4-1191-4ca0-abc9-00a6ece2120e", "value": 866010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762965664, "uuid": "7d779245-b358-4bd1-a16a-87ef69642f71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965664, "uuid": "53d76505-1e39-49fb-80e5-546e3caf00e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0427fcb3-bff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762969803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969803, "uuid": "bf0d529b-b63a-454d-8735-e37ed75428f7", "comment": "Malware payload", "value": "b7835810947057577a52685bf6a4e0d7", "object_relation": "md5", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969803, "uuid": "5ece7da6-f421-4663-93ca-05df01a00a58", "comment": "Malware payload", "value": "99c1b6dc58c681fd9250d59194bed07ddce2a0a64b92059b8d5f71ba961bb36b", "object_relation": "sha256", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969803, "uuid": "130a5361-e089-4a38-92de-0843d7b34891", "comment": "Malware payload", "value": "6cb4f0102a8b9011493694667c7f6be18268974e", "object_relation": "sha1", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969803, "uuid": "927d45bf-da5f-4977-b8a7-e95577aecfce", "comment": "Malware payload", "value": "faee64a5220a77efea7345968979cd9f0a5c1517b589d1d5da9e74568ad33b50b86de430d874e9e0c19bbd8aa04a9f03", "object_relation": "sha3-384", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969803, "uuid": "099d8478-2636-4d29-a76d-360f47fbf461", "value": "T1D1D5C75BF6B610D1D1BAC139D513622AFC7134A6833C97EBA2818E465B60BF8ED3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969803, "uuid": "2260503e-bbcd-4c65-bca2-7714e2786ab5", "value": "4296ad675a5756c70badde0779458380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969803, "uuid": "915c24e3-9b58-49c8-9df6-be19d21a1b91", "value": "24576:uNyhH9lrbq0ZcqnGl8Fnd/hlHaW6GnRWG:BJ3VbnGuT/rcGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762969803, "uuid": "af280787-fdc2-49ca-b130-c59985beb459", "value": 3009536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762969803, "uuid": "6fb12bdf-065f-4672-86c4-c2ccf11fa38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969803, "uuid": "dc65510e-1572-4f94-9176-ec91a571f2a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c12dba6-bfaf-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762941979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941979, "uuid": "a466457e-5739-498b-ab9f-e98b411077dc", "comment": "Malware payload (CoinMiner)", "value": "85e0448563a1059c6ea29d5e23f20e09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941979, "uuid": "689722e3-15d0-4ec0-b36a-6be5b3eb726e", "comment": "Malware payload (CoinMiner)", "value": "9a29013698f27f568f1e6e07c2f121b133bb4418b5cd52c3d4dc3a668a1b359e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941979, "uuid": "5957b587-fee4-4cfa-8645-82763f6ff26c", "comment": "Malware payload (CoinMiner)", "value": "58830744b0303171cbb484ee42197c94bb7f2a7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762941979, "uuid": "617d004b-eade-4025-9242-53ba0e38adf6", "comment": "Malware payload (CoinMiner)", "value": "69994b7988aa9e8b66ee5ffcfd5076360cc04c92cc7ba3eb40312da2533d356b6231aa0ac73b93b3b4f611ef30cfcd5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762941979, "uuid": "8b6b656c-b165-45fd-8c6c-cf3c7c27d5da", "value": "T1A08533802AFAB50F97AB19550CD8EEF7EB89166BF4100E0CB8065BFD857765D21334B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762941979, "uuid": "e45293be-5dc7-4a6c-8fce-4decaccfd441", "value": "49152:PXEZqTr/FGYiYX6HpXRHtNGpG5n9pAW3A/+w2SXk1u7EyQDf:Pxr/FmYqJXRNNGW9pAdx7rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762941979, "uuid": "a7fd9663-0f34-4cb8-a7e5-0097f922e489", "value": 1748976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762941979, "uuid": "fe727f06-dbba-42ed-a579-4027b8cebb69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762941979, "uuid": "3e32b782-8ae9-46c4-b1b4-f32dbfd0772a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71240c9-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762981297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981297, "uuid": "3613d18c-6c1d-48d7-8036-c18994576fc1", "comment": "Malware payload (AsyncRAT)", "value": "5dfc9c3c174a4c43639b95f76a83681c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981297, "uuid": "7b417237-2e44-4d18-afd0-c7b52c3469b2", "comment": "Malware payload (AsyncRAT)", "value": "9ae7e1c5b0b2a6a94f9f77964d134fe3e5b262b42ac6e1d5a8c704dbb91c2f41", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981297, "uuid": "eddedd94-12f4-485c-b3f9-9cf9aa69b84a", "comment": "Malware payload (AsyncRAT)", "value": "8e7cdaf175dd409a2b6036dc58b15a517b94020a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981297, "uuid": "ff9e9680-63ca-4cd6-8f34-34d6ddbb526a", "comment": "Malware payload (AsyncRAT)", "value": "ef87c92ce3470a41967565fa96861bc718fe024a10ad1b82a886161e8dfcbe16bda7f4f15a7cc83032bbf11316b2933b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981297, "uuid": "f5fe8f16-48dd-4d3f-b8e1-def5ceab639c", "value": "T155C022294216C14AD5143803A0B0F654348FB21E18E391582383DE1F0C424D2D00D36A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981297, "uuid": "7a27fb6c-add1-40ce-bb49-c71513ab0bb0", "value": "3:HRAbABGQYmknLyhKx9icyjBMRKGeKQ1rb2pKgHpUzSDApBHKs7V25YdimVVG/VCc:HRYFVm6LyhK+ZQ61blgJJA2s7A54vVGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981297, "uuid": "3b26da80-7453-456e-9323-6494a18fd74e", "value": 190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981297, "uuid": "3a774acb-2db0-4e24-b245-48c1c7043900", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981297, "uuid": "b2b09be9-ee86-4c58-8dc1-2bbc03ecb76e", "value": "Docusign_Document.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5ab5c9-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962221, "uuid": "06821396-15d0-4ef2-b367-ec0604ba1553", "comment": "Malware payload (Mirai)", "value": "137823207eb663601875495d5e5ec9f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962221, "uuid": "20735841-fa0e-4fec-a9ef-e8d54ba05762", "comment": "Malware payload (Mirai)", "value": "9b0143c73e9aa620bea96aac49a5ffc92ec79fe3baa28aedeea3f4680009f2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962221, "uuid": "b63ca4ca-b653-4ef3-b6a9-a50ef7cce354", "comment": "Malware payload (Mirai)", "value": "4fe3df79a7f6c94f48ba3c6ea53e581b87bdb575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962221, "uuid": "40c7faa1-d53a-47fd-81ee-deb4172d0c1b", "comment": "Malware payload (Mirai)", "value": "36011fdd52997c07ae4aed223f28efb0eba4b1ec78d7f350ff4f6460eaea95aaad817508bdefb3015823eed5fe7ff530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962221, "uuid": "3d6836dd-a8f2-4b9d-b59e-714487a54d5b", "value": "T154531941B8829553C6E4237AF96D41CE332673A8E0DF321BDD216F2137C996F0D67692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962221, "uuid": "d693d4a2-3799-43f7-93ba-b5b443610d2c", "value": "1536:BgdLTHss6u/9u3lZ9YmaZFlk6nBTKn+t:8zsRR3lZ9Da/O6Be+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962221, "uuid": "7c55dd4a-499d-47ce-bbb6-66c04c91995a", "value": 62280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962221, "uuid": "d2a725f4-4fbb-4d90-a429-92efc8b2d55f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962221, "uuid": "501be19d-f183-4645-bf72-792f666bac4a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f09b04-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962227, "uuid": "70dd8cf6-5395-49c5-b896-93f72c211cc4", "comment": "Malware payload (Mirai)", "value": "97f906dc2f541fae9ddc406773bdf4f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962227, "uuid": "9f2477c7-a3cd-4742-8967-f08c0d410775", "comment": "Malware payload (Mirai)", "value": "9b1349885ff5678e1e6798120b3cbce8f54c02070dcc17adde59686fed0168df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962227, "uuid": "65f978bb-148f-4c20-abff-732c6e57e5a7", "comment": "Malware payload (Mirai)", "value": "c6d7ff32d6adc5ebd396c219e5ad04bbe730e721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962227, "uuid": "c7c2ffe9-dc51-48f0-8b0b-c4c6fd72d9cc", "comment": "Malware payload (Mirai)", "value": "da256f618c2c3eb81ef5afeab560ad2ad8bb66a0e0df0646c0565bf8553c84485f9bd20ffe13e3207fd4ff1e9a6fc9f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962227, "uuid": "1351389c-aa01-4f46-9dcd-a7e859e2cfd5", "value": "T166434D42322C0F57D2A25AB0193F23E0C3BFE55025F4B989654FAB8A4679E725487FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962227, "uuid": "addc3007-f06e-4580-ad2f-1fee8ef057ae", "value": "768:8DH05LTW9greJq8Or9dEIS/KvmKAZqsLGlJ2REcv3U1ZnjmOfo+xyEoMz:M06jI84CISC5lJ2J8bmOfoSygz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962227, "uuid": "89363e10-c833-4774-ba5b-4e6461cd1623", "value": 59828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962227, "uuid": "5088289f-7ed9-455b-af01-5d7f7e5f0683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962227, "uuid": "7ce9dc55-a445-4018-9d5d-def3ac8aca47", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e238eb-c00f-11f0-a129-42010a9c0007", "comment": "Malware payload (FleetDeck)", "timestamp": 1762983288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983288, "uuid": "5590bb25-bc63-488d-8d7b-f3807eea16d1", "comment": "Malware payload (FleetDeck)", "value": "7118985eef818157c386134c8ee2aefa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983288, "uuid": "326fb156-6ff8-4ad5-a122-bb3842b54fcb", "comment": "Malware payload (FleetDeck)", "value": "9c4fcee7c52805f63af123244d414c5c6bda49ae8ca8235224936040bb48510a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983288, "uuid": "438da412-6f54-428a-a494-3a19647717d3", "comment": "Malware payload (FleetDeck)", "value": "46b50d682d780bdd7b62b38f3bea001ef2a57294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983288, "uuid": "da4b1f12-f64b-47dd-8c1c-8ef627138d3e", "comment": "Malware payload (FleetDeck)", "value": "c3eaebe3d635d28f9823cf3f5a2f125fbc550f9a674535cd554c5bccd6d99a7268b1a33c59fafd61bec05ae08392e1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983288, "uuid": "7b239ab1-97d0-416d-a58b-b1be4bfc1e69", "value": "T12416CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983288, "uuid": "81b0f3bf-75fb-4543-8cce-ce9f06cd0209", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983288, "uuid": "de5afce1-a6a1-4004-b08a-42b80ff3a383", "value": "49152:6P0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snU+:6PtZAl3XzKnaIcDgRjOlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983288, "uuid": "37774f0d-1c83-4cf4-9d0b-fdf09ce9c3b8", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983288, "uuid": "a93fec2b-34ce-4f9f-9df7-8af29e797f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983288, "uuid": "e8cfd8ec-cf5c-4d03-876d-16d7804d4bd9", "value": "AdobeReader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b060a6ce-bfc0-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762949476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949476, "uuid": "184e6400-5d55-43db-a4bf-3cc00edfae18", "comment": "Malware payload (QuasarRAT)", "value": "f166a20d013097aadff56a53fde51a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949476, "uuid": "bf9e0e5f-f9c2-4432-92fd-6b0a278569eb", "comment": "Malware payload (QuasarRAT)", "value": "9dfb214ab255d443607901cff10b94d1c4a5da6605968c254875d423b8ab8b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949476, "uuid": "a060cfaf-0a3a-4daa-9429-c15aba3a0b12", "comment": "Malware payload (QuasarRAT)", "value": "35f86e83b9dc08d98bc4a76d0868c42d28537a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949476, "uuid": "414745fd-e66b-46f6-b64d-6118e19388fb", "comment": "Malware payload (QuasarRAT)", "value": "3681cb37a8a9a2e39a87852a206def0e6b4207c37aa1517272ab663da97ff0991035e6237499cf0d187f1ae047edd2bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949476, "uuid": "f1c77cc1-e446-4f15-ab9b-fcba06425b83", "value": "T13A15C09077F48606E2FF17B9F4B549984B76B9069936D78F499CA0AD0EA3340CF107A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949476, "uuid": "20365081-2545-4ef9-9691-e55a565ea808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949476, "uuid": "4ba505e2-4ada-49cb-b6b2-0f4092db19e1", "value": "24576:Z4IOps1XjxJzck+uGW/yFoBkkAePYZ5EUId:Z4IOpYTYjqqanwuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762949476, "uuid": "1a64d77d-a15c-48e9-9281-d53f5ff5cf60", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762949476, "uuid": "ee175522-cd86-4432-84d5-f8c08f48baaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949476, "uuid": "30f32bec-aa21-4951-b28c-d419b572fc49", "value": "fnpriv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cef94e-c015-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762985771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762985771, "uuid": "c37f1834-f044-4c67-91cc-a35149607d4a", "comment": "Malware payload", "value": "f6859a0b7e61b14ef35b6dc355b0d753", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762985771, "uuid": "1a631b29-bae7-48c9-b5bd-ab2536b8f0ed", "comment": "Malware payload", "value": "9fa662b848046428d8a251bdc322c323ffe5260f1708d1b8b77f2230015cc488", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762985771, "uuid": "494fb80e-8589-41f1-859d-a7f53c0eed89", "comment": "Malware payload", "value": "f1e87e4d309b501597a60b17496fac8f8fbaec09", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762985771, "uuid": "4ee4fa27-d45b-48ec-a4f1-746a80a99010", "comment": "Malware payload", "value": "f9f4de4f5adba1c2c782d4fa5ddc9655e9b65a17fa0589ce86f587dab2a2017cf81e1817daf33340a6c2bfb709be34d9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762985771, "uuid": "a65081b1-b01c-428b-9d70-73932bedb354", "value": "T12CC499E22F2E8387EF4B22F6540435A3CF5CAA5893D6C0241BF1159BC149DFC66A1DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762985771, "uuid": "fc160130-6655-4ca9-970b-321d5e7a4fba", "value": "3072:Unur2uTvfKMFIzNmDmHgiCo+8EILa3u8r9RyCpJEkZI9O7L7tY/MvrNg1ONk82/B:UeDT8E68jW7bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762985771, "uuid": "8ecd5924-9be3-43ff-9084-121386448d61", "value": 571133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762985771, "uuid": "64278f2f-9230-41b5-94dc-735071f5b61f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762985771, "uuid": "0c9c0eae-7fcb-4d9d-ba80-cdb6e088ab09", "value": "ChromeReporter.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0a9c42-bff9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762974055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974055, "uuid": "5ef0aacc-6725-413b-9504-ac0b5f9949b7", "comment": "Malware payload", "value": "4eac6a0d209e8356d23ac15d895b0837", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974055, "uuid": "35cee72b-0e98-4023-800d-bc6691a609d8", "comment": "Malware payload", "value": "a257dbba14f7e4b2918fd1bc492f756ce0200efe272e13cf19dca288dbb53bc0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974055, "uuid": "b033d351-02f9-421c-878a-1ffda4e834f8", "comment": "Malware payload", "value": "fe63dc492c9002fe96fc953b5d3654fbc94fb40e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974055, "uuid": "76ead1e2-5aef-4cb4-9f20-6e584c6e1266", "comment": "Malware payload", "value": "ca43f005b6b232852b60536e1fbb37af7999fd16e980617af15f3dd45ae6926ca958f4aad4474aec6e0f34a28d062e90", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974055, "uuid": "09a951c9-c685-48f4-a1ac-70a6f79b48fd", "value": "T1D1D6338AED900879D37F0C33507E4670A96CBCA927A8C989D3C0BD1C59B798995D373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974055, "uuid": "93417270-fa33-40e9-a51a-740672240f80", "value": "393216:0iaeWMWz9+XiKBrflCk3zytC3/YM5h5BqPQ:0rFmi4AkOtC3A8h5APQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974055, "uuid": "b6de09b2-ba91-40c7-b873-beca99aa499f", "value": 13197312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974055, "uuid": "b4473215-ea19-4d28-bbcf-8ed521c3a4b5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974055, "uuid": "4b65fec2-04f4-41d7-b0f7-2c2a7174fc45", "value": "4eac6a0d209e8356d23ac15d895b0837.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c92b8a-c01e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762989779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989779, "uuid": "6d7a411e-27ba-48f8-bf2e-2511e9aa02ef", "comment": "Malware payload (Mirai)", "value": "9ae8fc397f0f65806a23fff24c122dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989779, "uuid": "ee7a63d6-5b0c-420c-9017-48d0db8adb40", "comment": "Malware payload (Mirai)", "value": "a37ee25f52116c2c8575f4ad3ab78339b9f42a31a49a2a810c5e6dc690a0cbbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989779, "uuid": "94a636f0-7e6f-4f0d-9e59-30e7f51ca12a", "comment": "Malware payload (Mirai)", "value": "85d4056b42e2b37b0ca91a38d6db2d2017c43777", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762989779, "uuid": "142ae587-7aa9-4b38-8ce4-fbee88a557d8", "comment": "Malware payload (Mirai)", "value": "7ad295c54838aae8623f5b186d739afdcaabd19eeac5df5e77b66091e403ec1360cb3c5f8f5e0e2861bd173c6c1ec913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989779, "uuid": "9b445efc-cb69-48a3-922b-144951ed5f3d", "value": "T11364F1CBEF11BC3AE984067125AB0B5DF7B8D99A82C3E090F2D4C55E3CA92C5BB511D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989779, "uuid": "95c1baea-b67a-4497-9138-2279d7004a77", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioJa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiZPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762989779, "uuid": "9c4f0544-7e3e-4a24-92ea-a272212bf23e", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762989779, "uuid": "9c6237bd-bcbc-4e57-9077-59a3f7e38838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762989779, "uuid": "4ef8fdbd-b67e-42bd-bf47-b7c949a5dd5b", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcba32a-bfd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1762959565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959565, "uuid": "a27f56f9-6fe7-489a-9828-12461efab638", "comment": "Malware payload (Formbook)", "value": "548ec09fe432f8f309a99236bd0d2335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959565, "uuid": "74648ca3-9df6-4610-8579-90207119e381", "comment": "Malware payload (Formbook)", "value": "a39476c2cb94736d32c3d849fe5117691ee71239767ccc506c3c93375f5dbf74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959565, "uuid": "0e109af6-982c-4792-9d9c-ffa821cd3fb8", "comment": "Malware payload (Formbook)", "value": "5a7a594b9637f460c44890420de82c694b2fa871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959565, "uuid": "8dfe9970-6aaf-4a17-9c14-656bba11bcaf", "comment": "Malware payload (Formbook)", "value": "a11a905247e01e9f40028ad2e672b4c17410dafcd6b67d93c1e6cf0f01f8713382b7a188a79eaa6ea1e4bcb715416b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959565, "uuid": "04574c39-5707-40ce-bf34-6dcba43f218c", "value": "T18545CF1363DD8361C7725273BA66BB01BEBF782506A1F46B2FD4093DB920122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959565, "uuid": "8ac650d2-09a4-40a7-957d-a6cbd32a559b", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959565, "uuid": "a0d53061-cfde-4a8b-8998-a3740571dd83", "value": "24576:itb20pkaCqT5TBWgNQ7aSDmFd/a2p5vZy2T/QSm66A:vVg5tQ7aSOdhp5hrl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959565, "uuid": "63df94b0-c491-4ab7-912c-e63b8c83e1f3", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959565, "uuid": "490665c8-a80d-4eba-9943-36bdb390f4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959565, "uuid": "e1b91e2d-7a8e-4141-9f54-862f75e0e4b9", "value": "PO 25.091 - KTR X MERCURY (JUNCHI).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dba2731-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939942, "uuid": "06cc3ab5-6fdd-47b1-a3a2-d0dcb5dada94", "comment": "Malware payload (Mirai)", "value": "61d1ca09729f236fa5dc0014e83650df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939942, "uuid": "618d1c2f-ce9c-457d-a4cd-24e33537ff49", "comment": "Malware payload (Mirai)", "value": "a6f28607315b0cd4dbbc9449ca5b08741ebcbb569b7fc88825a4ff90207a1dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939942, "uuid": "998b40cb-9c7b-4900-85c1-f0c6b73f897f", "comment": "Malware payload (Mirai)", "value": "8f91002bccc88dd132798253788ce18b5442c678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939942, "uuid": "c68ab96a-ae69-43e3-b893-74fb49108f38", "comment": "Malware payload (Mirai)", "value": "c857a264d7a3709f8b06e0cf0bf7d70302a06c6a30d0f385d137ff51ea6b9bd697bcaf8aedb878ef3006f3f2b73a547c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939942, "uuid": "eb1c6795-a5af-498f-9b63-93005d085f1a", "value": "T1E582B0305490EDE5C260E43EFE1E8DCBAA565FB8C7FE3525164407A8F9C190E457C08E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939942, "uuid": "f6206d72-5434-4dea-8075-df328e7b16e5", "value": "384:UTZoQgo2KCvvMPAwZMdRbTHLjgm7chymdGUop5hnGi:UpsvUpZ43jTcs3UozJGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939942, "uuid": "94143749-e24c-4c37-ac8b-b9a437c6a422", "value": 17608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939942, "uuid": "ae509aa6-1144-41e0-a82d-f6e4fe0e9922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939942, "uuid": "19deeb27-9ef6-4778-945c-7922c5595d48", "value": "mirai.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa5740f-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940017, "uuid": "ce047604-eb2c-413e-98a7-3ed0c05e6c18", "comment": "Malware payload (Mirai)", "value": "73fa8b3327f8f062f34c45d6494e61c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940017, "uuid": "38b4e974-566e-40fd-b913-a4cb83a38779", "comment": "Malware payload (Mirai)", "value": "a73228b776bd16464ff1495c342267c17a9fdeb54f7bcdcb04d2ada1282bbbd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940017, "uuid": "71c69ff1-99bd-4dc8-a4b5-210f5c8404cf", "comment": "Malware payload (Mirai)", "value": "5882c28393ff1535ac230a4ddfc2617b507abb95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940017, "uuid": "d78363b6-2f29-4d44-8088-86f1cc26a1d6", "comment": "Malware payload (Mirai)", "value": "7268b883a27bd4663d23d8042fc5f375ed8fc6bc007f1da93c1bc00df8ac12079dc7895aa1c3e9a0a54aaa17345f674e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940017, "uuid": "9d30b592-0284-4270-a2da-baf16b015ed8", "value": "T1E8C32B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940017, "uuid": "72b26d67-0463-4e2a-aa5d-0e26d344cdaa", "value": "3072:5QK3qOAWqKUUoev+YPaOS6cps+EuNM/9oE:5QK3NjUUoevbCOMa+E4M/9oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940017, "uuid": "e524b65c-218d-414d-a465-ff3e126bc53e", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940017, "uuid": "3bb5235c-cd5e-4d3e-929b-ff07a504c2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940017, "uuid": "3a2584b3-0fc1-4ee8-971d-199a2501b0ce", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745d4c6d-bf6d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762913727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913727, "uuid": "c0c4d436-df95-4905-a861-c7b2900aa65c", "comment": "Malware payload", "value": "e857e00c3c4a57f728be96026cf9126e", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913727, "uuid": "0ed094dc-5c76-43a9-b742-1ccfb725cd49", "comment": "Malware payload", "value": "a9e72d746cbf221c98a5070e8053dcacf79e7e879a0c5a11f555ca035c7ec97d", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913727, "uuid": "598851b4-06e2-44b8-8a53-63cc8cb9e71e", "comment": "Malware payload", "value": "e50739f84babadaefe6d142d77b30d64a833f069", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913727, "uuid": "794610d7-0aad-4cf8-8d7a-74957dcd61f3", "comment": "Malware payload", "value": "20ad4c993a59dd6bb1af676a41c38fa964b09c4ecf0b301b43dcbf2c687353c97c00aa03ecfe8e2197fc3f6e58774e29", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913727, "uuid": "3636bc47-073a-473c-9844-eabc07223981", "value": "T16817CF49F60CD42BEEC9B0BC8D8B0793B5627D551A10C18B3822B60DF9B37D49B65BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913727, "uuid": "823f700b-da51-48b1-9eec-9d8b0fab43c7", "value": "393216:cs2kiE0JU+dZsvj7jMvcdQxCu3gvv016j+41:qkiVJOjnMvcSFUx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762913727, "uuid": "49a29c27-a6d3-4a74-b57f-cfe49756fb95", "value": 19082748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762913727, "uuid": "f0178f8c-e68f-4a9e-91e4-c5fa5feb08bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913727, "uuid": "fee0f25d-e017-459f-a422-c65f30640b43", "value": "Group+Message_2.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8f9d59-c011-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1762984208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984208, "uuid": "30c58ab5-5254-4eea-ae4a-89c9130ac244", "comment": "Malware payload (njrat)", "value": "09be3197dedd045fdde5d5e82f0be0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984208, "uuid": "f6c837b8-d6c2-46ca-8db9-e845c400d66a", "comment": "Malware payload (njrat)", "value": "aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984208, "uuid": "baa9281e-a091-47bf-beae-ffa14edcdb0c", "comment": "Malware payload (njrat)", "value": "a8dedbdd9e46701f6989e7003d3db94e5c9ea258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984208, "uuid": "78f5eb7a-98a4-4ae2-a645-3f48b6f87b71", "comment": "Malware payload (njrat)", "value": "9a07241650055854272b6edbef41bf49709c54e1a77d7d5567ff4d460fe77fe010ca2bdf24dfe1a7253e5289d4b1223e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984208, "uuid": "f17ff2fa-ab48-4449-ade4-c9dd7e9107d8", "value": "T14AA3E1387E862133C67EC1F1A9E6768AABA9212F3191DDCE4C97028518F2F155EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984208, "uuid": "a0deba34-249a-4a22-8a20-ab55fdea66d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984208, "uuid": "8c9b151f-d6a9-497b-89ab-880bd662c67d", "value": "1536:MYxlY23kGwgMBUQGum2U8aVCguHEvQEbFeDVC3woFRKpTdm6L:DlY23kg3sguGDFaXmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762984208, "uuid": "ebadc50e-c5f5-4916-bf8f-d585538735e6", "value": 104832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762984208, "uuid": "f7a1573e-7599-4422-9e7a-375e3868d4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984208, "uuid": "e5955dec-3c37-4344-945b-0d1825f2731d", "value": "09be3197dedd045fdde5d5e82f0be0f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588b9100-bfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762960495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960495, "uuid": "fc6cd615-15ea-4ee2-994f-dffef769add0", "comment": "Malware payload", "value": "ebb30e79b1685b5270e8918a94b46eeb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960495, "uuid": "ef53aec6-e4f7-4502-a3a4-edc0c7d28808", "comment": "Malware payload", "value": "aae2ee8d74f7d74e430941e6206bdf221994967730a060fcdf3cc80e392352a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960495, "uuid": "cb757e99-63c6-40fc-8436-45a550c5ca22", "comment": "Malware payload", "value": "4eeb3516a1898769f02407c53fe37f83504abaa9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960495, "uuid": "b88573f2-6a19-482c-be2e-8a94de0bf680", "comment": "Malware payload", "value": "47dc4d2330650f16096f4582eecbbc8fe20a972a77da358b0cf96c337959ff5200708d76d723d67ac76b0fdec7524c00", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960495, "uuid": "f25489b4-a725-4b31-9e36-5e38a848869e", "value": "T1EC535BA4AB0C9617CB5F4EFF6621621387B1B6D2E60AE78B3DCC14E528523D523012DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960495, "uuid": "793e385f-fe19-4872-af70-30150427ea64", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960495, "uuid": "de69d235-acc4-4d58-8f9f-a2e6a6ef47df", "value": "1536:MHpPpXpI0p4SfOyIAGatuqcNEgTlU9zl0SbMZ2ZzbiKeubg:MHp9bkrev0SbjZzbzeubg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762960495, "uuid": "ebbe90ba-4795-49f2-8ff6-358ec44d4ec4", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762960495, "uuid": "465b0703-3cd7-408e-88d7-fbe0ca36e418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960495, "uuid": "458e9b73-5001-47bc-a9e9-226127b51dea", "value": "aae2ee8d74f7d74e430941e6206bdf221994967730a060fcdf3cc80e392352a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca62dd7-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962220, "uuid": "ce7e5bcd-d1ec-4b09-a3a4-5d7e422cd745", "comment": "Malware payload (Mirai)", "value": "f623c32856addc73846f01ed107e5c00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962220, "uuid": "bd76bc60-8af4-40a8-8b32-76b49cff1ea5", "comment": "Malware payload (Mirai)", "value": "ac13129712343ed65cfab365b09704d61efaca91ba45ba72b8f28abee5c79132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962220, "uuid": "cd934fe3-679b-4d6d-aed6-3b4c8d5043a4", "comment": "Malware payload (Mirai)", "value": "b1d8aa8602914123199b6d29f1bc0d4e35ea210f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962220, "uuid": "e0e50b14-ab8b-44e4-9568-7ffef9bd73ef", "comment": "Malware payload (Mirai)", "value": "5ef9357ddb30ac25ea9afabfd8a5961e09797fd73935ce3828972316ccedf47952dd4bd175b2f58b6dc2135a1ef79ad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962220, "uuid": "feb37e5c-f738-4712-aae8-94dc0cf48106", "value": "T170531941B8829563C6E4237AFA6D41CD332673A8E0DF721BDD216F2137C686F0D67692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962220, "uuid": "b75dbbe8-3d41-4c40-8d04-18e51c6a54af", "value": "1536:SXF399ON6GWj9uy62cbedNiaj61leeDZwoLbaZ:A9MNH1y62cqoaG1lpD+o3aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962220, "uuid": "11370013-8170-4b04-8400-440b7e14c8b5", "value": 62280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962220, "uuid": "067cee71-9807-4d95-8c9c-1a7c72777845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962220, "uuid": "25351eea-659f-4063-af83-7e68eb73a47b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05378e5-bf6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762913478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913478, "uuid": "036abba5-7008-474b-9843-eaca726f326e", "comment": "Malware payload", "value": "500d2688acb35207ec25816a3bb4e765", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913478, "uuid": "c602b862-70c7-4684-8e98-48d841266829", "comment": "Malware payload", "value": "ac4928b95e1d016fa8941da5e0840870c97987a154d70c5ae0124055ffa07196", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913478, "uuid": "87d32487-a694-49d7-99c6-b48024fe413c", "comment": "Malware payload", "value": "3ca3f75ddb8680312e7703b24f1191089d27e6c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762913478, "uuid": "55714418-0ea3-4d59-85dd-64aa1c1414b3", "comment": "Malware payload", "value": "bc7d02c6690abb1c19399a92c3b63c2296355d402c8e0f0663e6b125e633b146920d6bc970c24d35aa3ee53ddff7f955", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913478, "uuid": "ffc414c6-405a-4f48-98ed-225e2e10da5d", "value": "T17FE283503E84366E270E99BB7303A8D2F6571D5A299E89CFE1247C3470AA713F5F9630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913478, "uuid": "9063c48d-30c8-4cdd-a208-9f8057617735", "value": "768:TvynHLCOnlbmnfH9haeq3vOqSdScNlmstAeJI2wa5:OnHLaffyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762913478, "uuid": "9763eb0f-b4c3-4026-8910-78876a09c1d8", "value": 32757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762913478, "uuid": "ce5504aa-23a3-425e-9c7e-a7123b18c61c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762913478, "uuid": "fcb09d91-89de-417d-8d05-ed8bd367ae0b", "value": "patch.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3408731-c00b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762981693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981693, "uuid": "721674a0-4997-4f92-a2d5-e24019cd1a3d", "comment": "Malware payload", "value": "217c67e337a3f1c5851b09f19f98a6e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981693, "uuid": "0e091541-0791-4322-97ce-3d8dd8009451", "comment": "Malware payload", "value": "ad09c35e102808bf607e95658954fc30bf6f4cbe568768e5ed6d8ebc24545f43", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981693, "uuid": "fa9b55ed-da3c-4dea-8af2-4ef32448c5fd", "comment": "Malware payload", "value": "aee6463316eb180e1f9dd2ce676fa0300dd743af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981693, "uuid": "89b1cc44-5ee7-44ea-a6a7-b5059c93a3e4", "comment": "Malware payload", "value": "6fdd10e5e3fc9571e2d14a082f8ad6c477d6d781531c148b551eb23827d611f6dc18603a9098d1766d09b6f404cbdad2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981693, "uuid": "67b3c86b-b509-4392-b13e-5f65196509c7", "value": "T152546326EE875CA387D3DEA3D1E3D21CBEB554AC810B5EC4B5B8C6821861D2A0749F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981693, "uuid": "5f5f3d8b-45e3-44da-bbba-16a4b5be1f7d", "value": "1536:kuud4TTrB5XOjvnPvpBWfydS3oGi2zkESd7:k/WTrBlODnHb1QYHGkESd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981693, "uuid": "d3dfb21e-7c2d-4758-af31-16afae012174", "value": 278705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981693, "uuid": "4499907c-792f-4718-ad2d-1f17b7debc5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981693, "uuid": "8e49c253-9607-4d27-a594-5dbf238e674c", "value": "mdvAZtDNgVDqfMaVN6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24617619-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991761, "uuid": "ef6d3943-2e64-4327-b637-a3a8570f0807", "comment": "Malware payload", "value": "0df5496a28af4eb2fc9763521e5d41f9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991761, "uuid": "8033baa6-4950-4d38-96b9-a17dcd078963", "comment": "Malware payload", "value": "b01cd96e5f4399a616968ee1b551c58ba914d238531ce570f99491c2e5e7963e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991761, "uuid": "2a0fbd8b-0329-49e7-b98b-b7399221ae3d", "comment": "Malware payload", "value": "736eecb3c931ddf5e3cbc17f6c784707f8d7dc42", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991761, "uuid": "73a2b0c1-95f2-455f-8099-6fee7ee14534", "comment": "Malware payload", "value": "dbefe38ce6ceb84dfbf36baa497cbb7a46cc5642f1300e314fbd2c65e7366bdd61bcf31a11d18675eccc97f12f6f6864", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991761, "uuid": "048a416d-03e7-4336-9c5d-c289e872121e", "value": "T19A01009E31707121C468CFC5745DCA386506C3D36599AF15928D5832AECFB0B7267F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991761, "uuid": "8be0e703-8b92-4d19-85c9-e4a65154f265", "value": "24:FsOFgUsOagUsOfgUsOZgUsOEgUsOBgUsOvmgUsO4mgJ:F7FH7aH7fH7ZH7EH7BH7eH77s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991761, "uuid": "1563ac79-0c6e-4434-a265-f84d09b79437", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991761, "uuid": "563f029b-0646-4d09-8374-12470b8e928d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991761, "uuid": "cb843582-8b35-40c4-9603-1268cc9d1241", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a239ba16-bfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1762958471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958471, "uuid": "3718ba94-a3a1-4297-94c5-eed728551e03", "comment": "Malware payload (RedLineStealer)", "value": "ffad13a82b76ad9ec671ce5abb483381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958471, "uuid": "4193cb09-b180-4da4-b459-42bf6f41a32c", "comment": "Malware payload (RedLineStealer)", "value": "b03a20f72bbafa480554ad04df45c09a7b6e558c9e2dd9eaaae92b61a3c9097b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958471, "uuid": "c99cc7e9-e06c-4893-86a4-6a281dd28a01", "comment": "Malware payload (RedLineStealer)", "value": "cd5cab61eee3e808309178ceb18c9c0fef5cb23a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958471, "uuid": "a6244c7a-a78e-4be9-ab7b-923a36a607fb", "comment": "Malware payload (RedLineStealer)", "value": "b2047975f96b51cbf6d4363eb4368cd2e076512730db81c20cfe8adfb4d3c029097b44c3d5e693ce75816c20db552245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958471, "uuid": "4c3c4b6c-c114-491d-8be7-3f77965bf950", "value": "T1BDE41299135FCE13C5912FF44A10E2F463788E9E9401CB139FE67EDBB63E294A482395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958471, "uuid": "0cef5db3-9ff6-4362-84bb-6d67dd64d403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958471, "uuid": "dc859965-8d36-42ac-b2f4-72fb8b6b1940", "value": "12288:P40f/1P1s5FV4jskmkS59mAfaUo0fDSIU1TjwObdoRb9wqYmWH2UmweHLq:PxTsnV4j1mkS59m7UoVP7yeHHnmwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958471, "uuid": "97d6feec-23ab-4be3-83c2-2d84e7332d49", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958471, "uuid": "1f733ef1-f8bc-4fca-8e5f-267f6eeca9ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958471, "uuid": "3a9b53f8-d006-4c63-8fb5-8a2937be6dc3", "value": "PO MARKLPO147012025 & 1476t4564548.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a13f06a-bfaf-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762942056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942056, "uuid": "36fb4701-e2e8-4cf1-81a3-8fb038cdda3b", "comment": "Malware payload (RemcosRAT)", "value": "0ddc68aeb45f016c4d433e9b1dec504e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942056, "uuid": "7b31c2bf-196f-4728-8ec3-27cefcff7861", "comment": "Malware payload (RemcosRAT)", "value": "b073213ff4b316d41828688e1ead043c093381687cd2fa3a31aa1618d88d381d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942056, "uuid": "195510f5-6bf1-4d8f-85b0-73899078b791", "comment": "Malware payload (RemcosRAT)", "value": "6e4116228c93e4174e395bc21cde540cf02652e0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942056, "uuid": "c8c3c563-a7f8-41e0-8c15-15478aeba5ce", "comment": "Malware payload (RemcosRAT)", "value": "fb4a1d4abb1b11ce8522f50b692c16b18a2eb684cacf64596f25fd7cb4c1ff433ec56edbc05784aeb10d2b21d02f5573", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942056, "uuid": "fcb37d34-67c1-452c-b610-ef2419ea6e71", "value": "T15F863348CC422B1AE01FD7B91392C77193AADE11AF2851576201B365BEF2690FEF71D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942056, "uuid": "ed812938-2b36-4c13-b013-5bf7068cff7d", "value": "196608:CJMlrDEvSmJ/SF89zCgesq6H6PqIntZkKn6lWqy:Vup/SIrXiqINq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762942056, "uuid": "b79c2bdf-202a-4717-a1e8-1efe5149c74c", "value": 8613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762942056, "uuid": "66260438-9d2c-49c1-838c-383c2c0c34da", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942056, "uuid": "aae08737-d331-46e9-a8c5-c8ca9f184147", "value": "formulario_citas.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccea634c-bfe6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762965844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965844, "uuid": "39eee264-293c-4d95-b056-7ee9cf1a13b4", "comment": "Malware payload (AgentTesla)", "value": "fcdf752fcecc9ac63195330d386e28b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965844, "uuid": "dcf00262-701d-49e5-9cf9-6bd0cc1b558f", "comment": "Malware payload (AgentTesla)", "value": "b24bcefbc846b898ca8b37984ec1a5d8ae1f1cad6b7be3566554f562e436a87a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965844, "uuid": "b0c0ef5f-bfdd-486b-bd44-8e447fdfad46", "comment": "Malware payload (AgentTesla)", "value": "42e2de82b7d3a4d9d8e029fd8aecaa5f417175f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965844, "uuid": "20252262-eb93-4d9e-960f-8f985a5fd846", "comment": "Malware payload (AgentTesla)", "value": "e932147c4aba13e14ce36ad1b36e8ca8b9638a643331cf07d3a13d3155882e17cd13be1a87fc2e2fdf51edbc3f74f1f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965844, "uuid": "bf6c3a17-0fc5-4129-adb9-fb257e495247", "value": "T10ED423D7DEA49E2B00ADF29A4A42C1214B13D33D175EDF307A5314B6319DDECAEB6980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965844, "uuid": "9458ffa6-a328-4438-91c9-5784d0e45471", "value": "12288:bvu6Dv7rvggTbeCUxe5tHAY7+q2ihLtZ27AmW3kl2A7ggEfGgezxU:y6DjjgTCJ9OIpZ2UZ3kl2EgE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762965844, "uuid": "7d132219-f195-4643-8e47-0a55869c5b54", "value": 637050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762965844, "uuid": "50912cc8-1418-4024-95e6-c7d7b2a66b8c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965844, "uuid": "b403c463-2a18-4a42-a84e-4fcf82dc7035", "value": "HAT-PO-2025-149 .rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91522c07-bfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762958443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958443, "uuid": "3bc5e544-3bb4-4c0d-ad21-0d75b1aef32d", "comment": "Malware payload (AgentTesla)", "value": "c89b3df7dc4bdfc1f981e214ab6c6e4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958443, "uuid": "28429308-616f-4a3d-b8cf-cfd1963c369c", "comment": "Malware payload (AgentTesla)", "value": "b2ec1b86e1d28a7931b304b7ffacb31f083d904f81040fbb1565c77c14db1fc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958443, "uuid": "be2a35af-8ec1-47c2-adb4-6d01ef69adc7", "comment": "Malware payload (AgentTesla)", "value": "8ad003c736cccd77d7c42b1b47e76d73d2ce053a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958443, "uuid": "82dabb68-13c4-45a2-8364-0e1f34590def", "comment": "Malware payload (AgentTesla)", "value": "4e29f53ce66b5771691391975f1d4d6bfed2cc923c77eb05998890843ca543aa053d08c4fff8ce3689a116a59f3c451e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958443, "uuid": "248ff641-b312-4b80-adba-058869ba54c6", "value": "T1E252CCC8BFD2F7A21373A4632D27701DB36B6880F55C6185F239E2A4F860728D4E5878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958443, "uuid": "82ebedba-3aaa-4f03-afc4-d3ee100c0cdb", "value": "192:0TOBtuUl0hDH2St0Hyqsu7Y691ceIq2jZ+MVQgMfxdl3Caz:D8Ul0J03sx69kq2sgQRx3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958443, "uuid": "d0ee3b92-9d93-4492-851d-f407a36f87d5", "value": 13455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958443, "uuid": "3f75e3a4-4944-4c2e-980f-020050ed325a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958443, "uuid": "765758d8-75a5-4d3d-be8d-3e0ebc94592b", "value": "Product_Specs_for_Quote_Nov2025.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108b9992-bfe5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762965099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965099, "uuid": "6f989833-cb87-49a3-a74f-4051c5e25d2f", "comment": "Malware payload", "value": "1f6765eaa07a6276f77dcab1b20f4f1a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965099, "uuid": "87eddca9-2d43-4517-a993-d3b782f97cdf", "comment": "Malware payload", "value": "b2f6f559bb6c077f7a3dbe2fb5e3bbe6aa060391265fe8f719f45e9f2ce212cd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965099, "uuid": "e8979937-4822-4276-a394-c0071383c99c", "comment": "Malware payload", "value": "3224387a003896a7dac654a5ff7d5473f4266a84", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762965099, "uuid": "312080fd-74e7-4272-beb1-acc9f9b286d1", "comment": "Malware payload", "value": "7b63854f41d91d0d5454d6000c2b33cbc5a96419a5bae98bfbd0c22cb9aa4c4344d8ad94d6e05503d364b5a788a9d97a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965099, "uuid": "ec246110-17df-428b-b243-f7d4f47bd85b", "value": "T175731EDC725072EFC85BC4729EA82DA8FA6174BB831F4217942715ADAE4C897CF540F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965099, "uuid": "677d8d2e-0956-4970-9965-599706c7ad7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965099, "uuid": "d4c05f7c-ee43-4f34-9f22-0ea7cd155147", "value": "1536:ktsPIBXI/BERtyqa8gNkaGcm60yW3NtlTbCAQZbWmjg:ktc/BEba8w17MYAQZbWmjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762965099, "uuid": "1236441e-aac4-44bd-8fb5-54b10953de7d", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762965099, "uuid": "ae230d5c-ee16-4b30-ab4f-11f2326f0515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762965099, "uuid": "7cf0f6d9-47c1-4a80-9736-2acb227a3c11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb10b399-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935320, "uuid": "d3386478-2349-4da2-80c7-4b056aaaa9a4", "comment": "Malware payload", "value": "61ba159b3454c9ec1aadb614028774b2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935320, "uuid": "82d97c69-5986-4172-9369-2c9171b60602", "comment": "Malware payload", "value": "b459742f75504efda93e1154e73c41bc07bac7d23333b71f11ca3043db752217", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935320, "uuid": "0b4042fc-3407-410e-be7f-c2926db03d32", "comment": "Malware payload", "value": "880e9aabf932e8129fd4ef1f2b21bed055f3861b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935320, "uuid": "bffd216e-8254-401b-9356-38c8cce06d11", "comment": "Malware payload", "value": "61f82313d9013a893e9f113c9c70dab750c377521c9769d5383a7e06e3771a5bd9edf74d23be038374fa8cf6e7ac43e3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935320, "uuid": "b3bd8d02-ce08-419c-8cbd-7035e424baf2", "value": "T15A26F18BFB58A92FC87B14F209AE523116474D178E8397436D48321C69B76D83F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935320, "uuid": "6d04f4c2-5ac1-4826-b8fe-8b32169cf066", "value": "98304:QpaXL+64cLxNl/iyypjXkLzq/64luhbMaAfYwA8XUFygLCr4Sf:Aab+yxT/Y56ynLXUaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935320, "uuid": "44484f27-8104-4d4e-92a2-c66a4d745cd6", "value": 4842966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935320, "uuid": "9d729d28-c714-4b8e-891e-3c057c3cbcdc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935320, "uuid": "6a7f5a51-a95c-49bd-991c-20f1bf001c12", "value": "cafe4d_1.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c965ef85-bf5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762907427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907427, "uuid": "c1b102ba-a6e8-4e6f-9c27-6be8fcb7f1e8", "comment": "Malware payload (Mirai)", "value": "1fde86e44e271ca3c16c5c74aac890e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907427, "uuid": "7c71b3f8-5de4-49da-9352-3c5c1c1c25a7", "comment": "Malware payload (Mirai)", "value": "b46706417b0f1b6475ba53adb39054ace8e5f438d9f64a622c78b2e18fdffabe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907427, "uuid": "2b029fcf-54e8-4bdd-aaec-090adc8f081c", "comment": "Malware payload (Mirai)", "value": "ade1ab798bc2c2099ca594f567b0a5d551b8f4fa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907427, "uuid": "ba43dbb2-2c97-4791-8b22-e32046fef76d", "comment": "Malware payload (Mirai)", "value": "a09dfb7219fa8fb9d68e5343f1bfd047c19e46d048a59a07716f664bd2de541b51330f17a657600bb13abfd4a1ef97b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907427, "uuid": "4286eb46-dffa-4701-b379-8c6102871af2", "value": "T1651112F82065512A23186B11B06E89396CF7F7E260329DF0907FE42361CB2917722F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907427, "uuid": "caf7c7ee-912b-4d3e-9a92-bb54fb861078", "value": "12:3J3HqxHoaLxHWNIQQAxH7vK2HxHtKAxHbHxHqxHg5xHoHxHIcAxHu3AxHJzAUn:3J3BNIeK7q8SuAdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907427, "uuid": "b4009fef-9af0-4411-a4b0-9201d6091630", "value": 1085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907427, "uuid": "52a39a72-09f6-4917-967d-b14fa1db5201", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907427, "uuid": "f88ee53d-1a8a-4c62-bbe6-c31b7a1d51c2", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e856462-bf95-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762930843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930843, "uuid": "ae55a1c5-7da7-48d1-88a9-efc0ea0aa200", "comment": "Malware payload (RemcosRAT)", "value": "37d12116ff0855a805add31a0ea493d5", "object_relation": "md5", "Tag": [ { "name": "196-251-116-2", "colour": "#998C6A", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930843, "uuid": "7989b0b3-6155-4ccc-aa3e-caefa6dfe52f", "comment": "Malware payload (RemcosRAT)", "value": "b626c6f8924d4362e9159c8c403de3d527357f086a1d5ca27ef294d4ebae00b4", "object_relation": "sha256", "Tag": [ { "name": "196-251-116-2", "colour": "#998C6A", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930843, "uuid": "d2100eff-8049-4c35-9801-a6284ab98ef4", "comment": "Malware payload (RemcosRAT)", "value": "c166d147f07ea7647cc4399f16d2f84e3fd61860", "object_relation": "sha1", "Tag": [ { "name": "196-251-116-2", "colour": "#998C6A", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930843, "uuid": "1b4493e6-4b89-47f4-8363-cbdab4d63a22", "comment": "Malware payload (RemcosRAT)", "value": "6893a4140f313941f0e4f0c12d4b960910294aa7f2a106795fd59e38341227b7f191303868978df87abf145191919654", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-116-2", "colour": "#998C6A", "exportable": true, "hide_tag": false }, { "name": "AgidCert", "colour": "#56D604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930843, "uuid": "4ea3b586-0fbc-4a6f-ad12-51845168cd4a", "value": "T1D9D45B95A3E441F4D077C234C9C24537E6B2B8056671862F03E74E5B6F237A29F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930843, "uuid": "a4043bb7-42c5-4e91-8fe8-a09e31862f52", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930843, "uuid": "08c360bb-73a2-4b8f-8ef6-3d469eb51f98", "value": "12288:Bow9/1lAlDpFLOaBarQCYYTvaq4Goh1ou5OOVE:BH9NlqDpFLOaBarQaTvaqxoh135u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762930843, "uuid": "9233d0b7-6856-44be-bc13-386e0e430946", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762930843, "uuid": "e03f7665-4901-4ca5-9547-f5ef459ea15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930843, "uuid": "dea707db-63b0-454c-98b9-fd7e8fe36e30", "value": "b626c6f8924d4362e9159c8c403de3d527357f086a1d5ca27ef294d4ebae00b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dccf362-c009-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1762980556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980556, "uuid": "141da6fe-350a-4ace-8469-e0ff98c0da4d", "comment": "Malware payload (ACRStealer)", "value": "9681ed3581c5d09fb805026416d268e3", "object_relation": "md5", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980556, "uuid": "3b1992a1-bd28-4d93-b685-a404a60fc6ec", "comment": "Malware payload (ACRStealer)", "value": "b6dfa5d4cf51e2616ccb0ed4dcc3f0ab1f504c7b11b6366c73be860c42a3aa99", "object_relation": "sha256", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980556, "uuid": "20ab34c2-1d76-477b-bb7f-c5d490df562e", "comment": "Malware payload (ACRStealer)", "value": "68383ae445686eb5c89a2a027c7d470a7a8f4978", "object_relation": "sha1", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980556, "uuid": "6310673a-4343-4f51-a741-4b33bd4172fe", "comment": "Malware payload (ACRStealer)", "value": "a716f68560c10b3341334be1c9929b6ca8a65b58a3c6309a30ac7795a647ce3b7fa4a4fec689997755f479e8995dd4ea", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-43-50", "colour": "#58A738", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980556, "uuid": "6aa91ee1-a1ef-4b7c-96d1-84c8efdb2b58", "value": "T14107BE9BF242CEE5C08BD87014A3A7A29B307C1D08A007D7B1DEA76EEF72D405D56D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980556, "uuid": "1a75c201-9d81-422a-b2f7-14326b99d75b", "value": "f4e37ad53fb1cf51100953c5614ae872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980556, "uuid": "1c725f2a-40f4-4ef0-ae54-fa2e74461148", "value": "196608:gBWXBB8f18p6v0zUC6fnAf4LynX5MZsvzBFPZlZyqz+ouOTCTy:fZfpnXDvHxlZyqzfuOTCTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980556, "uuid": "650c697a-e8ae-4709-98a3-8693582459b6", "value": 17311800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980556, "uuid": "a31f30c8-95b0-4a4c-bd95-5b84b0182e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980556, "uuid": "ffbd31a4-c11a-480c-b985-616f34c52001", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b06d24-bfda-11f0-a129-42010a9c0007", "comment": "Malware payload (QQPass)", "timestamp": 1762960541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960541, "uuid": "7492c115-546b-4182-bedd-89e288330bf0", "comment": "Malware payload (QQPass)", "value": "ae74dd88eb6e2bcb9e4c2fae347320cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960541, "uuid": "3a86a474-4695-4ccf-91cd-c3bcb693ddcc", "comment": "Malware payload (QQPass)", "value": "b7324c29e583cd529ee3da94c962ec72196f564bb2ddf015684f2c953973028a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960541, "uuid": "a3c7c161-64b1-4905-ae76-2df0cf331d7f", "comment": "Malware payload (QQPass)", "value": "967bca993424cf9c8ebe31c23bc23d7458038ae2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960541, "uuid": "435cb593-2ebe-4b26-ada9-c9cdf1734e61", "comment": "Malware payload (QQPass)", "value": "033e4c81a10ef34088f43eec5f6772c8eeb2b90ac1e3a736f654b21d302cfe35473ccefc100d54d61000cedd476860e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960541, "uuid": "3a731d89-36dc-4b67-9b21-8d6014ad1496", "value": "T196536B68A79D8703DB6F8EBF56424092C7B1FAB6A70CE74A1CDC15FA28853E507012D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960541, "uuid": "b8a868ae-bd46-4c34-aebd-09c63dcc7034", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960541, "uuid": "37c78ef6-d63c-4471-b7bf-28dd296058a4", "value": "1536:WRpqpWpypRadTc/44OajZMLl19agzC8uOEbzbiKehvf:yg4U2Tuddj47agybbzbzehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762960541, "uuid": "f3b04fee-527e-4175-8c23-c70a2ab92c07", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762960541, "uuid": "8dcb05d6-8616-4d84-bff4-018287f72050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960541, "uuid": "8f476217-abf5-4c4e-9df8-cbe40758f086", "value": "b7324c29e583cd529ee3da94c962ec72196f564bb2ddf015684f2c953973028a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c0ae6d-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991760, "uuid": "ebf8d9d7-0a76-4e1b-8542-807ae5e95265", "comment": "Malware payload", "value": "2439720d03d6e250f9b5fd237e5ca872", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991760, "uuid": "cea262f7-d67a-47b9-8510-23863b1c45aa", "comment": "Malware payload", "value": "b748778a3d29f9927144d643783933a5a72775cf125b27924bcad4ada27a6269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991760, "uuid": "179dcfea-1d9b-4e88-90fb-11a8d983aa12", "comment": "Malware payload", "value": "1afd238a264917f4680e536b5c8de6aee2fc6942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991760, "uuid": "b9ecabf7-660d-4157-a23d-5103dd81e74f", "comment": "Malware payload", "value": "03c231e25952f58a9e19071f04932f4ca980dfca371ea154479b036007b73ecd4663673419c53494d90e1697b7c086c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991760, "uuid": "37901cba-7d01-46f6-b8fc-16ce0927e942", "value": "T16FC31B46FE905FEBC45FCE30053A830316ED98CA92E1771E7278DE8C7D6924689D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991760, "uuid": "ddf28eb6-bf47-4fc5-b3f2-17de561adf98", "value": "3072:l8GY4pSNkD9rqI2BIvxwOy6QBX1ujg4r2j+h8wXeLLLJv:qGeNkD9rqICIvxwOFcusHj+h8wXejJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991760, "uuid": "6e315696-048b-4163-97dd-5bee2dd33c93", "value": 128036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991760, "uuid": "0e1dca65-87e7-4ba5-bd47-212a8590b85a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991760, "uuid": "cc7e3e7e-4f5e-49c3-b800-22514ce80170", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9259bb1-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1762959423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959423, "uuid": "7bc1a89b-0298-41d9-8728-bffd89c90e33", "comment": "Malware payload (GuLoader)", "value": "60580e227b72528a2272baaa708e7e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959423, "uuid": "f7312c07-e230-449b-8fc1-3dd1847595cd", "comment": "Malware payload (GuLoader)", "value": "b77a470abcad2acdddec07438813988ed2fd51fc4215ab1e8b803c7df3f90539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959423, "uuid": "2d1ed88c-7297-4f4e-815a-d5db6600227a", "comment": "Malware payload (GuLoader)", "value": "99691524e4523ed7b93ade43e073bc6b591647f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959423, "uuid": "1662be62-9dc1-4884-99eb-81703493b523", "comment": "Malware payload (GuLoader)", "value": "e716709ab72a17db949f7cf7392d1d3d832d22b1db1063b2a677300ac5adee6b9bfc607e7f7a620551a61a2fb8759b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959423, "uuid": "a26534a8-c96b-4b5b-a8d9-506ab9ab85d7", "value": "T128C402303654F059C80FA13C4B1EF22E57B9F8E92B07855B6B61BF6E3DB5283890A4D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959423, "uuid": "befab0cf-af46-4783-a32f-b52f3a46a8ef", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959423, "uuid": "2b8467c7-ba86-46b5-ae6a-8cfd4f49ad26", "value": "12288:DX4j6f40DcylpOb/n/+DGfOUznAzPnSgMhGcDkagLRvzOOat:L4oD3lcT/+DuOUDAz3WDkLzAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959423, "uuid": "7b7e23f8-c489-4603-b93c-5a1c171918b3", "value": 573336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959423, "uuid": "8440c395-2568-4bed-b15e-e4f23a0e6740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959423, "uuid": "6c43810d-069c-4dbe-bc54-828087358a41", "value": "12411225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522bb3ab-bf8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1762928272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762928272, "uuid": "ee1d42c8-c21f-4b0f-b991-9a998fd8e0c2", "comment": "Malware payload (Stealc)", "value": "b68612aa1c68bb6ee7c82f7a85226f13", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762928272, "uuid": "c6bfc780-e573-47d9-9b11-70faf0f859bf", "comment": "Malware payload (Stealc)", "value": "b7e81d572e8943237ac7657be603b4a08ca5b5e6822d33575df9ff7f932b8988", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762928272, "uuid": "bf3fd942-9eb5-4d6c-87e9-ad10d49936e2", "comment": "Malware payload (Stealc)", "value": "5128b3cc0c06ee34a1d99f6cf83756f1aab57cae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762928272, "uuid": "433594bd-f596-4cc6-af80-cb5c8b5a9c69", "comment": "Malware payload (Stealc)", "value": "348c59bb10d603fa34a69100f10f741614e68f85aa5376183d55003ef659ccd9ab6e093a78d245f582a22ebd2c617448", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762928272, "uuid": "7d4d86de-f796-42fd-a6a3-2622ede79dbe", "value": "T17BE53379A3836C8FD04C8F761A88587ADEDCAD40AB75898F4925794E5B362D4CF1302F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762928272, "uuid": "43af382c-c8ea-4aff-8f32-fc27ae2eca24", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762928272, "uuid": "6edc6b09-2905-48c2-9bab-33ae26212a5e", "value": "49152:98blqYaY+nZ2k4Vh1fk/AsKdItz2oSmpLevv1W/sGCQj9VZigo5UC2ct:9olqZYaI1fk/AsKoSmqcUfs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762928272, "uuid": "a992c527-0292-4ca0-aa20-ccc09f039bc9", "value": 3075168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762928272, "uuid": "1fdcc274-e596-4a99-8642-5809e8b84dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762928272, "uuid": "050c7394-7fd5-4bb1-87a5-6de65e2d3ea9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5584f9a-bfcd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762955148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955148, "uuid": "3e7d6c4e-ffb1-4fed-a129-60d3631c1496", "comment": "Malware payload", "value": "c597d08aacba2e7dc2f363cac34ff89e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955148, "uuid": "bbececcb-d822-46cc-b67b-460f042398af", "comment": "Malware payload", "value": "b8b3d3669b85630670052d53fe189875e91eda44ae60aaf36f7135f51e113b8d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955148, "uuid": "ca06e833-c26f-48c1-9c3b-7ae5f85b9f98", "comment": "Malware payload", "value": "b951ac7b9596aa5aff256e0a74fddbe7b22d2fad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762955148, "uuid": "48e413ca-5c45-42b8-85ca-14863c59425f", "comment": "Malware payload", "value": "c411ea3c439b7ae83fd766095da7481ce70bbe9bd984569d5e60f7a2dea3165ac1fd0025fb6e5c9a069ddfc27307a108", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955148, "uuid": "9643c466-90ff-4516-98c6-4a643ae7af14", "value": "T1E6947D26FBD15CF8D097C07483528532A672B8C90B21EAFF13A852252F66AF15F3DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955148, "uuid": "1f835416-3dc3-40f1-8def-19e8938dfea5", "value": "eaed6c102723330cc21072da5f916b52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955148, "uuid": "79378092-8d34-4f81-ac1f-20d7ec7e1dd8", "value": "6144:lgKZVOwl7PvDNOHQFKa72xB/XBaV7/5Mjswi:JZVNzvgHYKQ2JaV7xMjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762955148, "uuid": "5861a6be-32e8-49b5-a9ad-b2fe63603d55", "value": 421176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762955148, "uuid": "bb854524-1ed7-4c47-ad2a-e9d24cb0fcba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762955148, "uuid": "2a87622b-6f15-429b-a473-e22e67db5b3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91ba561-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940015, "uuid": "f4290509-cb5c-443e-91fc-77a7ec7dd100", "comment": "Malware payload (Mirai)", "value": "c27c48cc77c99b3b7f7a0909e1205412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940015, "uuid": "5376671f-076c-4849-b16e-381791bc30cf", "comment": "Malware payload (Mirai)", "value": "b8da0343fb0e159aae382a650e7db5481d54b498f155be84e7e1c87e601339e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940015, "uuid": "13c0bad7-c65d-4b2c-ba33-4001f791678e", "comment": "Malware payload (Mirai)", "value": "d8d78fb5ebf11e2ff1e56b020cf3a373a5db8053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940015, "uuid": "9be8d276-3fce-479a-8e22-653534a27f02", "comment": "Malware payload (Mirai)", "value": "81e8fbd1bb1b328ed731124421c69137bf4c5f71b69fb6772c466b64a7278282a368315276ff7bf8bf7a0ae904777b3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940015, "uuid": "276ecf37-6f6e-4e41-bf98-896733abffb8", "value": "T10453B519BF650FB7EC6BCD3709A81B0538CC644A22A87B367934D468F60B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940015, "uuid": "e8182d04-464f-46e1-9506-52623acdb0bd", "value": "768:iAVWeGUx4YGMmnwCw5BheiTebiQ2ZFVyXiSA7mWzkCw:iAVWds09wxjTIitZFVbmao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940015, "uuid": "d23f6c03-356a-44ac-9f03-cc4ebe21eb5b", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940015, "uuid": "b5c75e62-debd-402c-84f4-58265890812f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940015, "uuid": "d58c974a-e497-465c-8e51-eb7710f51859", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d098ed6-bf61-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762908534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908534, "uuid": "318e04ab-99b7-4500-aeef-7ba70a5b913b", "comment": "Malware payload (Mirai)", "value": "32fb6326fa9145b18ee85e18cb975412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908534, "uuid": "6d08e64a-0237-4189-b086-b122279b298d", "comment": "Malware payload (Mirai)", "value": "b9a216ebff916091d3d22af2625b436d3e5e6998522a1685bb476191ef93e461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908534, "uuid": "9831a71d-076f-4651-bddb-d2f7978802d8", "comment": "Malware payload (Mirai)", "value": "925cbadbaefef9d7adcaa64a579c4c7cd57a7e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908534, "uuid": "8f075a78-db08-46be-88db-5b4069fd2f6e", "comment": "Malware payload (Mirai)", "value": "a33b4292a71c8a24e266304cedab64522a68089ff6021ef4279e9f0dba9b5507f80849bf58b13202c6a2a2fa04faaf7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908534, "uuid": "c1d08b85-9ee2-48bf-af86-36bebf6c7a64", "value": "T167F3CF9FBB8B2191C45702F007CF8BAE679310159EAFD1E7EE5EB63B14391DA9402360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908534, "uuid": "d46ea11b-943c-4882-8658-8f97fd563e29", "value": "3072:oL5vACggFDNgWDdAM/22Wkx/i3gBgL1q:ousDFZu2yR1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762908534, "uuid": "b0c0dae0-4feb-4fa6-8594-caa0dc354834", "value": 157308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762908534, "uuid": "3de5aad5-faa2-422a-86c4-99794ae97a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908534, "uuid": "af3434a4-b846-496e-b37c-471fee33d273", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe86a0ca-bf8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927703, "uuid": "ed62695c-eb4c-41b1-a987-a732ec05926e", "comment": "Malware payload (Mirai)", "value": "fef4c22eebd7c9ee6b717aae5927710b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927703, "uuid": "f32b4e2b-9c3d-4893-a43a-fa61c640877f", "comment": "Malware payload (Mirai)", "value": "ba059958573e7c59fca06c991c2b72097d0eecd232c29da7928ec7290e27a545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927703, "uuid": "e507f604-e409-4381-a15d-6b4aeae49fd8", "comment": "Malware payload (Mirai)", "value": "9db46fb84da862ee2f0969a29a0243a254f7dada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927703, "uuid": "64008dba-374c-4915-8004-c2227771e052", "comment": "Malware payload (Mirai)", "value": "27b94b01c7f512b28f5668bd6c85810a9de986dd36f5bdd0f21778da8f87f396b014b8f66692aea76dd5c373a4ab11da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927703, "uuid": "7cd2ce2d-eedc-422e-9140-a0c5fe095fce", "value": "T112D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927703, "uuid": "a06732a1-853f-4aa7-a825-f2d93bae55d6", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQI:yIRfe3xvvSrlvZZ7UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927703, "uuid": "b56332f8-0447-4033-b53e-6c9d89c55315", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927703, "uuid": "e4a92d51-cd7f-4f51-8ec6-191ba82f2695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927703, "uuid": "c04980d5-5c50-4f43-84db-bc66a13d85aa", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38da56a-c011-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762984378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984378, "uuid": "752ec30a-4cd4-4948-be2a-e6b91203e238", "comment": "Malware payload", "value": "221f37f7d86a4bb0440402c4723f20e1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984378, "uuid": "c4c5842c-bb91-4369-a85e-8dd4892af0b6", "comment": "Malware payload", "value": "baf0571512e88671ec1fe0b76efdb51fe1827912c277d0edec4922c4b0f0e1ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984378, "uuid": "be64ec70-1c36-4971-8f2c-a29a671f64b8", "comment": "Malware payload", "value": "3d50e424d9adabc339796305ebbd0ae3900bbe3f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762984378, "uuid": "6c6dab0b-1315-449a-ad20-4f3d3a2d972a", "comment": "Malware payload", "value": "85d8b77a92e386b2e182c71c68b47bfc6ff6869f45f1219b7f58f0c98a578b0256e5d736812d484c506d8c31ea9bc0f1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984378, "uuid": "8ede4af4-dfbf-42ec-b746-1a25f6eaa6ba", "value": "T134A14326FEC74DAA83C3CBA3D3E3D35C7B68948C9107668079BC82810960E56574DF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984378, "uuid": "5558651a-d65c-4c28-bc32-bce37846915b", "value": "48:Kc6GAbjT166dSM8EO/r5Qf6fnMYXTfJsk1Vj6ou665d2cTGAbBlAMjYXUXw9EDbS:Yr0pffdXLQoIprBTMX3KpXxgprbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762984378, "uuid": "3d038120-3837-4286-8a34-3d48cb02c2f9", "value": 4722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762984378, "uuid": "e6f078ce-b06b-40d1-8e5f-c937e3129941", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762984378, "uuid": "224e6e68-7986-4db5-892d-e2c68f5e863c", "value": "styles.css.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b12bf5f-bfdf-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1762962647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962647, "uuid": "198796fb-7cc2-4fae-b4e9-e51b00676729", "comment": "Malware payload (GuLoader)", "value": "01352ff90624d23d05f6f7f536165b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962647, "uuid": "ee9ff834-f6e3-465f-ace7-545c273f5a41", "comment": "Malware payload (GuLoader)", "value": "bd8ff6ebbd58786ceb7b9d931c41674058b124d362c7226ed9d0b80f2eb92663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962647, "uuid": "91d77d88-5ba7-45fb-a048-c0b11e8d21a5", "comment": "Malware payload (GuLoader)", "value": "7000a0085a0ccf20c2db6de6c51687f8619d061b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962647, "uuid": "8155201b-165b-4570-b165-5b1e92b743db", "comment": "Malware payload (GuLoader)", "value": "6784c25a033617db411d167661d03dbd9062b985a12d2a88160814244807e975534519934e0503dccdcc0e47f2401d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962647, "uuid": "8b63fd39-6494-4506-a728-64730bd39db0", "value": "T13005230AFBD0D7CBE0A3CF70001EC9BA86122F791994A4176F51BA9DFE725D04426E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962647, "uuid": "694e65d4-ef5d-4e62-a70a-dc268e0c9286", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962647, "uuid": "d9afe9c0-33fd-4ac9-a17f-5b28b34c4280", "value": "12288:2ci/4oAiV0n8dORgtauk4epVsWoFtV13urP1qz75Tu45FEmN+DQMs/8O/aV5Nxl9:2n4orYgtTk7pVsvzza2QzmKw8OixV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962647, "uuid": "1bff2dfd-b050-4f14-a710-74661bee22c0", "value": 852984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962647, "uuid": "b52dbdf3-56e7-4d42-87c3-e333a0577a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962647, "uuid": "107bdc7d-2451-4207-9ca0-136fee49bf04", "value": "INV CAT-26104.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581fc8e3-bfb1-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1762942885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942885, "uuid": "1ae6f8ac-1dfa-4f60-ad8b-774128b614b3", "comment": "Malware payload (ConnectWise)", "value": "4b94c5e1d4d2483efc01850df63a2115", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942885, "uuid": "87ea237f-4275-406e-845d-6ce9a0710d76", "comment": "Malware payload (ConnectWise)", "value": "be48b072d698b978b8547d3d8d6901586ec4abb129786cd880d294bd273a5b87", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942885, "uuid": "49bc981b-18bb-49e4-9caa-432187838328", "comment": "Malware payload (ConnectWise)", "value": "421a477d45f6dd9bf7fa2e0aa2230bef6dcd307d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942885, "uuid": "7b8989d3-7396-4ecd-ae79-f5bd1e45b135", "comment": "Malware payload (ConnectWise)", "value": "b5395b1facb7b66e74541220d3bd42c466b4a6c7530a5be2851ac27ef5542c5bf69a5631f074188f92e19af2c2e88751", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942885, "uuid": "eacd6a26-2d48-4adc-bb13-4b3bbafdfc62", "value": "T100C61211F3E592B5D0BF0A38E87A42665A75BC049712C7BF5790792A2D32BC09E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942885, "uuid": "3ebd1298-322e-4359-82e3-7da1a6a49757", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942885, "uuid": "a8033d6f-1268-42ce-b95a-9554fb801d5d", "value": "196608:13fefPG9gnsvf43WsH9BmgnsvfYgnsvfxgnsvfI:1Ywg3t9Bfw5w6wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762942885, "uuid": "2be02ef5-a0fe-4eb2-bcb7-dd355f0ca637", "value": 12572728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762942885, "uuid": "62c8bc64-771c-4849-8f7e-77ea3effc832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942885, "uuid": "b5322cc6-0171-4a4e-9727-4423178ce09d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a14fcc-bf88-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762925164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925164, "uuid": "5b5a043f-5a63-40c1-b01e-53b3a72eb864", "comment": "Malware payload (CoinMiner)", "value": "ef7d859fe887cea87d43ef8193506ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925164, "uuid": "65fd4395-5405-4399-9aa4-7a0187781747", "comment": "Malware payload (CoinMiner)", "value": "be8f32a15a3077ab8f5d25236d6e7b491cd216028f77d27bed5df333ff7c56c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925164, "uuid": "e8968f3c-50fe-4e44-89eb-a762e2480687", "comment": "Malware payload (CoinMiner)", "value": "937280d336b7c104172d1a9aa013231f4a52ba21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762925164, "uuid": "c6c9ab2d-dc05-4424-8642-1834918b5f96", "comment": "Malware payload (CoinMiner)", "value": "fb21a242196cd2edc5c36e0be25fdcf71ab2ac9c1d8abde9b35d718f041645391f6b1914028d957f02f31541d9d88679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762925164, "uuid": "b3ebc2e7-9d40-4d93-9759-de84d1ac2991", "value": "T1065533325F84861189AC21F5D45DA8FED6C913E9D36D3CB6C11E7E310E2F2C84E589E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762925164, "uuid": "02296026-b6be-44a0-af9f-8ef09defacdd", "value": "24576:bz+Wj3ymRslBUwWFRFRD0WzwKTJLw9YiJDScnYuwTmxBgB9FulGLUM0Oe:bzPLymRsBBWF3RD/wKTJLJimuwT8BLws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762925164, "uuid": "b8321877-b8f1-41f9-8ce7-3b53f84ad6b8", "value": 1300044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762925164, "uuid": "70d43a2c-5cdc-432f-802b-17ee1466ee98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762925164, "uuid": "93a33262-4979-45bd-b2b6-66c12b92bc3d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864ff8ad-bfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762960572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960572, "uuid": "7d6475d7-402e-432e-8529-cab19eff03cd", "comment": "Malware payload", "value": "f55f690ac4d904eb95869266c5366a9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960572, "uuid": "d13be773-9f30-4a17-a342-31ac61fa3ce5", "comment": "Malware payload", "value": "bf9fae2e1106417334d23342d83b1231d1ced3d7035d96d764799b0b3587fc2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960572, "uuid": "81eaf74a-acbf-47dc-8838-925398eaa485", "comment": "Malware payload", "value": "62ebbaa71ee0b6ddb4f94a9ef97eb712d362c267", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960572, "uuid": "29d2e4ef-0e8d-433f-a612-900594cec3cb", "comment": "Malware payload", "value": "4a5c60f53a8e233c1391711ff31bc11694500dfeac0174e8bc7b3eaacec9708f369f56072eecc1e290e2d366eff29772", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960572, "uuid": "5f40364c-8b44-49e8-991d-3ec7f4bebc33", "value": "T1FC132AA9A348471BCB9E0EBC5C92961B0771FA97A409E60B7CCC47D52DF63D304256CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960572, "uuid": "504fa456-06c9-448b-b37d-52b8b94c3fa3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960572, "uuid": "09ccc746-f84e-46b4-ae2f-b30eb55fe08a", "value": "768:wfMqwxxPKnWppqytH+s9IXrTq4ZFwb8lp8Lw1EMcFSza+:wf0xywPkXXeb8lSw1EMc47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762960572, "uuid": "5a4fc1fb-c71b-4ffb-a7e6-ee005f60bd8f", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762960572, "uuid": "aa8487ba-9042-4e07-a4d1-fad1b3b3e131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960572, "uuid": "c8a16c75-c54d-421b-96ba-1874ea29dc50", "value": "bf9fae2e1106417334d23342d83b1231d1ced3d7035d96d764799b0b3587fc2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e20d17-c019-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762987440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987440, "uuid": "f8f66a21-8a70-471f-8f66-aa62038ee3ab", "comment": "Malware payload", "value": "3855f92ba6024029181e8bb068f706c2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987440, "uuid": "61bed060-e202-4d1e-be1c-b4a602cb9de2", "comment": "Malware payload", "value": "c0142855bb8324f017937cf4d54b19ee6283f319d9bee66951c203e826f9bf59", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987440, "uuid": "51c517ca-3b42-42c2-9190-b46251767e8b", "comment": "Malware payload", "value": "cae8f058552903b1c02bf9cdb150833567c90de0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762987440, "uuid": "9588a849-cc5b-4b48-8cc9-3815941cdd95", "comment": "Malware payload", "value": "f24d407bc266fa5959b7084f6c9a9cc889ad787933b248b6aab2c2b75471b6c5b913ba3e3f18b230b01b3afe50745224", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987440, "uuid": "3339ddc5-6b03-4b01-9272-9db4640456d3", "value": "T1531319053A98C26AD6BF0F7CB8B20E6152B29266C102DB453D8C55DE6FB3705CF1639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987440, "uuid": "f4351b2a-6342-49f8-ab08-9039ac652a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987440, "uuid": "84ba5f1d-009b-4d3e-b009-795d620adcbf", "value": "768:iCnWZWFTwL7wuikjZO6W9ezHHolkgeIOt7BXAY0Q1C6XbYC1OkVWY:iOpwLXzJzHHolkgVY31C+b1VWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762987440, "uuid": "37d1e899-b716-44ac-b6cc-c14d4d7999e8", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762987440, "uuid": "e4d07304-6ae7-4879-a578-ea787c867844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762987440, "uuid": "d48824bf-d63b-4df9-9c1a-f6f2d7f25711", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2156a7-bf94-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762930514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930514, "uuid": "a27b04b6-d948-42c8-b48a-ad6bf66feb3c", "comment": "Malware payload (AsyncRAT)", "value": "62d8be744ca201d32e2b1d5c42a5cbae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930514, "uuid": "99826fd8-a7cb-4d12-b078-1fb2c48802b4", "comment": "Malware payload (AsyncRAT)", "value": "c16a24622be61848e7600592a41da8b1d6c315c2a16ae7e553784f6beab94a2a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930514, "uuid": "6f73ca4b-3936-4b8a-b32e-e3bc91d0ff61", "comment": "Malware payload (AsyncRAT)", "value": "396bc82180c2ff37f11d357a448b4083fa133457", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930514, "uuid": "c0aa0466-8ad0-431c-b1ba-05baef02463f", "comment": "Malware payload (AsyncRAT)", "value": "31577616af9464904888aa99958bdb35950eeb76e79a3fd4b8142d2d2260c91fb600c9a8eb4383cec0a6d6fee8308c95", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930514, "uuid": "c0591837-df44-4f85-8fe1-f53d99dcdb24", "value": "T13D953393700AFA73A8E706D0089FC7B7C379C2D7975AE6E6BF269213B1C119246C19D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930514, "uuid": "729e7995-cbcd-48f0-98ce-a7a8fada4dc2", "value": "49152:KA1OoDQC1QwhtCsbPoJz5ydJ7PmLQpLqN/bY2TNMpGTgn3+zWPK:7OoX6wLcM/P8OUDYJp2Y3CWPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762930514, "uuid": "cbdaae5d-c77d-45a6-be45-0b448272b7ea", "value": 1951264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762930514, "uuid": "d470e9f9-53d1-4215-9f47-d85c97371435", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930514, "uuid": "5dd59b6d-3d6e-4564-a1c6-42b172d7f998", "value": "KrakenVM_2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370ddf61-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762959151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959151, "uuid": "3c6c8d69-ec22-416c-bd62-fad42ca2e475", "comment": "Malware payload (AgentTesla)", "value": "4a0e5df2a7e55d6f90131636ec225465", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959151, "uuid": "ffaa53f3-c6e3-44c3-b727-1726be5ccbc5", "comment": "Malware payload (AgentTesla)", "value": "c18a28db58ee110d99668d90c2deede8ea10ba850799d8495ad7cd53488fb575", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959151, "uuid": "a218f6a4-c716-4f02-aa27-9294fc612681", "comment": "Malware payload (AgentTesla)", "value": "15e7dd3c32d1abaab8638248a0953848d372d39e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959151, "uuid": "60ce94df-137f-4ba5-8e0a-0ea4fc80ec73", "comment": "Malware payload (AgentTesla)", "value": "03615ddc6d2094f734ea38758427dce442fa91b0facd826c71a5c9c5ae7d2f5f8f078040cb8dfbba8801041266e420ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959151, "uuid": "4eb7a3b1-31e9-4071-9394-678a4a740d1d", "value": "T1BCE41205217DDF12D07B2BF459B0C57243B4AE9CB522D306DEE67DCBB826B414292BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959151, "uuid": "a97578d2-ca69-4ef4-81af-1fb7ca6fecc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959151, "uuid": "6d455de8-8d02-4be8-93e7-b4a83e8663e9", "value": "12288:G+EvkfPlF3A1C1xBvuAcr+DhvseFVwG/fRlNU92NnyKuf/1P1s:G+zH3A1rATgi7WKuTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959151, "uuid": "6a207d24-490e-48d2-abec-33cf3ff79424", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959151, "uuid": "22d999e5-1a8f-4257-8b8e-fbfb2f6dcb4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959151, "uuid": "4e7d4458-6216-4921-b0d4-07e41ad4316b", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08046313-bfa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762935879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935879, "uuid": "20ea8ae7-6594-495c-a16c-19c522d26191", "comment": "Malware payload (Mirai)", "value": "ac47522dd3d44f04a288b350b289fb0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935879, "uuid": "c03e0177-f5cf-4f3c-bf24-3398ceaebab5", "comment": "Malware payload (Mirai)", "value": "c3417dee4858027801671539b5d663158f65f8e0f99d30715f0117d2857cdcc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935879, "uuid": "e34c90fb-c9e0-4bc1-8d91-58f1a2f0fa97", "comment": "Malware payload (Mirai)", "value": "11fe2d9a6f4aa08113cf9f39aa2ae622f23f9a04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935879, "uuid": "f379b13b-1f50-4d65-b9f3-c8b8fb45b36f", "comment": "Malware payload (Mirai)", "value": "6aeb5c23ba2647a66c074325fad8ed9a1307208ae4753876ea58529c8bb15a3d7ffb45230e85d956a7fe6200dcb67592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935879, "uuid": "30dab074-fc2d-4137-ba42-7e3f69a22e09", "value": "T105B3E085B210AE45C02672FCB187099093B17E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935879, "uuid": "634f3be5-525f-4f18-ac00-7503e63ca61b", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wum:as5zqhr5Nzy7wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935879, "uuid": "94d52bbb-01a9-4a66-9938-8d804e3bd818", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935879, "uuid": "cb87fed8-4663-4b97-b797-31f98e28182c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935879, "uuid": "65c5e526-3fd2-4288-8383-3c88e5d1c891", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f28a25-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762981211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981211, "uuid": "ae851f13-73db-4b12-8170-fb11b4ae4789", "comment": "Malware payload", "value": "dd97dc44632e262dcf8da7772d0a3dce", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2126", "colour": "#91EFF1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981211, "uuid": "2a8aef30-e1c5-4e66-a300-db471d53557b", "comment": "Malware payload", "value": "c47ab5c739a5b52162591a75a274e7ba596cfac544bae05a18740a561f877774", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2126", "colour": "#91EFF1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981211, "uuid": "7ea91a69-5a10-4127-9f92-152340be7a8d", "comment": "Malware payload", "value": "25dd5717839cc35d9c95f776ae7000699418151b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2126", "colour": "#91EFF1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981211, "uuid": "c2e64fb1-5798-45b2-ae12-e4f49b0fad25", "comment": "Malware payload", "value": "0a6b7190145bf66bb92cb98f6083aea61ed6e34021aae384e345a3fcf1901bbf3c70024c01a0c527f2179e06fc7311ec", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2126", "colour": "#91EFF1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981211, "uuid": "cead70ef-3543-4ea3-9bb1-a0da1049345d", "value": "T15C1633659DB58F23342327391AC522D26FE6E2C504C665A31C04FCEDCB363AD978AD4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981211, "uuid": "0a357bab-6d44-4bd9-a39c-1484e219e22a", "value": "49152:RMGOX0p/xkaZAcnW8rMkmrDZ5JP3w2HMBCjZIf3Fs7MhIMezGilMOdQ30MEO0hSj:MY/xnTukm3ZznHpEb+G+veDXLRfssUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981211, "uuid": "abbf1658-beb7-4d46-8aeb-cafb3f212708", "value": 4223939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981211, "uuid": "69ed756b-b77d-4b72-bd08-32a45ef988a1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981211, "uuid": "f7fce297-055c-4685-bd01-4e6fcad9519a", "value": "file.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f481ca18-bf8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927686, "uuid": "4d5a0fd5-7539-4941-9017-60e6a409cb3b", "comment": "Malware payload (Mirai)", "value": "4ddae14e77e44fe0b1f7b009f412d21b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927686, "uuid": "e706f325-9054-4d0d-9065-c5bd00210bbf", "comment": "Malware payload (Mirai)", "value": "c5a64433d8e8865032a3edd2db818c0e379073c65497e2742ba002f4c6a2315c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927686, "uuid": "40e27e6e-3a22-4c2b-8438-042f2be2b361", "comment": "Malware payload (Mirai)", "value": "15e50271250e9883f567089a502294b0a97ff964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927686, "uuid": "78ef5425-fa58-4e57-bd6c-72f39e386016", "comment": "Malware payload (Mirai)", "value": "6ea910dfc4506eceff3c4b9bf7daf6c7b811bb3307653ca610107c98de6293926e988677b13a274ee4866da4440e2de1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927686, "uuid": "6f048d2f-6d61-46cc-8939-987437451630", "value": "T1215302522AA8F83ACED2D5390B2841E645DC49E4A447500F52CEBDF48A05D78BFEC6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927686, "uuid": "d357c711-e6ae-4566-9454-61ec1c2dffc0", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/fF9kCAQf:IaHJgMo8FwOA4zUFGUO3UhZF9WQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927686, "uuid": "c7b76f18-1d5d-4923-adfc-eeca90a874fd", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927686, "uuid": "1fcc85c3-306b-4f93-928d-017ee17a29a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927686, "uuid": "ab6de248-ce29-44e3-99fe-675b407e1e2e", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f9b2f9-bfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762960461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960461, "uuid": "04bc02e4-0858-408a-92f5-395c06596e1d", "comment": "Malware payload", "value": "ee60fa5f645964d39f2de576451fc9d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960461, "uuid": "fd495a88-e9a4-4ea2-b6c3-67338ddadd36", "comment": "Malware payload", "value": "c5b95d6b4f2388418ffe127540e5234c76d1c5431e60554b359a0558e290f8cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960461, "uuid": "7a961c4d-8379-454d-95b8-e8b3ba95713f", "comment": "Malware payload", "value": "f8012d5bd0fe6ae76940f0ec422f8a3b8165d81a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960461, "uuid": "ed9425ee-5929-465e-bc1e-2c072bb7f100", "comment": "Malware payload", "value": "62f659b9b1cedd47c7d1c37c12c33647dc2d683502230141856983ec0cb99607b3689004f99934c8b148eddb463a8ff0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960461, "uuid": "24bed3cd-72bd-4709-a7ff-d0b6676e528d", "value": "T1B8535BACD34C8B13EB5E4A7C9C86519A87B0E5A2620ED74E2CCC23D91DF53D794026C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960461, "uuid": "a3d60311-063a-444a-8f6f-b01eca61af75", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960461, "uuid": "05a73383-f696-4608-addd-c53f40178ede", "value": "1536:3ob2uKweFOMOXJI/jzGdC6l0LWsJI3b8nt0oFhz:Y6uKweFOMOczONrsK3b8nt0Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762960461, "uuid": "c8c8bc72-6b0c-4c26-bc75-da96301580e6", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762960461, "uuid": "528c76ff-88bc-4d3f-8365-1f65b4fce82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960461, "uuid": "1b3a832e-1129-4714-9ac4-b265f2cd35e1", "value": "c5b95d6b4f2388418ffe127540e5234c76d1c5431e60554b359a0558e290f8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb549423-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762959453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959453, "uuid": "0902359c-11b7-4638-9936-439fd25514d4", "comment": "Malware payload (RemcosRAT)", "value": "46c93e1d7d49de3143c6ba10b0e50324", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959453, "uuid": "bf6d6367-4088-459e-9166-28c0ae4b1f7d", "comment": "Malware payload (RemcosRAT)", "value": "c848398153264ae6d177817b50a2e14c5bff21ee227cb63336988a8534dfe30f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959453, "uuid": "8434de26-5e28-4c29-84d7-32077168a2c6", "comment": "Malware payload (RemcosRAT)", "value": "67bc4d95b191003193ad8b492906b97703f120f3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959453, "uuid": "f6c5b301-39dc-49b3-bfdd-6ef2279c3193", "comment": "Malware payload (RemcosRAT)", "value": "48092d1fa7afbdbb16431ee372a2dbd8cf94e95dceb2b78d2cf19a759384bcab7910d85ef50a9d6c8bec0d5f9346273e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959453, "uuid": "c43f4f21-66e8-4443-8ec1-16477b4937d4", "value": "T1EA15BD3E00E15CE4CB693379E79BCE3438792661592B3AF68DED90E4653EE10C39A147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959453, "uuid": "34afb62d-af62-4dcb-b8a5-6cda23b08e3a", "value": "12288:nnXAvg5ZSRUqCb8h9db2tuhbyA02vSFIGV55kQHnx5h6SURWxHz8+IAfZ0O0wD:nnXAvIw2E2YhbpoIGVDvx5MSUmTZB5xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959453, "uuid": "306ff95c-56ae-463b-a6be-b59f2c40ff36", "value": 910765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959453, "uuid": "f98d9c58-02e4-4b3a-ae35-e94ef4b3fc93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959453, "uuid": "72c39c49-391e-4af7-9389-aa1ef037e339", "value": "Re Plexus Purchase Order New 64312159267OP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017dfe7e-bfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939304, "uuid": "5551c782-2b0c-4bc4-9bbf-e6e4ab331b79", "comment": "Malware payload (Mirai)", "value": "2031a6b1c01b10d786f8837cf0c415d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939304, "uuid": "2bba31aa-522f-4473-b254-c26cd82eb236", "comment": "Malware payload (Mirai)", "value": "cbada6601d85cec73726566a544b3a9d9ad619d7b8c768123737115bbddf8afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939304, "uuid": "f568e5a8-4cab-4526-82f8-861dbd000a1d", "comment": "Malware payload (Mirai)", "value": "a23b438fcd3d34027556f072acb8858842150506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939304, "uuid": "36cfde1f-9780-46f0-8aa4-0ba9b207770c", "comment": "Malware payload (Mirai)", "value": "61c17960edf80593967b31141bb341278e712b4b0562fa1a4d165331cd0bc4569450ed096432d6dfbba398edab56e5d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939304, "uuid": "d535c208-a2c6-457f-adc0-d5d3d5a15a9c", "value": "T1267302622176DEA2D2B2C43213877D1E7D238876037463BEBC79A32FB482E505C4C55E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939304, "uuid": "68c1a527-da4f-43fc-bd91-5853f39f6e2d", "value": "1536:38zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWm2yVWorZ:MzRnwP0bMQ2RijvDZZ1rYGhG13jVWSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939304, "uuid": "9fdb2558-19d5-4f46-b31f-a8efe51d99c9", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939304, "uuid": "81a5c805-bd82-4a3a-a059-103409729b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939304, "uuid": "07114759-5f3c-47a0-81d4-4f3900d5fc3a", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9990605-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940069, "uuid": "63195c36-6cbc-4ac0-a63c-70725d48af59", "comment": "Malware payload (Mirai)", "value": "d4cb330053d425aa0d28483ac562115b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940069, "uuid": "48f00916-5521-49a6-a05f-61332a94d845", "comment": "Malware payload (Mirai)", "value": "cc26377eecc8e1c7709588022d545d183bfd9a5ee3cc703601d9a23542e199f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940069, "uuid": "a4674141-06f3-4562-a3dd-4f290930ed97", "comment": "Malware payload (Mirai)", "value": "f32f2cd135facbbdfa5fdef73aa59c57126395dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940069, "uuid": "ba65c6ad-609f-4e04-b60a-496c22135b5f", "comment": "Malware payload (Mirai)", "value": "69446fb5a43223717c7ff3ae00e5e0c0a1e166701ce1863c7d0979b2a15225c69e3cca8621dee1762adb57c6e25df20c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940069, "uuid": "be37b097-7cd0-4a89-8345-0cf0034a4dc3", "value": "T11E1318C4F553D8F0EC5A06703076EB365E35F1FA222DE553D3A5DA72BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940069, "uuid": "4d58d73b-c7d0-445a-b36a-b8e370c75621", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenz0q8uDOycM3U95VlVs:YYzs8ssGfrRI6aVnEeYWOrMErVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940069, "uuid": "ecc8d0d8-a20f-4d94-a4a6-1fd2e782cb66", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940069, "uuid": "483c4c62-bb48-4fb9-be51-0034f24a831e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940069, "uuid": "50e24016-d871-4404-8389-ab5e02c00105", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b319922-bf5e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762907323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907323, "uuid": "51175824-084d-4a6e-9fa4-94ca8f70159e", "comment": "Malware payload", "value": "e38decf881c1e1c56e61f94f494826cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907323, "uuid": "dc4196a5-a488-4d79-9f4b-bb706392cfed", "comment": "Malware payload", "value": "cc5dfc104697e85043a20833fc7928418e8a7321b7b6368b37632fd13b1ec4fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907323, "uuid": "df1b953b-0637-4ac1-baed-b8559f5020a9", "comment": "Malware payload", "value": "7e1e6bf43ea95b0ec36208d6772ea725698c6c85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762907323, "uuid": "5ae5bdb9-2aaf-43ff-aea2-3b653434c4e0", "comment": "Malware payload", "value": "97b9df4180fda44534628bd095d7faa9239691527b6a1bf6fe1457620fdaaa2ba3e19ea1b1dd4a9a23a69558a602d840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907323, "uuid": "e0f515eb-9e8e-4933-84fa-7aa2c1f2603c", "value": "T1FFC32A46BE905EEBC05FCD70062EC30715ED99CAE2E1771E7178CA8C7D7920A89D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907323, "uuid": "44c1a489-a348-48f6-acaf-73a65ba896ed", "value": "3072:xWydbOBH1rum0RBQCdwoM+V/1kvkx23bTZjqE4VPv9BkEv2mJ:mum0RBQCdFM+V/1bxOZeJPv9BkEvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762907323, "uuid": "c0f4b076-46dd-461a-bcb2-32351fdfc5fc", "value": 128872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762907323, "uuid": "23baface-08c0-4479-b74a-dcefc3514092", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762907323, "uuid": "2e78eae3-4390-4aa0-8b32-88fb99d3adf9", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c10a150-bffc-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762974970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974970, "uuid": "918941eb-1670-4593-b051-622ac412db98", "comment": "Malware payload (AgentTesla)", "value": "8bcc21cfc6499383a3e45fa10a38463f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974970, "uuid": "639bcd35-89fe-4ef9-a7be-de906c90d310", "comment": "Malware payload (AgentTesla)", "value": "cdab9957bb4309c5bd787e5d4ce2a28a55de3b591d6e509c402c070cc03b59fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974970, "uuid": "6d108fd7-9057-4067-9b29-b18a3ab91748", "comment": "Malware payload (AgentTesla)", "value": "28ebfb21e6a7760b4aa67f14b6cf7247c30077b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762974970, "uuid": "14b23d89-9f63-432d-b9e2-04d166603169", "comment": "Malware payload (AgentTesla)", "value": "a742ff8d7e5a8f0230fa78f5b2726cfc7b4bfcdb66fa4ab6dd2fec3576820a73f5ba3e0a00f0d47d6d1a507b900dbe2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974970, "uuid": "1c5683de-f809-46c8-b1ca-6d054310418b", "value": "T17D05332E666047E8DE5D6EE159105C8BAC3FAE3FD20C67F3BC1994B0106249AA3377D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974970, "uuid": "21fe1eb8-2c77-46fe-a8ea-0714f741e84f", "value": "12288:0IEy4rwSBorKzSd1IHqKrgz7pHbfbd8JGctog2MhYyDBFXa3GWz0kz/sdLepIm:74cSBPzSd19Km9bjiTyLMHHKlFz/KFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762974970, "uuid": "d5341d60-2ea2-4196-a248-12b6202405f0", "value": 861911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762974970, "uuid": "45e826fe-066f-48ab-97a5-000daa1e234b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762974970, "uuid": "aa461de4-d48f-45bc-9312-3dfe53e2b211", "value": "Bonifico.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928af8e8-bfd6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762958875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958875, "uuid": "56c1a2fa-1121-4487-a9b5-93f299c91d23", "comment": "Malware payload", "value": "ac627aa92294a3db86722a273b3e8ff6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958875, "uuid": "c6b960b0-52fc-4191-8ae6-04f2246d18af", "comment": "Malware payload", "value": "cef05123e6accd96bcce7ee650ae46fac29664a19aa40588cdba890280f7457f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958875, "uuid": "c1631557-382d-42f4-88b2-dac8ed97fc38", "comment": "Malware payload", "value": "e3fb764e77970150d55414b3e2627551dab6af40", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958875, "uuid": "d3ca48c4-c8cb-4383-8994-550f64b38478", "comment": "Malware payload", "value": "4f4fbd3c53392845dbeb4848e369aae4e3bd58770ce6929e57615539e72c7bc361e885d4cb2c8a1692ad786f1f6979bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958875, "uuid": "9baee6ff-f6ab-4197-b93b-c356e1c5516f", "value": "T106112FC1F3499403E2E301F07A8B424E12F983A41A4382447D1B0BFA47E0FCC28FA8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958875, "uuid": "439f1391-6962-491f-a730-6ec57ba9f7f3", "value": "12:5jN6NrrLN1QmerI+Gu5t4K3bXYdzBwdQmerI+Gu5t4K3bXYdDr6KHrrLNUrWMtwe:9kl1QmeD5t4OMdKdQmeD5t4OMdplHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958875, "uuid": "681ffd2f-ea17-483a-bb36-33591c5089ed", "value": 884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958875, "uuid": "edf33376-baa4-47bf-a977-1f1a93bd8f8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958875, "uuid": "331840fe-f45a-4d8e-be1e-023af13d02cf", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51787a84-bfd0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762956188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956188, "uuid": "9594dd30-fe1e-4817-8842-338d4cc6779e", "comment": "Malware payload", "value": "757cc9efc5f4b2f5a45d97b5706a3e29", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956188, "uuid": "ce331846-124d-4a60-b996-97a77406c988", "comment": "Malware payload", "value": "d0a43798210dd2daeac426bda77a7dfc388d5de670c16ed540c29289b26014ce", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956188, "uuid": "80036286-a21f-4043-a710-c97d59723780", "comment": "Malware payload", "value": "ef07c9d19948a510d2552c299fa6eda45d37af07", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956188, "uuid": "e1a5d2b7-1e2d-480c-8b5d-e1f3c9ade36d", "comment": "Malware payload", "value": "e9985dd237e137ab63e2e6c699d77b6d9b879e3d35c78c95a41edd7adfbd1045ad72f9026400c903c732f87002357f0f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956188, "uuid": "cc95d903-49f0-4095-9fba-198a668665a7", "value": "T163126925716D6F50FEBA6ED0A5318D51D3C8AF834F2ABAD822FE07CD4447B02C79910A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956188, "uuid": "8b8e35f9-f135-4824-bbc1-9b08e3bc2d53", "value": "96:uQBHfhTGnE/iZb7KJSSSSSSSSSSSSSSSSSSSSSSUn/SSSSSSSSSSSSSSSSSSSSS+:uihSn0ipjXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956188, "uuid": "f92b708a-ae92-410e-acec-296cc1dc2234", "value": 9143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956188, "uuid": "10971a18-d44b-43f1-b455-7fd8c4fa0de3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956188, "uuid": "77d347b4-19d5-482f-b436-945e0171107f", "value": "Revised PO-81786pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d687b5c-bfb0-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762942411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942411, "uuid": "ef1e1e1c-efd3-4263-98e3-bdbd53ac53fc", "comment": "Malware payload (PureLogsStealer)", "value": "2969a2350e3e2e95d5466db514115216", "object_relation": "md5", "Tag": [ { "name": "107-172-135-8", "colour": "#2FA237", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kutt-chatforma-com", "colour": "#0EB96D", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942411, "uuid": "02c85771-6b0b-499a-b21c-1dfecc25b5a8", "comment": "Malware payload (PureLogsStealer)", "value": "d17271c880d5af246df33d3f0f3bdad6f6356db81819bb267f17b115ad353f0a", "object_relation": "sha256", "Tag": [ { "name": "107-172-135-8", "colour": "#2FA237", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kutt-chatforma-com", "colour": "#0EB96D", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942411, "uuid": "27692c94-0398-4454-bc05-4909655c71eb", "comment": "Malware payload (PureLogsStealer)", "value": "3bf89951b05d75685b20bbf2dc8f663c9b1ffc36", "object_relation": "sha1", "Tag": [ { "name": "107-172-135-8", "colour": "#2FA237", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kutt-chatforma-com", "colour": "#0EB96D", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762942411, "uuid": "dbf7e2fc-ed09-4454-8ff0-d52a34a7e1ec", "comment": "Malware payload (PureLogsStealer)", "value": "cf0916d671e8f12f8968530804e2c5471f2d84726a663b1e31cd1c1258791cc714ce34a3f5be3da79c3c68ddb3cbc377", "object_relation": "sha3-384", "Tag": [ { "name": "107-172-135-8", "colour": "#2FA237", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kutt-chatforma-com", "colour": "#0EB96D", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942411, "uuid": "375ca7ac-0241-4968-91a7-9209fac5fa4b", "value": "T195251266629DDF26C02B6FF419A1C17113796FA9A012C30B4EE62DDF7476F408A42BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942411, "uuid": "96c6b701-2e14-4335-a37b-8a13b1083d9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942411, "uuid": "7906d21c-e8b6-437e-b17d-4415ae144a96", "value": "24576:HTshNEVkj8amP5jLyFlEzz/Pv4jJWNqs5oNqa0gr65:zg4jaEJLy3Ef/Pv4jk+r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762942411, "uuid": "419861ff-bc6c-47b5-ba16-3f22e49c9464", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762942411, "uuid": "bed21e8d-2312-4ceb-b8af-38b8a90bb4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762942411, "uuid": "32f2f33c-0aee-49a9-bb28-904fa1fef3f9", "value": "vllc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c225bb-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962215, "uuid": "fb5a1568-9b82-4a4a-a9b4-f0eb23282f0b", "comment": "Malware payload (Mirai)", "value": "7013b80b9b3a320f65a4f539d0224bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962215, "uuid": "63a909fb-9442-4c32-9fe0-a945f70a370b", "comment": "Malware payload (Mirai)", "value": "d37184c08849d745dec2dc3358b6a4a2af2da642b7fe3ac575d71df616880fb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962215, "uuid": "19f286fe-9bfb-48de-93ce-69ddb77dcb7e", "comment": "Malware payload (Mirai)", "value": "e906dfa38fafb1cd2742199f371b2288f82a31eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962215, "uuid": "f91d799d-6c8a-4525-86c3-5b65c984ae4f", "comment": "Malware payload (Mirai)", "value": "3b7347f013a01be38f9eaeff3e8374d2aaab9fd321583c70a6837023de2d4caee18c1708076cc6b889640f8bcd34fbf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962215, "uuid": "074fdf85-fa68-4799-8a7f-ae9d2b8c9f48", "value": "T10F630A457D824A21C9D5137EFD2E118E332737A8E3DE7226DE242F11778692B0E7B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962215, "uuid": "16b1f724-0807-430d-8d9a-8869373dd479", "value": "1536:q1n34oDQEAUN9jippx6G1GS6E5C955PSsIjs/XMqiiRfGzzM:foDiUTjippx90SC97/RfGzzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962215, "uuid": "c00e4345-cf80-48c1-af41-8a4459d24645", "value": 71428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962215, "uuid": "ee69b604-65ce-428f-814c-88dcd971d75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962215, "uuid": "e3708fc2-1965-480d-a653-992182afb524", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a1904f-bfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1762950129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "f278de01-f7b7-4b4f-9315-2e9466d3612c", "comment": "Malware payload (Stealc)", "value": "fa53c61ff65dcb2feeb8b13d49b9800e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "db9066d4-b3d7-4921-be8e-66e3fca319a0", "comment": "Malware payload (Stealc)", "value": "d494bdc4eb4e2d873a00c46fa4993450a580ca0495fe94efa870c5593eb606f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "80fcc1ff-03de-4972-b6ec-595904cd9577", "comment": "Malware payload (Stealc)", "value": "0f67422c84ad10d4bf6f6779d939a14b55147cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950129, "uuid": "96fc6445-a388-420f-b6be-196b01ae27ad", "comment": "Malware payload (Stealc)", "value": "19b3c59296528f97645dc5b73dec3e10900f7d450ca6545515f1ed57ad1c5f2e5b82f7a1ed2f4140bcd10983e58ba08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "d828f23f-3c53-4105-8fb1-b215fe16658b", "value": "T12DB58D2266F56896FA739B34192A969CDBEFBC71DE38565E72002D0F0C723B1CD21712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "b64dd6b8-8682-4810-8df6-83995b2a7b8d", "value": "77f62e8c6858bdb8e1d43a9c6ff0e9cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "4da247d1-3b3a-4afb-8d2c-e56c39b77e0d", "value": "6144:gAXYtUokCu2yMSSrmLKHzjOIKBvhjR5Il3KOpRUzhU/0on3oQ9:AtUoHu0kHnvJR5Il64RUtU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762950129, "uuid": "4e90d269-70b9-4077-81bd-b9387e496258", "value": 2491640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762950129, "uuid": "558d4f78-9b99-465f-96dd-d8b6276c745d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950129, "uuid": "079b51fe-5b39-44a8-adff-1f5f4f4c486f", "value": "d494bdc4eb4e2d873a00c46fa4993450a580ca0495fe94efa870c5593eb606f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd435e2-bf8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762926222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926222, "uuid": "11fc9e05-a346-4ac8-ace5-0276d8388943", "comment": "Malware payload (Mirai)", "value": "9b755f8cc7af1f0c0d5833649944c93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926222, "uuid": "eb38b7bc-1d01-4feb-9294-bc4e161af9e8", "comment": "Malware payload (Mirai)", "value": "d4d15b10f86194f4526390a76687063937d910dc744d770fbc4a646d7d8e49ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926222, "uuid": "29389195-ae23-4ab9-8e91-129784e169fd", "comment": "Malware payload (Mirai)", "value": "72aa3b6f8909c701951a612d79c08894f3e5ec4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926222, "uuid": "9b7a25b8-2311-42be-b6ac-8c879d6a1b02", "comment": "Malware payload (Mirai)", "value": "47020da7c8939014dea5ae99684cdece994efebf751dc12cd1a0afd7277fe4ce5abc35fc79b5188b86f4c6a8ba9c52b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762926222, "uuid": "c6b83753-743f-4648-b752-e8b5e678638a", "value": "T1AC146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762926222, "uuid": "d62fe796-991f-4fd9-86e2-937709dd8bcb", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtw:BZAyFzQSdS7IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762926222, "uuid": "da8465b0-474f-475a-96a7-0b80cb9cb548", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762926222, "uuid": "5b9e60ee-59a6-4131-b967-45921ebea010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762926222, "uuid": "880d3923-6b3f-47ec-9bee-8cb44144a019", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23bdb3e-bff6-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1762972699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972699, "uuid": "c8dd00ef-ef7f-46c4-ace6-a40caac8c6ff", "comment": "Malware payload (NetSupport)", "value": "43112654a7d9a9c972138f4e0333be23", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972699, "uuid": "b25e354d-3e19-4c7b-8672-c372ec58bc89", "comment": "Malware payload (NetSupport)", "value": "d6cb10bf0fade5f85562c6c700396b0dafc694a575f5d97472db52ee53b54dd4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972699, "uuid": "9f87d2f9-a3f6-452b-b3c4-53d6f1536562", "comment": "Malware payload (NetSupport)", "value": "8b8988f36bf66dd29eb8bff5c34904109510e127", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762972699, "uuid": "22ddcb57-9c74-4777-a0f2-58f7dd926ac6", "comment": "Malware payload (NetSupport)", "value": "a4f38436a8368b9fd90bb3c2a2335a24ed928f5dca7cf374c7c259cca6901ef94b1f42490a83b3095c55b81179fb0c8d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972699, "uuid": "c9a1d8cb-2b92-4136-b61b-3cb5ab5e8fad", "value": "T1C7E2951776009331C44607718A2FE7E54B2ABC49CF67152332AAF39D2F729D066B7AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972699, "uuid": "91f37f63-70b6-4f6d-a68d-0d817c93fe5f", "value": "384:ftseTZtpVoXgk5ebepCtx5Pey3M5sC01Z:PZ3GeqC9eWMmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762972699, "uuid": "25a6f62f-6317-4d9a-a36c-4d02c271005b", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762972699, "uuid": "d5003b14-3713-454d-9dc0-64bf7998cfc2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762972699, "uuid": "13778ca6-679f-4ec3-86a9-df821bb1d766", "value": "approve.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40251dae-c00f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983218, "uuid": "41eb6d7e-4436-44f2-8073-49076b20e478", "comment": "Malware payload", "value": "7759aa24ad582ad1469287d11323bc9c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983218, "uuid": "9333a256-b4af-4932-a66b-8a7f996b9b23", "comment": "Malware payload", "value": "d8d79fdb8845de09c7508e4be8119eca43994203d76ad1aeaa5ce1d65fef08cb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983218, "uuid": "ceb6f527-700a-4186-b599-5675903ab46f", "comment": "Malware payload", "value": "80474a04051f8ad80aabf767baac28fa276d4f97", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983218, "uuid": "33ca7072-41c9-4d0e-9076-96a5363a8cf2", "comment": "Malware payload", "value": "1e4a863c963a2837667c95186fa5a326ae95bae03f9a378c8d2a1932c01ef9288835001961a3b7453cec49089248eea7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983218, "uuid": "16dfb9f1-f3bb-4140-8fd0-299f1d9e6e1b", "value": "T1FA554A10696D40EEE27F48F63515A8D4C118F2EB377AE4CF704885F24E63ACA55E21BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983218, "uuid": "e65abb3e-19e1-450b-8431-a1f0062c86e8", "value": "12288:ZIWYUbWf1c1zLWdkJAptiPq28DeUrM5kGUuNXYkTTMsY/4kWL4AQZxpnXRgkfeb1:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983218, "uuid": "f2c6d71d-16c9-447c-8826-c6d99277f01d", "value": 1315862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983218, "uuid": "21b1467f-9fcc-48c3-8f2c-2265a73112ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983218, "uuid": "896e9846-6229-4769-b360-4cdc64c12d4e", "value": "Stake-Predictor.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69927f01-bf99-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1762932607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932607, "uuid": "91563534-209e-4ee2-af25-f763842f3d43", "comment": "Malware payload (GuLoader)", "value": "b661b44c0a510c1de4931bb8a84a1776", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932607, "uuid": "1e326950-fdd3-4f8c-bcb6-98dbbe1941fa", "comment": "Malware payload (GuLoader)", "value": "d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932607, "uuid": "556555ac-ee59-4298-81fe-44a3a979e565", "comment": "Malware payload (GuLoader)", "value": "64114abc726cb917f17fcc5f9fc1abca1fe51c1e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762932607, "uuid": "358d710d-ff58-477a-9adf-588be3927fd7", "comment": "Malware payload (GuLoader)", "value": "309b9431c13ebe001ef56cb9dd83ea0bf823283eaa730c90c3360e0cd4554535effefb0ec9144c44a61c5c3f4529d09b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932607, "uuid": "cea5ddc5-bfad-48ab-b4e6-f6186b692231", "value": "T1B3A3E5B99F1435F58F0FD29AB8633551F56EF1A0042200F0AD8C225B4EE5B687AF9D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932607, "uuid": "7a5e6989-6070-4cc5-bd43-b6ebf94d5a73", "value": "1536:Q1WfPGJWQA9z8+5KTvTKUmSXI2dI1LSp4lMiVJEuXGP:Q1WWJWQs8+5cvbrXxaQp4lMU2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762932607, "uuid": "afd75015-8cf8-4c11-a588-5811e1789264", "value": 105022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762932607, "uuid": "6d85557a-bb8b-422b-b025-68a02157065f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762932607, "uuid": "b638a396-8892-40c0-92f0-b19fb328eeea", "value": "z12Payment_conf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bca87e-bfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762960516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960516, "uuid": "e0b3ddc9-2f16-4c93-86f4-b88076d613e7", "comment": "Malware payload", "value": "093297305f572209298e0dc42760c7f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960516, "uuid": "40357159-21d1-476c-a292-f6c6759a09d2", "comment": "Malware payload", "value": "da5d137c9fd25a5b8419f2d073cea4f497a10cbf3eda2a69dec3426f0412f284", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960516, "uuid": "c6eb67cf-a63a-4ee5-aad1-fb1a6dd34817", "comment": "Malware payload", "value": "38d41f767a5c2838777c227bbda5df56dde6c59f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762960516, "uuid": "3a532ef8-828c-4358-a40f-de7e4206a8f9", "comment": "Malware payload", "value": "f1bcf25d8a2f93cfe1d5dfaf0a4c245b6fd3bc7baf66656f1f5979697876d6a575de3c91869116aab2acb86043d961bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemShock", "colour": "#372A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960516, "uuid": "2da5ac08-f3e1-4b89-bcf2-5cb19c2f2d1e", "value": "T13B231A482B9C9A07C77F0ABD4482956297B0B7F69686F78B0CCCA0F914D53D987053DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960516, "uuid": "56dfc93e-ca2c-46e8-b514-93f4445de662", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960516, "uuid": "170f500e-f388-4b73-9bf4-80d11839ac56", "value": "768:qCsBf7CkAkBv1ned/t5E9LdhboFhJx0wCSR84tbip6Sn67D8JxuUGskcy:qCsBGjpM9LdlyJx0wCwtbip6S9JOskcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762960516, "uuid": "a91cb90d-d5b0-4c39-b1db-9ae44da6756a", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762960516, "uuid": "3ed2ed24-559c-4363-9e81-b2fcd0da3dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762960516, "uuid": "2f7db668-4477-4e68-89d6-0e8ae9e7d5ac", "value": "da5d137c9fd25a5b8419f2d073cea4f497a10cbf3eda2a69dec3426f0412f284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3ecd69-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1762959129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959129, "uuid": "439da547-41de-4df0-a8c5-8942136d44dc", "comment": "Malware payload (MassLogger)", "value": "ff5557ed9b4a9d624e84b728c7d300a3", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959129, "uuid": "8f64b0f0-6d03-4a94-b0ff-633bda55923d", "comment": "Malware payload (MassLogger)", "value": "dac5e81d233c49098ff1bf5a73531ae401851fd48af34ec9083ead8d698a165d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959129, "uuid": "d0ead775-7e37-4475-bf92-9f18a717d7de", "comment": "Malware payload (MassLogger)", "value": "3e030af007fd1ae4a538b51a0f29561ab6e23614", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959129, "uuid": "5ac218a5-2d45-4ad4-8f33-f22e7fa6d2ad", "comment": "Malware payload (MassLogger)", "value": "561e7ef61c2c03da95b66d866c76bf91e844fbf7abb6559856ffd26819d4477f11eb6114d434221db29acff4dbddccf0", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959129, "uuid": "8cb3142f-9929-4304-b99a-86774f3c42aa", "value": "T1EE257C9D8471ADD3A054FE70E540EB9B8CDB478412274B121FE5A8A67202C47FFAB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959129, "uuid": "6c013409-0c89-4a3e-8cb3-cc9ba0f7f065", "value": "24576:ZHOU7dNHpt22O7oib/m65stpwDH3Fqo0NVhQPwFN+P:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959129, "uuid": "b9cf48f6-075d-4472-b360-9a19f671b506", "value": 984612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959129, "uuid": "2da9eafd-b5be-481c-a583-6ff325d94a2c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959129, "uuid": "2efce41f-cb3c-4c79-9547-df87bd65896a", "value": "rkc6743.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d70fb08-bfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762958437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958437, "uuid": "4f04ea0c-ea5b-4427-be90-c5b1bff1aa6e", "comment": "Malware payload (AgentTesla)", "value": "02a2208f0ae97ad50f175657e6261f0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958437, "uuid": "cbc6d993-48cf-4794-8336-344ed0dd6641", "comment": "Malware payload (AgentTesla)", "value": "dce45a432f1511fe4f0f8a36791a9324c8f58b72bbd165d60147f86ca21a1144", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958437, "uuid": "490e38a9-3f20-4f9a-9da5-b11fa0c0c770", "comment": "Malware payload (AgentTesla)", "value": "67b3950af1cb0f556de2fa6ae2b3a17c177f43ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762958437, "uuid": "09a750c8-c6dc-43e1-bc48-fb82d0947ee5", "comment": "Malware payload (AgentTesla)", "value": "b8e6bf59b0305d416039d7325e7e4912d7c3ca96414d227bd36780a18e73c3ff154b3c1e2de221123e9075bf504c5855", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958437, "uuid": "85f3dc19-3dc6-4855-b8e9-3795e108ed7c", "value": "T10EA17CC1DE2A6783C089B1B932BCBD7292E491E3D958E793016121776FAC98845F0E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958437, "uuid": "43c4ee89-cf42-4f14-8387-c0ee462f00aa", "value": "96:PNmrVOyLJGFLNToqCRVOrXGCyj+Raf9ym1siB95LZaNjWn9y0EVmv6yINoNmI:lmfLJOmfRIrW0gfFhNZEN0EVCtmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762958437, "uuid": "d4305d75-b5af-48bf-8971-3edc2edc713f", "value": 4940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762958437, "uuid": "fd54348d-4f65-416f-86af-70ba62aa77cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762958437, "uuid": "e8175c6e-0e43-4d6d-bdcc-9cc9b9c6e6dd", "value": "Product_Specs_for_Quote_Nov2025.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80741aee-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939946, "uuid": "d24256b5-a7cb-4b1a-be92-1cf1961f6519", "comment": "Malware payload (Mirai)", "value": "f90694c21279d8dc40340082c4d26da9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939946, "uuid": "320de178-2f87-46fa-b61a-03442d9a9cc3", "comment": "Malware payload (Mirai)", "value": "dec3147ab747c45dafc2806bcdc184e7760d88e9e12a8e73bc505d2b4afeea6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939946, "uuid": "289854e2-e92f-404a-8648-3de7f3fc7163", "comment": "Malware payload (Mirai)", "value": "1fe11cbfd79b16e5fac4de5b8b97af4f286e3185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939946, "uuid": "826ef562-82d6-41de-86ea-030619937070", "comment": "Malware payload (Mirai)", "value": "931c9d59fb987e3314710e984954baa1043899a79c1d32c0f5850410b14b4fd76d247a18bb3eee07afb46d06dd72f6ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939946, "uuid": "0353aa17-a801-4409-ad2b-b02c1a546f0d", "value": "T1DE13F192379BE602476024B1EA649D8157ACA3F542EF30CA9F75416877E8143FFEB843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939946, "uuid": "c7010287-842b-480a-b45c-50ae0f473e02", "value": "768:llJcU8bKV0/qtDdvdXCXVk2pduri89q3UELdkJaWUaaqTCM09n:Z+rcpvSS2pdjFLdKUaDjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939946, "uuid": "76e21478-30e1-41c2-ae3b-5a7ed14356df", "value": 45532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939946, "uuid": "751a13b5-1bb1-433f-99da-9263582667a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939946, "uuid": "7fcf49ec-f705-458a-8b1b-686cb3ace40f", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe477fa-bfac-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762940878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940878, "uuid": "30a6b9ed-d444-4d8e-b587-0ed6fa90f2b6", "comment": "Malware payload (AsyncRAT)", "value": "d5361e257f5aaa7c59a798c0b30ed339", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940878, "uuid": "3880e269-dc54-4a5e-bba6-281b53029681", "comment": "Malware payload (AsyncRAT)", "value": "df1aa968ad27b4ba317ee036dd641f42f7e15047cc9c3465f3402eb8f9081ea1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940878, "uuid": "cae5ac31-da80-4352-a04f-74aef5be0ecc", "comment": "Malware payload (AsyncRAT)", "value": "32391075eae582782b661c0c0aa3de355ad6e018", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940878, "uuid": "4686c4fa-4344-492e-8a85-561f1f3d2520", "comment": "Malware payload (AsyncRAT)", "value": "00f6347357b163e8f9f3d77d2fed03405cd7ad8578953bca7b8c4adba24c26d1cf60f9c0147e09fe8e7af27dc2b486a6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940878, "uuid": "b4539c54-e83f-41d5-ab4a-80e03c091ffd", "value": "T16EA4F195326DDF1BC02E1BF45860D17163B49EADA022E6138FEB3DCFB826B0145527A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940878, "uuid": "fead7f28-5adf-4728-881b-94c70e453609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940878, "uuid": "019918ea-87ee-41bc-9a57-3dc029c943b7", "value": "12288:wYaAx5cNlwXVVLTncgpolLOJo3ttazwOqyUkf/1P1s:wTwF1cgpHJo3ttazw1kTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940878, "uuid": "1cd5703d-5a1d-4950-b2fb-9b3ab8861b23", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940878, "uuid": "bf028d4d-8a2f-42e8-bdf2-19b1dae5761b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940878, "uuid": "9d6fcb04-2a77-4976-8612-44437d89cc3a", "value": "DSA0987654567890000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ec28a5-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762981261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981261, "uuid": "72b33b03-5e6c-415a-a76f-72e15668ac2f", "comment": "Malware payload", "value": "d7ebd7a6cc81cb49f0ef5d5533677f24", "object_relation": "md5", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981261, "uuid": "100c659a-f729-401b-8364-99c7a52577e9", "comment": "Malware payload", "value": "df6f1a2c0ab1eeca114a28796963e182a2dfab8d799ce0994434d808f05c0cb6", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981261, "uuid": "3bdd3359-6bd0-4e1b-b713-3f2760ad44ab", "comment": "Malware payload", "value": "453bdfd49645306e083f7ad3864a9da7fc7bc831", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981261, "uuid": "e646d49b-a259-423d-883e-761927a2b53f", "comment": "Malware payload", "value": "f97123425826ce4b0e60688717effe0e1bb92d34e7acbd9138d88abf8bcaf0fe08986a99edbf5489d4f16a7d2c8bcece", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981261, "uuid": "5287d22c-ccd7-4c1e-9222-efde0b411cc3", "value": "T10C169D567DD84866E099B332CCF751666626BC48EB3227D32D1C3A7A6E32FC00936735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981261, "uuid": "9867b7ad-97cf-4dce-b504-ab1a3a581827", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981261, "uuid": "1f3294c5-8f58-4381-880e-4b34cc144ff7", "value": "49152:Hro3ObacxSBUSg2oQm1C7C0SCyN3qV8E7657qv6j7w9sX3fO4OiZrq1DfP+rsNAX:HJhs65XG4OiZrq1DfPHNADtV6v+cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981261, "uuid": "40861f0c-3a18-42ec-8b1d-0128d563aff4", "value": 4269568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981261, "uuid": "e7f7146e-b08d-4da6-b7e4-c830670529af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981261, "uuid": "08dc6576-d78f-4fa5-8aae-757bae97163a", "value": "appFile_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0597fd8d-bfe4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762964651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964651, "uuid": "5e0f3560-cd8d-4863-a065-f3ff6bdf24c3", "comment": "Malware payload (AsyncRAT)", "value": "bca250111be8607c4ff19522450b6f96", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964651, "uuid": "a10d6ce4-26b0-4363-ad82-f7d1d3a7fa03", "comment": "Malware payload (AsyncRAT)", "value": "e148054fbd1c4ad49c5de5e190c37592adf67af4ced5305770eee255782ea504", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964651, "uuid": "3ee02b1b-e316-48b6-ac14-5d236b817717", "comment": "Malware payload (AsyncRAT)", "value": "06694786b7b690ffd1e0a6c27344b8fecc0f0679", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762964651, "uuid": "68e5d170-c95f-418a-a44b-2f160fc36f4f", "comment": "Malware payload (AsyncRAT)", "value": "584deb677baa0d75211f4c21e37bd17e5b654e73aede6074626bde0caddde7adb8d2aa704a947f2e3a39e76a22035373", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762964651, "uuid": "bc8c28ee-f7ea-4334-8d43-c3df0a2df530", "value": "T19F9423842B235B074D9646372DDBCC32B5F9AF90587A4DC4B301FF0565AABC970F9886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762964651, "uuid": "7db439e0-73c1-4df7-a53f-f4d9beadec87", "value": "6144:mjnqlPpPhk+jaRkO+St8phx8VohpKQGvWyRkAHNt9js0Jf4Q:mjUhPO+SyPhPVGu4BjRJf4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762964651, "uuid": "1cf934f5-f36f-440d-9a82-0745d88a19b2", "value": 424149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762964651, "uuid": "7f6b9a38-47d6-457d-93a4-5aad17f35a8f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762964651, "uuid": "e07e185a-ae8e-4e7c-b580-8dadac33eb03", "value": "BANK RECEIPT - 30% DEPOSIT for invoice no.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67703a5e-bf97-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762931744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931744, "uuid": "b809d522-a3d6-4002-930d-589acd8e98b7", "comment": "Malware payload", "value": "b03e5012b598c864202004d7fe943771", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931744, "uuid": "fd3f3c14-a24b-4ba5-a407-72c02091d040", "comment": "Malware payload", "value": "e1cddefaedd0ff1d6ead0d1d346ca8909ef2f4a99131c0a543b6690afd895385", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931744, "uuid": "20a3c119-3d6b-4332-8d58-e3a8efbccb74", "comment": "Malware payload", "value": "a40435fbe2db3735560f40ee99481ab9840bff82", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931744, "uuid": "10c9f581-0771-4968-b848-59ed39ac4847", "comment": "Malware payload", "value": "8c79562f6fd78c7ba6aace1e67e16403e7c88744322423e79972976b2edc9e9fd8a898128ccdfccc1993a76e1977bf83", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931744, "uuid": "5f978642-5144-4132-a68b-595d397b6404", "value": "T1227312474B35E740C27639B5E0E66465F33A951EBE449E3113B80AF6BFB489033CE225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931744, "uuid": "bf7be2b6-4d2a-4517-a16c-f70043e31eaa", "value": "1536:BJo8np9QhpdjaXBEBcCpdkkRh8NmuApywmF2dz4mPF5KXu+M1jVFu8q+ScgDN:BJo8p9Qhp0XrMkkR6NmuAwZ6z4mNIXuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762931744, "uuid": "34a1eb1b-6345-49f3-ba78-ef709e1de5ce", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762931744, "uuid": "1ca776b7-22cc-4d3c-beeb-105db9955158", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931744, "uuid": "b9610152-5416-4548-b465-2ea0bedcdac1", "value": "e1cddefaedd0ff1d6ead0d1d346ca8909ef2f4a99131c0a543b6690afd895385.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23061ea8-c00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762981021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981021, "uuid": "57680272-4ee1-4657-83bc-b19f5b16d986", "comment": "Malware payload (Adware.Techsnab)", "value": "ef4560a2aab236472caebfbfcf920159", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981021, "uuid": "53c262ad-2305-4ad9-a4c7-5b1423668c3b", "comment": "Malware payload (Adware.Techsnab)", "value": "e4573d92e31517c5cb82fef22dbf5b0aff5dc2695e13595f6df7c8925379304d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981021, "uuid": "6702e01d-d525-4015-9329-fb80dac34900", "comment": "Malware payload (Adware.Techsnab)", "value": "e119081500c3af02d17e4146eea10e7f7ecda99f", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981021, "uuid": "6fc7375b-21e5-4384-afce-6f4a1bae99d9", "comment": "Malware payload (Adware.Techsnab)", "value": "0e63f7f04c1fb93262efc86df4d333b99d811edcc014c6fb86df29b05139d2de76f4c8538205bdfde775a63d78220a8e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981021, "uuid": "cc9f6d57-9bb5-4a14-bb1c-77ee84a758e8", "value": "T16086F818C40DBB08EF3245BACB8E9E4B47B8758D01573384E8CF6FFD1E625896915B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981021, "uuid": "9a650c69-5a6a-46bd-ad63-d678ee5b6754", "value": "49152:tH3vpi/fmje+hpkE6IVdmjmUCYghwwnt8bAnrnPcM/Efu3EE+n3L/ed5ULX6GPMo:tH3Wu1wNn5ShkoPeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981021, "uuid": "4043e09b-cde4-4478-af28-790f2c638324", "value": 8222688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981021, "uuid": "ec66de95-7e12-40fc-bd73-59c7b3996768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981021, "uuid": "4b5035dc-868a-4a88-b0eb-e8f5d9232080", "value": "setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae30d662-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762940023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940023, "uuid": "b88a765f-5742-47f9-9606-613b49e0b16e", "comment": "Malware payload (Mirai)", "value": "739d6d8fcc2406341ca9955a27c71bc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940023, "uuid": "ca75a967-23cc-4b5f-8fec-ad48c0e33a36", "comment": "Malware payload (Mirai)", "value": "e458c5b6f80f626ebccf43dbfa789e113b93ac6a16c940cc859f2e81355a8cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940023, "uuid": "f6e89cf3-40d8-4ef5-8ca8-aa3b3aeacc2f", "comment": "Malware payload (Mirai)", "value": "e34132c7c649e46df37559abbdd567b716432742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940023, "uuid": "ae422490-85fd-4293-bf71-e06b98a844ed", "comment": "Malware payload (Mirai)", "value": "cd1746dc52cfc08eb44a3895c01980b524a9490ac81e9b59f5d44869c668283fee4b394f5050ff387c15b50e6ecb2d3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940023, "uuid": "deb5c961-2d7e-4e40-8fb9-35533470f66f", "value": "T18B231841B8818613C6E4137AB66E46CE3B2563E8E2DFB3179D221F503B9682F0C63F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940023, "uuid": "dd053f37-7592-407f-bf27-81fbb3086342", "value": "768:hRT38FvJsOvEZU3JyvqKVtn9K6/8axU/PoV1K3/N+WzHn533LEw:P38Fv+Ovo089wl/V3XBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940023, "uuid": "2f6febf9-4b16-4172-b0e0-86e912c4f5d4", "value": 46868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940023, "uuid": "ce10778c-bd53-4448-89c8-f65e05be66d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940023, "uuid": "24af0c21-39d0-4af0-a296-47f31f1bded4", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c3328b-c023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762991763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991763, "uuid": "cbad3062-3185-41ee-b3ec-f39d0414d294", "comment": "Malware payload", "value": "a179ff04840698cf56c9ab07f715a823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991763, "uuid": "dc1724d4-864a-4f65-9c0a-98d8b54bbcaf", "comment": "Malware payload", "value": "e4a963b5164ee3baa9afd4ef69c469fa640816742bc232c9c5cbc47f42f2e352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991763, "uuid": "88982d78-c3ad-4cdf-89d0-883e2961e6ec", "comment": "Malware payload", "value": "3a32a423a069c2a438d682fa822c3cbde3b4dc50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762991763, "uuid": "282795cc-ac80-496b-a795-73821f2e4b18", "comment": "Malware payload", "value": "d9cebea1b01184a73bceaeb8b84c0874cf6edb70eef72b328a9d134611ab58d7be8ecea6972dd85ec7cbe79e287ff254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991763, "uuid": "05279a02-4f93-4229-bc77-ae7073baba86", "value": "T1C1733B02B29294BDC49AC5B4C7AF9537FA327C581215393E7784BB742E33E315B0EA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991763, "uuid": "cbc1ad82-d116-4654-acf4-6d8e26cf7e13", "value": "1536:0QsG2lkiOFS5UBdCfAJ+EIC2wO6fhGvXllsTvorkCyF5:BsGwkiOvkO+ZKfAv1ldkC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762991763, "uuid": "cf892ba9-73b5-4cfa-a51b-5015a84f0262", "value": 75664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762991763, "uuid": "3d7c86c5-5863-4690-9fe1-f416dcb46e8a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762991763, "uuid": "52f45ff7-edd6-4a02-8450-9a2cb698d3be", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c80b401-c010-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983614, "uuid": "8687c12c-d271-4660-ac24-a46173a66583", "comment": "Malware payload", "value": "8ad0f9edc0bb1c84a7d4834aabfbce7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xanonymous0001x", "colour": "#98C2FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983614, "uuid": "81e52b01-3416-404d-8aba-06c4e9d53f82", "comment": "Malware payload", "value": "e5615d0e7c605565c37be81fea4317299a0a57d293e2c058cc46229e43f586e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xanonymous0001x", "colour": "#98C2FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983614, "uuid": "b3439407-3f2e-4e73-9f16-0df8393c797c", "comment": "Malware payload", "value": "f632c15309f6883e3d2da87b3d3cdf77ce8097aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xanonymous0001x", "colour": "#98C2FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983614, "uuid": "29c53af1-1c1f-48be-afa7-ff8cc691030c", "comment": "Malware payload", "value": "345a2b48fc64a8fe644808bb20c7b53ded3ef637dbaf5ffac2aea4a52eac3aecc1c01aa2aa80764090fd881837c1d57a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xanonymous0001x", "colour": "#98C2FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983614, "uuid": "085aadd0-4754-43af-92ad-1d70b19d8b1c", "value": "T197B633043BE009FEE9E6E23EC455DC35A7717A432B63CA9F035846212D736E5193BB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983614, "uuid": "4a66657c-2b18-49a5-bef6-1003416ce5b5", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983614, "uuid": "d66f65d5-d826-458a-9526-c3d2331787b7", "value": "196608:eaGWAurHm7ND9BKG+5fc2S/ErXKEtw+LoSfPjRMsqeXLUyrYM0nDkx:BAuCRDvV+53SM8+rfPjSDVWY3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983614, "uuid": "81a79168-4496-4287-a9bc-09965fe1985d", "value": 11027838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983614, "uuid": "ea2b62d3-4161-42fa-be8d-b52bcff40009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983614, "uuid": "bbec8826-a8d7-4d0b-8d14-32257fef8b8d", "value": "Microsoft update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bec2f91-bfd2-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1762956958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956958, "uuid": "94e9dfb9-e7cf-4688-9ea7-73786a3fc123", "comment": "Malware payload (AgentTesla)", "value": "e1f2e8cb7376c3f46b8a67a01c3ad04c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956958, "uuid": "ec7d3cb1-87e8-4aa5-ba69-53c293926ce3", "comment": "Malware payload (AgentTesla)", "value": "e5eadbed9a823cda0191a8d8893b28babc3e1b8c9ff54157080d31c33c14cfb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956958, "uuid": "1899cddf-b73c-4d3a-8826-9930c6273028", "comment": "Malware payload (AgentTesla)", "value": "a5fa7588eda44e600f74774cf89479a7b00e4759", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762956958, "uuid": "7f2c598d-3020-4c6e-9db4-d6525ac8b2fb", "comment": "Malware payload (AgentTesla)", "value": "df93308022d813a0073d2a5657c602b81299c2d10c8eb8fe606c70a0191e1b7ac25a1594d2d01312d1b4361523491e7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956958, "uuid": "4eaf032b-d35a-457c-b411-a50735a81adf", "value": "T183916C68C0019E7E8E6D9BFD565C0D1D478C6AC51230AA8BAC3F17BA4615BD1376C18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956958, "uuid": "71c4d85c-d99e-4678-a3f5-ae870b56358c", "value": "96:HNmCjQgXqnWjLhpC0s/vjVqomgC1cBEHcxulIJVxUFbS8h/LPQDW9hHankVBgoH4:tmFgXqnWjtpRs/70oHBQFl4oP1Lo4HKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762956958, "uuid": "69bf1de8-97af-4d62-ae86-bfdd141f110c", "value": 4561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762956958, "uuid": "50b5151b-7a3b-42a4-a348-871f1f0c91d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762956958, "uuid": "7f646cfb-f4bd-42fe-ac4e-9a1b3e7d64bc", "value": "Product_Specs_for_Quote_Nov2025.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee7da02-bf97-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762931703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931703, "uuid": "6bb82400-4214-485b-bb07-5e528bb78454", "comment": "Malware payload", "value": "888b3ea293190bcedc56e64c79afada2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931703, "uuid": "c0f29780-49a6-4a8b-b8f1-c367774509a0", "comment": "Malware payload", "value": "e5f35ad5d59d40e4efae922762c984666d2af4a0e5f85399677a092850b175b5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931703, "uuid": "1db350b9-ef3c-4c26-9bfc-eb9f412b8a18", "comment": "Malware payload", "value": "15606387088cdb5ebd2b74797861d39bcaf3463f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762931703, "uuid": "042dd9b5-4d8e-43b0-b899-2cc1ef59a68c", "comment": "Malware payload", "value": "1e228ef21e304ccfb5897e2485760fbed6ae604b2d6998ab822833b1502dbfba007ebe45a3a25b7a2e77150e55e2d7e9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "westy-karslioglu-tr-com", "colour": "#4ACAC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931703, "uuid": "c3d5ba00-2d46-49b2-ac14-8437384483d1", "value": "T1BE730299E2E237058C1AE6AD3751FE161B0F22A41DFCD1719AE6039D7E47D036C2D271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931703, "uuid": "0f928e05-d270-478e-bf75-6c88a53ae1f5", "value": "1536:OHAhEKtU7FRT8pcMFtI5lgiAejMX/VnSL+QbEUOHvpfrkEy:Og3YFRApKlkVSqHjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762931703, "uuid": "1f91c25c-3326-4526-b108-d04574a79c16", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762931703, "uuid": "a06023f6-ca52-404e-93e5-d29b2db55dec", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762931703, "uuid": "ef5c3133-508d-43d2-a6a8-f572015f98c4", "value": "e5f35ad5d59d40e4efae922762c984666d2af4a0e5f85399677a092850b175b5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414b0c4e-bf8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762926956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926956, "uuid": "e9399bab-fa84-4945-a207-8eb8c1d5c1e9", "comment": "Malware payload (Mirai)", "value": "924144963f84b23e9246cc30b9d912bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926956, "uuid": "2cc0d47b-a744-4a2e-ba78-d555d39dab29", "comment": "Malware payload (Mirai)", "value": "e62612443715920e204bda790c1eb909fa6fe9934d218a0f3ba284f889fa85ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926956, "uuid": "e781fe95-42f8-45dc-acd1-a818a0d6fe74", "comment": "Malware payload (Mirai)", "value": "d850719fe08c896059b643387a68fa5cd51bf050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762926956, "uuid": "48e5af24-786e-475e-80a5-c911c3c2efd1", "comment": "Malware payload (Mirai)", "value": "66f77ec737b2f045b240b24c30718b1306d1d77fc7d37499180142af094a9e546497a128a57c6c359330de04467146d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762926956, "uuid": "99115a3f-0fb5-4a62-badc-359870a442bd", "value": "T1A3C2E781AC8285668AD813BFF93D01CD3312B3BAD1CE7152DD465F08B7C994F0DA7A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762926956, "uuid": "973df8e2-7e9e-414e-83a4-a8581c3eab96", "value": "768:CMn1EjZA//+1vTRfRiOC7wYqT4JqsWA3B5d7I9Q:CMn12A//SrRftY97WARbIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762926956, "uuid": "8922d13d-b393-40b6-b11d-e3f7d180149c", "value": 27360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762926956, "uuid": "f625b840-0089-41f4-a3ef-d691fc658711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762926956, "uuid": "e316027a-1d1c-404e-83e0-b466380db3ec", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d10ee15-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939941, "uuid": "74cd9c38-e245-4181-b579-22afb00663ac", "comment": "Malware payload (Mirai)", "value": "07c737d672ccfbe87ed172554f74c2b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939941, "uuid": "ee74953f-7109-40e4-80ed-a89a57a039b5", "comment": "Malware payload (Mirai)", "value": "e63ba4010b1f254936ef5c7be99e059071be3a4f83c1080a30b43feaadf3ec7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939941, "uuid": "a5fa17c8-a6c9-4bc9-948e-71e35c6475b9", "comment": "Malware payload (Mirai)", "value": "08c5bdf5c230217f11e9ca3c0f3cff24e9a37a4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939941, "uuid": "8a42440a-5b44-44fa-808f-151dc842d85e", "comment": "Malware payload (Mirai)", "value": "75eba9aa8e68f540acfc5778b144fd08c5b40da7fc808628f5e6e34941a08f125bde525a89d5ad6a601d7449af22a75c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939941, "uuid": "7a908225-4c16-42a5-ada1-2bac7dbebf6c", "value": "T17AA2C06A5E45819BC05F50B90E8747B07F8403639CC39A8A34A6CE4BAEC35E87472BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939941, "uuid": "dc9e6615-324a-41e6-b97b-66aaa85baafe", "value": "384:LbKPOWwlFvhOnLt2eM4LOmjoXs7zdtPqQEDXxtFAIJgGlzDpH7uNj1JvJb:vmLtMK5UXs7PAXbxJgGlzDpbuR1Jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939941, "uuid": "db4d65c0-a6c0-49ac-8e9b-39878a4c0d9e", "value": 22604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939941, "uuid": "3402ad55-ae15-4647-b9e2-3214adc51ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939941, "uuid": "417b334b-b19b-4f0d-b44e-68c10dbebcfd", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28ed5d9-c00b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762981772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981772, "uuid": "e1046667-b479-4a0a-a21e-3535b5fcd9c4", "comment": "Malware payload", "value": "1a2ff9b03660b6c8d5470df00cfa74a6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981772, "uuid": "57d94982-e6c9-46ec-a4d9-b361dc3a9f6e", "comment": "Malware payload", "value": "e6b06841b777b3c9184f2bedf357e16b0a19414c9d85089010e271797c48ddb8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981772, "uuid": "7fdefd18-fb3e-4c6f-a953-c36c7b0017fb", "comment": "Malware payload", "value": "e56e0f1c83a93fc0a69eb92312fe81d4ffeb861b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762981772, "uuid": "4775739a-e9b5-4c8c-bcc2-1784e8cfd677", "comment": "Malware payload", "value": "9445904c413565b171afbf1e81151b14b857d4f43db386ab3fd509ecf4f3bac3a47c90928ae2468944740a48aecbf706", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981772, "uuid": "0f082561-8593-4f68-95ce-8139d4525ebd", "value": "T11C247526ED875CA383C3DAA3D6E3D21CBEA484EC840B5DC1F5B8C6865861D6D0789F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981772, "uuid": "ac98561d-32fb-4d32-8414-9d6ec6fbae6a", "value": "768:+0obKzDu6e1hr3g+3C5laZAfYbR52a2C7UaJmV0LBTOxQftZZV4EEOItEdzbCRFd:LeD3ABK4A5roZ36S76QvJT7z/mC/CWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762981772, "uuid": "89c166a0-54bc-4ec4-b66f-22be4037a227", "value": 222052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762981772, "uuid": "8574b57a-ef7d-4189-90db-2d504d16563f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762981772, "uuid": "a98e30a6-75cc-477a-94f2-130a149df0b5", "value": "test.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0398a7c1-bf95-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762930717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930717, "uuid": "d3d5a660-5fee-40cb-85b7-6472378897f9", "comment": "Malware payload (Mirai)", "value": "a1f36f38def26872170eb077f05f8668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930717, "uuid": "5422ff9d-94b6-453e-8077-7fc81a22733e", "comment": "Malware payload (Mirai)", "value": "e75d1e9b8b075abfc60c3db669af4c073efd35d94f2aca3e528f3af6e3eea772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930717, "uuid": "38acfc16-a831-4eb5-85cc-8cb3445d6d99", "comment": "Malware payload (Mirai)", "value": "8a0ddb67946a73709f6439d41836375cba6b556d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762930717, "uuid": "9b43b34f-484a-497b-9730-6f9bc4650ff0", "comment": "Malware payload (Mirai)", "value": "9c2f49df61a9ff7360d286afbc2b4f07b4827586805fd0bc42fef74d1a8d794c7b62d27fab657763cc46b08dfcc5934c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930717, "uuid": "8a6d1f1d-e755-4452-a20b-80834eb2ecb8", "value": "T188B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930717, "uuid": "41e54a83-bd60-4c5e-a319-4c8aeb872ec3", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzi8rSR:t3SrlGWnKTU83AQB5A5Liy36fmUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762930717, "uuid": "f493cdf9-23b8-48be-879b-76e4e0b57894", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762930717, "uuid": "8237281e-543a-41df-ad33-62704a731ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762930717, "uuid": "785ba5a9-79d8-4190-8b9a-002762a25bc7", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39da2d61-bfc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762951424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951424, "uuid": "b0e0751e-4bcf-4639-949c-3dbc4ce8a44a", "comment": "Malware payload", "value": "8da9242e1e30b4c19f45c8ea54db4370", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951424, "uuid": "c7d4d4a1-4af1-40a1-87a2-f1095eddb87e", "comment": "Malware payload", "value": "ea2d60008a93fcbef8a18c4dfb3bc71b4839076a65f84340e8bacf011e7256c0", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951424, "uuid": "115d9e64-9069-47f3-8cfa-e4b625118984", "comment": "Malware payload", "value": "dc2ed56af5066ca7946fcb2fb119d49a6ebf8921", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951424, "uuid": "60bd0080-ac5f-4b39-87ae-9a75e8d57c23", "comment": "Malware payload", "value": "bd724bb206f24a64bc4bc680de433c045eb1038c48842a07c1e0611df0a548628a24f57b39fb0b2c30a43a6b0037150d", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951424, "uuid": "e833f301-79e7-4c71-a635-181de9b421c3", "value": "T164C4EFC69F8F9CBE00E5BBF6143740CFAF497D14025B3CD6A8C4FD829684A87A49646D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951424, "uuid": "57aa7f59-761b-48e2-b6c6-d9f97a5f3e2d", "value": "12288:ccQaMIwmILVBejwTbHd6rofDWxcYT5FSYhSvhseGyhjIMLQ3:hQaM9zLVB0wPGOLYTXSYgvhsedjjQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762951424, "uuid": "65a8c6fa-a380-47b1-93a4-502d04b959af", "value": 596883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762951424, "uuid": "b0478b8a-6740-43f0-8c2f-a31eae3cda4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951424, "uuid": "1f329708-0b37-412a-856d-0b20f8c36a63", "value": "0116f823a88c046f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c7a3da-bfac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762940925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940925, "uuid": "2e99136e-bf8f-44dc-84e3-e77a5f3f8503", "comment": "Malware payload", "value": "22f052e805dc708ff3d1463179a14073", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dumper", "colour": "#1401EE", "exportable": true, "hide_tag": false }, { "name": "infosteeler", "colour": "#7BC68E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940925, "uuid": "d9f5e217-d8fc-440e-9e23-dc0adf51f986", "comment": "Malware payload", "value": "ea54bf556a12a654b7012f38edfcb5bb758af2d3a420c570c17c3e8027178597", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dumper", "colour": "#1401EE", "exportable": true, "hide_tag": false }, { "name": "infosteeler", "colour": "#7BC68E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940925, "uuid": "c8241ee8-7649-49b8-ad0a-039f9de0f8fe", "comment": "Malware payload", "value": "beb2a45f7b4f345c1e50a045af239ce286e72d8b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dumper", "colour": "#1401EE", "exportable": true, "hide_tag": false }, { "name": "infosteeler", "colour": "#7BC68E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762940925, "uuid": "d8dee9f9-f460-488c-b082-6a3f262c60f8", "comment": "Malware payload", "value": "2f21d3b6c58c1e14357650556a624b17a43bf43d164b99284a209f70c77dab3d7a47e60b7c7410413e1b30fdac08fd19", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dumper", "colour": "#1401EE", "exportable": true, "hide_tag": false }, { "name": "infosteeler", "colour": "#7BC68E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940925, "uuid": "48a9b431-af14-452f-a8c7-dc8a635d257a", "value": "T1C5E63359FB5A0500D1FA7F30E9B6B2F6A6EDCD7A920256A11050A31D6DF35C41E08FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940925, "uuid": "663a079e-158b-4c34-9beb-ecc7348b98bc", "value": "393216:cEIvzZecSA79fhulpJBn7ncNYZPPAeLiv0OCd0:gNHslpJB7OpoilCd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762940925, "uuid": "03698117-f051-4955-8262-174496f5eed8", "value": 14070330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762940925, "uuid": "7bec5dae-c54f-48bb-a053-ab511f54e12d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762940925, "uuid": "3ba3d8c6-f53f-4c58-b823-89157c7eec58", "value": "yes-card.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a008a827-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935275, "uuid": "7c056292-2220-45e4-bc96-ac9a2b486b2d", "comment": "Malware payload", "value": "2baf9e9052cf14f53c1d187009299a61", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935275, "uuid": "283cc18f-e3a6-435c-8c20-349f6bba4685", "comment": "Malware payload", "value": "eaa90ac2ba5916df0fc8b79ef19c53cbe148651fcdeb7791115479ad866e6431", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935275, "uuid": "6ed140ea-3f62-4111-9e33-93fddb45a7e9", "comment": "Malware payload", "value": "64f20595508fe2bead5ff51e305f266f1d33026b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935275, "uuid": "d35fd651-62d7-496a-8142-012fc91ec5b6", "comment": "Malware payload", "value": "d896a62858fe19fa90643620a737dc118abbfed77e62bb62cab1d4fe9191d0c0f27d21a1112ecf69f2e5f5ed2cea9b1e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935275, "uuid": "28416631-39b5-445b-8191-379582a45a95", "value": "T1BCD6F171F736E446EC8BEEF5978B9349CA4E410E2701F92E174D110EB978444BFA9EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935275, "uuid": "4bdbd838-6c62-4456-bbd8-a45d781a6724", "value": "196608:cLLP7+7a2fwhq3t8MUt3zq7XmH3Is0tvfB6uaNSeFJ82Ii6JDkD:YLPK7fohCHazmWH3IPlfB6x/8tbtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935275, "uuid": "d41c7aee-0caa-458d-ac9b-40a5bbb26a3d", "value": 13320243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935275, "uuid": "25e4632a-f927-4183-99e6-8cf863ca756c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935275, "uuid": "6ac52437-c6a2-492f-a6db-b9f5511ffc1d", "value": "SPK-SMART-MOORA-CI-3 (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d62231-bfd7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762959196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959196, "uuid": "3ddff435-ef0b-4f81-8750-aa130038a92a", "comment": "Malware payload", "value": "00aa2df81e7524b69eab1dbcefbfe22d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959196, "uuid": "f57d6742-70f6-47c1-a7cd-d646c9c87760", "comment": "Malware payload", "value": "eb0925d0211a14b2bf463a55331b2ca28b70c0929968685a8c01b4253fbc2f4b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959196, "uuid": "19fe1968-1a32-4f6a-a666-4318f152ca18", "comment": "Malware payload", "value": "f9ac3526575e4855e6cd825fd6e406923310a19b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959196, "uuid": "5b722aa8-b8c2-4b1a-a3e8-bebc427de2ff", "comment": "Malware payload", "value": "4e9be8bb53ac46a07c1677ca327f74429de158381c5781886c57e657823e1204d62542a0742b4f28b1105e918b3f25b8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959196, "uuid": "bda5586f-ced3-4890-8a96-2516c8ade5af", "value": "T1B0B42364EC5418E66705F2BA3E310CE9833D3E27D163911FBE21A1611F4F9DBA67A04B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959196, "uuid": "ef730602-74e4-4312-a2af-142b213552cf", "value": "12288:TwHDpGH4+xzS98ojWSoRoOsb686P/jrVrg8X07Jwb/E5Hy:AsH4SzSuW20q/Vc8sGGHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959196, "uuid": "900f6069-afcd-44ae-b2a6-9f300306e6aa", "value": 535335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959196, "uuid": "17b1e24d-3f1d-45d1-bf51-82a8380576ee", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959196, "uuid": "85de497e-6cee-42ca-a6f8-a71802086160", "value": "ORDINE N.25000650.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbd8647-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939945, "uuid": "94df7f1c-cb98-4257-978b-2fab7412dad8", "comment": "Malware payload (Mirai)", "value": "a42df10c0ddd07ff4271d101152f7edc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939945, "uuid": "2273900a-b2c1-4f8a-b321-2469cb389200", "comment": "Malware payload (Mirai)", "value": "eb3c580042f579f0d525cffd57c71c478ea7c7b6517cc669eb4984eb4bc693de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939945, "uuid": "b6e65b80-f764-4da0-8207-520820632c9a", "comment": "Malware payload (Mirai)", "value": "e023f5d5ce76d758ed5c1bc2d973639864257170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939945, "uuid": "c17f6c40-75a4-41db-9f7d-88fe8759dffa", "comment": "Malware payload (Mirai)", "value": "36f1473b39eb71f0e629d1742b58602219f4659cee1628f409bae02353552d56267331f7146910b1f585593006dc9299", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939945, "uuid": "10b51ae1-4f5d-48a4-8072-9168fbd270c8", "value": "T103B2CFACC1AC7286C4BD4DBC504D0BF04E9670E2225E870CA3724DC278AA69EBD9857D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939945, "uuid": "1b700cf0-2d99-46ca-9017-4da594584ac0", "value": "384:ZUNvTs0QPVzdYaONbcFWAmz5FcGKShtkQCqZTOsAu/wIL/lx8mdRvbRWGVCz0Nvo:yvgPVzdYaO0OFcG6gws1//LnxvFWKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939945, "uuid": "a7728d4c-1351-42c5-9002-70b2485082ec", "value": 23676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939945, "uuid": "28a41c10-47d3-4a4f-b91c-df668e4726ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939945, "uuid": "3b957cec-409e-4d91-b541-7416f2640611", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d7df1a-c00f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762983259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983259, "uuid": "e6cf5b89-0f77-4555-964f-ac48ad386cc6", "comment": "Malware payload", "value": "6676ab2dbd358aa22edde87bfc905e15", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983259, "uuid": "f69cc6e6-b5f3-4432-883b-02c8243750a4", "comment": "Malware payload", "value": "ebe4e61809a9e44d7fe49d342f0c4273b602c8578aa888e819221e133762e13e", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983259, "uuid": "9a0a0971-9e9b-4d5b-9a47-a2b16110c7c6", "comment": "Malware payload", "value": "0ffd66b8ec9bfc9e0e0a8904f0d48ad0d75f0389", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762983259, "uuid": "9af0041e-65c8-42e9-a062-02ccf70d180a", "comment": "Malware payload", "value": "a6f6634085e0ca83518194495b2d2b014b84484273db58fbc15f9a48ecd8be5bc76ca312df3e248c4026c371b729b522", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983259, "uuid": "64fc1a64-b77b-4d6a-ae00-aaa4a32ed463", "value": "T11E06F015B2C3C932D16D0177E969FF1E1538BEA3073045E7BBF43A5E49B08C1A27AA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983259, "uuid": "ea7a231f-5141-4a2c-bcbd-61feac149384", "value": "49152:UnMjkMo27Epq0n8Toc4Ug8r6F5mCmR+l+TWMShkkcr4u12X2rDNbuwoaMURv56gd:bYn8ToBo6JqrnfRbQlkPvynhWQ8W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762983259, "uuid": "7ebcf6e7-3d1f-4ece-a688-f867733ff6cd", "value": 3814400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762983259, "uuid": "c40e7021-38ba-4120-b7d2-a0b391c61c74", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762983259, "uuid": "72545d62-90fd-4489-984d-874528121701", "value": "ThePredictor9.3.8.9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5770fa87-bfee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762969083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969083, "uuid": "ecbb91fe-224c-4418-93d3-38990481cbdb", "comment": "Malware payload", "value": "7c5dd5ccb5af538e569852b7348891b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969083, "uuid": "68f3e686-d4db-4594-8d03-8289b2884b99", "comment": "Malware payload", "value": "ecbdada9891b9ff975f6f17a64bb2bdb5adc64dc680d82496df2bac84ec10ae9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969083, "uuid": "69641140-f8ad-41a2-a838-801d28b97b92", "comment": "Malware payload", "value": "da9add85cf9a0febb8d7712436e38dc476f202c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762969083, "uuid": "c4526a74-d94f-482a-922b-e2f69618915f", "comment": "Malware payload", "value": "270714f7eb3ecff8561f9ab6bc670ea537f5bc3e229a3db2be110e6498893c7f625bf78eaf5e6cb931a3a697f0d260bb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969083, "uuid": "a05a80cc-7e46-4380-9680-77da71d854a4", "value": "T17615F1F8D40752E4DA8EC0B65CB3A0398DFB39A39A720F5E583DA431DD46582BB3C951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969083, "uuid": "25e9b86c-3657-4391-9fdd-1c481e98dc0d", "value": "dc7582daeca53ba9537917ac1c1a7ac6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969083, "uuid": "36cfacde-e922-4e21-9582-0ede0128fab8", "value": "3072:X9kpM2qu6gKDk7a+UC5pZuatdhf3rG14dLDobX:EVqu6bkZT/f0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762969083, "uuid": "c848f599-b50f-49bb-98ac-d6e3aef734a3", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762969083, "uuid": "e72cb279-95a5-40f5-ae98-5cced54bab80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762969083, "uuid": "d9beeeb8-d14d-40a1-af4f-33549f2e1fa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e954c591-bf60-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1762908340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908340, "uuid": "e6d3d7ed-b1cd-40c4-8523-2bcc28236468", "comment": "Malware payload (Ngioweb)", "value": "1cdf6f3276325e648dd66d59e565cf8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908340, "uuid": "1a3c5840-2b0e-41a6-b000-2b338820b06f", "comment": "Malware payload (Ngioweb)", "value": "eeac99d3cb2e9e9c6c030c9964afccc0886688a0390a7849994146ac0c9604da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908340, "uuid": "b91b7789-8c0b-43f8-89b6-0f56beb388be", "comment": "Malware payload (Ngioweb)", "value": "63e32df9b816bf532a0e104ba7abde0679a756dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762908340, "uuid": "45ca9f06-75c7-4ab6-a393-271e8d97ecb3", "comment": "Malware payload (Ngioweb)", "value": "47d6e2fc78941f4e9e42689e1c2678cb7a2a533c12642494ca17b81daf9243a9e030f5522d69de3f5ef44b9c2fd5a0b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908340, "uuid": "836257db-c1ac-46a3-afaa-6204986471df", "value": "T1BB935B84FB83E0F1F6A305B1021BE3AA56709D289055FAE1FB0BBB767C717128C1566D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908340, "uuid": "0ca19f07-5f4e-40ce-8587-010249719ad8", "value": "1536:fc8XMw+Tv+0rWHGuq8BOWwgdMZdlD2pacwA8ELSjxGor/csbiCdRimY:f/8PyxGuq8BOW3SND2acwA8E8xxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762908340, "uuid": "4ffbf0f9-7924-41ae-9488-243dad9a1d3b", "value": 91360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762908340, "uuid": "8213c1e3-6c7d-4901-85e1-d5c4b6e50b74", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762908340, "uuid": "f4146232-55e8-4e8b-b9cf-1adb1a7414a0", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e581868-bfde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762962223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962223, "uuid": "8e64bfbb-febd-4f05-9857-a6d36c5c3cdf", "comment": "Malware payload (Mirai)", "value": "f9f2e4178098b09e0e7ef3222aed5203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962223, "uuid": "67bd9863-5fcf-43e0-9af7-5ebda611576e", "comment": "Malware payload (Mirai)", "value": "ef525723dfdf77a9263ba74dec59b36f2fe2d5f13414f3aff466636eb7f56779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962223, "uuid": "3654c219-330a-42af-b466-71b9a3436138", "comment": "Malware payload (Mirai)", "value": "aba96d51402ff3b3db9458a901590e96e86bf017", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762962223, "uuid": "6ebe5a5a-a1a5-44b1-abd6-ad4d1d52f7da", "comment": "Malware payload (Mirai)", "value": "0f24aaab4d349076087ec05399c92341c8447435560a6cacc602cab43145a2c3a2bfc8a36365478a29984f5b3baeb812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962223, "uuid": "9d657329-934d-4f5e-ad32-c3e7a9185274", "value": "T138533A32693A1E0BC0D0F97622F3876CB2F1264E2AE8CA5E7D630D4EFF6855055536B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962223, "uuid": "6e1724dc-73b6-4f3a-89d6-fc25ad5715d7", "value": "1536:qKCYiA5YoopbGfXw0xZMrn8qXl+4HBg9AaVA1HOH1t57x:RbiAaoopbUPeB4PA1HOH1t57x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762962223, "uuid": "878a59a6-59a1-4b88-91b3-a6b57ef73af2", "value": 62596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762962223, "uuid": "e04a01d4-54b4-455e-a89d-3933a03a877e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762962223, "uuid": "e5271a35-d52b-40c0-86f4-91b43b30e5c0", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4167da9-bfc4-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1762951254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951254, "uuid": "a0a25152-5f64-409f-8d0e-c82a212a04d3", "comment": "Malware payload (GenesisStealer)", "value": "8f43e321dec9dd12d638776a36ee194e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951254, "uuid": "c70562d7-477f-4136-8094-85ba2ca3b961", "comment": "Malware payload (GenesisStealer)", "value": "ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951254, "uuid": "6c8abde2-fe41-4a59-b85a-18617604687c", "comment": "Malware payload (GenesisStealer)", "value": "9a36263e9e95812c8d756f6ac16c00e229483927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762951254, "uuid": "607ccc74-fdb0-4520-aacc-7c50bf8756f5", "comment": "Malware payload (GenesisStealer)", "value": "bb4d0e35acd479b611f10fe73b16ebdf282b811c3d15992aca84f43ef608cbd2a3c682e8f6ce778e015b8b4c6ce47585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951254, "uuid": "72c1bec0-0d18-4494-b343-b7bd7b324147", "value": "T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951254, "uuid": "aa186bc7-3976-45b5-861f-ef799befea3d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951254, "uuid": "2793936b-24e7-47bd-8c71-36e951c05f84", "value": "1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762951254, "uuid": "fbcf11c3-2fb8-4b00-9ee5-ccfe2677f58c", "value": 88848291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762951254, "uuid": "6f007d09-d50f-401d-95b2-f4a8fd7e52ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762951254, "uuid": "910e761c-afd2-4c8c-960d-badb9a7b1f5f", "value": "MuckModLoader Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebaff91-bfe2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762963995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963995, "uuid": "de0acd9a-ced5-4eae-b457-946654a68a7a", "comment": "Malware payload", "value": "ad343e76a422a7b266d3c59d9bea535d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963995, "uuid": "53ddbf09-3994-4aa9-bbf3-da447fe2502c", "comment": "Malware payload", "value": "f0c5f41cde6805629993f709996ee73beb34699e0aa2b349832d65cfbc7a792e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963995, "uuid": "89facb0e-d4e8-4d4a-8eed-7821907a9b74", "comment": "Malware payload", "value": "4fc0b1a4f122085dc1f4b525bc45d10bc3c56d2c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762963995, "uuid": "76768139-d3e4-42b6-adb8-5cb709b3c35a", "comment": "Malware payload", "value": "111fe10b098a57a01cb2cff8f724bcf719e14d701edfca3fa510249006a79f6ebe77c3a2605503cd5ec874d96274f810", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762963995, "uuid": "748253a0-171c-4f83-8ba2-834ba9f9eeb3", "value": "T19B361296B7D66E2FCC73C9361F89623116569C26CB43D74B240933AC6C7B6E80E94BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762963995, "uuid": "78c10747-1b21-49a9-a4ea-f76e9d3408a2", "value": "98304:feTgcdS4mjmewbxeTgcdTgH+V5E6RZVnLOQctzC+lxPy3o9Gdoc:2TgdmtITgm7E6R2L1C+bwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762963995, "uuid": "305fa5c1-8a59-4c7b-bed0-312c92ff6f86", "value": 4949792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762963995, "uuid": "06c59831-a366-42aa-9649-905e0fa42a44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762963995, "uuid": "f9b998b8-c070-4867-ae33-8e6c64a00217", "value": "herodotus.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a684f4b-bf6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1762912824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762912824, "uuid": "ae0e1285-4031-4d16-8b8a-9c51c81327ea", "comment": "Malware payload (Gh0stRAT)", "value": "93a268e1ad1505c222182e5a4dd75790", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762912824, "uuid": "ae230dec-ad1f-44dc-a93a-18a2a871ed55", "comment": "Malware payload (Gh0stRAT)", "value": "f154be4057e821d85890232d3737c28140b396dba65db14a0d6b2db554f1d9a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762912824, "uuid": "737e4c45-927f-415f-974a-722c8149b271", "comment": "Malware payload (Gh0stRAT)", "value": "d16b3e76e718ff95bed8aaa0b4ac5da20ccc62c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762912824, "uuid": "acceb523-c9f8-4358-a67d-6209031ca6c1", "comment": "Malware payload (Gh0stRAT)", "value": "1581ed1f5fc48014af9b8e9c68754ccd947443ac60bbc7b731804dd6ccdf92e57fa292ac025e13e68fcc51f746601b4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762912824, "uuid": "5e32e454-35d3-4376-868c-2d59719e5dc6", "value": "T1D5047D01F7C901E9E176913C99FA6B36DA3374140B288BCB6754CA991A23AD5FF36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762912824, "uuid": "fd2ee50b-a494-4960-9b40-fd374867d219", "value": "b6fe1394ce89e6c21fe5af76775c6e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762912824, "uuid": "b402224f-3808-4a76-9519-6c69b5984dc2", "value": "3072:f/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:fLPnc2qrJ51ZkMaJhQCNBU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762912824, "uuid": "3e04fd6b-0e22-4071-ab08-38672555d843", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762912824, "uuid": "f41fc372-4aa4-46ba-ac37-1333c5bce71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762912824, "uuid": "1e6eca4f-6905-4d07-a87c-5823bf414921", "value": "93A268E1AD1505C222182E5A4DD75790.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8f9bf8-bf8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927919, "uuid": "23112b6b-4012-4c89-a668-04f98607d3b3", "comment": "Malware payload (Mirai)", "value": "6c8dfb15ff0d21e332d049c40bedd17c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927919, "uuid": "31fe9e7e-236a-4e4b-b710-e683edf6e71a", "comment": "Malware payload (Mirai)", "value": "f1db9998646df4dfc57937b2b5df86ed03d5b55001319741405fc2025308c520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927919, "uuid": "219f9e6c-abfc-467c-aa66-a8a327c4a836", "comment": "Malware payload (Mirai)", "value": "1b2fc6becd1fde335b494929e1ff220dd68fb0d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927919, "uuid": "5c0b9c9b-3052-46cf-8e97-1cbea08fb6b1", "comment": "Malware payload (Mirai)", "value": "e559c6893e77ae8b1ca6ac99442c1dea38f48dafe6a847cdf58d094f8b675e85f46c009878b51c47852eaa9b67860e9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927919, "uuid": "5da42707-d441-4dd0-98a8-307870f73582", "value": "T12BC3F185BB6369D1C1A242BDA4C00AC387916E318FE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927919, "uuid": "5b53b329-6fe8-45e1-8e24-34b9da3da015", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnJ:0OCDjXG9qTWywxlxTnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927919, "uuid": "d1f965e7-037e-4745-95e9-27931144c3f8", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927919, "uuid": "a3c2b971-83ab-47aa-9e3d-852206ae47c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927919, "uuid": "efd1a816-dbc7-42e3-b028-e27536e9f154", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c921c6-bfa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762935880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935880, "uuid": "5cd40168-d50e-4eff-b2d2-1fea2900232b", "comment": "Malware payload (Mirai)", "value": "cf835c849e52eb38f01f8001906e8d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935880, "uuid": "8a95950c-43d3-4f14-b056-8c4b0e292ddb", "comment": "Malware payload (Mirai)", "value": "f2a4e41a24edc6b077721eb8c247ae62cafee2f62d1a3146327770573efceefa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935880, "uuid": "8735ae57-f0e7-454a-bef4-2bed33ef9b4f", "comment": "Malware payload (Mirai)", "value": "bd8586b5521e5460344094b40d05ab72de135243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935880, "uuid": "03a8c9e6-7e31-48e5-a079-5ee472aacf35", "comment": "Malware payload (Mirai)", "value": "49119d2c639cc5ba4b88e48dba3055c356ca8e188c4e04bf06fdf420ac7c3356e7e3c36391f8f5910be5a07c005cfd83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935880, "uuid": "3e4e852a-2750-4faf-9a4e-aa24abb40d3f", "value": "T1D7631257FFCC1BACBCD95BF907AA6ACE27615021807241B41DDA9C4A809FAB111DBCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935880, "uuid": "fa08e134-acab-46b7-8eb6-e57cfd63da33", "value": "1536:JU7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgberP0:W7Mbp2L+Xqdfoz2sCerP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935880, "uuid": "ccb3f0d3-6eb6-4eee-abf2-161e67205f34", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935880, "uuid": "e4957335-cb9b-4153-a1ac-cfe7b3991bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935880, "uuid": "64c0c0b6-2188-45d6-9081-eb068a7fa144", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7359430b-bfec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762968271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968271, "uuid": "124f351e-9e73-435f-ac1a-a69c3ee66c04", "comment": "Malware payload", "value": "6437783513dc65048bde1584b9b70765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968271, "uuid": "bd53b816-0f35-4b62-8fd9-ca174c59167f", "comment": "Malware payload", "value": "f2d4a403037c7188c402a17f525901616cf2e2f8d4ce4498e5d08ae3b6c7e744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968271, "uuid": "4d2806bb-d462-451d-becb-c1436663e31f", "comment": "Malware payload", "value": "d8e7e87471df96246b5c3296bed97bd85002f160", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762968271, "uuid": "67bd7e9e-ece5-4084-bf1e-d4d2363c301e", "comment": "Malware payload", "value": "7f2c10c7ca6ce5c2851c9549f153e25a468aef7e2b5f6651a27924b331ce292b3d5c32b9e08885880b2485f39a377c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968271, "uuid": "015a0083-c450-4a8e-a715-4d516323dea0", "value": "T1C562D0A223823644E231DE7937EC340FD05C4927717997147995D24AD92BB244CB9FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968271, "uuid": "fa16533d-08b8-4b52-b610-80a7774d6c58", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvrY6jdE7F3:yb2eX3zAKuiNPZRwwqdvrrduMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762968271, "uuid": "37515242-9a6f-457e-973d-923eeabb95d9", "value": 15672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762968271, "uuid": "dead69da-bf94-40f7-9ead-b40357c374a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762968271, "uuid": "413932dc-037e-4604-a065-8ba0a90d9525", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738689ad-bfd8-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1762959682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959682, "uuid": "d5f27374-b00b-4101-8530-a81caffb9f0b", "comment": "Malware payload (XWorm)", "value": "a5aafe9347d8492f777b1839a1415a94", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959682, "uuid": "efa5b2c9-5798-4bd7-bd32-123dbbec6558", "comment": "Malware payload (XWorm)", "value": "f3daf8f3298e6121722e7d2c18641de146213ce8672f487c786614d09db7daca", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959682, "uuid": "f86fe6ad-443f-446a-a819-ef5607db9473", "comment": "Malware payload (XWorm)", "value": "1e39e758be3e0cbe2b9d3da52df43d66c5ad9aaa", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959682, "uuid": "9a5b08cf-051a-42a0-8569-4dd4cd002ee3", "comment": "Malware payload (XWorm)", "value": "ffa72ed0c922aec3db8868ae49edbd40b41f72ab1529d17aa349526efd9bf9523012b8eada1235d37b51e877f15e85b3", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959682, "uuid": "025ef507-83cb-4e69-a47c-26f4df1d9750", "value": "T121530236127BA101D0EFC7CC487AF52C71D58B2CEBC2BCE3999D80891786933E4D9895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959682, "uuid": "ca81f568-1438-4de0-b758-b2af49b69124", "value": "1536:/HtwHvyQOON9P+xQ5jfSK+ZUy0ZenW7Z1xe2vwj:/m1NRaQpqK+pAUq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959682, "uuid": "c5901f9d-a3b6-42bb-b7bc-53354db28dec", "value": 62274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959682, "uuid": "d2d1b360-878a-4398-b3d7-4d56f07ac4fb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959682, "uuid": "322ca214-cd00-4e09-8ab2-73e210fb85d3", "value": "nAWB_DHL_7214306201_Pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a66f273-bfd8-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1762959613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959613, "uuid": "d56f4402-e971-4e78-9611-ca69c9f4e0ed", "comment": "Malware payload (XWorm)", "value": "9b213a96c508337ac71d9a8ac3bfca0c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959613, "uuid": "e5133564-9439-4dce-bb49-153804c6bd62", "comment": "Malware payload (XWorm)", "value": "f4073f71a9d0616905a018e6f42c60530ffaad1cba3f1057d3f47b82fa3f90e5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959613, "uuid": "a3468df7-a916-49d7-bd88-6a2d754a6273", "comment": "Malware payload (XWorm)", "value": "a777e12145311054fadecfe0941ffc6085add989", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762959613, "uuid": "3003a178-7abe-452f-97ac-17024febe284", "comment": "Malware payload (XWorm)", "value": "6ef74f9f151b1a99c773b3189980ac8836f5af4925ef023cf0a6086d679d28895a904bb13b158368c45eca8d9155e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959613, "uuid": "31236cbe-f1c5-4290-aefb-2d51376ad3da", "value": "T1BC24D82802915D68CBA1337125BFFF70143AF24D99241A72C9DEA0EC5D7A1CCF7DA9A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959613, "uuid": "28c2a4a4-aaaf-45ae-b08d-41b789002293", "value": "6144:Ps1/DDO/vX03jIBxkez881JgwJsbObq2ymmLdR/V3Gaofbu0KFl2:jLUBNGuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762959613, "uuid": "163e4476-baed-45ae-92da-51176e5ed450", "value": 220254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762959613, "uuid": "f8321f0e-7774-46d1-a58e-cc070d8892ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762959613, "uuid": "8d39ab2e-e525-4c11-a098-01b0a7054459", "value": "rAWBDHL7214306201.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2ce883-c009-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762980634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980634, "uuid": "11be66b1-9d50-42ff-b8b7-69beac5b3565", "comment": "Malware payload", "value": "43fdbb8b80719110c38faf813911424e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980634, "uuid": "5514b6c7-5dec-41ab-bd3c-74bd3966b293", "comment": "Malware payload", "value": "f4a9651380d433fc2d3371274561b62b198bdc62d487a53541ad1c6406989655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980634, "uuid": "3b09db1f-4cf4-4b50-9828-8c849353a482", "comment": "Malware payload", "value": "b1fee4bac8c187de1ec7a676de6d56bfd56704b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762980634, "uuid": "29e9c7b4-cfed-4bf9-9aad-0ca2c453cd71", "comment": "Malware payload", "value": "9ff315b1e832be7d52b7ccdbd9b4eaf5f71e20948eefeb8f3cf2bf0f26a5a6e060a3f9379c03a9fd80255de7c845f0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980634, "uuid": "453dc8bd-89f3-4623-8555-9a057ebb4be6", "value": "T177A633A0E7C0BC9FDF97D8733163918D4E45D71295B18E5C6A484432BBB998B9E2C233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980634, "uuid": "3064eaf1-938d-479e-a102-43015f1d64db", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980634, "uuid": "71999eb2-48b8-4df6-be79-41364a24689b", "value": "196608:+YpsUiysF9aNoqrHh7P63rCUT+jW+HEPBRryF6ca+Q:+usU6vaNoaB7POMirPL+F6D+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762980634, "uuid": "7fe0f3ee-ec74-4209-ab03-f7e2613569e0", "value": 10336768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762980634, "uuid": "949233ae-4f60-486d-ba62-abbd8289869a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762980634, "uuid": "ac982b52-52f2-4cde-a426-a5683e0d7f7e", "value": "Installer_v13605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac51b1f1-bf7f-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1762921552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921552, "uuid": "adbf8d32-404d-48ad-a82e-3a250a95059c", "comment": "Malware payload (CoinMiner)", "value": "7d81b5e9004729d0970d449475f621dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921552, "uuid": "ac858c43-9305-430f-9278-d6c7f2339468", "comment": "Malware payload (CoinMiner)", "value": "f5ed87690ff6ab07868a23054d73b173f620b9d0abbfe4e16a0e0111ae0d73af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921552, "uuid": "6a45c991-b70a-4da4-a6d0-685111e7bcc2", "comment": "Malware payload (CoinMiner)", "value": "547df8de96c729edacd0694a887238b167f5e591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762921552, "uuid": "6e05f8e7-4c3d-4f3a-a32a-c7805e8cf17e", "comment": "Malware payload (CoinMiner)", "value": "afe2cfb2018c72b22e6016e0852b9d9b2fc6131421c1f7ce508762f49b24a12e20312c8128ef9db614e6cd09a0d512bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762921552, "uuid": "8697d333-ecfa-4887-80e3-28ac3f726049", "value": "T1789533B930BD40AA7FDAAA1057C4DD296D9A9E8C5162DC507CDF95E3A841C03F0BD22F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762921552, "uuid": "ea820e09-feb6-48cf-86e1-54bd334e9304", "value": "49152:KMSozbQm6IrcjEGPdXCTmTSdk6xh3xWx2Zshh:Kwnh6LjEI/TSdk6/xWxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762921552, "uuid": "b3884267-21b6-4442-8924-f96513aa5527", "value": 1880032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762921552, "uuid": "3b53f1e2-c187-4822-9254-afb56eaba0d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762921552, "uuid": "441701aa-8ef2-4517-8f01-009381cbd0c6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af63c21b-bfc0-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762949474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949474, "uuid": "26f46ebe-58ca-4d8c-b5bd-165559340eb3", "comment": "Malware payload (QuasarRAT)", "value": "7764f6750756c6a58bcb7ee3e8108e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949474, "uuid": "40b7cabf-e3d7-4a24-8a6f-fd28cc34c2ad", "comment": "Malware payload (QuasarRAT)", "value": "f77dc79317aaa60814d8bee4b73d45ad86c069e939078c43d0dc8da65f97be8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949474, "uuid": "711958e7-a2ea-4dcf-ac23-b8ffcdc649e8", "comment": "Malware payload (QuasarRAT)", "value": "0df1d8ee733998c00aec4560ca5c83e89c38c6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762949474, "uuid": "b892ad03-26c5-41e6-b076-65fe565e7b95", "comment": "Malware payload (QuasarRAT)", "value": "cc62e6665be162fa84d26c63357b99efcbcf4ef139885086784881931001cb52f98d2c771bca70d8504ac82e4e6d70c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949474, "uuid": "04be8a5f-c0c7-473b-b14b-5a1329cf2f46", "value": "T11415D09177F44607E2FF1BB8E47504984B72F916D97AD78F0998A0AD0EA37C08E117A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949474, "uuid": "897a8f65-05c0-4aca-b754-fdf627bbcc8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949474, "uuid": "4018ab7f-5745-4737-ae9a-4e6ae996779a", "value": "24576:54IOpsJxJzck+uGW/yFoBkkAePtgwbyIc:54IOpoTYjqqantru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762949474, "uuid": "b326ce7e-78d6-4949-8b22-182141f9c572", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762949474, "uuid": "3c8e0c9e-6657-4320-9f3c-8780fcdc8a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762949474, "uuid": "84d943ab-74d7-4ea7-8026-a6a6bd2b8622", "value": "SystemPerformanceConfig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8267d9c8-bfaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762939950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939950, "uuid": "58c81f1b-099b-41bf-866c-7368c120779f", "comment": "Malware payload (Mirai)", "value": "7f398a8eacadfa985fb699bdc2fef0c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939950, "uuid": "e03d422e-1801-42a3-b4bd-f8ca61173df1", "comment": "Malware payload (Mirai)", "value": "f8be45a03451538a0183f4118e5dab3e1306c87546c3230f29e3637d031c3ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939950, "uuid": "faae4b57-83a7-4488-8207-72c082e8edae", "comment": "Malware payload (Mirai)", "value": "5c670763cdf92a09cd726da9d81fdaa99ee30777", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762939950, "uuid": "c684e743-dee5-4e22-a481-11dda6e41864", "comment": "Malware payload (Mirai)", "value": "3a6c4f7e31b51367613d9feab4d791424d1a1446a03530c4b0144212de0426bdcbc63812b047367211fa0802a2dca3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939950, "uuid": "e73cc341-2b0a-46fc-aa24-a4468296b1b3", "value": "T19592D124166ADEF0E999083EDA7CD857B2560FECD5FF500408BD45BC4A9E00B61F548B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939950, "uuid": "70b93c11-8123-4d40-9e16-c3376979834b", "value": "384:2v6WEhmxeqtosJm41XlQypFpZH4cg8ajjLmkeoA5IDhymdGUop5ha:M6WMmx1OyplH9gJASDs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762939950, "uuid": "6752d9ea-8e9b-499a-81d1-e4c771609213", "value": 20880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762939950, "uuid": "f4f79ba3-73b8-45f8-b57b-336b1d5698d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762939950, "uuid": "a8a3eeae-b2ed-4bcd-bb36-bd42b3b8f18c", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f595528e-bf8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762927687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927687, "uuid": "c990d987-cc4c-4f11-960e-a030727bb46a", "comment": "Malware payload (Mirai)", "value": "79a3086ea289b018bc7e207786651bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927687, "uuid": "48f83500-fa17-4fa7-9bea-f0edb33532e1", "comment": "Malware payload (Mirai)", "value": "f8ea21971d321e0acaebb05c9b4f1d83df638d72dee68acd9c031fe47c1e689b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927687, "uuid": "b7852cac-cdf0-406f-8a10-75c312e11d99", "comment": "Malware payload (Mirai)", "value": "d4311a8e1fe799aca3c3d3c5eecdc7fc5d42ef3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762927687, "uuid": "1266c2b2-d088-4567-a4ac-699212f52c04", "comment": "Malware payload (Mirai)", "value": "62143903b62c416875e73cb8c82aee85d00aaffbb0494b4eded19df4794476952f0a11941001624c41c7802be07be7f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927687, "uuid": "451a0867-d371-4ec5-83fd-57437b572625", "value": "T18A5302F6A0E47ECDD29A5370020F0A473EC166B86056A63A76C5F2648BF1740DFD8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927687, "uuid": "69f90ad8-1b25-4f93-b10d-47792a39efb1", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASA2Lkg4azHf:CM5az1Fy0oPgdZX6hTo8RFLGazHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762927687, "uuid": "bd96bb8f-6257-4a2c-8a51-1b62a8b3093e", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762927687, "uuid": "20ff6d9f-e47a-4d3b-a2f2-514a84815c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762927687, "uuid": "4da930cc-977e-4513-853e-e2989e40dc5c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c2a90d-bff1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762970634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762970634, "uuid": "31b37101-be64-48e9-8753-01f25d2c313e", "comment": "Malware payload", "value": "489b1c5437cf14f93ea8dd5fdae6189e", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762970634, "uuid": "05060ca3-c28a-40f6-923a-772027788eb5", "comment": "Malware payload", "value": "f9a83ff9868503a6a8ef79a57451bf39b6ff312ca4bb139aad51d21e027a40a1", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762970634, "uuid": "b380533e-e8cf-4f44-b0f4-f0aa9536f055", "comment": "Malware payload", "value": "f99d46c0185c8a730f3e847cf0813255a01a5c7a", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762970634, "uuid": "ca56487f-2a24-4b5c-b5d3-82091e2fb7b0", "comment": "Malware payload", "value": "0d8c9bb0f648e7cd2c55a12811be96cf2303abc56abc711dbcef5d8e7fb97481a208b9ad540f6ebe7498c6a9af803cdf", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "desk-danfajuda-com", "colour": "#DE2A70", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "filehosting-is-certified-com", "colour": "#17A84E", "exportable": true, "hide_tag": false }, { "name": "hostingdanfe-store", "colour": "#EC7C06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762970634, "uuid": "5d270baf-9c88-4c5c-98bb-f5ea008e99f8", "value": "T1FF14F8DD726072DFC867D4769AA81C64FA6074BB931B9203E02716ED9A0D99BCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762970634, "uuid": "7ffad1b0-38f0-45b4-b4b8-6d3d56593174", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762970634, "uuid": "def5688f-be69-4d5e-8b35-0cb674603ab6", "value": "6144:PeeKezuGpWX1/jgevzYAC/b4yGJ5Rddf8l4:Pv3Ul/zL7yGJ5Rddf8l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762970634, "uuid": "b99b8493-207e-4d29-a9a7-ada6fa46b155", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762970634, "uuid": "cc88fcd5-ab8e-44ed-9d09-f988fe5dddfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762970634, "uuid": "8a044294-e5d0-4624-9034-55cc7ff4ac32", "value": "DANFE1918476.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88231dd-bf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1762935289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935289, "uuid": "7f9c838a-f6cb-403e-8c21-c8393246cbdb", "comment": "Malware payload", "value": "d3709734a670b65ceab74e4c2fdf7b0c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935289, "uuid": "46c30745-9648-47ce-bc47-b1c853019951", "comment": "Malware payload", "value": "fad6c042f68908ebb7e99ed20209ba8be473cd8fd229b8af26b4f4a5632c05fa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935289, "uuid": "8a1a80fb-0f54-4e97-b263-9a84f0a1e3e4", "comment": "Malware payload", "value": "1570badc2700518f2268cbd2eee5a390664f5b18", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762935289, "uuid": "ae287095-8d7d-48c0-9ad5-5a1231cd911a", "comment": "Malware payload", "value": "f8b63453b7cf8030aa2abf1c5b05437eff6ef6a665c4c6888be45c273375e3617ca34de5f524abf06f32b533455eca98", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935289, "uuid": "57ec12ad-8e30-4cfe-aa2d-a1e5cdc389a8", "value": "T11A660203F74E4D2ECDE2BA780E9313716A19ACEC1510928F4912F218BE776D95F26BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935289, "uuid": "9a4b0b5a-e464-4166-8a99-772c0a6e0169", "value": "98304:8yi7vbALnAiGbJHzTeB7OFNIBIUPK1PdPoHZlAOQpUkKWxTaBR:8r7MnAiGbJHzs7OFiBIMqPdQ5lv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762935289, "uuid": "4e291cb9-c517-416c-ba4c-570d43605d79", "value": 6984900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762935289, "uuid": "0766bf60-b940-4a07-98d9-92e84665589c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762935289, "uuid": "5725dd12-d3a7-4f08-8b63-2d56080685a8", "value": "file.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a19fe4-bfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1762950080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950080, "uuid": "4c6e2b5f-2c27-41d6-ab32-2db40b10a148", "comment": "Malware payload (njrat)", "value": "dbb64ee3c1ddd492e8bfaffe5fe5c77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950080, "uuid": "66452898-d524-430b-b090-a76e613976bd", "comment": "Malware payload (njrat)", "value": "fc018dca8633efde8ad35521e6486fcae98149994ac545d8e14551aba701aeb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950080, "uuid": "bc8b0118-bc54-4197-8328-547eb2c89229", "comment": "Malware payload (njrat)", "value": "4bb060720180eae8b31b0698b88ee9d729814ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762950080, "uuid": "6d0bfb4b-deb3-42f8-bc33-3ae57a71eec3", "comment": "Malware payload (njrat)", "value": "c6ab54d84c65e55ddb45448b473c2856fda6fb5857d3adfa49853d953f3dd067408cede291459f2e5c5881870c959e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950080, "uuid": "e40750ea-a553-46fd-bdca-8b7a3dabb4db", "value": "T12D033C0227DD823AE2BD0FBC95F1525586BDE1B72613DB4A1DC800EB1913BC5D9427FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950080, "uuid": "e6c0406f-3dba-4e29-81ad-88c6a9ae09e8", "value": "768:FGYI50mZHssfClwQTmktnRsrRm9E0NljB6S0W7l58:Ffw0m2lXmWCI9DToVW558", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762950080, "uuid": "6f592c91-ba70-4a30-a322-d915d6579109", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762950080, "uuid": "e7944635-99d0-48f5-b053-e0e8517d05eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762950080, "uuid": "ec49e1d5-e29f-4594-aa92-19784e87ab76", "value": "BF6external.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }