{ "Event": { "published": true, "date": "2026-06-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-03", "timestamp": 1780531381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6a95b8a2-d17c-4dc8-b950-65d0e0923a77", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5538272-5efb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780457140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457140, "uuid": "2c7c6199-ca44-4a55-aa6f-2d29d20f329d", "comment": "Malware payload (Mirai)", "value": "88de3e25e677d14a37eb4b09e8d503e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457140, "uuid": "31f45d38-4855-4668-8541-722d3d2f84cc", "comment": "Malware payload (Mirai)", "value": "059dc71f33a19774e03dc47e61c5383dd650f4967db0b13b47ac76b9a5208f4f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457140, "uuid": "49057678-2f8e-477a-bfb0-fa04d8a6b677", "comment": "Malware payload (Mirai)", "value": "264c2eda838deaaea376a5128be6d63722c12c9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457140, "uuid": "ade55968-9c9b-4f8f-ba0a-f23f2037cb98", "comment": "Malware payload (Mirai)", "value": "b6282000708c54c8eaf757d8ab619de005f14646efc4c360ab2a20c3192b811652b3e1b2c303698b155a287ef764bbdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457140, "uuid": "3d7350e0-80b5-44cc-87e9-93e9a35320f5", "value": "T113F022920B91002B0F7508C4F0FDC710610523B65B24822C7D4A892077C02D7F77386A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457140, "uuid": "ad4d3dd4-d1a2-4ae2-83f2-acd86ff8cd59", "value": "12:yEdEqdwq4XmaZVgzd3/FFscll7qxOOK4aF:ucHH7qxsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780457140, "uuid": "dfe24ef2-5bf1-45ac-82a2-a4a6d6440564", "value": 463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780457140, "uuid": "25f5c6d8-d372-438f-bca9-1e3f67affb61", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457140, "uuid": "e255e68b-2957-42c4-b922-f4be463438db", "value": "dlink", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4228f380-5f88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780517425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517425, "uuid": "7777210d-34b4-4102-9ecf-883618d04fae", "comment": "Malware payload", "value": "d39bec16917df2ba8528f0f9e2d6b923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517425, "uuid": "be56823f-7d67-40a0-9953-66708baa6696", "comment": "Malware payload", "value": "0635f24cd6717bb08e0ef79b8b2c01c48dfc292180adc86aa26e2e52e1fbb5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517425, "uuid": "6da4fa08-2ee5-41a8-9642-e80704de4038", "comment": "Malware payload", "value": "65f396c2abcefce3ad24aa321b227af2b59cef54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517425, "uuid": "9c498cbd-8749-4d53-a7ae-425fe791d6b2", "comment": "Malware payload", "value": "9b83d49381d3e6ad9066bef9d20cc18b3f5cc4c3d5cfc7799fe7512537adacde8fd5cb8a75f198400ad932131f8ddbe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517425, "uuid": "5855c89f-1dc1-454f-9d1f-c8abaf438f00", "value": "T1E906230BF94258A5C5EF413C08E6937223316659DB02D3A31658A723FDB63E34FB5AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517425, "uuid": "e0f753cc-e447-4b19-ac0a-b11dbd302111", "value": "98304:MSU7qEF4jw0pO/3r4ylvKCXJ9EPD83rSliFwG6rne:MSUIp4r4ytUPD+F36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780517425, "uuid": "84de2aae-7be7-4bb5-ac12-63d3d117899e", "value": 3709848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780517425, "uuid": "96f79391-85c3-47d7-8f98-4dacd472fb3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517425, "uuid": "f46448a4-76fd-47f4-b394-3ecee9759a2e", "value": "ws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173d2365-5eed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780450781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450781, "uuid": "214fc760-2986-49cc-aeba-c4aadb444366", "comment": "Malware payload (Mirai)", "value": "a7fdb8dcb256c22e6817f7e318838c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450781, "uuid": "09bc95c1-1eee-4334-a683-2e400f3b698c", "comment": "Malware payload (Mirai)", "value": "099a0e8ea83abb559f2fbbdec8b2fadc61903e318b406152cc91da880cd4b351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450781, "uuid": "75bcdb05-3058-449f-8ae4-a6971ba0c89a", "comment": "Malware payload (Mirai)", "value": "4c5cb0465d9a03e45123af32441095b31154548b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450781, "uuid": "5b73b0ce-4994-4fc9-96cd-0b1ecc3ee46f", "comment": "Malware payload (Mirai)", "value": "eb85df1a972fabba7c3662bc5d8dcdcc4ae4681b8685a4f876007744d5dac5b5749b0abbde402c99b1fa4221b762fb9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450781, "uuid": "c101f0dc-edf0-40f5-bd9c-153f538670d6", "value": "T1DAC21A47A7FB0D67C1C4577411930607BBBB6B09901A4B0FBE052D166E9A3A0792FBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450781, "uuid": "32beb0d2-0ef3-4ca1-92af-4636a53fe285", "value": "768:2BUuxOzK5D9olOkNnLfFnaJGdq60SuHiq:2KeSnMeq61Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780450781, "uuid": "5e3f246f-851d-41bf-8f2c-edbb508b2e8d", "value": 26512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780450781, "uuid": "b50ea471-dba5-4f79-afe7-e6b0dc01f34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450781, "uuid": "5efa32a2-14e9-48e6-a0d4-1aaa81d1aacc", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3495cc-5f85-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780516075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516075, "uuid": "f525cab5-64a5-49ad-bea9-e4638bdef982", "comment": "Malware payload (AsyncRAT)", "value": "e419795d628673b955401d67ec1e551c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516075, "uuid": "91b8852b-eea7-449f-9ca0-afbe4f57010d", "comment": "Malware payload (AsyncRAT)", "value": "09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516075, "uuid": "14f97b79-1e6d-40e7-947d-e1970854d4ae", "comment": "Malware payload (AsyncRAT)", "value": "010f9441b0847d42463ee9b13a10aba09ee17244", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516075, "uuid": "b727a4b8-ed16-4ea5-bd39-d81c1236ee9a", "comment": "Malware payload (AsyncRAT)", "value": "16d3dd83eaf26ff4d51ef339e238bbdbfbadc98384aa46047eed15fd57522cc149a9a6e93f8f24cfd96e5ce68fbb3227", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516075, "uuid": "6acc8f35-718a-4b86-8f48-c964b5aac22c", "value": "T19174275303851BBDF69D0EC9C94B215B20F2D8677D251298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516075, "uuid": "6225bd6c-db2c-48d7-9808-3fe5ebd410a8", "value": "1536:3nwFcftxWJaa4gXynMd2Y4x9V86gL/Na59UVW2C2XKCbi8MEBVzwopDdAThp9UMT:3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516075, "uuid": "d4874ecc-29dc-4052-b3df-09d5ce79e71c", "value": 346862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516075, "uuid": "4aa49167-33b4-4dd1-a917-95593e46ad87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516075, "uuid": "79d46be8-4279-4d8b-a89e-3e268b461adc", "value": "DOCUMENTO REQUERIMIENTO POR INCONSISTENCIA GENERAL EN LIBROS CONTABLES RADICADO2060603 REVISION ADMINISTRATIVApdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326d2048-5eee-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780451256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451256, "uuid": "d001cea1-28dd-42a0-96fe-b2ee07cb4c7c", "comment": "Malware payload (Gafgyt)", "value": "ebc307c38065ab3dfc7655bba04dfe4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451256, "uuid": "7c4d52c1-5f8a-4235-ac96-87fb1fb33934", "comment": "Malware payload (Gafgyt)", "value": "0a00fb5fc7316aa70d25eb0fb67f7a336027f9f3093d5974049e0d9b13b884be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451256, "uuid": "3042c9a0-34e6-4ffc-b8d4-dce1e997a95d", "comment": "Malware payload (Gafgyt)", "value": "64db2d4c878a2d0741e156e2a87041692fd5b65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451256, "uuid": "17caf165-a696-4e68-b7eb-81931a6310a5", "comment": "Malware payload (Gafgyt)", "value": "d71f66493bf498689e1e9cae21370355c46b7caf9602817812c5a88433bd40a070b1d0bc448d600d922b8693b09af96c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451256, "uuid": "9e9949a9-448c-4a71-b42d-6186a44e9d09", "value": "T175E3885A6E228FAEF678C33047F74A25976C23DA23E1D684D2ACC1145F2035E545FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451256, "uuid": "6d5b5264-1fef-4e50-95c3-3bbe0a0fec9e", "value": "3072:Nyhx2hvUrSc0I30BhC7jMp4QJSljQDXl5:N42S0q0BMZQmjwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451256, "uuid": "350a74aa-238d-49e4-875b-eaf964285219", "value": 152916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451256, "uuid": "7bebeaf7-787c-49cd-8568-51664a0d93e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451256, "uuid": "a950b788-de10-4a43-866e-9512ca52370f", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55ee779-5f56-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780496224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496224, "uuid": "03311b30-b565-4f1f-8956-fbf05674751c", "comment": "Malware payload (RemusStealer)", "value": "adfff8f7d617143b73b21d7e3c23cb7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496224, "uuid": "3f9b2764-0717-472c-8b9b-58d723714c97", "comment": "Malware payload (RemusStealer)", "value": "0a2b733519d04f2b7539935eaa3ae2199c9cbad748b808637fdfeb020f189f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496224, "uuid": "44582157-b89b-43ff-b5dd-98c5c82b38d9", "comment": "Malware payload (RemusStealer)", "value": "2cb9548e405f73340785eb5724c378957a1ca148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496224, "uuid": "43d823d9-f8fd-45f3-bee2-4147f992a8f4", "comment": "Malware payload (RemusStealer)", "value": "fcf327ebf81d758f3b3d2d04c62d194733e5f77a74b76a6b9c5330fb5ca8489d613ee818ede2c37c01adc44ba61db5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496224, "uuid": "aea9df5e-3ba0-4aa5-b93d-b06a3bd82bfc", "value": "T1EFC53A037CD008EDC095B33198B23A96BB25B8441B3A2BD72FA1AE782E767D05D77355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496224, "uuid": "7306ec8e-5037-4f44-985e-8cb20675529c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496224, "uuid": "fc4f2e27-44fa-4d29-b2f7-610ceb6c2cf7", "value": "24576:cWOQ9t39RvyQv4VRpC3RjAWUPBdRPmG9yUL543OL12GnIUGYU/nBele7tKDyieCg:cd6t3zvWVbC3RjYP554212GINLnF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780496224, "uuid": "ffccba8c-bbb7-48c3-afa0-1774cbe82114", "value": 2590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780496224, "uuid": "c6cc4397-1fdb-452e-9a6b-2a66abef669e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496224, "uuid": "5b6cabe1-2d1c-44ad-af89-a6c376c74afd", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4601492d-5f23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780474052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474052, "uuid": "4c5cd63e-6eff-49ea-84e1-405cdc6926c2", "comment": "Malware payload (Mirai)", "value": "f2c721a63279a7a88b20a858db93885f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474052, "uuid": "de988dcb-771a-4a3b-ad51-03206025468c", "comment": "Malware payload (Mirai)", "value": "0a75b48762ad77eba0f8832eb59f0f1ccda8d517533f77b5bddfa8cde4313052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474052, "uuid": "5e5f9e48-01eb-4a75-a190-aea5302a36a8", "comment": "Malware payload (Mirai)", "value": "c0f2941bfb129f4aeb779893d824470126f976d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474052, "uuid": "70a7dfa5-9862-47d5-bec4-db6e1c9d42e0", "comment": "Malware payload (Mirai)", "value": "02cdbcd7e50f479efcca780ac114abbba3411b56234a8ca2b917ce60c5f2a25c17e75148d73793e4b07489be20cea196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474052, "uuid": "f2b219a6-af7e-4355-a503-60ae7e4aa09b", "value": "T1A423F17346BAE8F1D02865BB405DD954D07D759013D40FB680F8B5FADDF2E902E209AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474052, "uuid": "25b56dcf-6019-407c-9b64-1ffeb5018009", "value": "768:SInEVflzTpXUiyd0voPa/tawgkPqTbj7gx57UDQoZkTdrAF4C:js/JlRvoPa/tP2jgz7aqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780474052, "uuid": "7dd473d3-c132-480e-9f1d-32f20b52d7eb", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780474052, "uuid": "468e8559-7645-4c34-83fd-79f740594e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474052, "uuid": "febf312c-7fec-4154-a2ef-acfda99c659b", "value": "0a75b48762ad77eba0f8832eb59f0f1ccda8d517533f77b5bddfa8cde4313052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb1971a-5f55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495780, "uuid": "71991ccb-dfdd-41d9-a4f3-955919ec9bca", "comment": "Malware payload", "value": "f9be0e12626e128332c9c6ab25bfb2ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495780, "uuid": "25a2bc4b-19cd-48b2-b227-2ff8e7e2fca4", "comment": "Malware payload", "value": "0bc73f1b515e2352c9c10159c8be2d7927f15291106ddb516eaaa3bf91e1b5d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495780, "uuid": "dd2c1126-be7c-43df-8229-89fa1e8653de", "comment": "Malware payload", "value": "045858f0316045e058000159f0b381ddbf6fece3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495780, "uuid": "568df4d0-2056-40bd-8e3c-458211da4793", "comment": "Malware payload", "value": "2e47ec6e69f067840f53a37cc926180e6b614e1128d3b97a9b75d3be8190810b7af67f210c406124ee232896dad59018", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495780, "uuid": "01843c25-674c-416a-8898-8fa997aee792", "value": "T1EC01AFCDC41A971041D5F89D36972545B410C3CF294ACB68FE6C547D8BAEA5C7065FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495780, "uuid": "d03954b1-27fb-4b25-9143-03779f2e77d1", "value": "24:kXCKysE2hi0ziQvZohaMD+wzQJNj/qfci1RYX:e9Qp+MsMa8QPSUi1RYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495780, "uuid": "51eae44e-0611-41d2-b9ec-e462eb7fb540", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495780, "uuid": "8d80e47c-2715-4a55-a80a-1e410a99d057", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495780, "uuid": "e71d066a-0e13-4ce2-885b-625617cfd78b", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6384fb3d-5f51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780493859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493859, "uuid": "eb5e227b-b4e4-4729-95d3-295bc1b745eb", "comment": "Malware payload", "value": "4341c4973fd48872566c2597e55efc57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493859, "uuid": "82899176-cb63-452e-975d-5e842e26201a", "comment": "Malware payload", "value": "0c8dad042e464cd3377e4c9098d868f83df1a23e4dec7af6aab4a6779a4c3e26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493859, "uuid": "13c7a1b6-bdef-4390-82c9-ea1f84ddcf3a", "comment": "Malware payload", "value": "a16c56b1badc99183e22b7b21fe5d9e75974ea63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493859, "uuid": "3d4a5f68-88e0-408b-ad3a-b54f0466a788", "comment": "Malware payload", "value": "6d14e5015fc86bbe817c8939969e1c90716fd0251196b95be076da267b8aef10ea8b5db70d355b7360da5d76561686d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493859, "uuid": "f04b0c68-89d0-4443-9444-6a7032a135c5", "value": "T18322C40793B75D1BC8E0637700A7032377E65B968994574F7E1A6D8E2F943801C2F39A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493859, "uuid": "c78ec256-057a-452c-b292-ab3b9e04878b", "value": "192:eRbTQVV5aAR3CSJxTmckf/nMA2cafOUJyG:eRbsMifZkXMAyOUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493859, "uuid": "06f11f6e-6602-448a-b572-d610e4454d11", "value": 10784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493859, "uuid": "f8809690-ede5-48d9-86e9-cf23b3318c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493859, "uuid": "bf84aa24-452a-4b4d-a40b-0d8c3540b859", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb5b3e-5f28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780476232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "6b177c00-e16f-4ba4-835c-e3ac55a7994b", "comment": "Malware payload", "value": "b24c8affd984bc47b7a6c5bd11e58b16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "8a6cdd22-64d4-41e8-afa5-f11ea46dcddf", "comment": "Malware payload", "value": "0d762c8cbba56cd827c0dc710688d7410840940b9994020b8e365b63d3ff316c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "fdddbad3-4f37-4a76-9fe9-e0a733b810b3", "comment": "Malware payload", "value": "cf93381bb17a8e4d82f9184efd10cf1da60986ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "2739faeb-f53f-4912-92d3-8c2a1b9ba7fc", "comment": "Malware payload", "value": "db500cc71dfe9aa0956f8e2803aee1f1d87a77c2b0a91fe377a42be489405a9c6899d879ee218bc95f4d8c05af333c2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "0b09ef2e-a329-48d6-83b7-480e5a012ee3", "value": "T1C723F23B68B656D1D3B5D6FDE97E0AA0F9A1E00925A333415AE03CDC2139CB4055BFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "d4a84033-5b49-4dc7-9c1a-c06c278024b3", "value": "768:m3QPPFqEChAfmWegsbs6NBFRmU779+AMaE0ygNWthDpXDGsHBUlJvsRDEsdSvnZt:v1COips6bFRmU7Z4aE0ygNWtJNasHMOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780476232, "uuid": "8d6f4ddb-e009-48a3-9684-18e863b35c0d", "value": 49076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780476232, "uuid": "48a52ae6-fd3c-47e5-a0be-721b993ec023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "3cfcd276-3fa2-485e-9758-1fad78ab4248", "value": "pty3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a20312-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495339, "uuid": "2a1484f0-9bc8-4a99-b028-b2e242bd33e5", "comment": "Malware payload", "value": "00791ea83684cfe68c411f150b5c73f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495339, "uuid": "3f094f7c-a6b2-45a3-bd76-a095b150e6f4", "comment": "Malware payload", "value": "0ed76aff5a5487f317d422967d4604114954f6cf93a231432b4996d600b4e9a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495339, "uuid": "f14ef5b3-4936-4d4e-9476-921a48e1d866", "comment": "Malware payload", "value": "d7d8f612860251a1f13361a7b6d981105910d3c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495339, "uuid": "85de0d45-a804-4d75-995d-36b3aea9e257", "comment": "Malware payload", "value": "e5ea9442fcde9dec492233271efaee23c1274e9861dcb2e0fd1f0141d5a2329b86fa1d4784753cee49320ed2d232f73a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495339, "uuid": "8ba0859b-1018-4ad6-befb-9c00f9e716ea", "value": "T1A4530859FD816B01D4D625BAFF4F114933934B6CE3FE7202AE245B2523CAA6B0F76406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495339, "uuid": "6957640e-4b56-4a22-8261-d29b39d33ddb", "value": "1536:9tnsWslNUZfAHuytl0xhwrMluE7DiBgmaa1YJZYeNX9V:n4gAHuytl0/0gmaa1YJZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495339, "uuid": "b8bee5f0-9377-4141-ace5-6a7c229711c8", "value": 64720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495339, "uuid": "343419b4-6a73-450d-94cb-a8970dd61191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495339, "uuid": "abe3be3d-b223-4af5-a9db-b28fb68696c2", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c81ea5c-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495216, "uuid": "2424f39a-9ca3-4ae4-bcbb-d9f88e4285d4", "comment": "Malware payload", "value": "8a1ef55162742d5e82187ecd86900e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495216, "uuid": "5a83d2b0-ff73-4ed3-adfe-ef8ae3226280", "comment": "Malware payload", "value": "0f0382c0a26ab086d40ed788733860d08acde953210f609e92a8da2b4112f31a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495216, "uuid": "edad7788-13bf-446d-a713-fa161780ffcf", "comment": "Malware payload", "value": "aabc18822b6cc932ca233320f77f48f583d7416b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495216, "uuid": "ba80b7bd-f039-4461-87f5-9cc3c8a94fa0", "comment": "Malware payload", "value": "a0837c1015012cd91e38a0e667f297875eebe41e29d930f4566aea7cc9aeddcac378ba27b0245993f42c36e5a15a81ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495216, "uuid": "52f1d1a2-439d-419b-a4ad-80e8b5a95b02", "value": "T14D9633BC6DBD21A2F84996B8D12389A840F4D82927F7750DD27D6427DE07E80EDEC90D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495216, "uuid": "d2441b6d-829d-4530-aa23-cc220cfd31a5", "value": "9a04dd44d612988612d7626c082c40a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495216, "uuid": "59ebf60e-d078-4771-9311-ec6992c13c2e", "value": "196608:3evKVIz9yjSvVnQ6p0vsByIkCcMZVsFOVB5whj3N:vyhy+V68yICMZVsgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495216, "uuid": "13756045-83b9-4fa6-8b24-3110ef80ffe5", "value": 9077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495216, "uuid": "14cfd474-8b27-499c-9907-3e540763deb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495216, "uuid": "92a824c6-a277-4131-b58b-a16009012055", "value": "Cs2SkinChanger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582d1dd9-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529917, "uuid": "c3d793ff-349f-4ad1-bc4c-6048195f1bb5", "comment": "Malware payload (Mirai)", "value": "bd6c9c746617a2fdfdb957574a7f16d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529917, "uuid": "61f63e1f-a2f1-4bc2-8bca-dafc8eceb2ce", "comment": "Malware payload (Mirai)", "value": "100c8aa4e7a3e89cc38f8d602e5f5f9388fc65537705a587d40a53449815b7b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529917, "uuid": "954429d6-da2a-45df-85b0-6a35c34bb768", "comment": "Malware payload (Mirai)", "value": "0995edfe450aa57bc3b83e8599050896741461c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529917, "uuid": "311e07ed-8471-47f1-9a9b-f0f914009756", "comment": "Malware payload (Mirai)", "value": "366d824505c51180af2e502c5539bb70c529d0f2aa389e03d0ef3986b9a3c6f0460472b08c15a3074e09f8cb5e6ce92c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529917, "uuid": "7b1b1a44-2a9d-4675-8988-a35a4ce608bf", "value": "T1A4043A4777118FA1C368D67009B7CB679AA626921AF1D985E76DCE007B3035C6C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529917, "uuid": "9b0fa9ca-8599-463d-bfa8-27c24595e141", "value": "3072:WEZI+uF93O3/JQTKQcp+oUbQgRJpkRzxp1CvNzvVifahb:7ZZufUJQujIoUbQqubp1SeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529917, "uuid": "5c9529f4-5874-4126-93c4-c4454d8eab3e", "value": 174816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529917, "uuid": "2a8a5320-2d42-4fc8-8201-748186f8f199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529917, "uuid": "4f3b46a2-764f-4453-8ed9-896fd332c577", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e59c9f2-5f13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780467194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780467194, "uuid": "f99ba907-5f92-4708-9306-523cd8093896", "comment": "Malware payload", "value": "a3c060074a52cce186a0b6e0f9334043", "object_relation": "md5", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780467194, "uuid": "14b03ad1-8a14-48b4-8507-74a6747fb5c8", "comment": "Malware payload", "value": "10a8d1df28eaaecd1b61a208a7aca2520d671a2e572545df8bbffdcefb280460", "object_relation": "sha256", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780467194, "uuid": "46e15d07-17b0-4136-869d-e4bf513ca31c", "comment": "Malware payload", "value": "8bd040577ab524e1a3d91944b098395d9700f146", "object_relation": "sha1", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780467194, "uuid": "225da44b-a6f9-4ed2-b639-b3ac5c10a36f", "comment": "Malware payload", "value": "359142820b74c13487bae2081528304e11536bbc8f7b6388ebc6e448c228ea69a0f83b769836900c3a3d22966f5a5a87", "object_relation": "sha3-384", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780467194, "uuid": "63f5c6ad-4aef-4a30-b08f-0564ed633707", "value": "T155963817EC6A59E9C0AED231897696537B717C490B3123D72B50F7282F36BD0AEB9310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780467194, "uuid": "91e638fa-61d7-4d9d-9ae2-651f41f5fce8", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780467194, "uuid": "7352c151-5caf-46eb-b541-99e07acf622b", "value": "49152:N3yIIEl7g5/NSRERVxvMWwxUziQ4Gw80Xl4+aWwFuiOdFG9A/1j3f66mmaOG2vtB:N3y0hovxvG+OY8pyqMQDbL9C7w9yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780467194, "uuid": "485bbf34-1acb-4546-86b1-5fe33577e921", "value": 9387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780467194, "uuid": "8b17c91d-51d2-4baf-8e4f-b6a7db47691f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780467194, "uuid": "efd8936c-1243-4b60-9d86-ddd7182dbe8d", "value": "06-02 SHIPPING MARKS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f152784e-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495385, "uuid": "6c055d7c-d084-40c2-a960-30c722ad5b78", "comment": "Malware payload", "value": "8b0a4c2db047f49548e9d511339f8611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495385, "uuid": "b5c9f643-0351-4803-9f60-d65d947756e5", "comment": "Malware payload", "value": "11f646fa60e6d56609b0f0aa821a689f2f367855ddbe7ead0e3f7ccb4732f2d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495385, "uuid": "348ba69b-0bcc-444c-9e2a-66b25e1972c5", "comment": "Malware payload", "value": "b7442adba15873c830f540daf5ce6985c18799b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495385, "uuid": "dda33d74-79d6-4fee-bf31-26d5e09bacc5", "comment": "Malware payload", "value": "b2c63b1eba5f6d06a66950af30a562cb0cf9a34ca2bc2abab2007a25473a8163ed4de37fb95dadbfe643bcf913ce434e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495385, "uuid": "056e2c4c-cdf7-476a-a0ad-c5a2a2d9e80e", "value": "T1B0E79D03769788D9D09EC874C6E7875799287CD62F36A4DF4184272A2F3ABF44B39321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495385, "uuid": "738b07cc-1dcf-4e26-8ee6-cb3678eb92d6", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495385, "uuid": "bbda9880-dc01-428f-8a3d-f0bbe1d64dcf", "value": "393216:wTioaSEwm1HiXUxO/RJk3IWhlbntjaOnQE4I4U6x9bd16r7B8aXmQI82ejyguUhq:wTXd7vE4Iior7B8aWe3Tff2ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495385, "uuid": "28d5ea6b-1090-4bd7-a0aa-fda377f3f43c", "value": 64823234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495385, "uuid": "a6f81530-85ff-4654-b6e8-0d215244ac68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495385, "uuid": "6825bbc5-5a4c-45c0-be28-728abbf8483d", "value": "ZC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1b631c-5f85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780516449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516449, "uuid": "f16dbf0d-7b3f-4365-88c3-562e115d2eeb", "comment": "Malware payload", "value": "2e2a3019544981d3f2e24611f007263c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516449, "uuid": "bd193efc-6c53-477f-804f-1e0feb36d642", "comment": "Malware payload", "value": "129cb2fc355a08e24da5a8b6a65ef30ab0a9f1b24b529c99dc4707bbb0303d4f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516449, "uuid": "6151bb39-9e9e-4ec1-b5c6-9d97da90cc37", "comment": "Malware payload", "value": "54e5541ba3707442538d0741fb3e497437f5e232", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516449, "uuid": "b84bf511-db0f-4fee-8856-2376bd509e90", "comment": "Malware payload", "value": "6130517add6057f8530c666ef6762d9e6ce50e00ee14f5c80b06096aa18edfcbb62614e25a6f34478c80c0b53e34c77a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516449, "uuid": "6511aa0d-be32-4013-b278-1d86d23fac50", "value": "T1B95733EAE011861AEC2FD138E974416F628ABE798A875865313173976FF379025F10CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516449, "uuid": "60ff4d60-88a2-4194-9910-2847bb199a32", "value": "786432:CIyS2BwND4Gn3QI8mcJ78ilnZwQVqmrGg1gcBlAZEZhUsVsJcI4A3h:CjS2B2FrWpHwQoVgBsZ7Dl4A3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516449, "uuid": "0adf8d00-6bdb-49f5-bbaf-9a423304b677", "value": 28798976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516449, "uuid": "ead4a074-a6aa-4569-8875-9ac89c55aa72", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516449, "uuid": "d8fd3544-7183-4cf5-ad6a-1f62f4ad48b0", "value": "setu\u0440.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bf7b64-5f83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780515529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780515529, "uuid": "0c3ff62f-c220-47ca-9afd-f0e252711a74", "comment": "Malware payload", "value": "2419ce8b5846d6a5275eba379c285b01", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780515529, "uuid": "d128f277-6027-4fec-b309-377a1eb9e6e9", "comment": "Malware payload", "value": "13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780515529, "uuid": "59a9e6c6-830b-4752-a1ac-2428ffaff149", "comment": "Malware payload", "value": "eed7952eb8a6fcdb20d2a87f81aee74f2a15003b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780515529, "uuid": "4c850bcb-97bb-4ab9-9551-f59a3f4a6a2b", "comment": "Malware payload", "value": "99dbddc2b34c373ec4f368c401a84ea2fa32f0f9f0035f6b5f0abca004beda91dec507e06e02ce2b940fbac0a714db00", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780515529, "uuid": "6e61ca54-ce76-4168-b16f-52742350a9a6", "value": "T13E018CC9C106961041D9E85C329B6184B811C3DB25468BA8BE7C943EDBAA78C7065F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780515529, "uuid": "c8bfa0c3-431a-4f97-a387-fd12ba77bf44", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaD1It8YXy8IdhUIsd8IixFJAI0HpuX:kXCKysE2hi0ziQvZohaD12m8MWX8NM+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780515529, "uuid": "980d1627-9385-493d-9225-003886c348ea", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780515529, "uuid": "8bd915a5-39da-4ddb-ba4b-7b3e6f80d86b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780515529, "uuid": "00481018-8dbe-4d79-a56a-5de5019661ca", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c10514-5f4e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780492472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492472, "uuid": "0c99f063-dfcf-4c44-9564-4773f578e2c4", "comment": "Malware payload", "value": "71fedeabc05846c6b330da7382746ae6", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492472, "uuid": "4e7fc99a-56d0-42d4-a7bb-438fd5da0ef9", "comment": "Malware payload", "value": "1542404ebe2259d512c3e6d8098e80dd215434a59f4f1b578472122cfa7635e5", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492472, "uuid": "8a540e2b-0bb9-4416-a515-204b4e428cab", "comment": "Malware payload", "value": "eca9faf07b8b98dbde3882451f32a4282b5b5556", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492472, "uuid": "7d4a8245-a52e-4127-8c53-41458db98af6", "comment": "Malware payload", "value": "490ba5f484e7eb46a432a304cbc84345d594832cb11d837cf42a764e9abc70ba9d30fb3370caf45e6cec88b72835b0b9", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492472, "uuid": "27b85111-1e17-41dc-9382-52a6d5a00b21", "value": "T1B9F1731093F48336FEB30B329D7256495679FA10ED63CB6F16C1420AAC36614CF71BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492472, "uuid": "dc438cfc-15c4-47fd-8aa9-a9ee517dc1a6", "value": "48:63xflVZWbxKQS535Wmb8My0MURAjFTFkSl7K3diRdCoiHqx0+IvdTgIPGDmDrZLk:0W1o3W/RU2hFkSl78diu60xvWDmDlLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780492472, "uuid": "38b7f7b0-d7fd-4964-9188-526bb0af0e47", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780492472, "uuid": "02f3a7dc-03e9-40b4-ade0-7bc1c5b37501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492472, "uuid": "f275a621-8767-4ebd-9ac0-a9965a925922", "value": "1542404ebe2259d512c3e6d8098e80dd215434a59f4f1b578472122cfa7635e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b45e2e-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495048, "uuid": "b534dd90-9374-453c-a0e3-350d702d14e0", "comment": "Malware payload", "value": "22aac5d1d15dff4cd36ad325985b6891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495048, "uuid": "d6e7277f-bf93-4392-ae4c-d04409438536", "comment": "Malware payload", "value": "1599ab8c3882435424154ca5ec71afa72574d85c1b0221153765c1d5db5f1647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495048, "uuid": "9c4dbace-d13d-437e-b6dd-b1f8d181135f", "comment": "Malware payload", "value": "4ec2e9eb058865ac512c3d6a316308e943dc9e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495048, "uuid": "845a1e14-cc02-45c7-8ebf-b192bf41bb15", "comment": "Malware payload", "value": "c674169adad8599dbb41d298deb971e49b3d7eb3ba0726ae1324c56ca8d1380db315411bde0d3d2d6bbaf2a874d95ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495048, "uuid": "7f9c40f8-6125-4431-9b17-a2c992a34288", "value": "T1A4A3F945FC509B17C6C652B7FB4E438D7B2A1758E3EE320399256F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495048, "uuid": "1724b0d9-c7f3-4052-ab07-c9b11889aa2a", "value": "1536:nMsRPeBQtD2qFAv4VWzyTEF9Ov9zHgOIZBI7lWZwywHq3L9ZnpmfecuXaorT8:nPe2tDc4UywHOOW8nHB/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495048, "uuid": "34254270-a81f-4af9-8284-fade30844348", "value": 101324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495048, "uuid": "47344d3d-fc3a-4fd4-b0d1-76776d07c329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495048, "uuid": "da854848-d9e1-481e-9180-4dea44bc19d2", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13becaa5-5f80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780513911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513911, "uuid": "3590b415-be4b-4145-a747-23588c979fb6", "comment": "Malware payload", "value": "1ffa0069d83417245fc4d4cb2623a321", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513911, "uuid": "ee5e4c73-38c2-44c8-bd92-c96e2ffe6aa7", "comment": "Malware payload", "value": "17a897b51e9214b724a9075ade9f4c3cbb3065a9a9630f2cd530b526a1c7007e", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513911, "uuid": "401ebe6c-ad73-4ee2-8891-c057e3a5231e", "comment": "Malware payload", "value": "2046eb0c9e07ad49b260b4bf891dfdf9fa80462a", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513911, "uuid": "50aa6530-061a-4e79-8666-a63adc11dd57", "comment": "Malware payload", "value": "8bfa4d70db8744380a9f83bba6753b3928db6eb7237a63e5b04a8767e3b334d12809ae0ec453cdfadee170c16cd5b3b9", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513911, "uuid": "0666f8da-cb8e-4315-8c19-8b7354d092d6", "value": "T136A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513911, "uuid": "d713aeee-525e-4465-905e-0ff99296295c", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513911, "uuid": "139ab2d3-2973-428c-b3d7-834222d014cd", "value": "3072:jn30og0xjei2dbYZ9z7/ZfLQWp+EKlptXmHrxlCavcGK4z9st0fO3:jnkonN2de9//ZfAjq9vcRist0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780513911, "uuid": "617e43aa-ee0e-40d8-b543-389d1fb142c7", "value": 479334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780513911, "uuid": "5dca7828-230a-4bff-8f7a-5ba858acad33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513911, "uuid": "43c2c906-90f7-4c65-b181-1f518aee7e9f", "value": "17a897b51e9214b724a9075ade9f4c3cbb3065a9a9630f2cd530b526a1c7007e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fec7ae8-5f90-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780520830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520830, "uuid": "0d1a903e-5516-478b-8549-f0d26708509a", "comment": "Malware payload (RustyStealer)", "value": "e14cd1fb18721fc64abb9b1a6cd42e7c", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520830, "uuid": "2456dd56-a4a1-46af-b1d9-d5c69afb742b", "comment": "Malware payload (RustyStealer)", "value": "1b13637243584aabde16bb9c604a9f3e1aa067880b70861ed7c71f9784f4980e", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520830, "uuid": "c1433d63-d9e1-44d5-b1ec-4f48786610c2", "comment": "Malware payload (RustyStealer)", "value": "735099987206b721bd9299e326c1651a00234cd4", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520830, "uuid": "d6f8d756-45b9-439b-94dc-03424cefbbad", "comment": "Malware payload (RustyStealer)", "value": "cbcadf407f01ba38afe47a7e469622e44408c8103392a1ea28e510e397b600d8531d17e11bf2ce0bbf426548e119d248", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520830, "uuid": "72a59323-8fe2-4122-b5cf-3582ac3e800b", "value": "T154658E43E695C1ECC55AC0B9C7579B36FA32B88D093076EB27D08B242E16F816F1DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520830, "uuid": "b9e5b345-23b4-4b99-8e28-8389a2019f82", "value": "c315611fcbcf6f6b48e39537f48d7d53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520830, "uuid": "c5bf757d-c387-4a8f-8ce9-44696300e953", "value": "24576:yJTSZOcYWhIJsAXInxAcIjhNNI6DEj/VIH06iy9FM:yJTSZLYarScIjNPmIU6is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780520830, "uuid": "4e2196c9-31c2-46ed-9c63-4de7cd4819f4", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780520830, "uuid": "d0bb5f36-6b27-412f-8c60-fe112329210a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520830, "uuid": "4c923bc3-8304-4271-b662-15926104b686", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217cd4db-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780469696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469696, "uuid": "f589529f-cdee-4b4b-898c-ea55525e5179", "comment": "Malware payload (AgentTesla)", "value": "0db9e6668ef1783c80c8e7f4a5e23fa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469696, "uuid": "0da5f0e1-e664-4e38-8153-de3ca7c08598", "comment": "Malware payload (AgentTesla)", "value": "1d0550027ee4a5a6c0c1fa342c2ee1fce46aba9e0c3351570ebd34460708c0f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469696, "uuid": "2f3b7604-a055-4587-9c4d-edf102e8b322", "comment": "Malware payload (AgentTesla)", "value": "d3e73c2c88cb2f0010ccb25e76b512394eac1090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469696, "uuid": "d2326d6c-1b9f-4d91-ae00-d5b14ad454b0", "comment": "Malware payload (AgentTesla)", "value": "bce07a452ebd6ee6c6e6c5274c5a9a84f455dae41e87ddfc921e20d85aefa411aea9725cda42d40bb053cf7a280d4b47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469696, "uuid": "9a2c6189-dfd6-42cb-a1ce-289533e36196", "value": "T152C5F9D1AF86C93C19A02ADDCED74436F84CDFD94D61094B3C560FE0BA819770BA69B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469696, "uuid": "4d257405-1eda-408f-a64c-1e20509f2e70", "value": "768:XaVatuBzar2qFLgIK9Zs9xxquoa8NbU0caaVwSlsK/vJ5629f884zh3Hqphdq7gd:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469696, "uuid": "dcd8fc60-ccda-46d5-b846-1e9245e70d17", "value": 2511508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469696, "uuid": "c68f60fa-75cd-4339-a398-61451e0c1ff1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469696, "uuid": "ba1df271-f07a-47f5-a901-a0a9037f72f3", "value": "Orden_de_compra_PO190278.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d24b7cd-5f33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780480829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480829, "uuid": "794fa1bb-7936-4861-9ea8-6f4f15075de8", "comment": "Malware payload", "value": "c2fc342ce2e1dd4deb0c8623f0e4c0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480829, "uuid": "645568f1-d2b6-438d-a40f-602ebe7369f6", "comment": "Malware payload", "value": "1db25aaa1cfecdc1deae3406c233f16fd5a48eadf00d679434a50694bb5a75ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480829, "uuid": "56d4b25d-ca9d-4ea0-922b-3f9cf15c7701", "comment": "Malware payload", "value": "8cdbb0234c652a82f0062e2b08348c3420119fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480829, "uuid": "5f0f7d06-1c37-4355-9a9d-34793154d461", "comment": "Malware payload", "value": "aa3fbbfa6c28133b015e0f884e046ee202a3321d3662b9b52f9a8ab60da88a4cb62146ff291e14cd526eef424226f813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480829, "uuid": "1f3f0171-f250-4277-8134-4d876896da90", "value": "T154D1B40063FC873AE5F64F38ACB3535556B4FE018D32C64D5C99421EAC7276A8A61BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480829, "uuid": "27d8e338-775a-4610-8373-65d52cbadf22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480829, "uuid": "c6b2c2e0-8eb2-4d15-a88e-cd70ec69331a", "value": "96:mZRletEvB4ITJiUC7ttp3K+TVw790jZlmnUwtCz8drJHLEe0C:sXMeGsdCdpVW98ZwnZdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780480829, "uuid": "f15eb018-4efe-4431-b0a3-40b9fc277f5f", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780480829, "uuid": "7b5c817a-3b68-48a7-8654-93ad8b07c8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480829, "uuid": "3a2e40c9-479c-4607-8a90-e918db912a48", "value": "rTrindadeRezendeSSAdvogadosAssociados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0f56e2-5f49-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780490466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490466, "uuid": "aa898e1a-628a-43e9-b356-4afa5b480c5a", "comment": "Malware payload (RemcosRAT)", "value": "a53236b8b545f2b9b24aeca5473fbadc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490466, "uuid": "1b785350-6b22-4ecb-9511-b9c4601bdc28", "comment": "Malware payload (RemcosRAT)", "value": "20604bfb9228b92a80eace6173046f3e78ef3d539fd097bdbea3da34f675a0c4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490466, "uuid": "19baf1a8-7bee-474f-b8a9-828b5cd9ac8b", "comment": "Malware payload (RemcosRAT)", "value": "42fbef6bc5388055d90dcae0c4e2c16e516f8d92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490466, "uuid": "bc3fa338-6771-433b-acc5-5330d0175d00", "comment": "Malware payload (RemcosRAT)", "value": "4c57a4db1a5efdcc065eb0cf7325426ba21bc74c1593f713fba3d51e93ed92eec38db67934ae08121eaf697f3878e5ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490466, "uuid": "e8c503aa-3a6e-44ca-8e1a-040511d31756", "value": "T1DBF6109E2372322F94DB5F662250763A27A7DB9A471CE92602856007CB53F0E7739FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490466, "uuid": "f1940a9e-b913-473b-bc1f-d0677d7d19b5", "value": "768:10FINABSYPrHIayCQ3S2LPRDIDcne2g12PlG+464RPguC4zJDW2aitlMDz31n3Xn:c3CB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490466, "uuid": "f27737ed-1fae-41dc-b3b9-ffa9755c282a", "value": 16569238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490466, "uuid": "1e50245d-8dda-428e-b0c4-6a8c606221e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490466, "uuid": "56edd968-c04f-434e-a4cc-53fb07768ac4", "value": "Customs_Clearance_Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8974b9ed-5f6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780505089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505089, "uuid": "00744b0c-db7b-4d42-ae45-05e2cf98ddff", "comment": "Malware payload (Mirai)", "value": "e67505b4e2937cd41ff4604a1dadbb51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505089, "uuid": "1c7d78ed-e9fc-4121-9ea8-0f1eb241a32d", "comment": "Malware payload (Mirai)", "value": "213972db5e81a5b87f8da392cbc8bd2f16f05b32ca9308e5260ebcbcf2116dd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505089, "uuid": "b5be9254-7d2b-4f0a-bb72-08f62537a88f", "comment": "Malware payload (Mirai)", "value": "144f3a224d827f4227989b01db920dffe54887af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505089, "uuid": "96089c29-5590-4abe-b32e-7afc1ab9210c", "comment": "Malware payload (Mirai)", "value": "5922b997054d81c47a32ddde9ede720c1b0c0686a7eea9863f50a1243d6730ee6e51e9b614f647663f161ee42bbe1eaa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780505089, "uuid": "47817c5b-dfcc-4816-a9ff-504a76fd58fe", "value": "T14D3161DF01039B0235A9DDDD7BA240894413DCEB258FD34DFD48152D778898932ECEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780505089, "uuid": "5a12c72f-13a1-4553-b3e1-efbfce347557", "value": "24:NZW6FJmJNIBt7bdKA5tWz65jz9nmnWCK/+6hXjSOU4bJOOa6bFmFWnGYPcwLuoq:NZWCkYbd3WqjBnmnTK/+aTSGbJO7MgW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780505089, "uuid": "79a5ec79-9fde-43db-8055-f26b2f1c8e9b", "value": 1522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780505089, "uuid": "996ef855-8a40-45ff-80ac-4c7c3f4ecd39", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780505089, "uuid": "e57bebbb-cacf-4037-92d1-59aacb5a8e86", "value": "dck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba23fb8-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529977, "uuid": "96b89a1f-43e6-4ddc-b85e-28beaeb8c16d", "comment": "Malware payload (Mirai)", "value": "4b4b76f0535fbc531159d7d91992dc48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529977, "uuid": "f57e8a03-0fcd-452d-a3b7-d980e471603c", "comment": "Malware payload (Mirai)", "value": "221c916c83f005733578671fd4418776ecf8b1d82a99bdfbdd9b1c15358629fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529977, "uuid": "045d2804-597e-4864-995d-c35d0b92e189", "comment": "Malware payload (Mirai)", "value": "5bc72d835d29b91ab12f5569c8ffef55cabe749b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529977, "uuid": "1e4f6617-b228-4051-b2cc-980f9c56e75a", "comment": "Malware payload (Mirai)", "value": "c1ac307575c3586bc9959fa93e6e154b852f8c355b60057d368239df456f2c44718fe54d93f0eee773ce6c7beccd932d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529977, "uuid": "83df24cb-4785-4e38-a2bc-39305c551492", "value": "T1B7C36B81E6A2D0F1E28701B00557F3E68931E5345016CADAFFA93D71EC71B81AD9BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529977, "uuid": "c91058d8-01b9-42e8-b224-e09033ede16c", "value": "3072:Yc5A0RnxNVb1yVJPhyJEMCrJZSqcPyrNCdzEc2:YqRjVb1yVJmYrMzEc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529977, "uuid": "ad67c537-988e-42d8-8e70-368a2b407f90", "value": 127568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529977, "uuid": "c43c4ee4-1c28-4755-bc2c-fe22e650a0c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529977, "uuid": "7f555e6a-475a-41df-bc70-e2b2528535f1", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc809756-5f88-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1780517630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517630, "uuid": "4aac32c9-9afd-4b92-9a1c-a771baa3b71a", "comment": "Malware payload (PythonStealer)", "value": "46839a55602af9fb5ef1479e13ae1337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517630, "uuid": "08c1a3a7-c855-4c24-bdb2-14b5c9c45c00", "comment": "Malware payload (PythonStealer)", "value": "2248a71fc8e91ca64eeb2c31f9104d237269dcccb4ed78f140e859eabae1cee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517630, "uuid": "75c28ebb-4ef3-4bdf-84ec-cf26946f478e", "comment": "Malware payload (PythonStealer)", "value": "bf66bc0e94d75690f40a47c559a7e482a02397d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517630, "uuid": "1a82a3e7-a67b-460a-a579-a3db047e5965", "comment": "Malware payload (PythonStealer)", "value": "7c8ad2c0609b89dd139ace909a5206eb06f3cbe140de52b05861fc048daa0b715cb2abc576aab3ddaa73f239cf472cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517630, "uuid": "51c441dd-cdca-4ada-9bb9-aff6985bc9ae", "value": "T11807334A66F5E53DF3139870BAC46BD8673070C65B1683A711B2C1B41C5B8B49F3A8FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517630, "uuid": "c1dea861-1f6a-4ab0-a1b8-53706f13be45", "value": "c34ae6746479dcbcc53703921362989a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517630, "uuid": "52b0ac4a-22e2-4a3f-939c-fffdb9bbf1c0", "value": "393216:oRgJsZDng62C24hPgxT3egix3YF7xGy+s7y+oErn+T:SisZc62P4Rg+YiPyr+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780517630, "uuid": "87059c3e-7a70-4ce4-bc91-7ec3ebce3034", "value": 18247560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780517630, "uuid": "40663488-8309-419c-b465-4437c2db518e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517630, "uuid": "4d99792e-1fd9-418f-befe-1d4adc5e213a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d838c8-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495074, "uuid": "c80501cf-d9a9-4513-ae03-1bf474287d07", "comment": "Malware payload", "value": "9d1ea5f24183095b6fac00152a44c444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495074, "uuid": "f6d982e2-b59c-4173-86da-f58cd0e940c1", "comment": "Malware payload", "value": "225dc299034ce35437c3de0bc7b999411b1f61c7be7b4323b5eb70e19117428c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495074, "uuid": "7bb2988f-31c9-4d31-a410-eed51091a6d3", "comment": "Malware payload", "value": "c2b6e8cd83df04162034bc6217a61c9c8dd34abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495074, "uuid": "b3c78ca4-8f21-4290-9f91-1fb4e3b09bae", "comment": "Malware payload", "value": "a5903bce81f4da7405046322400939ec06e370a40de1bb31a1932961c8f86a2204e3d73a0574b2b62bf3c34edc8c4988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495074, "uuid": "fa5f446e-8df3-472a-8e71-32100405296b", "value": "T1E457232B7199C4A4F2A6943AC9A386F05633AC739F31C5EB74A231A41736DD33D7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495074, "uuid": "3a9d227d-f0cb-492e-8f02-6e744718b005", "value": "e6f55769a2e7729b2117612737217d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495074, "uuid": "cf846e7f-14f4-448f-9f86-a410c54d1b2b", "value": "393216:ebrrU+uKttEt8lckpKnn9Xz2zOEyrCxFaP4kcfi03BSXENhtD+qFCzt6oW2aS5bJ:e/QiHcfSIuf13BeEHtxgt6oW2p5VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495074, "uuid": "f238b8b6-6af2-4668-b130-756bbf9f9a18", "value": 27493912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495074, "uuid": "4f00ab51-14c5-47a6-bb2d-8d2a7a975ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495074, "uuid": "fd601dfb-c0a0-49be-a2ae-3a8b5cb09cfa", "value": "Fei_Shu_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60afdf87-5f77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780510175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510175, "uuid": "0a5cbfa4-9cec-4573-a070-067450f3b2aa", "comment": "Malware payload", "value": "08b2cd944729850842fcf02e1b801f7d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510175, "uuid": "37b07019-e84b-4863-bd33-a81c81b79dfa", "comment": "Malware payload", "value": "2491deb9264542ee81e9f1d077a00f1a7a23639c17ebbc97fc7879ac54906b8e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510175, "uuid": "3437b69e-84a5-4059-88c2-a7cb388e31fc", "comment": "Malware payload", "value": "d49c6380aea0deeeea155a3c1da8f4e86b010ce2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510175, "uuid": "e5aba74f-94f7-4217-b8a9-4715a79f6de5", "comment": "Malware payload", "value": "70ac0721f63724c6b972fac824ffb9a0f1abe1ac56893e23b7079e6e92495ad8e1763aa6e204670a1a41b8b537551b2e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780510175, "uuid": "a0c8c022-c4cf-46d9-8aea-2907efcd6ae7", "value": "T1BAD18D617DA2737172002795D5DB39A237F164AB30289901384E95CD9B4701ACAEB4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780510175, "uuid": "67946818-bca8-42ab-b4e9-f030ce6c8c93", "value": "96:1ydB+dT/nDC6sk8dG4MInZIyq/XAMRXdRCKRMKw3XHpO8hpW8P1Jdy7kLyzEOV3b:18YbC6r8nxqJRKKR035OOPkkWzEOV37P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780510175, "uuid": "be3b918f-6ef3-42a2-a3de-74dfe576862b", "value": 6190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780510175, "uuid": "6ea332cf-bbed-4185-b9fa-7dc24beee4f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780510175, "uuid": "7b062932-b16d-4323-b475-f2c5e0e43d41", "value": "main.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9e81d7-5f3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780485635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485635, "uuid": "8b4f6274-b8d5-439a-be58-f5edc25926e9", "comment": "Malware payload", "value": "087cfa0e50fc81cd09c5a5674517a788", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485635, "uuid": "664cb9c5-7be8-4a69-b185-5584726a9fad", "comment": "Malware payload", "value": "26ac872fe2174266491e187b76a00865f4a3b338b1004c8e9be4758fcc1cfa0d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485635, "uuid": "14aeadce-80cc-4456-9baf-53ee3611d3c8", "comment": "Malware payload", "value": "d00cac538848694238d70d79a4f83d9b0f673510", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485635, "uuid": "6b9c9e31-920f-4601-abf4-558ebb677083", "comment": "Malware payload", "value": "7363617962073c90c663316af4e90b75253b54c3361838418f42009e3b22c945e4caa47085b19425157e330c637b977b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485635, "uuid": "052e5921-9984-4ed6-a897-50e68de382b3", "value": "T1903402EB9D05BB1EC1ECDA8A844F6F571124167BDF0378DD2B0DAE4525301782ACCA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485635, "uuid": "18084d58-21f5-4018-a920-d2c3cf3390c4", "value": "3072:8RpIlbJua1+/N7l6y7KhQHhZQos2LJSkv9twpDm8YXpVYo4qeGfffffffffffff8:NwF7kyNh2osIJSItjlXn4qeUNnkQGEhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780485635, "uuid": "383efeed-fd96-4453-9f97-b8cdd0fc4c50", "value": 234036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780485635, "uuid": "ded2bd9c-0942-4dc5-8fae-12e242b45106", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485635, "uuid": "29fd88ce-fe2b-4a6c-bc6a-7149249bd0e6", "value": "Fyrin.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd61f71-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495027, "uuid": "3ff17940-c2d8-4dca-8dd7-49674bfb55b2", "comment": "Malware payload", "value": "a5ba73839257796a04cce3266cb96b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495027, "uuid": "b90167a5-1a0a-424f-a80e-73e670be5c71", "comment": "Malware payload", "value": "28ad8bea01712d33febdb547e2602d6097e22aad29b35d40059c7ae2f2e05f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495027, "uuid": "d0a329e0-56e8-43ae-8a5f-7eeaad5750c0", "comment": "Malware payload", "value": "52e834254d677a06ee38b1812a13b4e4707bfec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495027, "uuid": "96471919-cc38-44ab-9ffa-03f018ed1536", "comment": "Malware payload", "value": "e1e41bea86434c16d13d82e525f655e65efc7e61a60f5085a512fd656f180e5ab12c4284e19af1878efe0391060747d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495027, "uuid": "10fcde91-c10e-4dff-888d-72dd426a2bfe", "value": "T13FF79246BB81CD97F86946348C9B87903372F8B54B5A83C333A8633D6E6E3D44EB1951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495027, "uuid": "8f2f7a17-5d81-4c0d-b260-853605a1528d", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495027, "uuid": "aa7d3e09-ae65-4cd5-9e75-df338ad33d26", "value": "196608:sdFbcB/7ePfoeO08oAqZ2ArbcojUAt21Ch7Dhb6Z/LzEnSQ5Pe:4cB/7sNDcoDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495027, "uuid": "a3c63284-78e9-4445-aa10-31d20c016bc3", "value": 74593280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495027, "uuid": "5fd7db6c-2ba3-4645-a1d5-6bffb1c6bfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495027, "uuid": "4c79464e-ac38-4e74-9f8f-83036a1ac0fa", "value": "ainst86635512005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941ef72f-5f4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780493081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493081, "uuid": "5ab0e7bf-b4cc-4dbc-bbce-26dfd8327f91", "comment": "Malware payload", "value": "fd2e11b681707ae93a7aac12d3bb3d23", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493081, "uuid": "e25f5e68-0a75-4cc0-9701-907700f7e7de", "comment": "Malware payload", "value": "2a9150f83c184c1f349e2fe4abe317e86e6ebf13170ac1a8ac51c15fc3bb104e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493081, "uuid": "bd69349d-ce61-4bd2-b302-285c621f902d", "comment": "Malware payload", "value": "fcaf949d2ffbce84ce9b8253764a430819a4ace4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493081, "uuid": "c1512477-d413-4012-a8bc-590b23bea79a", "comment": "Malware payload", "value": "8561287e7d966c397f75fdf4311c43bdb6a867f9b7e81de6f2ec78c27030cc984f7185c10f588a53fc2adbc3a5211693", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493081, "uuid": "d473b5f8-d89e-486b-befa-13b46653c1b1", "value": "T16A137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493081, "uuid": "81238b7d-0927-4b21-9b3d-1ff218ed65ca", "value": "768:5XRWNGxVR9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:TlxMco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493081, "uuid": "b37496d7-f782-4eab-9c91-0ca7531d7928", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493081, "uuid": "4adaf1cd-e015-46b5-a593-e4756fd9698a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493081, "uuid": "5f08156c-de99-4667-aa06-586d81947dfc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a63fd6-5f56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780496144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496144, "uuid": "88ec72ea-abe1-4edf-8160-5867e9e9de7b", "comment": "Malware payload (Mirai)", "value": "5869634a5c01b95af2da32759a030904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496144, "uuid": "6ec6e511-8573-4e09-86e7-14baf1f7c274", "comment": "Malware payload (Mirai)", "value": "2b4cdaed66a495937d5ace71e7c0ff7532ecf657c6005fe42a0af32f30c89541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496144, "uuid": "ae800ee3-3dff-47a9-9618-5d44c0ed1353", "comment": "Malware payload (Mirai)", "value": "c18e88e69b28718654ae527299c8e68d7d61f966", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496144, "uuid": "d3c65600-e569-403c-ab39-7585ca39f0ef", "comment": "Malware payload (Mirai)", "value": "f3767c6974ec0845ec704d7f39a8d9201300dc15475c634af2874cc2368ab9fb3a8de535ba7da98bb94e82e2a992ef5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496144, "uuid": "539d2d3d-56a8-492b-9c4a-5580a250e899", "value": "T14A23E18EBEB51D9BC7DE3C3D508A1F25AE147084AF5D964C4FB90D086B03947746E075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496144, "uuid": "244815c3-15f3-4ca5-80c6-98e671f07c26", "value": "768:x509b7Au9gH8tHKEmKUjbTrqXphCkNL52wjLXMfxpjWK7bWVqohWR:x509b7BmB3qXuU524LMKxVqoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780496144, "uuid": "9fbe9b74-b99d-4456-b791-bce92b72b5d0", "value": 45584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780496144, "uuid": "5ebc09fb-f067-44ec-ab4e-0031425a2758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496144, "uuid": "9d8c27d8-7883-4eab-b358-294c8da4223b", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b9dd03-5f77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780510177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510177, "uuid": "99be6079-8386-40e5-bcc5-b49f47fc1884", "comment": "Malware payload", "value": "723b7cf256e7fae192b9e76e5a251778", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510177, "uuid": "f35759a4-f2a8-468b-9141-4a53f81b1f51", "comment": "Malware payload", "value": "2bb3dc52c88743b35909db6c2532c0dbf3522f16f530a5bcf3d683f4d4f9b5c1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510177, "uuid": "4596c960-4254-4655-856f-6872f780e929", "comment": "Malware payload", "value": "e2248a5b76fb7772d492a71b3bcb189929b9f520", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780510177, "uuid": "dc47c91b-2754-42c6-b339-4dd912e6349d", "comment": "Malware payload", "value": "7337df59b3a0129543fd645c5ce0e74d3fbbca24eec0ca2594b42c9fd6dba5d66bc54565e2b6366b8181830b6e11e35f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780510177, "uuid": "6d2d877d-3663-402b-abd3-b127c0272f20", "value": "T15B31A96B53E041E84D47A9E3644838C5149C9DED4279F4706F7B48C6FC4CD2C89A87DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780510177, "uuid": "c240ab47-40b7-494c-9931-86a88c98e657", "value": "48:w1GFwFoD7WeyEbl8X35u5a5GZM7NUkCuxXPXjYI1Kr:BFw63n+5uc5ewO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780510177, "uuid": "99f9cd3c-b46e-4673-b2b5-0bed51718de5", "value": 1835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780510177, "uuid": "d2061e5a-a051-4ac1-8211-3b50756d9200", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780510177, "uuid": "4259b762-61da-4f86-9c5b-6d7e795e10f2", "value": "sample.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b068ff-5f59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780497161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497161, "uuid": "ce6d2786-af42-49d5-9537-f7ecf870e6c2", "comment": "Malware payload", "value": "99cd1873fbb819f2b310e01da0582b8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497161, "uuid": "2f1a92c9-24ea-42b8-ab64-1e5204283d37", "comment": "Malware payload", "value": "2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497161, "uuid": "2f2151a2-f439-4949-8400-03f7d06b894b", "comment": "Malware payload", "value": "4d4a1920a3e11982303d0ea02149b16f0b9cc8a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497161, "uuid": "2da2a685-d551-4c83-93a1-21be58f4ae10", "comment": "Malware payload", "value": "a945fdb612d08724900158be244de840c7b1b800a9ad77cf9130b50dfa2206cc3ec429b05f5925bc27103ba3fbbf4879", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497161, "uuid": "b3a8515a-eabe-4c8e-8201-d0b576fb7acf", "value": "T1E201EBCAC103C720E286F89D26A751803411C3CBAA420FB43E8C043EEBAA718B0A5FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497161, "uuid": "cec49f00-29bd-4c9d-ad54-a59563d8d6ea", "value": "24:kXCKysE2hi0ziQvZohaFv5pnTF8llAq/KH7:e9Qp+MsFv5pTF8/Aq/KH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780497161, "uuid": "d7dbeada-30f8-4e88-900f-ff37ff1a032e", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780497161, "uuid": "2238b2f9-90f7-440c-87fe-795f623416e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497161, "uuid": "1e05c509-5083-4d1a-a992-8d55ab8ac6db", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea1454-5f56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780496262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496262, "uuid": "e1425739-ac28-4c1d-afdc-a7e29b308f5a", "comment": "Malware payload", "value": "f364cded370cc811434c530b44a9148a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496262, "uuid": "031eba10-6625-46ac-a84c-219b7f120fc9", "comment": "Malware payload", "value": "2c6cc863d21298b7be6fd027426b4f1f8120ffd20b14451c0daf2b53a848b0c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496262, "uuid": "a7d20ef5-2660-4ca6-93fe-6a4009b97905", "comment": "Malware payload", "value": "c2e424aa93bcd6d67c9350c1c0741729a1ed58f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496262, "uuid": "5ee3be63-1290-43f3-8379-ba97c17373c5", "comment": "Malware payload", "value": "d32eadd0f36b7814dfe24cf0095790b5f58d09484ea1184fd517fd60459d46f3c3f6f872d72ff517253a6a82395df095", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496262, "uuid": "b8691198-426a-4486-b77b-eb53ac0fa441", "value": "T100B66A137B6CEB1FC228223409F2DA946B695C9201D7A517B385F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496262, "uuid": "884107f4-5ff3-45ee-8ee8-3dd4d254a7fc", "value": "196608:8p2o4mspeR4KNEzs/H9PRzDKxquDJqGnvC5ObJkek/QOLdr:8p2o4mspeR4KNEzsP9PRzDKxquIGnvCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780496262, "uuid": "2028b5d7-112b-43cf-82ae-c14c0639a74b", "value": 10967197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780496262, "uuid": "c9a86aef-6209-4687-820d-4b25201ef7e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496262, "uuid": "d459ebc5-6e4f-4621-8351-f03b9748e335", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af31980-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529895, "uuid": "9c402e89-163b-4258-9f2f-8483a4de6247", "comment": "Malware payload (Mirai)", "value": "a174449ad481617989b16dfd37c01d9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529895, "uuid": "51caa7f9-3d04-4713-95fe-09499027af5a", "comment": "Malware payload (Mirai)", "value": "2ea0eb1347857e7435b23af39f160c4369cdf1a796bbc583fa645a0e60e3e81c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529895, "uuid": "f2057743-2072-4a00-b7c5-db0e8ff5020d", "comment": "Malware payload (Mirai)", "value": "21c2bb18f9c4d37fb441281593101871bea5745c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529895, "uuid": "7c3f7fbf-5e5a-480c-a8b3-9a1247b4fe01", "comment": "Malware payload (Mirai)", "value": "63c17fb4872de01711ed8b90a1173ee5571fe5dfc57cfb717919dbb830727437fcd7096bc243ffe3f6e9c3eaf3a115a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529895, "uuid": "63be5f71-2348-44d7-925f-f69b8c264dc6", "value": "T1535302D38570AE12FE2A7874CBBC1AE9005B115E0D2FCA75EA3A650D65323465F30C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529895, "uuid": "e7fee14e-5732-4771-9ead-44bfea5a6e46", "value": "1536:3CTEztuSxAL2ptfBP07kLCgFpIEaTVwndrd4h65sm6PAQM:3CIuSfJQApF+EaTVWqkmSQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529895, "uuid": "73ec0ee1-c704-4f16-9ac0-5cebaaddff66", "value": 65904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529895, "uuid": "621bfeda-8523-4322-a60c-a78a492a8315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529895, "uuid": "4012a559-0ae5-4693-a892-c953254917c7", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a31611-5eeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780449950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449950, "uuid": "abefff84-cd3f-4ab2-81b7-e2563a35758d", "comment": "Malware payload", "value": "d4c5a0e29aa9598ef049564d14078f4e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449950, "uuid": "150dfb19-ccfa-4a29-99d7-9bb466d4d12f", "comment": "Malware payload", "value": "2fd9f11e43e7448909257e73175856e3f1035264c3f7f19c9efcc00d626e79a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449950, "uuid": "6b0e0eb1-e2dc-4c4b-8184-ef926eb04a68", "comment": "Malware payload", "value": "f1543b823806920ba2b7ba85468bb904d48125eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449950, "uuid": "54697e7a-1f9d-4b5d-8dd4-dfe0ca7a6dbd", "comment": "Malware payload", "value": "ac7a44d7feff1b1ba0224c38abae63469f8db6ffe1976c1a8e3db50d6cb72ad1abb0bba9d8c6178fe0b7f5ff6677d64b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449950, "uuid": "33f88045-c361-4069-ac14-76f88e0f1ad5", "value": "T16801AFCBC00AD76001D5E46D22E75544BC21C3CB2985CBBABF5C083E9BA9A08F056F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449950, "uuid": "42093698-3c4e-4dc7-84d2-cd5c7652d137", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauIPxznUHINDl1XILMcVI7/IGgIX:kXCKysE2hi0ziQvZohauSxj8c5VeaNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780449950, "uuid": "9cd38d5e-aeac-4206-9ba1-a978b8346a13", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780449950, "uuid": "18035ff4-3839-4e20-a4e9-6f30c23259de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449950, "uuid": "8a6bf46d-9876-48e9-a7ec-71af556edd52", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e263ba5e-5f5f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780500084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500084, "uuid": "fb7086f5-e6e3-41e1-9e66-62362b6ef822", "comment": "Malware payload (GuLoader)", "value": "b7fddc0f52aa19361bb43414efe86378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500084, "uuid": "9ec23e67-e00f-40fe-b919-a936b06774aa", "comment": "Malware payload (GuLoader)", "value": "2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500084, "uuid": "40ca1b76-03e1-4971-92fd-0af909c5a5df", "comment": "Malware payload (GuLoader)", "value": "1b09f4837c3c401aca9c1d5bc22f5a1b393c1f4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500084, "uuid": "44c13f7f-795f-4953-afc5-1b1effb92172", "comment": "Malware payload (GuLoader)", "value": "aff269e3d764210d105dc8b968b3a5099482fbe865173bbb9ade050c54a83b4b5365f99c3d6e2999a89beccf27010a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500084, "uuid": "c70094f9-1343-4a18-8f0e-40f65d8530e8", "value": "T1D654D082758490EBDA256470C8ABDD334B277FBA47D15B0F23B6762E64731630A2F50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500084, "uuid": "fd566aed-ba2d-4776-b969-7f0acf903fa8", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500084, "uuid": "40074d11-f6ce-41c1-949c-8250a27fa0f5", "value": "6144:cpZgUXltNBTzek8VuyT9oajCYQXwa8ya1f20lCnTZ8Ikv:EFeduQoaj8c8uCT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780500084, "uuid": "a6274764-1f63-4d03-8f09-19d805150479", "value": 292592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780500084, "uuid": "ec1a7e8d-5c68-46b8-b7a3-7eaa0403efbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500084, "uuid": "dcdc9e3f-dbe3-43b7-b83e-c4567b29bc9e", "value": "June 03062026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2abd0a7-5f43-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780488005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "b337b458-05c2-4fc0-a433-b3c394ec53ff", "comment": "Malware payload (NanoCore)", "value": "2f16720b5051a79b5d48494dd7042f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "fc6810fe-373e-407d-a39d-e9093da5ab22", "comment": "Malware payload (NanoCore)", "value": "30a9f9a9f677e73b8adfc87a7b426317a1e968a320f01addb0d8af794a64282d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "d74fbcb4-1230-49d7-8596-162d6462c9a2", "comment": "Malware payload (NanoCore)", "value": "8385685a02c2e49f6a9f8f73da290fb945317073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "1d1f3110-d4d9-4aa5-b71c-80cf48159063", "comment": "Malware payload (NanoCore)", "value": "d6e9d0897ccb6ee0f9c60a47748966b71f38160d74fc747e750966f4d11026e1d0efdc8a915caa56f7da59da3c9757ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "e368ac66-30ae-43e4-83fe-e0abff06924b", "value": "T16714CF5637A8493FE2DE8678602242539779C2E3E8D3F3EE18D855B35B127E50A0B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "7e3340bf-2513-4250-b4e2-18a590e0621a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "099d3001-0263-4d4f-a0b5-705556d27d08", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIG1skdn+BJCnryIwzt4LLOcsj:QLV6Bta6dtJmakIM5pskxrgztsLP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780488005, "uuid": "2c52b2ea-a56a-4fc3-ac4f-0ddc1e8557e4", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780488005, "uuid": "1f946fb3-a756-42da-a4e2-f1da8397b461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "8fc2b6ec-7dd7-4891-ab17-c2bad5458e23", "value": "rtfo77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a91db55-5f15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780468154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468154, "uuid": "45b3b869-416e-4785-9cfc-4b3844b7a2c4", "comment": "Malware payload", "value": "b9111cac752e80b064e779d06fbb2bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468154, "uuid": "d1a43e53-04c8-4a54-9506-46e30d6abdb1", "comment": "Malware payload", "value": "341ab263fc6bd4ce4ddaf6c82132fbfcfe7fc8801def0ccc6dbe2c5f6d071a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468154, "uuid": "177927d4-c483-4b54-a69d-49b27902effa", "comment": "Malware payload", "value": "7bcf7f5da24f159b2fd0003b6301131b9e2c0be5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468154, "uuid": "0f068082-d13d-48bb-96be-69959dc504b2", "comment": "Malware payload", "value": "1d343d639f32012248742f53f616a319cc822fcadbc43ac8818860ae2abc78721f5e93832c3fefb38f81281c3a9dd176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468154, "uuid": "02bbb55f-0c4d-4b06-b663-fb1ca0dbc526", "value": "T191C5D01AA3B400FCD0B7D2B4CE569907DBB2B8461234969F03D189A62F67B719F3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468154, "uuid": "8b32c644-2332-47a0-8689-3a9499f909af", "value": "7d2bd09ae9d9b74185a09a128003b5c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468154, "uuid": "ec87010a-dca5-4997-ae52-45533d0e4175", "value": "49152:ScIKmjtitHaaNZV/Ovfe/PFJdG5CYUzDC0QOu/r:jAtCHaaHVmv2HFJgAvxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780468154, "uuid": "82011ab8-d635-4b13-9735-f5ed90243d9a", "value": 2565120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780468154, "uuid": "8bba873a-37de-44e5-a606-af045a355eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468154, "uuid": "193e2b04-0f48-41b3-bdfc-ad3916fe9255", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77225213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdd7112-5eef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780451676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451676, "uuid": "18008dc0-edf2-4d82-b082-e8d16977bb65", "comment": "Malware payload (Mirai)", "value": "ada69700ace2ea7a602059c9658844f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451676, "uuid": "b3e6c163-999e-4cf2-ab32-6bf4636ebbf9", "comment": "Malware payload (Mirai)", "value": "345aa1a1424725973f9dbefddaf2d8819a531db790d94f9597d07f3f693a5dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451676, "uuid": "19d85ef5-50f3-419f-bc5e-1bb57119b28e", "comment": "Malware payload (Mirai)", "value": "ca700e551ffb7e7d2dcdbf29f54750fe650812de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451676, "uuid": "495f0c4f-d650-47a5-b4ab-9b4f8b957f29", "comment": "Malware payload (Mirai)", "value": "3b16a1adc089493b381201293088352a32fb378b48b7226828dd9c78356c14bad9fcb49e98c67cdf29eb7b6dfc755a83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451676, "uuid": "6ce8c374-03a2-4a01-870a-f188f69f5b9c", "value": "T1EED307C7F900CEFAF80AE33748130405B230BBA645925A376257396FED7A1991577E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451676, "uuid": "0fcabf35-7f3c-4774-87e9-6be56c0de19f", "value": "3072:oBcEBh0qFxcyqxBs14j22E0xLVZQ/ysVtjbi5LH9dL4V:oBcEF7cyqEmi0LY/yTLoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451676, "uuid": "8b5982a9-6e1d-4a30-bf78-f06db7bf3324", "value": 137156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451676, "uuid": "3afb0fa2-c404-4f5e-8bc6-c5593bd51981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451676, "uuid": "10d8c827-6f2d-4f2a-94bd-c9889ff25b7e", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e23973e-5f60-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780500399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500399, "uuid": "eba5772d-0b1a-42dd-9c92-420e75d96db8", "comment": "Malware payload (Mirai)", "value": "61bda3c7eba1a51d063a6d38531121e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500399, "uuid": "b8a19cf6-b15d-4d1d-b41c-462b60030b38", "comment": "Malware payload (Mirai)", "value": "352698d6103fcbc04f406c30d1c6dc5fef12c57232299d472aba17f59dff2438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500399, "uuid": "cdfe3021-0887-4893-8e68-a22fcfdb81ba", "comment": "Malware payload (Mirai)", "value": "bcfba98715debe123fccadfba1f839c37ce4b309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500399, "uuid": "dcc3e352-40fe-447b-9898-eed643f32039", "comment": "Malware payload (Mirai)", "value": "515fc6d3ffb2631497af25436f930fd0185e4a64972c9d9fa2f76ac8ab255659c87d370df49d9cece715256d7f58fb28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500399, "uuid": "af02f699-b491-410c-b784-975d55cd2b63", "value": "T1A9D33A82E683D4F1E91605702567E33B4632E535103BDB83EBA5DF36AC92E81D61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500399, "uuid": "458e046e-c127-4b86-ba06-4b7598966b68", "value": "3072:81r+ohrC/09o8FNXGxEIsTge9msvnw2Esy2W/6:81rthrD9oYN2je900W/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780500399, "uuid": "ddc08327-b0f1-4afc-af95-9385ebc54382", "value": 140596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780500399, "uuid": "7794df5b-0dd9-4fe5-8b88-b1b120bc5b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500399, "uuid": "ea94fbd8-285d-4e85-91f0-85f0da2104a6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050e39c2-5eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780449462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449462, "uuid": "20b8e412-49f0-4e54-9cd5-845d08214bd2", "comment": "Malware payload (Mirai)", "value": "4c5826c255f39ec5162297a129d5768a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449462, "uuid": "e782d6dd-12d3-4c8f-95e9-6141c0e63117", "comment": "Malware payload (Mirai)", "value": "35ff13886e03dcefaa6ce426db5d84e58f63ea63a15a2661b6b714c993e92390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449462, "uuid": "250e4885-38d3-435b-8a8a-823dbe173191", "comment": "Malware payload (Mirai)", "value": "19cc4a8d546a3d73105b21641c48b4c326a1f5fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449462, "uuid": "48012165-4021-4f03-b129-1581377e8fec", "comment": "Malware payload (Mirai)", "value": "092900c22145860e550982d9e40cbcec2e8a8e85b150c15fd1d227e298f817fc67dbb3a092e2e44e2bfe5bb31c401e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449462, "uuid": "2e582686-3363-4eea-98a5-2621578f3cae", "value": "T12713F1146137E643E3F0503F5EE6C5C3C7A1077AF0FABA3628128D78192922971ABF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449462, "uuid": "ab472946-2c19-4136-9abd-2507818ed61f", "value": "768:oLJmaAe1hbGvYtGwYBmBtlyvLYyK+4NkSko3GZBzQ2dL63ZMZ6VrOjAUT0s3UozZ:oLJ/G1wYBmvATYy54+S/WZJndeJyAsRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780449462, "uuid": "d1d660d4-e4d6-4c54-9064-5df8d5c06634", "value": 44460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780449462, "uuid": "1a0da800-a3b3-436d-abc4-0d4ff4ac508c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449462, "uuid": "e52e989a-c5be-4cc7-a41e-c3ded0da363a", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f075fa0-5f85-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780516051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516051, "uuid": "4f0f8333-5784-4982-b956-042fbb99d980", "comment": "Malware payload (ConnectWise)", "value": "2ac676f0d303aefef8b0fa0d688add23", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516051, "uuid": "cb81adb8-9727-478d-893c-6355429f3eeb", "comment": "Malware payload (ConnectWise)", "value": "36e16b13182f190f605fb12d0d1a0881e67a1cd265520aefe43a4c10983d066a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516051, "uuid": "ad5c86f2-bf03-4949-98a8-cde0de16a1a6", "comment": "Malware payload (ConnectWise)", "value": "06e854e27b621b484e468893ad8cec7982ba6a82", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516051, "uuid": "2ab0838a-cad0-449f-ae3e-945f0a9dd542", "comment": "Malware payload (ConnectWise)", "value": "80503a11c141c97754faf5904e099998c4f4a301d05bd75094a72e420416e978694caf1d0a1fdddcb4edca9302d81482", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516051, "uuid": "c5927f13-38b9-479c-b425-91ef54011c22", "value": "T1BAA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516051, "uuid": "1fc38a73-456d-487f-8f1c-8edc5e092b49", "value": "196608:NnCtVYqI5MvbWEpKkq6IJqKVnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqEnCtO:NCXvI5MvHx2JbCXvI5MvHx6CXvI5MvHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516051, "uuid": "a26ff9c9-b5b3-4edd-bccd-024dce7e0451", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516051, "uuid": "1dbad96a-52af-42e2-9101-554d131bc1aa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516051, "uuid": "f82a8242-f519-4956-b314-5e512d2f612b", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bca35aa-5f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780490705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490705, "uuid": "dc9bde7a-c8e0-40ad-afff-53dabb665f31", "comment": "Malware payload (NanoCore)", "value": "2ecf4a3bf9b53c1c1f7cd998da94e664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490705, "uuid": "8775ac0c-9dc4-4006-bc2b-49b8b19e75cc", "comment": "Malware payload (NanoCore)", "value": "378ac23df0db902049109577898d2926d72e8ad6a723159dc019f99f2ccbd01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490705, "uuid": "fe75deef-de81-44f9-a035-886236d69e5c", "comment": "Malware payload (NanoCore)", "value": "40d755e43a1da4afbf87efaf3b4a4f97b23d657b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490705, "uuid": "18af77b8-873e-4c8d-afaf-034617c48ded", "comment": "Malware payload (NanoCore)", "value": "d6540c78561149e0103c31919a4417d31a459183c1d806442c88b220c0000bf1745149fcb0239766d5992d1bfe4b25e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490705, "uuid": "0b04425e-6bd8-448e-b205-52c12336ff29", "value": "T1E214CF1A77A94A2FE2DE8AB9611212579379C2E3D8C3F3EF28D454B34B163E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490705, "uuid": "1ae3e868-0b7b-4acb-abfc-9594f1044b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490705, "uuid": "4282f119-e210-4a2d-87c4-505a73e1b9bd", "value": "6144:MLV6Bta6dtJmakIM5pMluAJDAxGJg09osI:MLV6BtpmkGRAioJgzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490705, "uuid": "6e3bfd56-b5a1-421b-b3b2-48d58d26c41d", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490705, "uuid": "fc64345a-0183-4469-a9f1-f625844d6df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490705, "uuid": "34ffe5b3-7378-4a78-a9c7-e1cc54bf1cb4", "value": "maskelibros.cl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cedaf1-5f33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780480818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480818, "uuid": "7e2eeba6-4c2a-481b-8f7e-0fb3cb31fe95", "comment": "Malware payload", "value": "9da9cb96ca86ae1f17b76641fd7dc678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480818, "uuid": "1fe92e54-30bf-49fa-8046-91084a0e1402", "comment": "Malware payload", "value": "381559c2be60621ea3b41e68c717a70c880a97b6997435d567814e83d0f33c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480818, "uuid": "2739e6c0-90bc-41d7-978c-e14732b4733d", "comment": "Malware payload", "value": "8feceddbda83c84fe171a12d3090c2932ed78b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480818, "uuid": "2ba6ef0a-8c3e-4295-98da-f87c75d567ef", "comment": "Malware payload", "value": "deb2cd6304796bbc10752b21dd44e7cb6a7569d0871543298e7a3171a1d9243e9094fb892bfcb6142db28fab9d5f4dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480818, "uuid": "dbaffe4d-4ceb-4ae1-9da4-57ef8c440a93", "value": "T1E5D1A60463FC4626E4FB4F38ACB3532516B4FE114D32CA4D5CA8024EAC72729CA62BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480818, "uuid": "de2112ff-8f56-4c44-8b40-927cb9c9861b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480818, "uuid": "3e09d96a-38ab-478b-83eb-ce14589fb9eb", "value": "96:lZnRletEvWIqy/4s3K+TVw790jZlmHGBwtCw8drFTNELC:vXMeWjy/4ipVW98ZwHcdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780480818, "uuid": "ad45198a-6a8a-4c34-9567-5480a74e0faa", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780480818, "uuid": "0a8b248c-0ea9-4bd0-9a8c-b38525d6d464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480818, "uuid": "d8f692c1-7ada-418e-9e93-2c9464333a79", "value": "rFerreiraRezendeSSAdvogadosAssociados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81ecea2-5eef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780451910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451910, "uuid": "8a442f91-c18c-4e73-9043-227cfa67babb", "comment": "Malware payload (Mirai)", "value": "fe71e531dbdb73be517fd3b7be86ea2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451910, "uuid": "4c6b5312-200e-4790-911a-74fe1c8769cf", "comment": "Malware payload (Mirai)", "value": "3a17227e9c8950019176a0f65cd3e8c29d65c3314231da791ff9ea803cfa9ee8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451910, "uuid": "fd329d62-3184-4a7d-b490-e02ded0fb89d", "comment": "Malware payload (Mirai)", "value": "c80d235ab9af0799f62c444083bb774fb3cd0725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451910, "uuid": "0b6be017-9441-4307-812f-53626661c3a4", "comment": "Malware payload (Mirai)", "value": "33d1b8c74586ce429ba8c48d35f14c02a12bae29aa02eab90f533bb86429603400848a5f0447bb312dc9d6a22ef5aa45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451910, "uuid": "0dbc0bf2-6bf5-4e86-bd36-d1581613bc03", "value": "T1B8C33B17B8C1C0FDC8E9C2B84FABA13AD973B4295134B21E27C4BE672E59D205F5D660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451910, "uuid": "1a614646-cb0a-4808-8746-53e2417ac4aa", "value": "1536:dxMdBEUj9DwDdlRUob/yJntHJ1FFll3YIlUkCAJMZH5I1Dq3E:dcaUj9ObKhH1FFllISHCAJM/I9GE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451910, "uuid": "da2b02c4-cded-4da0-92bd-e5a47fba6317", "value": 124872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451910, "uuid": "f56bd78e-35e5-4ea5-b2b4-0525871bf472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451910, "uuid": "296b467a-5765-479d-ba82-a752955730ae", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c4603a-5f53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780494859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494859, "uuid": "7643d1f1-f3dc-4a86-8d58-f921fcaf2652", "comment": "Malware payload", "value": "3f760ca7e76b3149c6cd30f53792cc9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494859, "uuid": "029013fb-8831-4ed0-aed5-7aaf44cf1d53", "comment": "Malware payload", "value": "3a767e62124be13045c449b3c876e354ad2ee3e207ee69404951b2a5ce82c0d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494859, "uuid": "b4280430-b21b-4712-ba69-f68bc87f6569", "comment": "Malware payload", "value": "9ea25c5e25f69fbf3dff9e541c75e8bbe194fe6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494859, "uuid": "58876c50-1728-45a5-9ab3-e9b2673604ec", "comment": "Malware payload", "value": "0407d35e2fa32bbd19a798eac67288b612506eff5e877f7b0af62d3b0edc20151b0c61a357f3fd5801bd5e714f6c26bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494859, "uuid": "42ecba55-2b17-4786-b574-403b2efbd398", "value": "T12DC3F846F8819B15D1D151BAFE0E124E77231B3CE2DE73029D24AB747B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494859, "uuid": "49f15954-6362-4b93-ab68-984a5c795bcb", "value": "1536:R4nBHD8eO5KIsHMg7XykttDE0jmiviXuOQZW/aWouyhgq0I5Jp0m0AyOA7D515j8:31ssUXPDuRQZW/aWsgq0I5il8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780494859, "uuid": "4bc45aed-a632-4347-a88b-8e994128cfbd", "value": 118736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780494859, "uuid": "1b32a02e-27a2-4aa2-8f1c-12ee8c313d9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494859, "uuid": "f4fd2e9d-1ba2-48e6-8d87-12142748994f", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6cc87d-5f2c-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780478113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780478113, "uuid": "c9d8ce90-3b7f-40b7-a0f9-f80709782067", "comment": "Malware payload (WannaCry)", "value": "5209e4d695fb5245483b45ee74a0c5bc", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780478113, "uuid": "86ae9625-0c21-4255-96cd-01d2ae54b7af", "comment": "Malware payload (WannaCry)", "value": "3a7ad1f4cc13618fb549375990cf3cb3581eec295b852e8fc89d2032f97eeab8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780478113, "uuid": "4210490c-a4bd-4968-9e2e-cf86523ac49a", "comment": "Malware payload (WannaCry)", "value": "40ee2851bc09bb0b135d397791ad05fbe3bb3288", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780478113, "uuid": "1c7aa126-02f7-4128-a5a5-c256e32fd728", "comment": "Malware payload (WannaCry)", "value": "e29e0d36d0eadb67e57728e4bc29d2f52d78fb7425dac68f6855098671fcdff76ce0de74c1f15b0e2bda78ba543f6e55", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780478113, "uuid": "a70b9f75-d2ee-4bc9-bc89-667a2a80df32", "value": "T1103612309268D0B8F09F69B223584E45D2ED2943DBBB462DF51E41183F03F9ED59CEA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780478113, "uuid": "16d14a42-0359-4ce4-8038-87d2e39f86e3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780478113, "uuid": "18f58037-69d1-445e-9be1-396974660421", "value": "98304:Dy8qPoBhq1aRxcSUDk36SAEdhvxWa9C3R8yAV:Dy8qPn1Cxcxk3ZAEUa6R8yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780478113, "uuid": "f6a32234-ac6d-4829-8756-716cfc236960", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780478113, "uuid": "c8fcdd59-8dfd-4301-b2aa-7b562d63832c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780478113, "uuid": "c1071c45-d183-498c-8346-83c7837c5841", "value": "3a7ad1f4cc13618fb549375990cf3cb3581eec295b852e8fc89d2032f97eeab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87e16cf-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495343, "uuid": "3d2ae20a-1bcb-46fa-b722-5a5d0d6d8dff", "comment": "Malware payload", "value": "95e99ece7499667a40e6d8db59bda41b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495343, "uuid": "6c745885-e99f-44b9-9f69-b0ea4c5bcb4b", "comment": "Malware payload", "value": "3b000c0a6a5f0936addf3a6d0e4dc08487802961f1c2b9776c537aeedd391f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495343, "uuid": "29ce559a-7e32-4f5c-b983-0d5d5f731843", "comment": "Malware payload", "value": "3fffb8c5104e55d1d3b8725c426e22c5ddcf40d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495343, "uuid": "b9e83877-7266-418b-8dfe-44a2b3fd3575", "comment": "Malware payload", "value": "3e43fe9c626d95244a6c404fd4813baa29c35c0a9df1096453cd8a62a04d35b32c02feffb5ce7e307211cf236ba0d236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495343, "uuid": "5182fdcd-ccf3-43fe-b3b5-a4f94503ed82", "value": "T16E068D1777FA00EAD47AC27DC9835903EBB27856033267DB016186661F236E65E7F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495343, "uuid": "a0f6ade4-6868-4409-b2c0-1bab758ab036", "value": "ef7e7a1ef08822e41f56d1f600fe83f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495343, "uuid": "981b5a03-90ca-4202-ab8f-38adc19a49bc", "value": "49152:kh1247wtmC2aPWwFjldtoslKl9VoIk4dKKpDqRF4DyWVajSilXamh8mylsaqZOhR:oi4dKXoh8aBm8yZOh8AvvtERDQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495343, "uuid": "6fce6560-9eb5-4d0c-bbe0-b8cadba1b9ed", "value": 4000768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495343, "uuid": "0044d41b-4947-4f0b-824d-aa16f9c1a8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495343, "uuid": "1fef83a9-ebb3-4714-9484-9a6045850f6b", "value": "Feishu_v2.1_x64_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5342824f-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780469780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469780, "uuid": "d673fe0f-9b3a-416b-bf32-ec73136e0de7", "comment": "Malware payload (AgentTesla)", "value": "f6b8f8706789966b0108d331e3d57ba1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469780, "uuid": "8e4b116a-ef05-4a85-a99e-36398b2f2853", "comment": "Malware payload (AgentTesla)", "value": "3b3c396524c4ddb98941fd82d0881b2c5babd388df42ec13abb6223a5fafc38c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469780, "uuid": "7125e37d-9940-4673-ae1c-5a8d6268a2d8", "comment": "Malware payload (AgentTesla)", "value": "02457dba3f9ffb68611ddd593ea91e038f44e152", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469780, "uuid": "fea01ed6-dd23-429d-a711-4b9ea6d2a8f7", "comment": "Malware payload (AgentTesla)", "value": "dc29ee4082e0ae320decbf9004a0e8296feac6d21379bd8ca53b7e24526316fd16ad634a6f060abf085a61ce4dd2fd0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469780, "uuid": "948c28b1-f270-4fd2-b182-7cb2747fe55b", "value": "T17835CF222E832F68F62D5B7C8012185C27F0D8536297E71F7FEC98B81AA7B81CD27555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469780, "uuid": "4881e61e-d38b-4bf9-82d1-0833ee0eaab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469780, "uuid": "bad3f3bc-fd36-4bf7-be4b-44cae9999091", "value": "24576:rlmPiCg+ugZU/FHGtYINStGFt2QHEQCvoGFwYEG0R:r8qCFuWU/hGtNNStGF0QHOvvFwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469780, "uuid": "92abdbb1-eae7-47bc-b351-941b84fa2256", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469780, "uuid": "6f8ef7e1-f86e-410c-be09-fd612021ec9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469780, "uuid": "1a902c7b-33e8-4239-94fe-5c49613b2867", "value": "nuevo orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7f16ba-5f55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495538, "uuid": "8d73f92a-5a69-4ebd-a2fe-e320c2a557ed", "comment": "Malware payload", "value": "283eb606600d754a2b03edcc5563a8de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495538, "uuid": "8410e643-6e79-4078-b71d-ed6a643eb2aa", "comment": "Malware payload", "value": "3b51ba17efe988b0a761146c74f4fdfcc7e8c17da434bee2deebe94138a6a1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495538, "uuid": "8d106fe5-5fe6-42a0-bd46-2c0a01b33d81", "comment": "Malware payload", "value": "ab0cccc5dda6af177c3969b00a9af4d68a64d947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495538, "uuid": "098598e5-29ec-4b02-9501-a4892be9c193", "comment": "Malware payload", "value": "389b79a56fc724e0b70474cdeb0f626837aeff562bae02dfd05c72bd1baaf8a19cb250859f07086c111dcacb98264fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495538, "uuid": "b5f66bcf-46e0-4b74-b114-3a4c6d664b92", "value": "T174963368DE0234B3D97143336626AEBC754F7876D97585F306B0B128AF9204B4E71BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495538, "uuid": "bd71e771-e49d-4002-af4f-c14cf1e23ab9", "value": "9a04dd44d612988612d7626c082c40a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495538, "uuid": "1841938a-b955-498e-afd2-4135f311dccf", "value": "196608:YbXS8UjsejgzITfppwa11vrqoNyGIArUifEl+hPyZevL9:2Zs7scTf911vrqB8I4El+hPtv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495538, "uuid": "034010c2-fee4-41fd-b985-bcae30e4bc05", "value": 9089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495538, "uuid": "74fa72c6-5962-4aec-b580-8fd31f52c281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495538, "uuid": "4ebf2eb2-f7c2-49b7-a1c5-b9b800348a5c", "value": "Xeno Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0d8b59-5f17-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780469122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469122, "uuid": "ab1b6575-d512-44bd-9cb7-87ed34180f0b", "comment": "Malware payload (NetSupport)", "value": "d02b3a3bba4936450dcdb28be5bd3a6f", "object_relation": "md5", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469122, "uuid": "3c36235e-8ee9-44cf-9941-3c8d4eb902e6", "comment": "Malware payload (NetSupport)", "value": "3e041fca1afb1896f9fa534df0d56b872d3b13f724ff10255f4b669cd4aef2f6", "object_relation": "sha256", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469122, "uuid": "8d4024d9-5485-4013-9b99-c4da6a2b7689", "comment": "Malware payload (NetSupport)", "value": "d2a432a38cac4ead4a095e90908994938c1c4634", "object_relation": "sha1", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469122, "uuid": "76c53239-76ae-4ae9-934d-2931967bfe00", "comment": "Malware payload (NetSupport)", "value": "2e35eecb0252c95b0d3b98e93224b1941369266223b9f11bd4852b1d2096bdcda07c5dc664728662e848f98dd26ccf8f", "object_relation": "sha3-384", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469122, "uuid": "980c85b4-f564-4f19-84da-20ad55bb9401", "value": "T10F3633AA6C59CEC0F3954D306E2CF1A9DB95DC7B85638A21304BFF5917769830728BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469122, "uuid": "6d4069a3-1f68-446d-a956-d528bf849052", "value": "98304:znJz6QofWe1V1zo1vGUZNJd8jxRDM/dAw2KJrm9cVbxW:zJZ+VAbJdYI/dAvKY9sbxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469122, "uuid": "ac3cf2c8-5259-4fab-b8e3-0eb774d5fcc7", "value": 5132288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469122, "uuid": "abcedca8-eb5a-4487-b9f7-767219cc2ccd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469122, "uuid": "d97c8271-6879-461c-abe9-c4bf29a10e40", "value": "3e041fca1afb1896f9fa534df0d56b872d3b13f724ff10255f4b669cd4aef2f6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593013f3-5f28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780476232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "0de7e087-0b6a-4155-94c4-4a6ecbb6b5a9", "comment": "Malware payload", "value": "25d16799de2eed88a5c04fdc4fe4d64b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "a982820a-ae72-4332-bb3f-3f51c4986944", "comment": "Malware payload", "value": "3e16c3bc39182471cac0c89b9883bd102d23d4bb938eb648c7d88b8649e857a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "972163b8-1efc-427a-9e85-f526d5aec569", "comment": "Malware payload", "value": "5bea3031c368b4cad26a92e80232ea41847cb708", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "fe64e3c1-1d03-4c63-8476-c372ae3add36", "comment": "Malware payload", "value": "cd28f0ecbeda17dc4aa3d0f7898a9db01a355294bbc412436d93958d41a702e5256c361d6ee24816c08b1d623c7572ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "6bb38ca9-ea8f-4fff-9e82-1276d648d341", "value": "T1E313F102B9F9FD16F687ECF321887C9CB3BED89B0A717BEA2735186710B116141344A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "a84b3c2d-eac1-42e6-b8af-c4c6630fb77d", "value": "768:aXkvhd+xT8f22JF+qqSFHZB4aehF1S1Y8+2vwqGHHmVXRjA:0Gy826FHZSae8Wf2vgHm5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780476232, "uuid": "21dede6e-f557-4c23-9d12-b00483e63a3f", "value": 44972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780476232, "uuid": "a5d7efab-9fe5-4c10-b098-61cf6823fe7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "0ff3e44f-fd40-4215-bc75-7efdbb2a3546", "value": "pty4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3114c9f6-5f05-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780461132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461132, "uuid": "907a255c-f2b5-402d-b8ad-fe2a8b8defa6", "comment": "Malware payload (SalatStealer)", "value": "ad909d6903dfae43bad7db11d279142b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461132, "uuid": "f6466718-59ed-48f7-97b9-c25e51592449", "comment": "Malware payload (SalatStealer)", "value": "3eaa33b359d6123bff87e5227e2f4d9f24c17e5a251c4c15aaedee7df1737777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461132, "uuid": "d77b343a-1f55-46e7-8900-78eb3315536d", "comment": "Malware payload (SalatStealer)", "value": "0d4ef6c2ff3860752246def93ea8853a5dc1fab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461132, "uuid": "3e378c82-d5fd-42e8-b7a0-dd721823f067", "comment": "Malware payload (SalatStealer)", "value": "0b65cd1694297b864600b4b650489e17ea9e1e6890d2e633a711673819a8e40ba99bb5d6a72f8a36210f49eeae5e4502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461132, "uuid": "f5d1f504-0ced-461a-9d7b-4d071a03884e", "value": "T13DF5336E73384789D6141CFB2DA35BE2865203D462792E23518F679E37614BF6338B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461132, "uuid": "4371f64b-94ee-4cb2-8170-23668f44e053", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461132, "uuid": "e32d0201-c476-48a1-bf1f-4ae4e3ec00f1", "value": "98304:sW4OlAbVyqtA11802gYKiZ6w7EC8zrF8LpUT2lZOE4:sWNl8kqtAmOA6A898LGT2lZOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780461132, "uuid": "28097241-8e2d-432c-af55-5c11d451c9d7", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780461132, "uuid": "a50ea400-9d51-4538-bdea-3d89918d4bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461132, "uuid": "9b5892af-546e-49d8-bb79-8a81c5ef1afa", "value": "zapret.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7ced9f-5f8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780518271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518271, "uuid": "8129b678-2c65-451d-8225-c0c4cd583daa", "comment": "Malware payload", "value": "a96d1b70f9bc2ce8c2119669d1f887d1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518271, "uuid": "c5d2abec-23e4-4cbb-a0f5-032f554e7914", "comment": "Malware payload", "value": "414e028db1b82a70169162679ac24a3c3092cbc2e2f78ef75cfd5f6805589339", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518271, "uuid": "d868809a-9b33-4b5e-bca1-da861491897a", "comment": "Malware payload", "value": "746e221b3af38bae468f24bace31b8c598a3814a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518271, "uuid": "ea7e9825-5671-4ba4-bc5c-40ba63c42027", "comment": "Malware payload", "value": "b8fb0bb78446abd30840807445d00c93e2e47b695d2c399359914c5c59ecb3c69331f6f57cb9f4f855abd350c72a40a5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518271, "uuid": "02dae01c-5d7b-445e-bfe3-0aa4daabd768", "value": "T1593177052AF94718F6F78E7D94FE2616483ABC1ACC71CE0C01A4554D10A4E12EE3AF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518271, "uuid": "b78fe6c1-2ab9-462c-ba42-d87ea76d5917", "value": "24:8lLJ/Bqk+f6bivzYwnpSx+DC5gnZtRowNFDCuV1VpugnZ+L8r2zFVrab0R:8NxoBvFi+DrzRoADNl5gL8qzFRaQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780518271, "uuid": "a668c916-3b63-41b7-a392-00c86a118f3d", "value": 1672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780518271, "uuid": "289f5994-401a-447e-b78d-a07924584f39", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518271, "uuid": "143d4367-1d61-4dc8-9099-73699f26b61a", "value": "List of Required Items.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493bfe76-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529892, "uuid": "9bd2466c-6ae4-449a-942f-42664b1a2586", "comment": "Malware payload (Mirai)", "value": "53e8a368974e34e9222ab56aad6747c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529892, "uuid": "72c77f79-233f-4ee6-9681-fe8a211489aa", "comment": "Malware payload (Mirai)", "value": "41d4cec0c31112c1235c1762e16ee3a838118f655acc1af017ddbaf8c7934c61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529892, "uuid": "55d47b30-6cac-4032-9d04-30c3c976158e", "comment": "Malware payload (Mirai)", "value": "41aeed56f84c45b421dd66b0516177d80ba11923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529892, "uuid": "a54d50a0-8cf8-4b31-9d08-d68f8830dc3d", "comment": "Malware payload (Mirai)", "value": "a130b60b1c87377413f3841607b899b4ec9524420ad02d47bc2a8651f7f8e8281de4779888002c6ebe1b8cea1ca26951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529892, "uuid": "2a47f10b-5c88-4712-981f-86880d3963cf", "value": "T1FD63024071B5F1CFEF5EF5BAD0230F93E00266EE25A3FAF50904A60AD8B501B5D65C56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529892, "uuid": "b67a5051-3aa6-4389-8d68-ca288f79e532", "value": "1536:QOQH+Ih9pGafUpZjvA76VvVGz+6/FQ5jquAXcGuM23mvqJzCTo5Nd:CeILGgUzvy6VfwFQ5j5AXcY23mvqT5Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529892, "uuid": "7c47dd20-1bb9-4f84-b352-70ef16b12d4e", "value": 72200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529892, "uuid": "85790db2-4491-41f8-8f57-5611deb44ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529892, "uuid": "629a3925-dc4a-4e13-b232-83373c228ed8", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c9d93a-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780469896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469896, "uuid": "383b2a48-df1a-4260-aae6-eba0c476026d", "comment": "Malware payload (RemcosRAT)", "value": "48f041b08cccbc3bd4329e228f51b2fc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469896, "uuid": "85ec765a-07df-451c-be4f-70bd648c7cc7", "comment": "Malware payload (RemcosRAT)", "value": "42a0b1752f57806dae7132c7d24ee274777e4f4066ab9e915dbbb0fdb420b6fb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469896, "uuid": "38a289dd-c0e6-4fd6-bec2-cd20f3187e21", "comment": "Malware payload (RemcosRAT)", "value": "4e9888f4b1f7d2458ece5a1f752efe3a2d3bf9ed", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469896, "uuid": "f1d567d1-7eb8-4fc5-bbdb-0e42ba9e110e", "comment": "Malware payload (RemcosRAT)", "value": "a372839cb3328175a1324adc46e1a89d78be4c9d2a3403c2c379ec1d718883fdde003cf6aea665f4ccbea4c008c0cfec", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469896, "uuid": "cddeef19-7200-45f1-b04e-adf6601f1d74", "value": "T18195127417FED1BA4260062513BF6CE3CD09F655D9E37BADA223CBFA911E122058E5B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469896, "uuid": "a817e188-55bd-4aef-b02a-9afda3ce2456", "value": "768:6U26pbG//fnS7YmAkCRMkK1MxM9RxqlgUwdgkgUUgKTp8yuu6T2d4hdZMUgUeN/z:YtFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469896, "uuid": "4cc2f050-a20d-4888-a648-b8115bfcaf86", "value": 1951546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469896, "uuid": "08bf9084-61c3-415a-b04a-d441eb8f5f52", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469896, "uuid": "8659d0b2-ee72-4dc6-ab4e-d9ce6aae4283", "value": "ROVATTI_OFF26IT00100673_030226.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c868ec5-5f58-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780496800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496800, "uuid": "ba9c41ed-391b-4894-8e9b-d218b05a8a7a", "comment": "Malware payload (Mirai)", "value": "90aa6f8d40443cffab0e58e3b3235233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496800, "uuid": "5c62e5eb-c4cf-4a7a-8873-73a6b7c2d666", "comment": "Malware payload (Mirai)", "value": "42dbf83c051ae621848e31e12f62a32f187637114b73f870f5de378793b17c56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496800, "uuid": "11d12c1d-f920-41c9-8356-e3011a4f2268", "comment": "Malware payload (Mirai)", "value": "07ed3a47345cb3abef58c22a06ece1a2f9a69820", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496800, "uuid": "38b87e0b-e9a5-4e25-9960-c6e12a97ad43", "comment": "Malware payload (Mirai)", "value": "45d7c934ed16fa40e1e90f5e157c49c6771b6a2de07008a78fc37688387d8b0cabbab8a8e0ac0bcbb998c1e7452d77d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496800, "uuid": "587982de-562c-45ca-8452-d6c1b850622d", "value": "T1BFA3F845FC514B17C6C762BBFF4E428D7B2A1758D3EE720399256F20379B96A0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496800, "uuid": "58c7fc47-a461-48bc-a5cd-341166e0269d", "value": "1536:7XAVL1XAJi3IK4VXaV7NYv8TcONBWa/vz8lorywywXzMusxn9EsVMpt:7Q51XTp40VpYkya3Hs+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780496800, "uuid": "4911fb0c-fb7d-43ed-82d8-e2022836f344", "value": 100812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780496800, "uuid": "df2c0c75-e3ca-44ff-9b4a-fd5f7e8c296c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496800, "uuid": "591c83b9-8afb-4e29-9aab-04527ade77f0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e12a43-5f49-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780490633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490633, "uuid": "70eed4ca-d9ce-4caf-80d2-43f855f7b749", "comment": "Malware payload (PureLogsStealer)", "value": "c2dde5e748e5f764bb0ab887a08cf70f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490633, "uuid": "44e6dbaf-60c7-456e-b3ad-e9a992ea99a1", "comment": "Malware payload (PureLogsStealer)", "value": "4334b32b02f055ad7553e21cf13b1706b892a648fadb4584cafb3283245f6389", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490633, "uuid": "a2db1350-215a-43b1-af94-3ed6064aae5e", "comment": "Malware payload (PureLogsStealer)", "value": "a0b8feb8c27209ea68b57500a3a013faa5892e56", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490633, "uuid": "595f098e-650b-42e2-b131-1ccdb23669e2", "comment": "Malware payload (PureLogsStealer)", "value": "bca23924ff883d82a837624a077ee785636943bf2602d63c3ec2596ee21e8d4b8617dcaeaec29b54c4de1c9c1e10f5c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490633, "uuid": "364dddf6-2c1a-45cb-9cfc-334b2a41c23e", "value": "T1BC05393DCC68412FE8B7D929C59A40AFF4855217622CE94760C73B5FAE73A8277D212C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490633, "uuid": "9b070985-fd9a-4320-a53e-14a656a6b737", "value": "3072:+bSuKLWGxb69B8ZMQ3zL/DruHpFrmNEMZ5/i0nyJxIrVKYC6zbPQwdco4ymvMdlA:E8t30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490633, "uuid": "23033436-0ed0-4aa5-9140-bfaa993549b6", "value": 819536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490633, "uuid": "e62e1d00-0bcb-4c21-ab26-9446da0b146d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490633, "uuid": "7db39000-a52d-4ac6-818f-cfa6dc745b23", "value": "Sales Order - Order Confrimation VTR 180991000308785206003 - 00761-407-EXOL-Q_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07440a25-5f85-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780516038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516038, "uuid": "af4a3a26-ef76-4b5c-91e4-e69f5df00623", "comment": "Malware payload (ConnectWise)", "value": "f518106dbb86cb4c5bdce8dcdbd75b34", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516038, "uuid": "f7fb8081-0230-4f61-a402-e4698b764763", "comment": "Malware payload (ConnectWise)", "value": "43ecb0e232054bb2d7f7fdc1ad9f84aae1755e4e9db7a3f84b86782a82e17b03", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516038, "uuid": "d0bde5b0-7429-4f4f-983f-a10fb18fc79d", "comment": "Malware payload (ConnectWise)", "value": "83a4ac475870ffdc118f9272f7fe1e15bf39bc25", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516038, "uuid": "2a06cfbb-efbe-4a6e-ae77-099d45182ab1", "comment": "Malware payload (ConnectWise)", "value": "05b9848dd4964d47c2a77b925be0ea3630988dd1162afbe120eb53727d7b3d9c323bc4c291a44aaeed71cf9d020627f5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516038, "uuid": "6341b01d-de46-43f8-9980-b037804128d8", "value": "T1E1A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516038, "uuid": "d581dc5b-b00d-434a-8b43-32c87930a07b", "value": "196608:JnCtVYqI5MvbWEpKkq6IJqKUnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqEnCtO:xCXvI5MvHx2JmCXvI5MvHx6CXvI5MvHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516038, "uuid": "d642859e-dfc8-47cd-85f0-c056cc385bcf", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516038, "uuid": "9598255b-a3d1-4b89-bd5d-8d06e09e36d3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516038, "uuid": "7428f664-ce28-4024-a88e-bcd54cd5a7e5", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b7eb3d-5f8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780518552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518552, "uuid": "2ec4b8f5-6e2b-4173-94a7-7c0e0bd01ebc", "comment": "Malware payload", "value": "fe11b4c810aa8a32063a61beb92d2ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518552, "uuid": "9bace1a7-d060-4b9c-be14-b25475bf8b23", "comment": "Malware payload", "value": "44d52ab509e291bcbb6059b42733d3c941155848751d29d8cf073e00b9daa230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518552, "uuid": "bd7eca6a-feb7-42f8-97c9-389519d238d9", "comment": "Malware payload", "value": "900d95e739bed32329e2a5640a16b9a6160982d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518552, "uuid": "26487dba-0843-4637-adc5-ef61efeee14c", "comment": "Malware payload", "value": "a2709bfbe8eccc7cb324cb424c76c513e92b66e8b18dcf8cf8e053d160032b7d3f36688219a84fab36163e9a84e0a965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518552, "uuid": "ccc5cb0b-bd12-482b-8305-2d12b29e7b2c", "value": "T1E5C40287BB85DB45C02851B2C8E38D6403EAEED72A73E3067A4513D94D513E0DDE6B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518552, "uuid": "ff6b2333-7252-4524-93e6-1e7313560afa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518552, "uuid": "b9c76379-4487-4916-a068-8525f8476194", "value": "12288:1YdnM42Y0oOUyWNMaYa7IM4OKo6W2tZ5tGSXHcPP:1YdnM4pZzyWSaYafRJ2D5tGmSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780518552, "uuid": "eda68199-08cb-4a68-a630-5306042ba40c", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780518552, "uuid": "415fc1ae-7339-4be4-a6c7-213ca167760c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518552, "uuid": "b4f2e5f8-afd4-4551-90a1-34ff18882103", "value": "SecuriteInfo.com.Trojan.Mardom.IN.10.41395823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6b6b78-5eee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780451197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451197, "uuid": "030b70fa-f2f5-4966-96d6-7467593a0857", "comment": "Malware payload (Mirai)", "value": "c86c6d76918a9d195b19a0961a3f2cea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451197, "uuid": "169147f0-4205-4fd9-bda3-a9bfc30ac731", "comment": "Malware payload (Mirai)", "value": "44fa6c1da6bbaed3645738269359af28f0b27e0a20bf59a9714735e7c2632309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451197, "uuid": "26f73594-4ec0-4eb9-ad50-bfd4e47ba641", "comment": "Malware payload (Mirai)", "value": "ace30f3aa9e687984ba7b5e8f03d70a0bb28be19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451197, "uuid": "122291e6-ead9-4529-ae84-f58bdbc10d98", "comment": "Malware payload (Mirai)", "value": "daff1a72297bc956aeb1a538a0a70dfb237eb38f27c9646ec015a8790997faceff5ad115b0e6bd1f4165935715d284f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451197, "uuid": "2e7f6be3-6cd9-420d-9f06-6cebfea11aed", "value": "T17423F1E9EF1004C9CA81E4F865C40FC63C290B319752878BE800E7975B595A1AFD3AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451197, "uuid": "26a2cf9b-9d48-45c5-94f9-c0c7874c2b3f", "value": "768:o41NnPcbB+CdJA6l1RAstYjRYSarD4cbM6jt7Isf/VhtNwrv0OX0BBv7W/NHkffR:oONE1HdJA6OoQNar7b1j93VhtNwrsOET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451197, "uuid": "a9cbbc44-ec57-4990-a6d5-3b3c6440d819", "value": 49004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451197, "uuid": "bde911de-e0c8-4fe5-a27a-ab103993d24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451197, "uuid": "c309c781-8f14-4077-85da-ffc57d331f2e", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7fd9af-5ef2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780453179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453179, "uuid": "404d2cb3-8bca-4edf-8a80-2c8e51210bac", "comment": "Malware payload", "value": "d0e243ff204332959ac94b5542cf7f94", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453179, "uuid": "3277f421-cc13-4091-b97b-f50c3f9acf75", "comment": "Malware payload", "value": "451f346e92818b9adfb98408ff946fdacd2ef6fe92fce7989db863df528c2bbe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453179, "uuid": "095b8c88-06f7-4e91-ac92-56ec1a06b460", "comment": "Malware payload", "value": "40de6113c075e9d932d535e2f06fc3d9d535023c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453179, "uuid": "e358dac4-453e-4db0-bfca-96eb1d091116", "comment": "Malware payload", "value": "fb4c0083d0535d6687c34ad2f7c00371686369b3bde8442ec87be4a7db15c228b9d9ced1fba1440773e5092f9faea7a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780453179, "uuid": "61a7a538-26bf-4744-ac6a-e5682275491c", "value": "T147137C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780453179, "uuid": "248a1c5f-81a7-49ae-a2c3-9d5dfe649654", "value": "768:Ur9NyXsZztC69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:SHusZeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780453179, "uuid": "cbfa6294-51cd-42a9-9adb-145d3f0b4b30", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780453179, "uuid": "9d6eeb99-163c-4bed-af24-a86b3bcc27a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780453179, "uuid": "75391080-1945-4402-a73d-744a403fd620", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548206c8-5f49-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780490398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490398, "uuid": "4cb989d9-abf6-459c-a580-e188059074fd", "comment": "Malware payload (Vidar)", "value": "0d1fcded92bb646fcec35d30f68e387e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490398, "uuid": "aebcb679-4502-496e-9b52-d0703101c510", "comment": "Malware payload (Vidar)", "value": "458bb12486eff9c03d6467d1a10534f450095a23ef2d35cd88fdaba724918c6b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490398, "uuid": "68c01e9b-4ac8-4b7b-8bbf-c0fd76477222", "comment": "Malware payload (Vidar)", "value": "65f131dcaea1de2cd73d12072890cbde1328e865", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490398, "uuid": "6171f426-ccb7-4e06-a458-5948d0760027", "comment": "Malware payload (Vidar)", "value": "0ddea5c892ceedc178025c6e5be53b9c4778772925d748392f2fadaf03be3a1f77242505f87a3e4434379407700b9503", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490398, "uuid": "48c1f30c-97cd-4658-8e6e-8af52148dee3", "value": "T145F56C4378D048ECC095B331A4B37992B76178085B3A67D72FA2AE782E367D06D37359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490398, "uuid": "4587b39f-3542-4efa-aae1-1495d55a2db3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490398, "uuid": "42871531-f60e-46be-a9cc-2b37646c5721", "value": "49152:Acz5AzX6OPuqZhnxp6/B+nwwmUHHRSG24wnUG2N:AXNlwtUHHftwU5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490398, "uuid": "672c1aba-e45d-4eff-89e0-437a083c6bac", "value": 3649664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490398, "uuid": "e536ba97-6b00-4d45-a55d-43fc77967917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490398, "uuid": "8c01b58b-a8ee-406d-90bd-ba948249bcb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e54a578-5f24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780474469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474469, "uuid": "ff9dae1c-d2f6-41c2-8d47-5834f56045be", "comment": "Malware payload", "value": "1cec239a6ca48d4eb08c3c0e79bc2f6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474469, "uuid": "b201deed-2b7a-4bc8-8e48-2eb9b575a650", "comment": "Malware payload", "value": "45edefc47a3cb73d7ce1081dae064d0fc9b63f48b13f7b275c5fda30b950a182", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474469, "uuid": "91ccafef-6889-410e-97fb-097c7602dd2d", "comment": "Malware payload", "value": "4f68512e9b04dc9028894c17994f6406c2a5f40b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474469, "uuid": "3903eb1c-550a-4374-b776-73719759c894", "comment": "Malware payload", "value": "6cfd8a0b7b7eb61dc8950cee332da30a75d4dd081cbb49a2154d0e48ce604609bbdfa95ee9f83a1c4cc8f86c026454ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474469, "uuid": "86847c41-2b97-4c5b-be6a-d229fba2308c", "value": "T1FA136C6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474469, "uuid": "0e6cc9af-1722-41de-9fc8-8f464e2e7805", "value": "768:aXRWNGxV89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:mlxDco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780474469, "uuid": "7441a139-87f1-4369-a2b9-e0ac40be50e6", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780474469, "uuid": "c7f02657-4907-4e9c-9f1d-840cfe82b76b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474469, "uuid": "8dd00cce-b1a4-4abc-bc26-2176bd0a6510", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd579f7-5f17-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780469125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469125, "uuid": "3531c2d2-b9c2-46a0-9b34-6185a0c3b491", "comment": "Malware payload (NetSupport)", "value": "491b64557af2ccb42ca447ad815a411f", "object_relation": "md5", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469125, "uuid": "7b8c1167-9747-4e48-b710-ff2e351af695", "comment": "Malware payload (NetSupport)", "value": "486a26f35e5fa61c0aae6a67adabab02a0fbf87f245beae11248bcd0d208a224", "object_relation": "sha256", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469125, "uuid": "0e27b752-11ac-4c82-9df8-f4332668283f", "comment": "Malware payload (NetSupport)", "value": "dc73649d0d284ee9bb733184bdfd4d8ff7209e1e", "object_relation": "sha1", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469125, "uuid": "6423101d-fb7a-4dfb-883d-c463f51338e1", "comment": "Malware payload (NetSupport)", "value": "d7426ac3f4d93e6718d9a73971003abcd651529d389e341834815e34cf8ab5bc9170915823de1c2688b534a6e1488bf4", "object_relation": "sha3-384", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469125, "uuid": "3ad0d070-8674-48f6-bae9-b788d769ab61", "value": "T19236335F9C14CBD9F79A8474BE2CE0A4EBD69D6B46739610502BFBAC0773D820228774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469125, "uuid": "68b6101a-6679-4f44-98d3-3ffe3179700f", "value": "98304:WnJz6QofWe1V1zo1vGUqnFE1T5M6tO+K071q6m:WJZ+VACYaIK0hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469125, "uuid": "14eb9272-8dc0-4f25-a784-4fdbf878a33f", "value": 5132288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469125, "uuid": "26979202-f54b-49fe-99ef-6a5ee728d8b2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469125, "uuid": "956ae728-75f4-4b5b-86c5-9ae2430a7b1e", "value": "486a26f35e5fa61c0aae6a67adabab02a0fbf87f245beae11248bcd0d208a224.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff23f14-5f5a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780497852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497852, "uuid": "c8b67934-da8b-4dff-ac3f-5618aec1655f", "comment": "Malware payload (AsyncRAT)", "value": "413ecc3c4b51b68597ce809ad3b78501", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "defense-evasion", "colour": "#6AE152", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamevault", "colour": "#AAE9A0", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497852, "uuid": "1a132752-a21a-4046-98fb-b1cc01021903", "comment": "Malware payload (AsyncRAT)", "value": "48f4e1be06c9f197a0cbd34c33cdec5ee8b1d5f55c8c27a6f3fd0eaca9d154e2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "defense-evasion", "colour": "#6AE152", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamevault", "colour": "#AAE9A0", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497852, "uuid": "b4339d4e-03a0-416a-8145-199680ca368e", "comment": "Malware payload (AsyncRAT)", "value": "15620282203eb4699a353b5edad14caade734e5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "defense-evasion", "colour": "#6AE152", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamevault", "colour": "#AAE9A0", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780497852, "uuid": "1cb62518-775e-43a6-a4c2-abb0aac74eaa", "comment": "Malware payload (AsyncRAT)", "value": "b32e0fb2bebb3461187d887c34689164e997f66b357caa3ccbecf4e55b6a777781404a5eec2926a4e9e66e5ad802f675", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "defense-evasion", "colour": "#6AE152", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamevault", "colour": "#AAE9A0", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497852, "uuid": "040f0853-5bba-4e72-b984-754344987fdd", "value": "T1C0535B0027D8C926E2AE0BB8ECF2554106B5DA732112DA1E7CC814DF5B9FFC54A127FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497852, "uuid": "659fdbc2-3552-48d5-91e7-12dd80c3c17e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497852, "uuid": "9b436568-e9d5-4fd7-919f-5f56ffbfe995", "value": "768:KKyqtV2Lwz4GqwGUAGgXu2D9JPJF1+SSCv7mqb2nbpwH1otrLD9kXZTEcjr7pqKX:6QPZ3gjRJxFMGbbCwGKXFEIr7pqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780497852, "uuid": "3f4a1823-1d0a-4657-8079-dd0d1bf7e30f", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780497852, "uuid": "5829df45-bb6d-46a2-abcc-ec5cdfe72132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780497852, "uuid": "7badfcaf-268e-47e6-a112-94babc9564f4", "value": "gamevault.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415c8c0a-5f3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780485211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485211, "uuid": "8b4d3137-62ae-4049-a6b1-0235fbd80f1c", "comment": "Malware payload", "value": "0f8e0d95454ec38adf6d01122ed19028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485211, "uuid": "a4337ac9-0dc1-4f31-887d-1e9fbecdb8df", "comment": "Malware payload", "value": "49451ffd46cadcfd7f67144394176249badbd4c00cfb23aadf05826f8ce7c4d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485211, "uuid": "49a2018a-413d-4d0c-b24c-51699012c587", "comment": "Malware payload", "value": "beed29d21abe1c4a2d4c19ad3a8d7fe5e58da3cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485211, "uuid": "ac0304ab-60ca-47b2-98ec-e3af98fd7b65", "comment": "Malware payload", "value": "7688fd333a72d0a90f715481b04b5f2dfc7c901d4ed183ac77ef613e0aa0486406ba8bfd0eab5897e59063c9c40c000e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485211, "uuid": "3e6a402a-45c3-4a13-87df-31ea1325a140", "value": "T18E9339B3C8256F69D664D1B0B1B28F796BA3A95181870FBE1677C2744043DCDF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485211, "uuid": "45519bbf-5d16-4fb6-8801-9039b3953c59", "value": "768:LAOiLYoIIDGWPyx1HuaokCtRouehupIAJ3KTrdjaSGIJWtCDX0ePRNSfbW4OtJi4:ktryfCtG+IeKTrdOSG0WcDke3Hi8UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780485211, "uuid": "49e252d6-2235-4490-aca7-b00197c34efd", "value": 93232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780485211, "uuid": "848e9620-2484-42fd-aeb0-1ce4e6551f1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485211, "uuid": "1070aaa1-a59e-4e0f-b453-2e5a86c54b52", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac7ccca-5f41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780486892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780486892, "uuid": "ab0e069d-4300-4b3d-8784-7a7fa97f3ada", "comment": "Malware payload", "value": "e4ac26dda18aec7ae304eb5c700e0158", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780486892, "uuid": "0a10bd01-22ea-488a-af95-c2bddb4a3664", "comment": "Malware payload", "value": "4a703ea539520212ceb479a73e82e5398589b40d8bcbe7e8ad86f02327ce8555", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780486892, "uuid": "e9a91a22-591b-405a-bede-3fb075a1a80a", "comment": "Malware payload", "value": "38832bc601e73d8e8e4f7f6ab43cd1ba2cf1afb3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780486892, "uuid": "cbee5b05-62b2-4271-8eeb-64254f04883e", "comment": "Malware payload", "value": "93e56691e04855e8624b461e32dd2da791c75797312b4e59f081b0e1c00fc2521c628c20a6c84f29b898d6cb472a1dbb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780486892, "uuid": "5e2a6e2b-17e9-416c-9654-1024cd55ce3c", "value": "T14101ABCEC1038B6041C6F96E72AB5190B420C3CB56924BE87E9C443EDBAD2587029F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780486892, "uuid": "e9e63fd0-d779-45dc-8054-96de1fb3b585", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkalSIPgq0zFIiQFIXjMIwfaPsZIGXOUauD:kXCKysE2hi0ziQvZohalSQcF7OVbZdf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780486892, "uuid": "9a5a4d78-6572-4257-9e1b-cbb60cabd627", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780486892, "uuid": "0f6bf36f-9ddf-40bc-9803-6c0131e5088c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780486892, "uuid": "72fff08a-da6c-4589-acb4-c96bf160a002", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd84ba3a-5f10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780466146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466146, "uuid": "0ad66b26-25b2-4856-9295-f35f3797bcd8", "comment": "Malware payload", "value": "c3f874aa9eeaeb03080ca276f58b4c46", "object_relation": "md5", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466146, "uuid": "e367f3b8-9b13-4e5c-838b-82cbbf3344bf", "comment": "Malware payload", "value": "4aa30c6c7c26afe87dc491ebfa62bfac9505c19c28b8a8429ebafd3ce3c6499b", "object_relation": "sha256", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466146, "uuid": "512a1713-78c1-4a8d-a5ca-10f83e821bff", "comment": "Malware payload", "value": "1f6e25416507f3c63644f75c4884b13008ff7d65", "object_relation": "sha1", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466146, "uuid": "d0d3c972-3710-4632-ada6-1faaf776062c", "comment": "Malware payload", "value": "f1cd059b35b508661ddc637b09c3449bd1854fff06a90be91563493362e197d02c96c95cdac9d9ab012cef63b00d9df0", "object_relation": "sha3-384", "Tag": [ { "name": "209-38-132-165", "colour": "#76D2C5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemoteAdmin-Overlord", "colour": "#F8ACCE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780466146, "uuid": "325be66f-60c6-46ac-87e4-6e3c4b31aa3d", "value": "T189A63817EC6A59E9C0AED231897696537B717C490B3123D72B50F7282F36BD0AEB9310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780466146, "uuid": "ea6ab183-172e-4eed-9374-12abf5e54037", "value": "49152:H3yIIEl7g5/NSRERVxvMWwxUziQ4Gw80Xl4+aWwFuiOdFG9A/1j3f66mmaOG2vtB:H3y0hovxvG+OY8pyqMQDbL9C7w9yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780466146, "uuid": "045adf55-4428-4f0c-93bb-bd3557b3b591", "value": 9961472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780466146, "uuid": "16cc23da-279c-4447-b9fc-725074f8aa90", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780466146, "uuid": "9f1f9158-63a0-4dfa-80df-c1c88417e8c5", "value": "LABEL 06-02.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4eb9b52-5f17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780469111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469111, "uuid": "f7e36947-37d3-4770-8848-6ce38e912a6a", "comment": "Malware payload", "value": "bcfd6a7b699f9ff643d346a958ca04a9", "object_relation": "md5", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469111, "uuid": "ef134e8d-9749-47d4-b5a8-be70e3010a9a", "comment": "Malware payload", "value": "4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0", "object_relation": "sha256", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469111, "uuid": "0f87e855-ae4d-4902-931b-a0da4e6acee4", "comment": "Malware payload", "value": "9c9fc660da68775629ab48bb82dd4775b153597a", "object_relation": "sha1", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469111, "uuid": "0b80adf2-7734-4a0b-a27e-d05b74679dca", "comment": "Malware payload", "value": "646c7cabc97655fe53d32d63245a9f7239b8a9661755a4df52c1aa94b21d4b7ef6ca69ab6c116c71e3f7882dc8daba33", "object_relation": "sha3-384", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469111, "uuid": "f99392ed-aca3-4d9a-adfb-9cc86448a0bf", "value": "T15A41A11617E50715D7F78A3A9CF7F3128635B915ED624FEE024092881CA4128E875F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469111, "uuid": "169107dc-c6fa-4d75-a617-b920c5322239", "value": "24:8SYe9NcrGFjc6aKKILhWhWAsuWkp+/CWP2+/C46DwW8loxO4I0WROkOFpK6+/CIz:8StNcqUbsmHn8lSIL3ABcatdMq4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469111, "uuid": "21beb065-d7ae-4e5c-83af-8f5e8545daa6", "value": 2030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469111, "uuid": "f23f95b8-642a-412d-92d3-ecbfe7a1941e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469111, "uuid": "62009b47-2aa7-45a4-b599-cb12127f004b", "value": "4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804e4748-5eed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780450957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450957, "uuid": "5de15dc7-38ae-4ec7-953f-9a04305b962d", "comment": "Malware payload (Mirai)", "value": "6bf1582107c07a32ac1c0301cc1ca652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450957, "uuid": "909d87e7-88e1-48b4-adbf-0b085105b570", "comment": "Malware payload (Mirai)", "value": "4bf982fcbc5f74bb9d72087e0d38ee739bfeeec8a5b0a63c9414c8fc4126208d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450957, "uuid": "326ac75f-489e-45b1-a2b9-2736921c8ec3", "comment": "Malware payload (Mirai)", "value": "98a990424c9452423eaafc12cf125ff4b2a0f02b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450957, "uuid": "9386b48a-456b-4850-949a-f6e22b1b8013", "comment": "Malware payload (Mirai)", "value": "cca1e6c0e742b99f40dec18e91a502c4bb00350dc4ded038a0bb7dd66f5411a592b0d3be66298c909ae796907d7a2e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450957, "uuid": "706f0458-09ef-405d-9850-85e288074abf", "value": "T1B0631859F980AB01D9E624BAFF4F424933630B6CE3FE72129D255B2027C696B0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450957, "uuid": "d79b7949-852a-4d22-8759-74babd5f0dfd", "value": "1536:2enbBp0lJAKZ88MFLGRQa97QBkm+mnWlMwBibn/8y10YK:hOJAKqpFLGCa97QBkmcIn/8y10V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780450957, "uuid": "2f93c86b-7ca0-4fd0-ad0a-d87414ac03ee", "value": 72128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780450957, "uuid": "28aa3329-f9ba-4555-b1c5-7669caabac5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450957, "uuid": "1d571a8f-06da-49e3-be59-8f979de69a7f", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23661194-5eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780449513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449513, "uuid": "a0673322-489b-40b8-b9b6-578c5b334873", "comment": "Malware payload (Mirai)", "value": "511543180d13b46db8d803fb9c5f450f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449513, "uuid": "cf11796b-931c-401a-9c73-e05d6fb17d41", "comment": "Malware payload (Mirai)", "value": "4c74e47ccbf9ac88748327f30171833efd60946eb29d33cb7ba5729e910478a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449513, "uuid": "efc5df67-20d9-407b-9017-b9ca7d3375e4", "comment": "Malware payload (Mirai)", "value": "8e9b916b8b4afc91fd02b4593d92809dd9bba505", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780449513, "uuid": "45f4bcbd-d7db-471a-aaef-3e72cd6fd814", "comment": "Malware payload (Mirai)", "value": "7330cbcec1dd9bf1b6b2461c7a0758474769eaf4149323e57cd12800e728ea9f3b8daefd8805713dccd8d501091e2937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449513, "uuid": "72b5d737-046a-49d4-83b9-2fe70f3615bb", "value": "T1B5B30A45F8408B17C6D651BBFB4E428D7B2A1758E3EF720399296F61378B8570E3B106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449513, "uuid": "b6c133ba-f7f5-4cd6-b28c-1468359e692d", "value": "1536:G1aulb++lBla53AjR1XotEjJUyQdCTnXmpOir3O2aRNTXO+agblWkwywlxAhIIz9:mlb++lBlLj/YEjJDDmpfmxXicIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780449513, "uuid": "7a9b2e13-2415-454e-8d37-c81485f6890b", "value": 115396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780449513, "uuid": "a7a646c7-e710-48c9-b74d-7bc90dfd232e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780449513, "uuid": "c2736928-ded5-4a7a-aa57-90db937514de", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ab1349-5f68-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780503763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503763, "uuid": "54167e51-f47b-47fe-acf3-5367fd20a79e", "comment": "Malware payload (PureHVNC)", "value": "cf99e0ca82ac9163f6ff57246439ca7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503763, "uuid": "383943fa-a8a9-4883-82ad-95166cbc0aa3", "comment": "Malware payload (PureHVNC)", "value": "4c9a4e858f8d15e2dc2354ed2235fcb7f2d99d7c6c0cce7d14f7af38542acf95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503763, "uuid": "5d732709-ff18-43af-8929-5193f76f25c8", "comment": "Malware payload (PureHVNC)", "value": "b6b5d615a8c21608447b66eaa067428dce213d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503763, "uuid": "b6e34ed2-94d3-46c2-b464-b05d4f5f14a7", "comment": "Malware payload (PureHVNC)", "value": "d6f6261abffae074f27044efb67847e63ecf1bcdc36a18d909819731162cb65ad04925937ba75476adf4a13429f3a52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503763, "uuid": "da76dc65-0a06-4570-b93a-ce20b5b7cb51", "value": "T12FF4BE2BB2528E12D2C85B33C1C75D05E3E0DA863633D74E758523A65A073EBDE4A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503763, "uuid": "2f5ac7b5-afc2-4015-b8c3-1f600d254829", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503763, "uuid": "958f4dd8-aa30-4883-9d72-8174653def22", "value": "12288:cBO5itFNKMyBVrKEQVY3V4eerYMjisrGljijWzX7Yg6L0q4OJOpiEC12:HTBVrCVCoYMjisCJijsUg6L34HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780503763, "uuid": "834fe6e4-ab46-46a5-8b3d-0cc2d81409ea", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780503763, "uuid": "8006cc52-2120-44b0-be11-4d3f33a1598e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503763, "uuid": "4d253ac0-791d-4d91-9a14-adf277527414", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.88458368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f329f81-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780495247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495247, "uuid": "147d03ed-854e-4df3-bf9b-337d44fa33ff", "comment": "Malware payload", "value": "39990512844e11ea5a29d59879792293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495247, "uuid": "1399026f-99d1-4dc2-95f2-6969fb7538c3", "comment": "Malware payload", "value": "4e0420eca1aa93c8a698bf0ba044e1705da97fc9f13ffabd7bbccd79dd0ed5e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495247, "uuid": "8d625a07-52db-45ee-96db-ec04fb999853", "comment": "Malware payload", "value": "ba6f21a80b983c299c98c5bed921d8a2fb90ec75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495247, "uuid": "42ccb8e4-a6c0-4ab1-8773-9413638e46b3", "comment": "Malware payload", "value": "75fce7df7df5f50cfb44d1a4384e418ae35c1850165b958a9df9ea160d4704148709a76e4a3aad0f9ea36d1acd142efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495247, "uuid": "c42d0ea6-15c5-4d6b-aa52-d7cc230bb5c4", "value": "T16FB65C06BCC42BBAC46C4A7484FAC95122B05E104AF1467A6565FFEDBCB72797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495247, "uuid": "acdf2a34-6857-404f-8b07-77d61dbda19e", "value": "98304:hVbGCDC4MaE2dptiTzrHhJvQfVdcIGCX4Zcxy:fGCBMHepWvrvQf3zJX4Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495247, "uuid": "1354c337-7662-47fb-9f4e-f02f847802e3", "value": 10900197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495247, "uuid": "4d2e3bf8-5fa3-4ec9-b28c-1d7681b43a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495247, "uuid": "3c48fcb3-f9d0-4dcc-bed3-23c5933ef620", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007491f7-5f33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780480808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480808, "uuid": "4cd9319c-53ab-49e9-9ea6-715456485a3c", "comment": "Malware payload", "value": "c33444d94b3ea01bd702ed12bd2ea61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480808, "uuid": "8ee72fd8-841a-4d57-a215-6815d7ea798b", "comment": "Malware payload", "value": "52cb7c4dfc84b5b8ddbf222bcc5cda87697d53a56057b6e8183b3bfabc6192b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480808, "uuid": "1f5f8a7e-9560-48a7-8ab5-3e326669d080", "comment": "Malware payload", "value": "3cf5128578ffd3cdedfab0ad7e3dbf7262139e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480808, "uuid": "7538dce7-40d8-422a-bb2b-59915e8834c4", "comment": "Malware payload", "value": "e42b8c0d95025b61a82a07acf17e82a18756f24ec7bbce50d3488a32b5f91051c3ddd7ff5913cde107e28fea8a300935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480808, "uuid": "3169a7bb-5f12-4c9e-92ec-dbfaee2a2167", "value": "T1A3D1B504A3F88729E5FB4F386CB3531516B8FE015D32C65D5C98425FAC32769DA21BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480808, "uuid": "8479bb01-27e7-46c6-afcb-d480597ab584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480808, "uuid": "3d014508-ea3f-4bcf-8f60-a47be149d0b6", "value": "96:FZRletEvB4ITJiUCy53K+TVw790jZlmnTwtCq88dr7pKEIzC:DXMeGsdCYpVW98Zwn4dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780480808, "uuid": "ecdcb83b-1ca2-41a3-8f7d-eff0ca05f390", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780480808, "uuid": "428b0a61-9bdc-4f17-8749-f6c8bf3a9d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480808, "uuid": "87c13714-b1e6-459b-a1b9-d021767a0022", "value": "rGarciaRezendeSSAdvogadosAssociados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c92bc66-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529898, "uuid": "67256361-594a-4657-bc98-e72ece610710", "comment": "Malware payload (Mirai)", "value": "7d90995d8f7fec0a22ccc58cf5591eb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529898, "uuid": "f91a9886-b4db-40b4-b9d4-57ece3540563", "comment": "Malware payload (Mirai)", "value": "53a3c0a6e8495d8d0466d91bb4f2d5365a2498b8b0b687a4ed78be25f3180ad8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529898, "uuid": "0cf5faa2-20fb-4a38-beba-a225a8f17342", "comment": "Malware payload (Mirai)", "value": "5e28e98b5cb05662ed6539ca99f40043ec7a44ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529898, "uuid": "ff02cc4e-45af-46e7-bac2-350b95a66382", "comment": "Malware payload (Mirai)", "value": "53649eeb84f6077ddac8a539934e946f09096cf864f56479372dc11cd8e8e84b1f8f72fae44581e9a9ad79958aa04b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529898, "uuid": "b0161893-7244-4eb1-a69d-ea631ea327fe", "value": "T11473125AB0E20F58DCAC0535CB903BB8BCB1B453267247D668CC765C3BE60E67D8D496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529898, "uuid": "edccca91-d51c-46f0-a289-c73749148f53", "value": "1536:ESEa5jMHYmzF7DK4X5Hyh2cSJCCWnOvEfty3kvp9DP0mlOPyXMPoryk:YekBb5Sh2cNZOvEfty3iL7dlOvS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529898, "uuid": "c7999fb8-9413-4fde-89f7-ba3baaf88f98", "value": 77104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529898, "uuid": "45625f37-1513-4ed9-a1d8-54d49fcbfe9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529898, "uuid": "a66aa6f0-c9d9-4e2d-a4cb-4a656dc66c09", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f00c90-5f51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780493856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493856, "uuid": "df355d95-9eed-4971-887c-b4ae31d29ee9", "comment": "Malware payload", "value": "e6180ea8a49bb8341ce9bf07d6ebd7ed", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pccvioo-com", "colour": "#CDC162", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493856, "uuid": "c4cfa5d4-a1c5-4b6d-bf7c-e6ed8d56674b", "comment": "Malware payload", "value": "54d412b1e8470c0f9156bf67fd565fe60adc5d45c7bd2616e1c353483b2fee7c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pccvioo-com", "colour": "#CDC162", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493856, "uuid": "7bb9e03a-09d6-4811-a1ec-1cb35f880c2c", "comment": "Malware payload", "value": "8a267a302737b7799bdad633c87c95cc5b687686", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pccvioo-com", "colour": "#CDC162", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493856, "uuid": "d6cbeff4-7bde-4224-a34f-65286c872788", "comment": "Malware payload", "value": "3ce41ac92c9c0d5a5154152a2ee7836bf355446532576340afdbcb935d88e051a013c5b35f53fdce466fc9e4a2c844e4", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pccvioo-com", "colour": "#CDC162", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493856, "uuid": "4fe0c8ab-f0b5-47b2-a774-447c406d97e1", "value": "T129D1A58AB7E42735426131F8143F2907D4B2C9663D28D0D8E1E9FD5B6D3BB549122E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493856, "uuid": "dbc256be-2ef1-4967-a51e-4c6e89245202", "value": "96:teMwtX1BoFGeDQLMMkGdBVYpmmFEbskXJhcBnxMcCCtlsaT2sK1tdJqKFUQinsYi:wamSEbzXJhc3x5aCKFVivOBtCRzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493856, "uuid": "f735c952-f860-4d38-9227-f672bcead827", "value": 6283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493856, "uuid": "7e19b8c4-e05b-4a6b-a388-c24bc9251d41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493856, "uuid": "ae66cca9-5b31-451a-9410-516243069696", "value": "main.prod.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f247db0-5eee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780451439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451439, "uuid": "37ed6449-640e-4dbe-9d39-2b328a52abfc", "comment": "Malware payload (Mirai)", "value": "53853754aa247186b716cd977f12a7f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451439, "uuid": "33a43da0-b798-4d54-acb1-91deb2590b22", "comment": "Malware payload (Mirai)", "value": "54fb71a4b9c3e80f2e29384fd1c0abcb055cd6abf15b6428141b0b7428ec7492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451439, "uuid": "e01bf24d-3044-4eb0-91cf-94ec4df6833c", "comment": "Malware payload (Mirai)", "value": "dd93ba4a8b740b953a2e0152402c5ca1198bffac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451439, "uuid": "6912f5d6-ff8a-4bad-9f52-3301ef7b2b3d", "comment": "Malware payload (Mirai)", "value": "dcd5a8d3c6cdac9617806c139adf5ade8a2c15b17ee8010a9792346f50c9f8807f10323fb31cabea977e050863b263f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451439, "uuid": "7f6fefd6-f070-4108-ae51-a18040d4291b", "value": "T1CB23021195AA5C34C4B15C32F83124D7348F1B26A41F776AA3284304FCFA6EEAD3E53A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451439, "uuid": "1496575c-492b-42db-bed2-5686d571166a", "value": "768:WMLR2K4rOY+MeU1SuSBdpT5M/JnZ2NlSh+WgEKqClOlP8KB9q3UELa:3E9OTMeUIBd10JZKlSnJKqgEKLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451439, "uuid": "e838195e-94e5-4b6b-bf3f-01daeef9a9a9", "value": 50016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451439, "uuid": "6faeaf00-bc63-43d3-97fe-55fba7ab69e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451439, "uuid": "9c67100e-8be0-4079-af0a-341ad72291a9", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08e85fe-5f50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780493558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493558, "uuid": "c4759b70-cff6-433f-b971-29d715d2818c", "comment": "Malware payload (Mirai)", "value": "a5346e19ebb18387976f4b8484b40ae4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493558, "uuid": "48e8ca50-c541-4e97-9add-8e1ce21f3a66", "comment": "Malware payload (Mirai)", "value": "556b7a458618f304c9de732039469781b9fc4a3515557b0aa367b4dac1d93a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493558, "uuid": "60bd2886-9b64-4f6d-ae6a-11fe26550c84", "comment": "Malware payload (Mirai)", "value": "a94f01a36b94695e7a5e4c6a1ce4d03b43d60078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493558, "uuid": "cc359de9-83a4-4660-b8f6-37c812c70f3c", "comment": "Malware payload (Mirai)", "value": "6dc64cf19a0714e2b74923d09488ad082288cd35f20ec38d3e473781883f79987ccdac190eded2f13cc75103bd6b9ab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493558, "uuid": "9b46a777-5598-40d9-ab60-aa42c75a31cd", "value": "T1D2D3B70A9F510EBBCCAFDD3706A90A0639CCA55722A43B753674D538F54E90B4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493558, "uuid": "63f40aeb-f3fb-498e-a59b-016805fe9d3e", "value": "1536:6dqyxvRCyQM9zB2Y6m+qeUcn2Mw8kyD2JHAUFFUviCJZvJR9t1mOE:VytN46fgUFaiCzhRpmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493558, "uuid": "32b65e17-311e-4e7f-b790-96d8eb558a4a", "value": 138040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493558, "uuid": "22f30e57-b0df-46c4-bf89-92275624c2ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493558, "uuid": "7fe8e878-5058-43dd-a825-abc5c542e718", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcac4e3-5f8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780519193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519193, "uuid": "a3048a8f-c0ba-4c9e-8ada-3d112e8709a5", "comment": "Malware payload", "value": "b1a4d2caee92e6c8a888d77821ebd6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519193, "uuid": "d4b97e90-1b58-46b0-9f78-3366e244d655", "comment": "Malware payload", "value": "556d7e26039a275f61e29165700b53574f04ca451db415d8c2b5ec1533d2094d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519193, "uuid": "60fe1adf-fd40-49dd-bcec-00a2142a3ce0", "comment": "Malware payload", "value": "2ada87f6fb62025d91db45562af8e3ad6be7ba01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519193, "uuid": "9042c286-0475-4775-ac68-d447fd3e158a", "comment": "Malware payload", "value": "54b44315d76cb505a412af221ff473aeae587735ec64d78c44202c49946f391b11c49155ef4b2ba59afb10655ed1b497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519193, "uuid": "bfb230bb-5220-4ab1-a952-dd7c170520ba", "value": "T14927BE1C4E2C6492A6DB1ABCDA218423C6AF8435047AEE7614FDD1B94EFF5DE10349E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519193, "uuid": "364ea711-20ec-4bc2-b5f0-03f40094f796", "value": "0c650e3e85b88377e6a4343076d8dab0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519193, "uuid": "639d8d45-957e-48ee-a220-6c99ea6a01c8", "value": "393216:uZi/zfHn5knLIGOL5ZOi2hgZm6cfWT84ahnAXf3pcY:uQ/z/GLIhfrEqm6cOTh1X/pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780519193, "uuid": "32cff93e-ef6c-4317-9f9f-3ccb3e452fe9", "value": 21805084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780519193, "uuid": "cace3744-f89d-41f7-87d4-7e6b6a482647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519193, "uuid": "473473f5-a42a-478d-8577-2cdae802c9eb", "value": "iDXs9HOIpoTLZRE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d1567c-5f92-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780521860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780521860, "uuid": "c7ea81dc-ca5c-4fcc-aa65-4a76d5171f49", "comment": "Malware payload (PureHVNC)", "value": "8f1b318694e3b082ab9a5305575806e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780521860, "uuid": "f2645616-2b30-487e-8469-17ab317eb308", "comment": "Malware payload (PureHVNC)", "value": "563573b47a7c78670736bec9ca0bd3a8ed2d815e5bc2836c37b21b3772b7c929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780521860, "uuid": "3aed1184-966a-4aa3-acd0-a4917a549803", "comment": "Malware payload (PureHVNC)", "value": "327c325373d498f9a25c53d4cefa110231f12c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780521860, "uuid": "d8674ee5-211d-4a48-aa57-d51382712ffe", "comment": "Malware payload (PureHVNC)", "value": "920937a5596bd23e77288e779bc487830f16a713b9944c239f3445892f5ca199f05122a49f1d1075ef49f1abcbc62c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780521860, "uuid": "c6976c37-f223-4617-a078-8e30725f7f2d", "value": "T10FF4BF2BB2564F12C3C85737C0CB190193E5D5877573EB0E768423A62A163EBDE4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780521860, "uuid": "42dfc270-6fc7-42a6-89bb-a564c5057532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780521860, "uuid": "f6f40b1f-65e5-46c9-b6d6-281d71b2e597", "value": "12288:NW+a4aN0FaEmL/qUaocwmKUSeWm2moYYJIc25Su06hp2MIE4W:wHN0IXPaorm3FH1YJJ21Rhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780521860, "uuid": "8b0dec62-cb46-4461-9f87-e474b360fa51", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780521860, "uuid": "e5036a78-b3d7-490b-a9a4-80cbcab0eb07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780521860, "uuid": "c90e43fc-993b-419e-90d6-0ff2a357806e", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.85786496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8f9994-5f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780514574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514574, "uuid": "8ee220c1-08f4-4b17-8bcf-dc423894b57d", "comment": "Malware payload", "value": "3b693d3aeda6e2403fcff91454380172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514574, "uuid": "e471c274-2288-4a40-b27c-d67233737235", "comment": "Malware payload", "value": "581139e92b21903519d7725ca4e20da338535c6e2354aa2f758157b1eca3fd0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514574, "uuid": "3445a5cc-9c2a-4fe8-b93e-2c8d5b0a9f13", "comment": "Malware payload", "value": "faa66907297e646f6af6e0a0f652f41717a65a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514574, "uuid": "3d2aaf0e-f374-408a-9b6c-750f0397a08b", "comment": "Malware payload", "value": "e629789e94dfb421ff5fefb91bcd528d0ee385d7347f1da279d3e7b13f5ac575610064d8ff614ceb2203264c5c0c2eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780514574, "uuid": "7d0c2a18-75cb-44f2-8be1-5cadd6aa2436", "value": "T183E4DF1BB2B411FDEA5AC278C6165A17F7B3B4301324A79F07A583B21F63763A91E311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780514574, "uuid": "82fad0c3-d418-4d8a-af79-11ba87453ba3", "value": "12288:ntsR/FHc/3KwF10kItWw+MKXxlUk/oIMH:ntsFJc/Z6kXw1KXfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780514574, "uuid": "c95fb75e-0232-4eb2-90f8-71166da7b178", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780514574, "uuid": "6328cd40-8a0a-4ca7-8398-52885c5895e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780514574, "uuid": "54d4f2c5-f9c0-48b3-a420-03784aff02bb", "value": "SecuriteInfo.com.Variant.Cerbu.271353.59124636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc89fde3-5f4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780493203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493203, "uuid": "34ab20f5-2cd3-4c53-b767-254aa8494032", "comment": "Malware payload (Mirai)", "value": "9247e8734846d5289c317ab30af8c4ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493203, "uuid": "0c6ea164-8d34-4b13-9f44-b7d35aeb1391", "comment": "Malware payload (Mirai)", "value": "5917065d40454761105511f6c63d590cf9174d02453ad2f94d228fe9c996a090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493203, "uuid": "40b8f710-c100-4df8-bceb-e0390d77e5a7", "comment": "Malware payload (Mirai)", "value": "231ab19eea736b67bad8c64c5388ab677996fd70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493203, "uuid": "02e70997-5aee-4a0c-886e-dc42d3294467", "comment": "Malware payload (Mirai)", "value": "29d7d3f7f8a6f3cda84b2346a7077506c71f50d72bdbddd5fbc2310ee2cbb56ad0daa74d6ea57ac69ed261d4a20c30e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493203, "uuid": "24bcdf4d-7bfc-4726-b84e-e45495adc90d", "value": "T129A3F745F8504B17C6C756BBFF4E438D7B2A1758D3EE320399256F20379B9AA0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493203, "uuid": "61063896-d032-4522-b8f6-d5d0779baf0e", "value": "1536:WBgkBFmAC3DE4VX1nz7Riz0fcO25sYFbRl5hwyw7l/J8+511sjVLUf/vE:WeMFmRY4jz1iojgJZLW3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493203, "uuid": "c0fb2563-6a48-4f26-86fd-3faf9ed8ef45", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493203, "uuid": "d319fc91-92a7-4442-9b3e-d1d0b34f1f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493203, "uuid": "0dc767e6-f2a8-4baf-9320-5dae3daed179", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71dbba6-5f4c-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780491905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491905, "uuid": "612d46c3-e5e5-40ea-8019-f8d882702ad2", "comment": "Malware payload (NanoCore)", "value": "0cb5cd6ffe701d912a54d833a72b44e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491905, "uuid": "42dfe658-b526-49e8-b24b-cd6055c23ab1", "comment": "Malware payload (NanoCore)", "value": "5db6e46ae0a2f0c1c7f6f2a7ff28fa2b50f4e36b5918906111928ae6cf24ea41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491905, "uuid": "56328075-0335-4d41-985c-5768c1f9f8ef", "comment": "Malware payload (NanoCore)", "value": "42e0d011c32467c019367d116da8e7e2f4164d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491905, "uuid": "4eb0e530-4ad3-4e4c-953e-1fb286ba8bf8", "comment": "Malware payload (NanoCore)", "value": "24c155c818ad975d4e6d720f1c9a9c241ee6b2717ea1fdb5127deb99ce69cba4fc07ab6141f965db7c46f753c60235a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491905, "uuid": "d1bf1e1f-6c9a-4a0e-af7e-4511d0e7d1f3", "value": "T1C114BF567BA88A2FE2DE8579611202128779C2E3ADC3F3DE18D420B78F567E50B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491905, "uuid": "c063e6f1-0ac6-488b-8b9c-1e585701f5c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491905, "uuid": "7bf8b556-1593-4b4e-ba55-9019e12b0d2d", "value": "6144:MLV6Bta6dtJmakIM51G9lT9E6CvvHPfI2xc:MLV6BtpmkyGrBfCvPPfIWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780491905, "uuid": "f80e07d5-f63f-4089-a1c6-3377fa62da43", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780491905, "uuid": "9af1370b-d52c-4724-9e54-f56b7e664741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491905, "uuid": "41d6a6ef-b5fb-4f94-b8c2-937949d8b0fe", "value": "0cb5cd6ffe701d912a54d833a72b44e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a010146d-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780495249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495249, "uuid": "a956683c-e13d-4fba-b549-726d09aa96a9", "comment": "Malware payload (Mirai)", "value": "a71f1876a1649c6a0d969e87dc9fefcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495249, "uuid": "29b1b75e-1668-4f08-a3b7-5af6ab4178e5", "comment": "Malware payload (Mirai)", "value": "60086477d91812f2ba2fb08ad65ff4bb15e2a4ef7f4e41e6d80f91404bb393f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495249, "uuid": "4d8d964c-8ee0-49b8-bdd0-9c31274484cb", "comment": "Malware payload (Mirai)", "value": "a526c54ea433fb180f0e721615c9d4363b5e0f6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495249, "uuid": "ceed515e-e14a-4967-826a-75658b9fb80c", "comment": "Malware payload (Mirai)", "value": "e01045002f59b6491287b6347a2ed648992e3b8479e148ac32e2da02420543b71c12d4d322b99fa1167a3f11af4895c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495249, "uuid": "c7f987b2-6428-4075-9d87-57bacfe955a1", "value": "T1D2E2F1718F113F9AC5703179E0F6C2C31B3A1EB99414E0F32976911C785AAE49AFA153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495249, "uuid": "e4cd3b35-ace4-4091-9f64-76d2c0d77dd7", "value": "768:ULWE8BfmF3IV3oXqRyV+u4+aICC73oS669q3UEL1:U8g3IV3o62+u4+aR83oDL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495249, "uuid": "d232991d-31fe-495d-a25f-b4940c506d8a", "value": 32360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495249, "uuid": "71980ca9-dbc4-49f0-aaae-bbdf9608c2ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495249, "uuid": "a0ec9c50-b84b-4f1e-a69b-de08ef433f2f", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbae161-5f4e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780492772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492772, "uuid": "4ae471cd-1c9f-4ab4-93fc-d991dd4368f3", "comment": "Malware payload", "value": "cf2d75c9334d5d8161342039a0533415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492772, "uuid": "2a78130c-ccf6-446d-ba2e-c0a6b73cb146", "comment": "Malware payload", "value": "63cc26e27c3901a7ce9eab9f956f0dcbbb095829b445fe28dbb7e7d6225374fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492772, "uuid": "99b5b1e0-0c0b-4ed3-9a74-81a09418ef46", "comment": "Malware payload", "value": "6e0659e722da42e560d40f4896caa8cd01aae573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492772, "uuid": "a65f8e79-f465-48ed-a0de-461f318213db", "comment": "Malware payload", "value": "39d582ccca086abcb088e84f68d3b65f73eb4e85eb2f09afbc40113f5642e165a3ff8edec52a045f38150deb6ce97968", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492772, "uuid": "b091248e-85f7-48c8-9741-1caa2a976a41", "value": "T148D38A592F328FAEF66CC73147B74A24976C23D623E1D684E2ACC1146F2035E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492772, "uuid": "38e95078-ffe9-4d3b-a46d-f6e5392f7cc5", "value": "1536:wMPYhjTwMd8kUFUR762AW+QLeVRTY9+WeFOubmAB6WL:wDMYUFUR762AW+LC+yubAWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780492772, "uuid": "198c5074-dd5b-4649-a02e-996412384b05", "value": 140720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780492772, "uuid": "73fe10e0-85fb-4378-b833-c9ba9c58c5d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492772, "uuid": "bce9c141-6eee-44dc-af1b-a5560c8a3031", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b65172e-5f51-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780493765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493765, "uuid": "604dcc0c-fac4-4551-98f6-f8094dc5ea1b", "comment": "Malware payload (MassLogger)", "value": "d65b291e3483b0b78387c805a68298fe", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493765, "uuid": "57602300-f1c6-4362-8f98-b7433ce9a4c2", "comment": "Malware payload (MassLogger)", "value": "653a9fe4dc002736cd9eedafe4345d3cace7fa5ab2926fa8bbab15795834c9c7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493765, "uuid": "213ab413-b3c3-4d72-8b63-4724263e7717", "comment": "Malware payload (MassLogger)", "value": "357605ba55c486f4d6d208055382b7daf74fb3bf", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493765, "uuid": "128d0b91-1d23-45d3-85c5-13c233263f2f", "comment": "Malware payload (MassLogger)", "value": "84dfc17e8494f7e188208b6bb9b0a5801c3c89b039a35e4fb58fb046dfa94adbc27de40859d765ec4d47ff298ee59d4e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493765, "uuid": "ae3d9fad-f6c5-48c5-832d-e7c39b7f9754", "value": "T1C9E59E6D2B7E0026B0D63510DFF7A9F7BED0E657287A4C6CBD6D29E047B80016639DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493765, "uuid": "da1a8c6c-5ebd-42ad-b03b-a506407f59f0", "value": "384:E88888888888888888888888888888888888888888888888888888888888888e:0+ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493765, "uuid": "39cc12a0-a13b-4ab7-85bf-98ef83ec4fc3", "value": 3042747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493765, "uuid": "b19111ec-29ff-4085-b839-a5c0cab854ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493765, "uuid": "e739b180-a090-4fbe-acab-112a3c2ee262", "value": "TALEP SAE0306.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62588c76-5f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780523492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523492, "uuid": "8f2a1b0d-1139-4f7c-a9b5-2365b5d0b379", "comment": "Malware payload", "value": "54165c7df6b32147d4024af3c8532904", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523492, "uuid": "d6bb5ad8-a9c1-4f06-bc69-01b0b6c3492d", "comment": "Malware payload", "value": "68021bb546d19a1c4b57447d0826ed47b545ba9685e0d0c3d7bdff87927a62be", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523492, "uuid": "77ba8480-213a-4f37-aeb3-d91c1f447705", "comment": "Malware payload", "value": "9a319fb30d4bd5ff336925591411e568a8dd72b6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523492, "uuid": "0dbc88b0-f267-45bb-9b80-45c47fa92bfa", "comment": "Malware payload", "value": "754f7fcbc44fc6e9960c26b355606e7dc5060eb98bb9246e04cb154ab7a2d31a5928294e97cef7dc599f8d612c27f99e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523492, "uuid": "794f4b70-c1f1-40e6-857e-1cbcbfa5f591", "value": "T16DF6123FB29B653DE02A1B397A76A250593B6E61A5024C16DEF4E44CCF3D0B01D3E786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523492, "uuid": "10e59aca-d02b-4f54-b092-088eca0f6a01", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523492, "uuid": "5d0c77f1-e100-487b-9ee2-9fba6d62dd40", "value": "98304:05/xkGku7idB9Ts9eBIpHGJ232Rw1XTe/DIL851QqGVQwysJbQ:QpkW7O9Ts9e2mk3vers8D8JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780523492, "uuid": "8db06506-766c-44d1-ade2-666641e74922", "value": 16334719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780523492, "uuid": "cc39ea4d-75e4-45ac-8cb5-279e76fef1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523492, "uuid": "090bd097-34d4-4bbc-89b3-510a37c4db24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615f260e-5ef2-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780453053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453053, "uuid": "e16f1f02-a98c-4207-85ce-da9f8feecd39", "comment": "Malware payload (Prometei)", "value": "e267997111f461932a8d4cfd9ee1cdc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453053, "uuid": "ea9d720e-d140-4c98-9f70-bf2fdc48065a", "comment": "Malware payload (Prometei)", "value": "6903a94fc11523f7d621173a43e8943361f2c49a81b2158408c5a883d2378199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453053, "uuid": "29da644a-ce04-42e6-adeb-b762a8452dab", "comment": "Malware payload (Prometei)", "value": "af86d6132b135e57bcce7ca86b996698cd1ccb63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780453053, "uuid": "a312b97d-cea4-4ac0-a942-ae09b2b3cfcc", "comment": "Malware payload (Prometei)", "value": "b6c558906051c1169d86367a2d3cac506f0e1a3699fc008e23c397716ee0b4437950c3c8a1a3ed067205f0cf6eda255a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780453053, "uuid": "7d632572-de74-49f1-be54-a07e35b04564", "value": "T165C68C73914238D9E5A88DB4D11026526DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780453053, "uuid": "fc71c898-0ed2-448f-9ad8-8e705921307e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQw:cqYUQuVDt0TZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780453053, "uuid": "59a39cce-0a19-4b70-958f-8ae50375d474", "value": 12189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780453053, "uuid": "d657c63b-757e-4877-a0fe-18738cb581d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780453053, "uuid": "13eab608-7c63-4d0f-b2a7-1b70c846f799", "value": "6903a94fc11523f7d621173a43e8943361f2c49a81b2158408c5a883d2378199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c5c08b-5f17-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780469116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469116, "uuid": "00f8bb46-4a16-48fa-9d35-bbb27031709a", "comment": "Malware payload (NetSupport)", "value": "4f88a13abda5f0a5747d7bb180cdec4c", "object_relation": "md5", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469116, "uuid": "f2cb2a62-27b7-461b-ac80-fe29dadb52f8", "comment": "Malware payload (NetSupport)", "value": "69fb8fb0615a92bac3534188fea232b6a6230fb7ee0cd11e931cb4ba383227d0", "object_relation": "sha256", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469116, "uuid": "e846c1a1-de27-4232-a163-bf6b153b0a11", "comment": "Malware payload (NetSupport)", "value": "7046f4f7e84edc2b53a4d214d676dbd17824522c", "object_relation": "sha1", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469116, "uuid": "f75216ee-76b5-43aa-a56c-9b2a38d12399", "comment": "Malware payload (NetSupport)", "value": "f7b66afa1dcae924bc91e983708a49eff19d629c508cf9f5f001b9d85cced247e7bd3cbc73f7dc22d07074d4f58bca99", "object_relation": "sha3-384", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469116, "uuid": "f6f0d15a-5603-4a8f-bd0b-fcd57e9da0bd", "value": "T15536339B2DA4CFC5F3894A34BD1CE199C799EE2B45E355623522FB5D0332996032CBB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469116, "uuid": "705d0fd2-65af-4653-a2a1-342a7bf999d4", "value": "98304:lnJz6QofWe1V1zo1vGUhpIepG3EH/9+UIZbi+Nc9xVt:lJZ+VAh23M/ELs+UxVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469116, "uuid": "0a9f237d-4e6a-41d1-8487-8067828a1dbc", "value": 5115904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469116, "uuid": "1beb36b0-dada-4033-8486-5f1bc4f88cfe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469116, "uuid": "f39edde7-fb96-4080-a56d-9b341d338f2b", "value": "69fb8fb0615a92bac3534188fea232b6a6230fb7ee0cd11e931cb4ba383227d0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0893cca4-5f58-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780496713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496713, "uuid": "a91d2eca-fb4e-4ba2-ac6a-4a76fe2a8af8", "comment": "Malware payload (Phorpiex)", "value": "b3b91368857bfaae8542c8fbb1b04bf4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496713, "uuid": "3744f65f-3c5d-489b-b9bb-5c2d7b9de8a5", "comment": "Malware payload (Phorpiex)", "value": "6c1a22cac041444e250c358abe7dc196be740a9c43a1d77be9886ba2b313a08d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496713, "uuid": "b3fd5edd-d874-4a9e-b286-97833b062e87", "comment": "Malware payload (Phorpiex)", "value": "fd79fd0f9759595de840f7e9835985e5dd3b55e1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496713, "uuid": "30c9760a-e330-4658-8742-d33519eaf029", "comment": "Malware payload (Phorpiex)", "value": "cc20360a842d370f9b7230f903775a82c3b31a30e7e8bdd7afc02078a6ad80f57b98824f9e30941345764767b311ce3e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496713, "uuid": "d1ce6336-3474-40b3-94fd-43c992bdd634", "value": "T160825B0FB9464316D1E100B0A632977BDA79A87633C414DBF7D08AEE0AA86D5FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496713, "uuid": "2226b976-9797-448b-8acc-dea05956a7ed", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496713, "uuid": "cdb9b89f-a0e7-4a8d-a8c0-7c2343e44a72", "value": "192:E6IqCngTtXpEQazbytj22DRDqLu/Yle63w/KUSvu9zw+gXSRCgbO5qXEd/Fk2wG1:s0pE9ytrt/Y0kTu9JgiHh2Jav8U9cvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780496713, "uuid": "c396ecec-9788-4cfd-81ed-10733e501f0b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780496713, "uuid": "a0a893b7-92be-4c4f-b090-7e5eccb760d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496713, "uuid": "9ed47290-a16f-4342-a1cb-771d8acce3ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39e727a-5eee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780451500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451500, "uuid": "a62e6242-13bf-45c8-9555-84498d1d259a", "comment": "Malware payload (Mirai)", "value": "94172e85f413d19eb0aa07a8f4cca0bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451500, "uuid": "6d8034e4-a20e-47ec-9ceb-51770a0abcc1", "comment": "Malware payload (Mirai)", "value": "6c9b79f9579df95168d72542acd54f109f806402f88bb154ac039cc327a948a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451500, "uuid": "1e9f03a8-c1f0-4040-bd14-8b3acffb1038", "comment": "Malware payload (Mirai)", "value": "dde94443d5a41431cee6d3e7c7636188d5075142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451500, "uuid": "b6ce2e80-4209-48e3-a81c-7456f579f80e", "comment": "Malware payload (Mirai)", "value": "5d060d92e57aea0166e14ded01e0e8eb09a5990a739cc1c1d4e4511f9600e15abc903fb796f916687a5e4ad36f1b62c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451500, "uuid": "e72f221c-3b2a-48f1-bd71-567aa3ff2f0a", "value": "T183C31A46F8819B11D5D151BAFE1E024E37231B7CE2DF7212AD246B347B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451500, "uuid": "faa1ce7a-d6dc-48e5-b3aa-0316cb727441", "value": "3072:W4yM0lMDSgD25Ze1amnm+yFSz5KvBY/8M:UKDCg1asJyFBY/8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451500, "uuid": "837d4aa4-6228-481a-bd47-a2bbf0ba3d0e", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451500, "uuid": "95e7595b-f25a-4b1f-8178-30787ec37a3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451500, "uuid": "f23e0508-aa57-4818-b3a8-5085f6b66c15", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc5f06a-5ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780452698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452698, "uuid": "d419c991-ea5b-41c3-8340-d7669a5ed40d", "comment": "Malware payload", "value": "a4f8be3e4a6f51f961190704b1c4d227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452698, "uuid": "020e5aa5-db5e-4b4e-8d2d-17fdb0fcfc25", "comment": "Malware payload", "value": "6e447ac15957961bf697a1709ff5663ca6a8f30f85413fcb7c8c6e1df7864838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452698, "uuid": "60449364-e72f-4449-9514-68fa1d565ba5", "comment": "Malware payload", "value": "1141d32cb247c40e1a123c6e33f16684ba550fec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452698, "uuid": "15fbdfa9-cb14-47c1-9819-5b6aa1ceab7d", "comment": "Malware payload", "value": "d0bbca6d1e93bdd75b3192fd4980850bfa6d56cc7e8fc3bda6b31760ecb43a506ced2ce9de52b973d80228db26abc1bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780452698, "uuid": "fe5ec9f5-4242-4a37-acf5-47219e8fa782", "value": "T1622302DA1B2194ADE62BC1F4AA048B473D3346136745DD3D7959EB97728F22D0F23780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780452698, "uuid": "1a7061f6-ba51-44a3-85b4-bfb995120c2c", "value": "768:tw41NnPcbBobm4sk5rBWUxPFKX/h99XTXhQZWrdtv7z6/OKURMcJgGlzDpbuR1JZ:6ONE1mmu5pxwhbbKQJ7kUVJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780452698, "uuid": "803439ed-ace7-449c-a974-4f610db7cd2d", "value": 49060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780452698, "uuid": "f1da3a7d-70a3-4403-8bba-d06eb9a275cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780452698, "uuid": "8a422f11-bc59-4c1b-839c-f12b37874a50", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8e9171-5f6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780506517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506517, "uuid": "1548c9f3-3d78-400f-a7ac-3fa15875f8b9", "comment": "Malware payload", "value": "03bd7a5b6d1ddc6cf323be0342e56257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506517, "uuid": "3ddc652f-c184-4dc5-90d6-b01f1128fdd3", "comment": "Malware payload", "value": "7398af011a33b43c81c8ccc4e1719c72a0d5c3ba24a81e29ab7294ef72c61d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506517, "uuid": "7c3a71cb-de1c-4dde-9df7-31143f0c73b4", "comment": "Malware payload", "value": "5df4570934886f235c1d2d0e5e4576c61f12fd15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506517, "uuid": "d5454d4b-53a9-4ad0-a17b-c4f9c4fe49de", "comment": "Malware payload", "value": "9bc1e12a4c3316cebc322ba933221552c15e7836928ebbf8adbc5cb73fce2353baa116551284b607d9d259bd7b94b7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506517, "uuid": "f51cfc48-7437-4ebb-9826-04b4611adc21", "value": "T18F27CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506517, "uuid": "f7e49e4e-1670-488a-a5ce-2c0302315fe8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQd:cqYUQuVDt0TZE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780506517, "uuid": "cec4ee1b-2dba-4bee-8bcf-ba830ac81b59", "value": 22183936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780506517, "uuid": "550d30b7-3b51-44b5-b39e-6420bedb33b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506517, "uuid": "80db82b0-bab8-44e1-839a-ae3f4b8586ec", "value": "7398af011a33b43c81c8ccc4e1719c72a0d5c3ba24a81e29ab7294ef72c61d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72eb57b9-5f2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780479282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780479282, "uuid": "46de54dc-fded-41fa-9b95-d81d4fdb48d1", "comment": "Malware payload", "value": "c43aafa19575a591eb01539bd453ef39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780479282, "uuid": "4f9dc568-8f61-4e47-9fb5-455906c94feb", "comment": "Malware payload", "value": "75c416121c2ad266842d02c3ea405ba24ed1ed78c5bd6aeb8180da1f3c903600", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780479282, "uuid": "ab33bc32-25f2-464c-b759-b6897ddbf2f9", "comment": "Malware payload", "value": "7364d5eb4f4046b309f0bfb60b7e275db56e0c23", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780479282, "uuid": "2fec4ab1-c8c6-476d-8d75-8165d695b68c", "comment": "Malware payload", "value": "1f60f0f87c297f3801ce4a78f9881eccba19142e038490fef0baf1300282f04e813014bf97b32589a1ebc522f4686888", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780479282, "uuid": "9432a96f-6782-459e-ba78-afb270b85f9f", "value": "T194137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780479282, "uuid": "16637fa3-41bc-4d37-a910-ec7da96562a8", "value": "768:EXRWNGxVw9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:4lxbco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780479282, "uuid": "eb55dc30-d56b-4189-920d-ff51203a5308", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780479282, "uuid": "f3546c7d-94a5-493b-85da-d17c841dfcfa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780479282, "uuid": "b2ce1e38-15e7-4cea-bf79-af6be0ff772a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dabe2e-5f23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780474107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474107, "uuid": "9b2e0460-3de0-4924-9dd1-67dae7e0709d", "comment": "Malware payload (Mirai)", "value": "ee7dd968e77fbe52a36c0bdbe01d5337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474107, "uuid": "05fc11b5-70b1-4201-ab14-4da83709dafd", "comment": "Malware payload (Mirai)", "value": "75ee72753f2b5098636997ff86e2240da2119b7b28f7ac5af4a3cf86ec38b6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474107, "uuid": "ee90cefe-e50c-43b7-a174-e8d784f53259", "comment": "Malware payload (Mirai)", "value": "7806f9e99701a80f6968457aa2286508409dc23d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780474107, "uuid": "6e46b9d8-dc7a-4818-8132-605911402b5d", "comment": "Malware payload (Mirai)", "value": "91dc3759b4bb3266ec4e19ff773f6f9367b8a8e7b9b454ad10ce106666f91a2b251a17c43f24968790be891539691c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474107, "uuid": "c35fa477-7121-43f1-bd2a-94345f19f019", "value": "T18CC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474107, "uuid": "092f1ad9-d1b4-466e-943c-2211df3af931", "value": "1536:UjAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3r:UsFmSmviqS1Bs0+Nd6lAqktNMxSNbmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780474107, "uuid": "c7d77536-2553-47d4-a856-4a0272ccb650", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780474107, "uuid": "ed51496b-c3c5-4c51-894f-1480e7bc55cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780474107, "uuid": "0150bf20-982f-4255-9772-0ac86446ee02", "value": "0a75b48762ad77eba0f8832eb59f0f1ccda8d517533f77b5bddfa8cde4313052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ca82eb-5eec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780450542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450542, "uuid": "4a559f64-68e4-4147-b151-7101e44ca932", "comment": "Malware payload", "value": "30255faac4b30ca2df688f244f358529", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450542, "uuid": "090a7a4b-4f0e-4c8d-90fa-2c1237977a04", "comment": "Malware payload", "value": "7681e29bcb8b6f448cf99cff2c25ae3fa76cde3e67bd36681280ea333fa20636", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450542, "uuid": "0214bd07-739a-475b-99cb-a30f10081acd", "comment": "Malware payload", "value": "c13d1ffc977a86b02af4bbc44551db5b42c280df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450542, "uuid": "9bc9cd5d-c83a-48ec-8182-f66257d901eb", "comment": "Malware payload", "value": "af26a6c7d7ce1938dbbc77ad66f000043191b7b950c4a1b175b2fe4c9df408a7a7eb9c1e465e520b812f3b4c78c448c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450542, "uuid": "74418884-f636-499a-8f7c-18a09131cb99", "value": "T1FE01CECAC112D75040D5E89E22EBB280B820C3DB19418FF87EDC043EDBA9748B069F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450542, "uuid": "e50403d6-f4e3-4304-9015-5792cf6dcb0d", "value": "24:kXCKysE2hi0ziQvZohaITWtjTvbSVMFRr7:e9Qp+MsITWZvOKRr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780450542, "uuid": "26acecd8-265a-46c6-9ed8-7b68340d67b9", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780450542, "uuid": "ef6cb92a-77d9-403e-b57c-2dfdb28a0e2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450542, "uuid": "893d84ff-466e-4fe7-a333-68a5742c86ab", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de667d4a-5f66-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780503084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503084, "uuid": "1912e2c1-bced-4d03-8eb4-c851fe6d4089", "comment": "Malware payload (QuasarRAT)", "value": "e0d61fd634a9cf31fe341476f6bc41d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503084, "uuid": "6245f8c2-e552-445e-a681-efa7100e74d5", "comment": "Malware payload (QuasarRAT)", "value": "77193b76e7142383c2fb8f4c92891fa8eb0dd0f50ed206532ebd0abb93da9bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503084, "uuid": "d4c27261-6086-48bb-b34f-4c60a2c53e2a", "comment": "Malware payload (QuasarRAT)", "value": "964bc91b13adef482a70de22ad51fd0619668f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503084, "uuid": "f81716b6-167e-4cd9-9091-c1ea010edae3", "comment": "Malware payload (QuasarRAT)", "value": "bcfcefb7eeaf91340649faff7265c9c7a9d9ca6ab39e0b5fe3f401ab7075a836e05e209d1d1759ddc3612201917c67c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503084, "uuid": "a973ebdc-b1b3-4602-8630-77f7ed561123", "value": "T1CBB633063841E64DD9B3C67C8EF6ACDCA697D4FB6418C8151615909F20AC632CB8E9FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503084, "uuid": "5b4da043-16db-4266-8291-c4838ee01add", "value": "22d2097fddb55e4b610171b15e37eaf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503084, "uuid": "06b355ca-7ae1-49d0-ba10-72be0c9ddb7d", "value": "196608:oXW3FxZm3Q85tJooibDcrTjz+P+wA6SMyOOgKdfwvhCaoSZg5m631A4G6vQV/l1d:qaxKQ8dzTjzdtN/4vh9or5N3jvCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780503084, "uuid": "01430049-9451-4ee8-bd92-2bbc1bdeb894", "value": 11295232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780503084, "uuid": "d5abf474-3a27-47da-837c-6db40a2d9b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503084, "uuid": "c645f96a-a3df-4028-aca7-7825fa68d89c", "value": "school-year-2025-26-calendar 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e050b3-5f72-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780507872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507872, "uuid": "4b3a838a-3be8-4d27-8340-89d8f1cd3a60", "comment": "Malware payload (Phorpiex)", "value": "95b44481af9df7b2afc6da54fe1d7b12", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507872, "uuid": "5b1adaa2-579b-4a27-bcc3-1ee830e1ef71", "comment": "Malware payload (Phorpiex)", "value": "7811efad3632c51b4e7b962909522fe1c18c3a20b86e3948d26e68a9e31100f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507872, "uuid": "1e94a394-72db-4fdf-a918-e9a4ad61396e", "comment": "Malware payload (Phorpiex)", "value": "646c755a24379820e053f38b7872942a684b228f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507872, "uuid": "a4a793e9-27ba-4882-ad63-96c295988c9e", "comment": "Malware payload (Phorpiex)", "value": "611ca676f01bc0654296b4b327f5cd8f86f8c4464e5e10ebd1d9cccc34729944f4692ff52816f53120719db382ffd103", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507872, "uuid": "734a882d-b2bf-44a3-a6a7-c3bb84d68eb4", "value": "T14E824B0FB8424726C1E100B09636967BDA79A87137C408DBF7D48AEE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507872, "uuid": "a3790ac7-4485-4221-979b-999c1d3f2d45", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507872, "uuid": "2c0401ce-9913-4385-830a-c7e0a13034fb", "value": "192:XKaqCngTtXWQQzbytjd0CzS4Tzl/le6f2vKUSvu9zw+gkSmOgbO5qXEd/FN2GJxG:50W/yto4N/0Gu9Jgrkhoav8U9c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780507872, "uuid": "5f7b61ce-e125-4bf8-b653-0eefba651e00", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780507872, "uuid": "d7a10e19-e1a1-4bb5-895c-8a07cf555f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507872, "uuid": "c9a96057-b989-4493-aa2b-511b6a664feb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8a52ee-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780469849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469849, "uuid": "975084a2-18a7-422d-bc76-ed80e2c6e558", "comment": "Malware payload (Formbook)", "value": "6550d5551e5a8aefe777a7f5f1a2e10d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469849, "uuid": "feb4d310-a2e3-4439-b4e5-de8d4e8aeb60", "comment": "Malware payload (Formbook)", "value": "7bde71112ff4675d55c88b1c04a08dddd0b981da19fe3f0c4d7c2483f1f80a9f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469849, "uuid": "a8b72bf6-3bdd-49bf-84a8-d60118af364a", "comment": "Malware payload (Formbook)", "value": "55f5db48d46b4e22369137da348186cc2ecfbfeb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469849, "uuid": "f763398f-5a7f-45f0-84f1-ea5f60611b0c", "comment": "Malware payload (Formbook)", "value": "0c748bfbda4df6dabbabc2b33fa33cefc4166c059e1812596ed6c773c2f701177a92faebdfd75686e2904a0a91b1ab75", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469849, "uuid": "19e6b328-956e-4377-87d4-c0c42cdca46a", "value": "T168239274194C45EF2093EA74B088A7E3FE6C0A5C9FED664F925487DA1A3EB8734C3581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469849, "uuid": "e1caca17-f16c-49fd-b5a9-fe16541c0a6a", "value": "384:Qfg95a/sah7h0WDjqKyyg+hNZOzv1vbrnP0T9MxZsCZaxWUo/7e2t7mp:X9AkQ7hGKxI1TrP0CDZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469849, "uuid": "4f82f5f5-a28e-47f6-b8a3-775435634e05", "value": 49867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469849, "uuid": "a48cfda4-b49e-4cc5-b618-f2e2e76be585", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469849, "uuid": "f350936d-39f2-40b0-a5a6-3eacc20137eb", "value": "ORDER 1300001416.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1c69af-5f53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780494863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494863, "uuid": "fb0d577e-2b77-48b3-b36c-6f1b7e0e3940", "comment": "Malware payload", "value": "f7731d824c5a386c068c0231d1b1b621", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494863, "uuid": "bb9d3a6d-b3fe-441f-ba5b-2664e043f665", "comment": "Malware payload", "value": "7c5d2c2eb44de16ea8762a9f96b95d301e911578cadb0b2a216783f8d7dfc9db", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494863, "uuid": "88ee770b-373b-4def-bac6-4dd56a7b2715", "comment": "Malware payload", "value": "d1f3fa4af2e7aa334bf35cc261f94da2abb77a77", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494863, "uuid": "77313681-1697-4129-822a-21d2cd4d670e", "comment": "Malware payload", "value": "93c78c712654b1c1f6d31d83589e035203f7d1cef378812ffe83c07b54b01defb8c2f614c2d377c615ac8af76d22dbf0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494863, "uuid": "c217a473-4681-4f0d-af51-f9d15758608e", "value": "T13673029B720E92CCDA775FF272C7D421290A1CF0ABF1312349AD574308592BCA785DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494863, "uuid": "31a82e29-496d-4972-a582-246d23771085", "value": "1536:vOcJbx7cwk4wcjbeBan3dCJITwi58D7s93NwXnC4zBKSqfc7/DeboQZdG:vFdk4wobyU4GMi5UI9M3zBKSqfgeUQZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780494863, "uuid": "e85dece9-9e2a-4d41-831d-64d5422de152", "value": 77163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780494863, "uuid": "52b18ba0-3703-4498-b3c0-603740426c55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494863, "uuid": "3f376d28-7fe2-497d-91d5-397403602818", "value": "Krypton.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da27f67c-5f56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780496205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496205, "uuid": "97d06af4-05b8-45ea-87c0-bcd09302b376", "comment": "Malware payload (Mirai)", "value": "7bed686f95773c76c93c903b4dd1a5d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496205, "uuid": "29d8000b-b3f9-4ae4-9600-da5825646a30", "comment": "Malware payload (Mirai)", "value": "7cfc5c4770b9b8b994855b36937b4419fd2537279d0c604e3a2081d84b40f1f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496205, "uuid": "ede2806a-8de9-4b18-8fba-f50ee20a7436", "comment": "Malware payload (Mirai)", "value": "7a0d864ca2461276073dff9031715a331173b7d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780496205, "uuid": "322112b7-57be-499e-ab0c-0eb9443ba207", "comment": "Malware payload (Mirai)", "value": "07e392a34a1b79e94d6370939b654c69a946f52bee2fd9a5e08713330e55a27f9ebb336224e6b44461659261403797c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496205, "uuid": "a3565f0e-1840-4e05-90dc-1fd2dac230b0", "value": "T176E3B7169F510EBBCC6FDD3706A90A0539CCA54722A43B763674D938F94E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496205, "uuid": "212d6678-85f4-40fa-be23-f75edcfd312e", "value": "1536:zmO98fN8cWNrID/oazSZvQmqADf8JbNzKlvC0WsctdI3uZLL176ysb+B:zmj3CmmeKlvssedIe117wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780496205, "uuid": "66114629-2235-481c-bc38-b08342723e7b", "value": 144176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780496205, "uuid": "1446165f-7641-4e57-9509-bda1e3a12660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780496205, "uuid": "ab2faab6-924f-447c-959d-56b9effeee12", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991546fa-5eef-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780451858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451858, "uuid": "031c3eb3-8c4e-4f93-9229-8a234af1f0b3", "comment": "Malware payload (Gafgyt)", "value": "5f161e5d83846eac8391d19cf5931769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451858, "uuid": "d3382532-9558-4e27-80da-8115399e69c4", "comment": "Malware payload (Gafgyt)", "value": "8013e0ee0865605f511882c9fb2fd017e0d6585e7713ef8cdac77e9d0fb985c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451858, "uuid": "98ef79de-5eff-41a1-8586-e5c122dcbddd", "comment": "Malware payload (Gafgyt)", "value": "95a25c3f8d838d95ae31d12be449dd7dd6d13e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451858, "uuid": "a22354a3-ae8a-4a0e-ac57-52e481d1e08e", "comment": "Malware payload (Gafgyt)", "value": "fa8cc9e1a1f3d3ada53af71ad2170e4a53ffaf9c98b022489c9a131def43ad1666b17b1f31a05c60efa0a31079b419cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451858, "uuid": "dd048240-55c3-4b0e-a028-9bf79f474972", "value": "T16923F13353FAC1F8D56AA731AA810684B179FD6B72260F8F53D005A990E3B88EF24911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451858, "uuid": "45314c3f-97ea-46b9-95e5-441972f44826", "value": "768:Y8pZ3TfcsBXLlCfQ+aQ15Fu8AS+Joi0/0bmeYWxnL2zB+6Aj//YGFgTxnsOf:Y8ZjfcsVofom3uJSs08bPznLY+64HWxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451858, "uuid": "ab5bf121-0b9e-4b14-9c6e-98b24d077fa7", "value": 47852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451858, "uuid": "5cae8dce-2862-4521-bbbd-3b79749dbb02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451858, "uuid": "23cb08b3-3f05-4e1a-a55f-0b51a42764d3", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11edd8b6-5f7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780513479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513479, "uuid": "dbb73dcc-9317-4080-b4de-f727ff6d1056", "comment": "Malware payload", "value": "403592c2e81327240f4643fb937cecb8", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513479, "uuid": "12919129-a88e-49fc-8f47-56030c0ef94e", "comment": "Malware payload", "value": "83f6b8e88a8aa9407587fd5b41a68cc9408b22a493d1e6b7347517638605d57f", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513479, "uuid": "3ab576eb-81aa-4888-9cd4-e06829627537", "comment": "Malware payload", "value": "d2127454b2721179fdf94cdde6350115fa3e3a55", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780513479, "uuid": "a34e7b6b-a7bb-48bf-ba6a-0fef33b5c1b6", "comment": "Malware payload", "value": "b10e2e334b7569d555de2937520bc0d81df5c8f38cf7a5a7899a1e0c8ea5b0aedfb5d4b97506340031020182be956aa3", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513479, "uuid": "21562c43-06c5-433b-90bb-66314001958c", "value": "T1DB038C52A6A414C4EAAEE9B0C170DE27E9B5B14A572196CF03B4CDA40F733D0E63D35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513479, "uuid": "fc57bc0a-f5dc-406a-a87f-400ec5cdcfc2", "value": "ff87cc76b7f8139549af27a98ea0587f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513479, "uuid": "d2e4a7bf-150f-4f71-8cf3-92fd5fd6b593", "value": "768:2y2ZKY0j23v1lnJmk7h1QMzdibwWDeKEI3iFl9zb:crDNlnrhDzkbl2IK3zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780513479, "uuid": "55dcce05-128e-46a4-89dd-3e15ffe7878c", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780513479, "uuid": "ae0d6099-9475-4ab6-9a32-57c5e016a027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780513479, "uuid": "56cbfd0d-e71f-4b16-b47a-2b52ae2b3a20", "value": "drv.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a20dc7-5f17-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780469060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469060, "uuid": "f4f80e06-a4d3-4cd0-a770-469f9bb2d71a", "comment": "Malware payload (NetSupport)", "value": "24ee7ff428946c5e1c442cf398090558", "object_relation": "md5", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469060, "uuid": "045bc80c-2612-4852-ae3e-6766ef71cc4c", "comment": "Malware payload (NetSupport)", "value": "866c14545b6c4c02aa8546fc02cdad173157e5b62ebfac5cb8d1e8a1d4970b9d", "object_relation": "sha256", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469060, "uuid": "e08eee02-e144-4e81-ab89-fdb803dd63c8", "comment": "Malware payload (NetSupport)", "value": "28a2eac08f2740a08bae710347dbebf2321d7557", "object_relation": "sha1", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469060, "uuid": "a68fffa6-6418-45fc-b191-9741a9276ed1", "comment": "Malware payload (NetSupport)", "value": "0a4a3514501b2c2a40a0023d039ccb86eff287cdf3a8e2f2ae816a49ca207da09ef7e34e1004f85f75bb69fabe89ea16", "object_relation": "sha3-384", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469060, "uuid": "5ef5bb1a-3195-4b47-a329-8e016c441d67", "value": "T111C533B0128EB366E0531EF3727D9209F51A7240CFC2F90AE9DE181134A94EFE15DEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469060, "uuid": "5c6bf42e-caba-401c-b7d6-b1dd6a87e054", "value": "49152:pZrKZYnir6iOqNxlA5gOw1nyzV3WWcbmKq2RNJ0f2oXJu9UBhda/:D+rGlgRyxmWCmKjaJXI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469060, "uuid": "4cd371be-2c64-4cec-9ee7-ecefdae05732", "value": 2598406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469060, "uuid": "8f861311-233e-418e-af03-757d87255c40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469060, "uuid": "53446661-6d79-4934-be74-33f652954a3e", "value": "MpOAV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283a9b9e-5f16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780468419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468419, "uuid": "626eac2b-9edc-4fa5-a9c4-7bff53be127a", "comment": "Malware payload", "value": "238ef01259270119b11d4e580d699871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468419, "uuid": "027aa1f0-d238-42de-a24e-e9cce464909b", "comment": "Malware payload", "value": "887d78d3ddba606cfa017f871a47a258de6099f6b6e4674f6a5012eda350b1cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468419, "uuid": "0b1cfd92-8677-4cb5-88a8-50ee891d37ae", "comment": "Malware payload", "value": "ceb3b83354c33225515283f2d01a4f361da2a532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468419, "uuid": "28ae4cce-f09d-42e9-b28d-5d16c6c2ce62", "comment": "Malware payload", "value": "ce948313bf3e24b7431e60150162404e156857ae618fb73525c26d797e77c492bacfcb903b40cf3f8bc9ce00691cb82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468419, "uuid": "325da0a4-7d53-4575-865d-5543e7584df7", "value": "T13E57CF7792067CEDE9B98CB4D01025816DA878874778E3C7BAC471E666EB6D08D3DB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468419, "uuid": "6c27abd2-4185-4aaa-8bc3-44515cd1f5d5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQd:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780468419, "uuid": "f2b74405-45ab-4997-b00a-d0c42fec4d82", "value": 28311552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780468419, "uuid": "96325010-8a73-4c45-8312-9e3235489c54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468419, "uuid": "47fa86b6-deed-4c90-8adb-372ad3c671e8", "value": "887d78d3ddba606cfa017f871a47a258de6099f6b6e4674f6a5012eda350b1cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707dcdac-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529958, "uuid": "641b7c95-0622-4c2f-95e5-e1238a9bd186", "comment": "Malware payload (Mirai)", "value": "186572411072a68e889dd76c9ddac098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529958, "uuid": "21afbdda-5810-4654-993a-71ddf52bd7db", "comment": "Malware payload (Mirai)", "value": "895ac29db2a4c2d5e1c1e0356fe6b6a042191a98e6eca23fc325c3fd1c63cacd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529958, "uuid": "2ba24270-6868-4c24-bbc9-639582dcf953", "comment": "Malware payload (Mirai)", "value": "628eaf64fe6ce7532041df6c8a86d04358ccacd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529958, "uuid": "94a82b8d-dfbc-4774-abb3-3f3a417781cf", "comment": "Malware payload (Mirai)", "value": "338591b94c8ed55dcdec66b2cc2c12ef2de651207cdbc9196c6c1d3eae45f376ae8e185381b6e5627b5bef51ad6e26ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529958, "uuid": "3aeb1b80-9a06-4d43-8d67-b301912d9bec", "value": "T1D453014340F5B968D1A736700334E3AFE510F8C96C4ADD78E2ACD4EEA1779249B46B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529958, "uuid": "c06f85b1-9ffb-41b9-b761-01e10948032b", "value": "1536:wmGXmbJVA3/niU+UwassRMNOWiqlyy1IgIpYafTPj5aLkg4azHV:VGWbvA3K6LRq8MIdPvELGazHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529958, "uuid": "95948700-73f0-4aa6-a014-0a6130359260", "value": 62524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529958, "uuid": "afdc6ccb-1a6e-427b-b19c-342e906ef4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529958, "uuid": "191444d2-fee1-4846-a442-d4e83d8a0121", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908d3a38-5f6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780506390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506390, "uuid": "070e7cd3-1521-46fa-9b4e-659abb1694f5", "comment": "Malware payload (Phorpiex)", "value": "9c423dfb25ad359105727d372267cc73", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506390, "uuid": "cca6a466-bfb0-4e5b-a4fd-5cc407b86fe7", "comment": "Malware payload (Phorpiex)", "value": "8da293947ad0a935ec3522721258a7bb9d0c755ebe36a8eb71dadadb17a2b23f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506390, "uuid": "295825be-f5bd-4d56-8180-8202a89a6405", "comment": "Malware payload (Phorpiex)", "value": "84a0e720669b97cc877e9a9f42f9e375b9ba0eb2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506390, "uuid": "74b93762-6222-4975-979d-6cdf13b8fd4a", "comment": "Malware payload (Phorpiex)", "value": "45b72629f2d22e0b92dabfa480cdd1604ae6da817f6ca0d59a52c89b91e18d231dd641bf06845f2089f144a56854981a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506390, "uuid": "e148589e-43f7-4ab5-8648-bfabd6cd7980", "value": "T1DD833900F6D08236F4F640FBE2FB5679682CEFB4530644E76391A5AF6B249C5B93142B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506390, "uuid": "b6491080-f688-4560-8cff-af7ced529835", "value": "08cb850c073d48e5dac072545df0288b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506390, "uuid": "4a903e91-d6fd-4b0a-8525-aa1582d5568b", "value": "1536:iyfP27Fmav82iV6Vtb1i+M47lf9qIZstEDnpGr52F:vX9O66V1vMeR9qsstELpGr52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780506390, "uuid": "bd7a0af5-01e1-4b4f-bb7d-c0f16da6dc14", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780506390, "uuid": "dcf7c31d-25e1-43c8-b968-7f3b70c4d60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506390, "uuid": "2866b393-cccb-4529-85af-683195fce0eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b2dca7-5f33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780480840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480840, "uuid": "d873b92f-33d4-45ac-91a8-b1002d627e46", "comment": "Malware payload", "value": "eb6ff100078715dfbe8389391ffa9e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480840, "uuid": "c608e6ff-5238-40de-851c-d7be974a8cb0", "comment": "Malware payload", "value": "8fec22cf1ab5997d5631b5ac739e697150a1cf7eb6ad7d67721096220942f5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480840, "uuid": "139057fd-feb6-4c6c-b0f5-fe7f271ac860", "comment": "Malware payload", "value": "bac2c8032d7ca1b9a714e0383fe1de41c5f4b464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480840, "uuid": "42a71f1e-1cc5-4224-a228-81d362127d1b", "comment": "Malware payload", "value": "2b0c19610249e3499ef54c1abc4d3a5c9105a55cfbf34cc83b696b0fc3505a65ce135a65fc7ebb96317ec25d1c693e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480840, "uuid": "b3320ff8-c1d5-4373-95df-2160144950db", "value": "T182D1A441A3FC8629E5F74F386CB353551AB5FA019D32C64E5C98425EAC32B58CE21BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480840, "uuid": "898a9b3b-894b-4cf2-8986-4147e16c342a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480840, "uuid": "69e6f881-c75a-4f81-bd0a-baef8e591eb8", "value": "96:EZRletEvB4IVeJBb8WdHSHm3K+TVw790jZlm/DwtCf8dr77dELC:mXMeGyBspVW98Zw/Cdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780480840, "uuid": "132d45b1-9690-45b5-aaad-2468132dd32b", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780480840, "uuid": "5a07860b-0885-43ec-adbd-800fd4bb44cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480840, "uuid": "8060848a-6793-4c25-9f85-cd021a9168e0", "value": "rGodoyRezendeSSAdvogadosAssociados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87283827-5f4b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780491341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491341, "uuid": "b2e5ef02-7005-4c61-8e66-23d6c31040e7", "comment": "Malware payload (QuasarRAT)", "value": "c50365800609fc9a8883a92d68c76d1e", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491341, "uuid": "e9200d67-b9af-492e-8583-171c6b377242", "comment": "Malware payload (QuasarRAT)", "value": "902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491341, "uuid": "62acad26-fb4b-4e2a-bf65-ea79e3948606", "comment": "Malware payload (QuasarRAT)", "value": "8cac3befc4da7a0bbad64d436d1923cfde11fa82", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780491341, "uuid": "334fb568-5463-423d-940f-fa2397915a03", "comment": "Malware payload (QuasarRAT)", "value": "b3c387e0c25e22e5e23725ae7054ee4005ef0682020bbafa43286786e98e2d464a5796f4166e61809a3c7305ff066dfd", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491341, "uuid": "e6db9e6f-2ede-4c61-bd85-efdbd9d7f0ef", "value": "T15C4423148101D9EBD59B6D763E52621232B465E43FA5F7D2A8C2BC65E0073938E0BE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491341, "uuid": "7afb07cd-8d71-47e4-87c0-e651f5ff9e09", "value": "6144:xI3fykv56jSZuFnRA3Lrzul4U9nN2UoKN4GfaM6yBpX7nHhyubZR1XUv:xIvykv5AAuRRcLrY4U9N2Uoy5C3yPX7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780491341, "uuid": "6130e5e3-3012-4b7e-8618-24fefc28b364", "value": 260448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780491341, "uuid": "45cf0f4f-aa5d-4736-8734-3dbef5872e63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780491341, "uuid": "af2bf149-221a-45b3-9e57-bec735d47338", "value": "DHL_Orijinal_Sevkiyat_Belgeleri.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a3fe3d-5f55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780495599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495599, "uuid": "e729e4a5-c72d-402d-aee0-219f4b4efab3", "comment": "Malware payload (Mirai)", "value": "2656687708a0bd1a29e133cd3fa701ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495599, "uuid": "6fa092be-91cc-427c-b605-8d3580b49085", "comment": "Malware payload (Mirai)", "value": "908ca3ed1a482d3af80ea0fabaf9bcb6199ccfb7c820be4c82c6f879007c8ffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495599, "uuid": "4732e4a0-3c60-404c-851b-f4c030adc769", "comment": "Malware payload (Mirai)", "value": "3d9aac07a1299b94d07961caffbd58536f85c3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495599, "uuid": "8ba51331-3f07-405a-bf09-2c42ed2aded2", "comment": "Malware payload (Mirai)", "value": "046fbc8b1384b7808ca8b752734605ef5df3b89a7afef08e5367df4a98412a0670233ff35469a53679d9eaf57411ac9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495599, "uuid": "2b8c944b-de45-4766-add9-fb6e4698681c", "value": "T13D83D605E9429B01D49731FAFB8F42597393AFACE7F97101DA246F6123C6ADB0F62112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495599, "uuid": "86971066-008e-44bc-93f3-e78a5c835c05", "value": "1536:/En9onJtsh9p/QHsUvaKnFI83JmaA0lmUBIimtragrYFF3T:RjCTYHsUvaKnFI2JJQragrWF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495599, "uuid": "a23de2af-5d4c-4054-8433-344c8b5944ca", "value": 81252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495599, "uuid": "839a5b08-f247-4fba-8512-74d8d44785fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495599, "uuid": "fc4207b9-0c84-40c7-8061-2c8c3826956c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ec4a93-5f3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780485623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485623, "uuid": "22bb4046-ca24-4ec0-a7b1-b5982336238d", "comment": "Malware payload", "value": "86ebc168420ffecbd4b8353c0b8492f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485623, "uuid": "068c2ccc-96e1-442c-89b8-51c1c0d5af52", "comment": "Malware payload", "value": "909d7c46ca88e6ff90780ed649e9eff65eb43c4b816ffd7399b9ed3d5e04b707", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485623, "uuid": "87281b33-0049-4e95-96c5-9c4986a60aaf", "comment": "Malware payload", "value": "a9ea0b022efca8a1bc40011b2b824e7a5cdd693d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485623, "uuid": "d29667b3-2dff-4dc3-ab3d-98a17dba94ad", "comment": "Malware payload", "value": "acdde8ee96c0747333a4f1337cb8acf3b8b712243338f6166e8e272cf52a8744491db178ed2116268c2c665de294d959", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485623, "uuid": "55ca72d9-4376-4bec-835a-1872c1ea0629", "value": "T15B24014AAA52457ACF1EFE9C14278F522B09F340C681C0E9B6D6355AFBEFC2315D24D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485623, "uuid": "bc2a4b7e-974d-4ee9-ad30-628753caf3c9", "value": "6144:4a8SGeAAu0Pl2NfT+cSMWaRPLoWYRByfNTpA/272:aSHAtE2IcfPLfAByZCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780485623, "uuid": "12f4db86-a5c2-428c-b8ad-ba0bb26096b8", "value": 224316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780485623, "uuid": "be9ed644-ac95-4045-a2e7-c57a3e2273c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485623, "uuid": "378a2f6d-89a8-461e-9edc-3b1904a497b5", "value": "samfu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588571f2-5f66-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1780502860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502860, "uuid": "191a0f01-d423-46fb-a3b9-afdf1c3f1a68", "comment": "Malware payload (Arechclient2)", "value": "fcdd277930536b5d50c39f7152423095", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502860, "uuid": "06d8361e-2110-4bbb-b8e6-c9ddefe3ed74", "comment": "Malware payload (Arechclient2)", "value": "925ad6253e84a28e0e2538b7492a991b0224a88f334f586880ade9ef6bbc59f2", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502860, "uuid": "9dce68de-4e6e-450d-986f-f125887277a4", "comment": "Malware payload (Arechclient2)", "value": "ee82aa9fb7ef90aa15f02ea89990f137eefbb8bb", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502860, "uuid": "25c941ca-57a5-4f35-bf4d-a5156b3a74be", "comment": "Malware payload (Arechclient2)", "value": "ce76bca9542acaa8c24dd1375a8c612c6618abfab71084225dccc0bb1d4d3f4deb2209ca29ef6b3dd0be1726f83c2e3a", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502860, "uuid": "e87248ba-727a-47b4-8c16-95ca3e3629d3", "value": "T1B4351201B79A497DF6AE433588D78260E372B4D137C1DBDF03A506264FAA7D09839BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502860, "uuid": "73702f47-34c6-4004-a8b0-57feda475884", "value": "d6c3af26618abc50178dc462029cd32d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502860, "uuid": "6349ec6a-c151-4b44-b0e6-7df3663a4d91", "value": "24576:vdUiTWlpex9d12t+qjue0ckFLwW6D5LS+FdZAdXwIUJMTPH:eicIx9d4UUh0B255XzAdI8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780502860, "uuid": "bdc235ed-eb77-48fc-8c19-fe9ed9157ff9", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780502860, "uuid": "443652ed-f37c-4434-a77b-0a128e329fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502860, "uuid": "a0b1838f-d7df-4d7a-a949-e4f72ee964d0", "value": "tempdir.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522bc60e-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529907, "uuid": "b4f1c088-d66a-4ca3-b299-6b044eb3cab2", "comment": "Malware payload (Mirai)", "value": "aa2e36a3d8bc240416d1d509fd2fea22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529907, "uuid": "fe9daaa7-fa56-404e-99b1-af7e73ec7281", "comment": "Malware payload (Mirai)", "value": "94a2fb0c7b2cae75aa462b96045f6ce7c3ee3f72443280d36b2ade458fc2bf9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529907, "uuid": "e4fd211e-7a88-48ce-9053-396db845027c", "comment": "Malware payload (Mirai)", "value": "19ae5bd58d6d55379ca701dfb9f27d256fcf564b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529907, "uuid": "18f5beb4-87c9-46e6-a9fe-a1f25abd323a", "comment": "Malware payload (Mirai)", "value": "44a00db3b3088c54bb0429ee6468ae4602aabfa64cef4563c791c7eb1f42656bb2f2069ad6c6b07dfcce9bfcf1a01123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529907, "uuid": "7261b7cb-e3dc-4b03-a146-40e1b5b29950", "value": "T141148E58FE8F78D2D2C7E37EAE4A0FB2302778748155C0B51A41969FC5EEEE85890613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529907, "uuid": "e9b9b019-f68a-4121-9763-ccfaf7954faa", "value": "3072:U3prI8P/WlamVf1FSdbHZCitXy/jEigcyxNKzPx9:U3pxGlbfLSdb5CimgiJb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529907, "uuid": "92535f1d-3a43-46d3-8267-1df8fa89bd6b", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529907, "uuid": "187fe872-2ba2-4805-822a-a94bdeecbb83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529907, "uuid": "a2a71040-b1fc-48c6-8967-70c17bcd787b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3e4918-5f49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780490434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490434, "uuid": "a8f54eff-76c9-41d2-9bd2-aaeeb502f91c", "comment": "Malware payload", "value": "3536846050d2bebc446f706806e884e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490434, "uuid": "406a5064-51b3-449d-a3c2-84bf7d72d108", "comment": "Malware payload", "value": "963b228d90e5c13521908ee20a5f92d481762957123558b302c37a1984e20ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490434, "uuid": "aeee057f-3646-4cc7-8a02-075b568920a9", "comment": "Malware payload", "value": "232f6bebe65ec4bda9cae07fdc85eca2665e2642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490434, "uuid": "08694890-24f0-4cf3-a4ab-963a2cc49043", "comment": "Malware payload", "value": "84197b22f72a0ca751cf2cfc90a7fc6cb032096826586a1139f239a9781be15f9605d7af84a29ded9fd36da4cb8d3c53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490434, "uuid": "5441a0ca-b791-4b4d-af72-a1c2b2f8ab7f", "value": "T1B293F12617C97B72D8DF497611AA00FF469A025FC6C0CBAADE0439173B0AFD50E46DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490434, "uuid": "76866fa9-64ee-40a5-9c37-11e28d2ac3b0", "value": "322d146a819c1c4cc979a0d5ada7d0af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490434, "uuid": "1c023bb6-0feb-418a-a6e1-ca900505f864", "value": "1536:6iP/lHcPfYEAV0pucwk7KfrbB+txV8b3pk7KIn0R4I2Tswk7m/KPGJO2C9WQdkfE:f3Qf+uYRBGgLaK00SO7mz02CoWmcXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490434, "uuid": "4b17bf0a-569e-4d0c-8008-3d3ce43fc074", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490434, "uuid": "3b07f58c-93a4-4145-83b1-3c6edfb6d34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490434, "uuid": "1f6e55af-65a6-4ffa-b368-0df5c6077c3a", "value": "\u622a\u56fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac24ed-5f47-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780489723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780489723, "uuid": "f9be7893-2d2f-42c6-91be-bc3119c73df5", "comment": "Malware payload (Mirai)", "value": "634f6099211b4f57bbf9bffbd1f8068d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780489723, "uuid": "3817e8f2-4e1a-44fc-a316-572b4f5d1e0b", "comment": "Malware payload (Mirai)", "value": "96e8856960313b53bedfc47816b2869a2378b9347efe056ca039728a3dcd6852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780489723, "uuid": "0540bd8d-5af8-409a-aa43-1646272ba0bb", "comment": "Malware payload (Mirai)", "value": "2059e0e69c8db7cdcf65f1f4645377fc7a8eb581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780489723, "uuid": "1fae68d6-6020-4937-9b8d-15e9ffdb3d30", "comment": "Malware payload (Mirai)", "value": "2c69ea90891804c4a0cba0e81a43346f33585b89ed2c4ce3c01953d136f4d85e49bb471c4f3899d3ebd10af6f8451c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780489723, "uuid": "80d6571a-0bd9-42b3-a53d-2946e67e28d9", "value": "T12043F786BC82865689D423BFBD7D41CD331273B8D2DF7102CD155F18B6CA94F0E6AA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780489723, "uuid": "7456ef23-1509-46a8-b46f-dd52a7b8489a", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysa:T2s/ITo7WCkybotgsJ913DhrbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780489723, "uuid": "48d0f83a-779b-46d9-b85e-8586ea3ac94e", "value": 56908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780489723, "uuid": "9cab88c2-e91f-4149-b2e5-88142cedde19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780489723, "uuid": "a40f6a23-cc42-42dd-82e7-b30b8253f7f6", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55196373-5f90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780520893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520893, "uuid": "e518476b-ff47-4f2f-a205-2b9e5c961a28", "comment": "Malware payload", "value": "d939f2e018cf18ac8168e03b179c1c6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520893, "uuid": "cb713728-8fe1-4352-acb9-8b353626102c", "comment": "Malware payload", "value": "99a7e360b0568778137ad883a5f53d75bc962d2543d958a0aa9f18974d3d0bdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520893, "uuid": "e735ce67-ae17-44d6-a181-d11b953b9c7e", "comment": "Malware payload", "value": "da746b9d64a0a478593e71b0af8a8e07be5aa07e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780520893, "uuid": "dd02bd55-1bf5-46f7-a20b-af9cb988f8d3", "comment": "Malware payload", "value": "cffcfcd2ff386dcc7fe3c0c317c2d97fd6ccd5bb6199cfef581053e0732aef1c029193273aaf40d6f61a2c19d860f74f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520893, "uuid": "6e21bffd-710b-4d2a-8e5b-09fe9922d662", "value": "T18D57CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520893, "uuid": "b74764f4-ef47-4126-aa59-e20213684f2b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780520893, "uuid": "6c1018c8-8b1e-43bb-8cad-35a1ba596bdf", "value": 29392896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780520893, "uuid": "bcb473e8-1394-4079-aa32-2a088c1f81f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780520893, "uuid": "11db386f-80ce-4321-b60d-2de5b25a8ad1", "value": "99a7e360b0568778137ad883a5f53d75bc962d2543d958a0aa9f18974d3d0bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f03b59-5ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780452757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452757, "uuid": "ce007b56-06a1-4365-b982-05caed9a8220", "comment": "Malware payload", "value": "cb1219811ebccea0aac7d31589e52ad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452757, "uuid": "ce503deb-03c8-4ec5-a5e8-c205e376bc34", "comment": "Malware payload", "value": "9bbc7ccf02ca942ea76a5b097fb3b14266ea1606e97dfd71e201c7e8ed0a0ec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452757, "uuid": "b6c3c578-666b-44be-b2b9-334813259cfd", "comment": "Malware payload", "value": "fb30f4d577f4a45b544b16926fcf093b710c6b53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780452757, "uuid": "9f05037f-0bd8-4575-b7f2-f101d85d7a34", "comment": "Malware payload", "value": "8e4e6ede5b63d2ef33dcb94f4740d2ca8c18c678d9b93845c3d449215f97f0265a2007dece00db1c298fb5818475f394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780452757, "uuid": "39c9ebb5-f20a-4fa0-aeaf-d8969066adb0", "value": "T16AE3885A6E228FAEF678C33047F74925976C23DA23E1D684D2ACC1145F2035E545FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780452757, "uuid": "8b956614-0597-4679-b38c-e8c5ae9bf6af", "value": "3072:NyhIFhvUrSc0I30BhC7jMp4QJSljQqLl5:NZFS0q0BMZQmjBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780452757, "uuid": "deef36b6-6f00-41ff-82e4-ed7b1fede9fc", "value": 152916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780452757, "uuid": "6d5f8ff6-c7fe-4361-8f5f-f8a99dba1823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780452757, "uuid": "a020d9d0-facd-4358-92f1-c5c04900a2b5", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c238d0f3-5f43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780488005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "34df95f7-76b6-4920-8054-378e399936bc", "comment": "Malware payload", "value": "9db83b5499239509869996aa96abdf02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "580fbaac-f3e8-4a29-911c-707886ff6223", "comment": "Malware payload", "value": "9e040c45aa797b15b6bf8b0c9baecb9ef947a0644b2a57f9f7eea0a68528cfee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "1f234a1c-7f27-418a-b45c-0cd6fa448d60", "comment": "Malware payload", "value": "47ddc077da67edc500a58902011f6925658c4e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488005, "uuid": "882b4252-9f5f-4b8d-ab45-6c90c8087e61", "comment": "Malware payload", "value": "60bdb561f40d078f735cfd911b81a55ec68732ad59b203cf54b81c5adf711ba51a281e3c595b19093b3773f7f9c866dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "4282188f-caca-4518-9ff1-8844f9229a89", "value": "T1EFD1B700A3FC8A2AE5FB4F386CB353161AB1BE015D72C74D1C98021EAC72B54CE61BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "fa3d20ca-edd1-4cc5-9122-11b3a403e9ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "34bc3977-d780-425b-8371-fbc989437e3d", "value": "96:qZnRletEvWIXRVE3K+TVw790jZlmfWBwtC/8dr7S4EFpC:cXMeW6VapVW98ZwfDdqLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780488005, "uuid": "1c8fd46d-9783-4da8-bce0-954e36bdaafd", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780488005, "uuid": "e0f29b8d-7a66-4c15-880f-95d79692742a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488005, "uuid": "b8a97d70-18cc-4c60-a0f4-05bed301d7f2", "value": "rAndradeRezendeSSAdvogadosAssociados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e353b95-5f97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780523888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523888, "uuid": "5b039935-31f2-4eb3-8882-fd45c351faee", "comment": "Malware payload", "value": "232bb91b5e89e036ea3c7d1b6131b01c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523888, "uuid": "eba0fc04-a3e8-42e3-b2ca-a2201414af25", "comment": "Malware payload", "value": "9f90fbe389fedf9d06d38707f651670c954ca842e22156347a87e64eec960a81", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523888, "uuid": "c4a1ef4a-dd4c-459c-8487-27bac2a51c85", "comment": "Malware payload", "value": "8598bf1c9a57f3a2262d38886098c105cdb9e136", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523888, "uuid": "d5897f62-a8dd-4418-a576-555674b1f99e", "comment": "Malware payload", "value": "7e45e9d46baf6ee406f6bc0480b1b33423603370c200e643986bf20e79540b7dc7e94ef0ac902990430171b27fff3fb2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523888, "uuid": "2e20751c-c4fe-4a2e-9e29-5a35c3e09ec9", "value": "T1B6825B0FB8424726C1E100B09636967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523888, "uuid": "cc042253-ad64-49e6-ab92-0bc6a1bbba69", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523888, "uuid": "d5f3bfa9-5163-490f-8fbf-9e5355cd6043", "value": "192:WKaqCngTtXWQQzbytjt0CzSATzl/le6f2vKUSvu9zw+ghSMCgbO5qmEd/FN2GJxD:w0W/ytwAN/0Gu9JgwMcoav8U9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780523888, "uuid": "84ba0e27-ab8f-4323-87d4-58a65be72c26", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780523888, "uuid": "71802a4a-7040-44c6-a6a5-f604cf5f32f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523888, "uuid": "8dde7cbd-ec1a-413d-ac3d-8c1475aa8465", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a603696-5f0b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780463725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780463725, "uuid": "5e769dff-b2aa-4142-a9cb-50fd6ef0f9c9", "comment": "Malware payload (WannaCry)", "value": "8a19776144252bf691d4fff08dedc4f9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780463725, "uuid": "3e75b6ec-7057-49e9-9425-80cefb092633", "comment": "Malware payload (WannaCry)", "value": "a276e317c0e08cd0190ec82f57b57089d8e6eaec98927f9d30c29de4265911f1", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780463725, "uuid": "af88246f-0a33-4646-80f9-57a5a3371b85", "comment": "Malware payload (WannaCry)", "value": "8e41c3159b0303fb3695d96cccf1222a21ee1db9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780463725, "uuid": "242ba07f-3d98-4090-8159-3af14b20cb8b", "comment": "Malware payload (WannaCry)", "value": "518547f0853beebf4da8f720ae92224c990ef06e6b0f22383519d73def23f36266b7b9f15949f0081caccdd13e3e9e20", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780463725, "uuid": "fb9b9bd1-fd8b-4618-81ea-49ba560e039c", "value": "T12E363358626CA1BCF0110EB084A38E56EBB77C5777BA4A1FCB8041660F53B5B9FD0B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780463725, "uuid": "328dea4b-9900-481a-b3e3-dfdd59cd623d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780463725, "uuid": "01fa17a5-fcaf-41ac-9c6c-2f4900458ad7", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2x3:DI8qPe1Cxcxk3ZAEUadzR8yc4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780463725, "uuid": "6cfcaaa4-286b-46af-9401-da6ca400f8b1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780463725, "uuid": "9c76c8ba-065a-4c08-ad9d-80ed141658fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780463725, "uuid": "01d824d9-1664-48ea-b675-cc901fe4994f", "value": "a276e317c0e08cd0190ec82f57b57089d8e6eaec98927f9d30c29de4265911f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866cc166-5f65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780502507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502507, "uuid": "a413e796-53e2-4aa2-a92f-7506673295df", "comment": "Malware payload", "value": "fb43a97a08786ebc51dc0e3b0093810c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502507, "uuid": "72d8a54f-0df8-484e-b7f6-fb6a0f65fa38", "comment": "Malware payload", "value": "a27e2b29ee82be40aa8ba65b91ba4e6f23d0fbdf8f3df0e0f76a7a046c906691", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502507, "uuid": "900a4eb6-d75d-4d35-a44a-971e77141bdc", "comment": "Malware payload", "value": "3e9e6e07956bb22fd73697e77ae66151671d944f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502507, "uuid": "c7df7eaa-1e01-47ab-ab11-f832726f76f4", "comment": "Malware payload", "value": "91abb28c246d9c7d916e618392a78885e04c1af792d49f9c8d65d0c9fc1c7ab685a67cb46c2fbe1fdf71063d301d9d54", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502507, "uuid": "e6db4801-f0af-433c-af1d-83ed73358a37", "value": "T1956733DAE9D88F2BCA294570D8907A69151A6F430B104DC9FF0CF7C50AF2763B57682E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502507, "uuid": "25841852-3d61-4aab-b4a5-8be58a8de591", "value": "786432:nGtHanCKZAyKyP3v1IJbOMdO1cZFh6efW:STwAyNNSbhuCh6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780502507, "uuid": "6202da55-9885-4ab4-b2ae-3fd8eda78435", "value": 29818880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780502507, "uuid": "e443d6e2-75f8-4cf1-916d-831ef2de8516", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502507, "uuid": "c59ec4b2-ec9b-49b5-aa61-ef3eb676669d", "value": "BAasd5XpZbsd5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555de889-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529913, "uuid": "9d9f6822-2f1f-4d50-b427-fccb6703fb45", "comment": "Malware payload (Mirai)", "value": "a11524d520b5af8438b41cb513c1e69d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529913, "uuid": "8cf5a59a-d03e-4d5a-863e-fadd18ff390b", "comment": "Malware payload (Mirai)", "value": "a60ad3d122428305f12a38210f4d183c43780cb5dd64ddfe048d8c7395666950", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529913, "uuid": "1d6a464f-8b84-4f17-9dc6-c1e1f0effb73", "comment": "Malware payload (Mirai)", "value": "f846eda303b5ee6c657beab292e807e9b7f35c08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529913, "uuid": "4eed211d-620e-4cc1-b057-2602e4088a88", "comment": "Malware payload (Mirai)", "value": "65df999783c44afac1b5eb0a4d479c64791b5d325a78608b2162f7f92567160528682285b1030f1e6de911d6e4b85f1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529913, "uuid": "892a704e-db0e-4d2a-96d5-5aed0a5f5f50", "value": "T1ADD36C0A79D230FCC687D17083AE9F61EA36745C42183DAB9383BE711976DD06F25E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529913, "uuid": "1248dc69-5e92-4223-b318-ae5c14b73620", "value": "3072:6fnaWfySJFB90o1Tck3kCht1RU9QFAcljFnLFdLg:ia8190o1jsQmclxnBxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529913, "uuid": "4bbfae53-ab48-4461-95b5-df7983324563", "value": 140160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529913, "uuid": "7dc28b6c-17c3-4628-b2a4-2905b93d68fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529913, "uuid": "3b286b50-6cd5-420c-b6ec-17c383ef8bfa", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1a3c95-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529894, "uuid": "ff62b152-c740-4761-b2da-cb1152e52985", "comment": "Malware payload (Mirai)", "value": "c1cfa773dc478635f2e01625d7dbf37b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529894, "uuid": "b05c8285-706e-45f2-a01c-ad09c9e94326", "comment": "Malware payload (Mirai)", "value": "a795b74735f796d2bc926e73b73ddad0b9fa5f147b57b1b996b271af29e936fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529894, "uuid": "7c0e8f59-e198-4b21-81f0-9fbc9f594c17", "comment": "Malware payload (Mirai)", "value": "2893bba8a89aeada7bc55d45e3aee78f57d4deb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529894, "uuid": "6774d031-b0c0-49c2-8b84-1686e8995254", "comment": "Malware payload (Mirai)", "value": "ee5853c58619b01518c2f90b569054e8a9ffb68f982fe2344c60a11dee4844d0c56cdcd19b73c1823ec56f9eb10c7150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529894, "uuid": "6fed8974-820c-436f-b6d0-bea5460c7214", "value": "T133D3C031F1056CE1CD1026B8347A96BC0700EEB407D52293EEBFE8AE54B7D5579EDAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529894, "uuid": "f40f46c7-86db-456e-b1af-f68fad75c251", "value": "3072:j5vFW9Kd2zoCc96XHPoV1SZfG5HeZatgcviZq:j5vFBCfXPoVK+VwatBIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529894, "uuid": "edd26db6-ab32-46a5-9d0f-a46fc52ddc45", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529894, "uuid": "c113573a-144c-4866-9e30-5ff59e2675ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529894, "uuid": "237a5407-d13e-4d56-99cd-b82f9bd3b9a0", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dab208d-5f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780506787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506787, "uuid": "2489e968-f10b-4e1a-b878-78b8236510a9", "comment": "Malware payload", "value": "661bf6deccaf79bfc79ed447eea9c262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506787, "uuid": "2ef4dbf2-8dc3-4bc8-aada-d61acb8307f5", "comment": "Malware payload", "value": "a903a9e5f6755981950528b54a57fb48ada724523542eb54ad2a28d56a168f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506787, "uuid": "c756b2b7-27b1-466b-81fe-248dbbe367af", "comment": "Malware payload", "value": "39ea04b73cd2e76eef2adb0d69c7b97507fd871e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506787, "uuid": "27e895d5-58e3-4ee5-8d39-b3bd6f681968", "comment": "Malware payload", "value": "a55b93c0cc70f0889719ee5675e89c6b78950038c4bcfe17a156e5d26cd61b705ef48697da67718c9dc18fc6c560e3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506787, "uuid": "8e1ff882-eade-4e92-afe2-c0a4828d2a15", "value": "T1CCF26F748E44FE0E3732583F2F9D24E1957C438FA5E2759BBE62AA0463D6C9811C20E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506787, "uuid": "8967a2e7-daba-497d-943a-1b49d8771e18", "value": "768:QeGhXTD3aK8eMK4qc8lWXEJw1Lff4QVndWHrFmXauZSOtI4iojD5w:QecXTD3aI4qc8lIEJw1Lf3dWHrFmXaug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780506787, "uuid": "21f95ab4-e76e-4f36-ab52-fab11ff5e042", "value": 36721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780506787, "uuid": "ca68bedb-54cc-4793-a60d-713248fcbee4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506787, "uuid": "2722342c-7f9c-4898-8a1d-50a9a891b687", "value": "files_court.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0271d85d-5f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (MyDoom)", "timestamp": 1780490689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490689, "uuid": "3b480d64-63a7-4667-9be4-3c84e2dc4e71", "comment": "Malware payload (MyDoom)", "value": "54f1c5e1b9b14744898aac5821601575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490689, "uuid": "1f7cc877-b902-49b4-8fc4-992874ff68b9", "comment": "Malware payload (MyDoom)", "value": "a9eb9c3478f1f5c27df9cff9711c910d03388f5d01b2ca586f84566753598411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490689, "uuid": "5ace41bf-1fe8-47a8-91c9-1ad49566640d", "comment": "Malware payload (MyDoom)", "value": "26b1e971856232982825905a9500e2e5ad3c9309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490689, "uuid": "034f3275-3bb5-42cf-a0a2-fdb0e685bbdd", "comment": "Malware payload (MyDoom)", "value": "eaf7955a8d9e959e6d4ee50cd019b627729c66b2e8d134d3de007c63947fc78808dd08eccf8384bfaea2c53aefc19bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490689, "uuid": "110fa5cf-5e0a-4fb3-a7f3-c5a263b65613", "value": "T1BAD2C091B050BAA2C06582335D86C461F855DC604AAAD2C7B634BFBFFDB17964B0CD2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490689, "uuid": "1a7cfcc5-4dd8-43ea-a6b1-08dc359269f4", "value": "98cd465c2ab2841f9fd90d5e847563f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490689, "uuid": "c6031bd9-029b-42e8-af46-48d12ee1b917", "value": "384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNZK:Dv8IRRdsxq1DjJcqfGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490689, "uuid": "a7f55d23-c993-4ad9-8a27-023a5cdab5bc", "value": 28864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490689, "uuid": "92a5df82-982b-4f6e-a3bf-8aa494e42e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490689, "uuid": "603795d7-f60f-4f9c-8d9b-84ebdef07095", "value": "file.doc .scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967af31f-5f55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780495662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495662, "uuid": "ec944bd5-133c-464e-9719-30e141b92a35", "comment": "Malware payload (Mirai)", "value": "f655660095a9bb27bbbe54c74010c121", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495662, "uuid": "d6a2f505-e615-40e5-a4e4-3cff0177cd35", "comment": "Malware payload (Mirai)", "value": "aa4b7113c39803f0bc9bd640a44042e61de370bfe28422935d00a43102d08530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495662, "uuid": "ac264b0f-f11e-41b9-8f6a-c690564df276", "comment": "Malware payload (Mirai)", "value": "51ca66d097180eef7f7a9d05b7f6e1452c8bf357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495662, "uuid": "b52ee987-8f84-4987-8881-ff4e9c694be1", "comment": "Malware payload (Mirai)", "value": "0b7f56152ee7a3caad3f054e044011015b9a80a1c548184f0855fe27c744da0dae247b2afd716ba59a46e8cbedcb5c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495662, "uuid": "7ddee557-422a-4e8c-b50b-d3ac4c406313", "value": "T12A03F17520E1BAE1D9301076127CEA8328B703FF51FA727725B1801CD892A677A7D1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495662, "uuid": "424094a6-fc4b-4a3c-847b-da9d65754dfb", "value": "768:IdJJDTZOdt2GnmEnbAOGK4dGF8CR3/HAA8v4DSs3UozS:EJRTZOAAbJ4dlCR3Y9ADzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495662, "uuid": "f9455222-4fb3-42fc-a60a-fb636fbabbb9", "value": 40476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495662, "uuid": "1183d302-5bfd-4804-b3cd-8efbd1dbca1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495662, "uuid": "814ae64a-cb74-404e-a54b-8c8f0cf896d3", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48322881-5f5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780498537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780498537, "uuid": "ad79f664-0ca5-4e14-87eb-545c6707712b", "comment": "Malware payload", "value": "90833ecd91fa96a9c839174e843c751c", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780498537, "uuid": "e01a8c88-ee62-4ca5-9765-bae196af0718", "comment": "Malware payload", "value": "ab47c8073a579da82445158e7999034c97b24743a48ed4bd342d98fcf995f749", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780498537, "uuid": "d9d9e370-63ef-4a37-8cd4-024331a69af6", "comment": "Malware payload", "value": "9763aa23f6241a4d5f44764d62f09cef832beaf7", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780498537, "uuid": "4222d0d3-be40-400a-9e8c-184072d6511d", "comment": "Malware payload", "value": "9407c91376ec3e2c795d7220ab8f915b022a75ee5fbfb007af0cb683696be1247865ddd1aa02c6232a0ae56156507888", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780498537, "uuid": "0fe5e059-0199-412a-90ca-24ff7f0beb00", "value": "T1FED18D30771738A906459C635140E13413A851ABF059A863BDAEB6CA2FBB9A3CF5CDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780498537, "uuid": "f4ec801b-41f6-443f-8241-451c93071269", "value": "96:21NeUkolrAvgOkPST5lu9UhcZ60eztfUbmt96KgsbJDlL79SpYlZ/BnXMkLyCBTW:21EUR7Au9UCI3gs1DB9KYlZ/BXMkWkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780498537, "uuid": "b1eccb16-6ad0-4753-a3bd-685042709096", "value": 6261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780498537, "uuid": "2060d0b1-f669-478c-ae58-87879b556e89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780498537, "uuid": "fb69f864-bc90-44ee-ab40-c55ec12826cf", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9184d524-5f9c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780526148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526148, "uuid": "999d26e0-6122-464d-8f31-0dedeb6a7cfb", "comment": "Malware payload (AsyncRAT)", "value": "303c9e0418c4905e9d8f19d4f5ecb542", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526148, "uuid": "0e3dbf8f-0e1e-4562-9ea1-f897c762bc64", "comment": "Malware payload (AsyncRAT)", "value": "ad26107885d09d73e83460464ffaf9cc2c3332a61971d07eb99fde546b1a9fb9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526148, "uuid": "3b0d0620-db0f-4cb4-a583-b31955a26b86", "comment": "Malware payload (AsyncRAT)", "value": "898d2a604c72bb2726430cd0943c61265a81c949", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526148, "uuid": "b8e9a3ce-4bf5-4648-a92a-897cb37c3e4b", "comment": "Malware payload (AsyncRAT)", "value": "da38581db5c741d698a29f8cc57b9dfc39d31805aea22dfee6ffa9100a28df4c04bdbdaf3ad43a45bd157de2ea5a6294", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526148, "uuid": "a2eed3e3-9d99-4961-b9ea-19b0a200a53b", "value": "T1FBF53A416BE8CE1BE1BF2775A4F201111BB1E449A732D78F1698E6792C637406D0A3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526148, "uuid": "20846e8a-9283-4b18-a4f8-d9ea2db1ed71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526148, "uuid": "725e50f1-2019-4ba6-b9ff-e280d2c2bb8f", "value": "49152:MK0iW8MUMQn9F12ShzPMAzU0mdBdo+6WuDayPJr/NxJ:MpUtnMS91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780526148, "uuid": "165a3d35-27be-482e-81d0-c61f16696089", "value": 3369984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780526148, "uuid": "b8ca24d8-1c5d-4c18-8080-bfe29bc11beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526148, "uuid": "f518d045-ad98-4701-9cc7-64d49374a9a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bead26a-5f85-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1780516072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516072, "uuid": "473d5f27-4401-45a7-acf4-8cba1fa8d0e1", "comment": "Malware payload (SimpleHelp)", "value": "cff62800e5d57b6dd07e86582c0b8e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516072, "uuid": "6bc82aaa-35e3-4017-a8ae-b947fd524260", "comment": "Malware payload (SimpleHelp)", "value": "b195d942890e926b5525d9f419523834a18016fa5db7d3c1af3858ac68309028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516072, "uuid": "44009217-b72b-49c2-8545-db0d326e0cd8", "comment": "Malware payload (SimpleHelp)", "value": "66ba06d3c225d1479ca4cb7dc331cb8a28d86179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516072, "uuid": "154b9bd7-6445-41cd-8f24-109e744a104a", "comment": "Malware payload (SimpleHelp)", "value": "739766e2c4b75d013a64ccd743c1a56ad072598318169b007807a11af511224133afca6808aa9df613fbe7e74c996c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516072, "uuid": "c5d8dbde-e5c5-4dc1-a6a1-6256aac471a3", "value": "T1CFF6332BF65A04FAD877D538C99542A3FB71B156032962D707A48C361F7A3E5223B30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516072, "uuid": "23f3daf2-77f8-47d9-90c1-e7add25a6abf", "value": "4dcdd102066c792bcf91dce0ad10afac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516072, "uuid": "66807983-f257-4a38-8fb9-671563251022", "value": "393216:wJrPSIwPrxgU5+0QXcZBae/2TonNiY/x10CFDN3cccQrgeQToFFWJi:groPVk0GMb/Ji4x1NDa88Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516072, "uuid": "f3e7dec7-19af-4cc1-a738-514b311a39f1", "value": 16663128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516072, "uuid": "950fa78a-7b14-4150-ab0d-36a006631826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516072, "uuid": "d818daac-c6fd-40a1-8499-9273607bc16e", "value": "453SSA-D0CUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1aa1cc2-5f49-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780490661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490661, "uuid": "0fd9b054-dc6f-4ba4-b246-683c0c1a7c50", "comment": "Malware payload (AgentTesla)", "value": "34271c407f08aefa33db7e21312254a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490661, "uuid": "5a554dd1-a7cd-44f7-b7a0-0b4aa9ca5144", "comment": "Malware payload (AgentTesla)", "value": "b27b61b8c6c2856bf8e5a2f0a2fcaab088dc19604d18f7ef2fe3436415bf6dd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490661, "uuid": "1f9eec7c-522b-47cb-8a79-dfb4d7133ed8", "comment": "Malware payload (AgentTesla)", "value": "46be7792363767ad64a04f59c7dd621b09ee992f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490661, "uuid": "cd7ddef5-f1c4-4431-bd8f-03c3dc30f8db", "comment": "Malware payload (AgentTesla)", "value": "728c174b3d49ad0ab99d8b811cd037aafe3d49ecc63031927d6b3929030277fde027b948730e199fb9774c2600493e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490661, "uuid": "def9087e-f8c8-49f7-b433-7a76058a3d30", "value": "T1BB05B08CBCA84FCFE7BD67B2BEF5847514A79CBE62E1125DB575923006A3F520C4A009", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490661, "uuid": "b81c1583-8610-44ed-b5b6-9f08d690f0b1", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490661, "uuid": "26d31f38-09dd-4517-b308-71d5ac81bd87", "value": "12288:BlnKTyFe/oWvnpaj+yPwPsPij+PR88XK84/DDElqZNXNKnpFKVqFh5GJM6d/YYdj:LnLq7/MlQWKoFKZv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490661, "uuid": "9880255e-5e08-414e-8b3e-98e56083928f", "value": 796096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490661, "uuid": "895ae9c4-0425-410a-88a8-754de3441c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490661, "uuid": "a2983f2c-8877-4dd1-b1b9-3ccebcb874c5", "value": "order059968878465-600697987991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a40192-5f87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780517268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517268, "uuid": "387bdb74-3cd9-421d-b2c3-274eabaa701a", "comment": "Malware payload", "value": "fefa490e855a61be4a8cfba3b7bd8560", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517268, "uuid": "1e5b909c-45ab-4980-a1b5-9864ceda2016", "comment": "Malware payload", "value": "b28db71a7701c2d816e5a59a57974eeeba3342434b07a496747f6f860d1026c4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517268, "uuid": "0343e484-2c23-4c38-8e97-507ec9a5526e", "comment": "Malware payload", "value": "e03b9cf6fc61630e088b18c998703d5b7e931ad2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517268, "uuid": "4877bb4b-63aa-4e65-b4a6-400b70601ff6", "comment": "Malware payload", "value": "789e1ef6d71529fc9df5994069050829780c2251301703bb70d689d72fe89aa7479f35a41c6d132afb4044cd9a802c35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517268, "uuid": "104e7a8a-715d-425e-8d25-db7f19c40d9f", "value": "T1EC136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBF8B3CF18C15A9CE318B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517268, "uuid": "99690e52-de46-4d66-9f5a-6bb0b03d7d1a", "value": "768:kr9NyXsZztCw9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:CHusZAco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780517268, "uuid": "b21d0764-873c-4cdd-99f0-55bd57e45614", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780517268, "uuid": "71fe45e7-dc63-4c29-918b-f02ca555acdd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517268, "uuid": "5c3e7a00-1433-4ecd-af20-3e16ad6b3590", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d90ff71-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780469743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469743, "uuid": "954fc0ff-33b8-4946-bf8c-60dad849f70c", "comment": "Malware payload (XWorm)", "value": "fb45a1fa4d286cea084142f3485e96bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469743, "uuid": "559550a8-930d-423a-ba4b-06f8d797151f", "comment": "Malware payload (XWorm)", "value": "b31714535f67657f69f78270f4e5f806939a1687f6f5ec055ace6add52b4ab50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469743, "uuid": "6e3061ac-dc20-4cc8-9114-59ebc3a87d48", "comment": "Malware payload (XWorm)", "value": "1d8c8f0889c9d3782e991e42ce1cc5665e4e81c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469743, "uuid": "7cf05100-4a55-45e2-a415-216bd9b0262c", "comment": "Malware payload (XWorm)", "value": "65fec0a07c992297ae9e84861f4a398974213190310a66caeaffba908f02cf3a827d28f4e55d86268b842ad39136c18b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469743, "uuid": "7965fa62-d225-4f89-9b5f-29f779ac7221", "value": "T1F435E0D43722AF05CF9A1A30C576CD7852931E987D22BBD22ED93F573DA91206D0CB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469743, "uuid": "e068f361-88be-42f7-bedc-2c2c61dd7c97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469743, "uuid": "5290d945-e9bb-4555-859e-785eacf2c5c1", "value": "24576:HJjBVYWiMjfmBqQ45nMhJeDZeMLewlpVhKD/7J5v0iaRjJ:fVBDbO+nWSMMXpVhKD/L0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469743, "uuid": "7d6e5212-40f0-4db2-9f3b-e1e11c52b71a", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469743, "uuid": "14d3cbab-f8e5-46a2-a2c9-010ab306b951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469743, "uuid": "9e9b7d2e-28d9-44d1-93e1-7ba09c24e6c9", "value": "QUOTATION_BISCO_0581 A105N MF471.pdf(983KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc44c58-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529897, "uuid": "845e8112-7590-4e9c-b3ab-0d67df496724", "comment": "Malware payload (Mirai)", "value": "e1b59e50da0584c0b9d59fd0b8fb0434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529897, "uuid": "bb5e9bd3-fc22-4410-b821-47238a1cea0f", "comment": "Malware payload (Mirai)", "value": "b328c7703c8bcf91268c616a6e709c4bd8df936ddfdb082ce50d742380a02d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529897, "uuid": "954dbc26-5f6f-4d27-911c-176691a981d4", "comment": "Malware payload (Mirai)", "value": "074b8e340b3eea10b79a24c1227b3d919f766298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529897, "uuid": "eb1d391f-65cd-458b-9a4a-3380afc7450d", "comment": "Malware payload (Mirai)", "value": "5fa4df621c3b51775e525234704ae5910766100db55cdbc827f5f59c2d968ffe41694933f0c7745aa0c6354cd780be52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529897, "uuid": "bf051300-d39b-474b-905c-d099227e3e1a", "value": "T1B66302F29AB63F4CD530E17C759E33EAC91C406398D292C7AB4716B872164E262313F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529897, "uuid": "462a5a80-9952-443d-a619-8922634ea279", "value": "1536:dEd1viGwizBlIRUojJEKOL7CGfSywJ3sB37GH+7rPE:sZiGw4d4JIL7ZS73sAH4rPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529897, "uuid": "24428642-e1ea-4e23-b6ad-54d587b9be7a", "value": 73044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529897, "uuid": "13c981c8-a1bb-4e51-b960-a86589377a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529897, "uuid": "ef8522bf-8769-4bad-87a0-a5bd30586542", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bc0e56-5f55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780495661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495661, "uuid": "cc9b55dc-35fc-4001-ad56-e04dbc28c891", "comment": "Malware payload (Mirai)", "value": "858707d4532f8fb69facd440e134ebd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495661, "uuid": "0f687883-3c9b-4aca-ae73-a6e7af5f558b", "comment": "Malware payload (Mirai)", "value": "b32ee262443aa29ada3ad1f806772497b2d33b15ff1e57b68e43209c61c0764b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495661, "uuid": "04c26020-82a8-4653-b6f7-11ffb78bbfc0", "comment": "Malware payload (Mirai)", "value": "4f2c600f2967d4188b6baa3ff8f3b974f74e97dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495661, "uuid": "2c22b391-e510-432a-849a-61832c96cad9", "comment": "Malware payload (Mirai)", "value": "f5150fd05f4a568f6062d3592d48154947e56fda3be94ef854cb7fcacfaede693c1479668ec78aac01af1a24b8a4994b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495661, "uuid": "b9a30686-54b7-418d-941b-6c6731db4699", "value": "T1DDC307D7FD00DAFAF80AE33648530406B130FBA649915A376257353EED3E1991877E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495661, "uuid": "b6ddfe7e-e426-4b1f-b497-bbdb4d68444b", "value": "3072:udXZ72yqqhEfqmu9qP7JBVDjbivLjpA5ImEVISu:uWyqkEf9u0P7KLNKEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495661, "uuid": "b59dd48a-9172-46be-9100-b3fa2493188b", "value": 125676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495661, "uuid": "de4063f2-d9da-4bff-9bad-02945e19754a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495661, "uuid": "91b2d18c-7f70-42b0-b9da-7e5f7d8b3676", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63996f70-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780469807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469807, "uuid": "77a19a1c-35ad-4cfb-a104-349db92e480c", "comment": "Malware payload (AgentTesla)", "value": "db4aecf750a2d2b159ef4f940dd5545e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469807, "uuid": "f4c831f0-adf3-4803-9eed-fbe430508d7e", "comment": "Malware payload (AgentTesla)", "value": "b41c4326c24d06be0772d6ded4cb1cb50b3b69f5f38c59b3ac8b9a7248439b3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469807, "uuid": "df78cb51-2c51-43b6-b287-f45814a46725", "comment": "Malware payload (AgentTesla)", "value": "c3cb14ce658258289ce0d50e9d7c366acf7ed8cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469807, "uuid": "0358bf53-8bcf-4fee-9fe9-e7457add1380", "comment": "Malware payload (AgentTesla)", "value": "baa02dd9dd6e83b03d040e307a48c81e955fb2c1541f7246ca938af0ba5ea9c2418a12597647f3987625ec70c84e5bbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469807, "uuid": "dcf1edfa-f0c4-47a6-ad57-27dbc7244e04", "value": "T11016C4C507818471A66EB79CC17AB520A41F10136BF6DF0230DECA74BAA8D77D385AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469807, "uuid": "fbbd951b-249d-4a50-a0ce-a0f7175bd02f", "value": "98304:EvYu1eseN73clqbACRlXejUysB27DYIjfI9NFjHL1xp8AORSWFI8Z:EZQseNbclqbA4lXlb2/vjw7t/p8R8MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469807, "uuid": "601c9efe-249e-4451-8bbd-c8ecab77fb54", "value": 4405832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469807, "uuid": "cd625c92-db78-455b-ac44-9ee8e9fb31db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469807, "uuid": "311661e5-c2af-4a42-9fda-c8272cf7458e", "value": "#DCFLE.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eab45e2-5f76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780509715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780509715, "uuid": "4e7aa875-3f29-4d0e-a28d-12458e7267d9", "comment": "Malware payload", "value": "bdcbba777a11e31da0d6606431bb070f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780509715, "uuid": "6ee5ba05-192e-4879-aa19-971e2fe5fbb6", "comment": "Malware payload", "value": "b6546800604658d98784cc9a3bdf8c9a9a345a43e7d925ded86de59c75a7ad9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780509715, "uuid": "395a6442-cf3a-4fc1-8f4e-c08e2be1f3a6", "comment": "Malware payload", "value": "6e6a74d5d61181326ca69c874b33c8f456fca9c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780509715, "uuid": "02854e40-c598-4479-a9dd-d4378a3245af", "comment": "Malware payload", "value": "f426f2a9c5b4886821635e25c9bf69af010516228ec77405ca7ac85c818c61eed98e9d68fc1ff8ed4b12834d3f70425c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780509715, "uuid": "051afaa8-3d63-4341-9395-164186749906", "value": "T17AD5E03FB28B653EE06E5A367A72E210583B7661A5134C1697E4C88CCF150B12E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780509715, "uuid": "4df73752-7ed5-4e15-aa50-85b45d8b88cc", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780509715, "uuid": "dfdffe5d-774c-4587-9471-c72aa622ad2e", "value": "49152:DuI2h/WKt/RDHZyyUXxh4yEieRz8ldRv6Hh2FZAr7jt3mwUKMDwph:D5O/W2RD5mwyryolXYh2Fur7jtJaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780509715, "uuid": "2f7ebffb-34a7-471c-a303-294cfe326a2b", "value": 2883768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780509715, "uuid": "4029d19a-dd4c-4e52-9eaa-9adddcf172e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780509715, "uuid": "5eed4401-ba99-4e84-a589-e8c91cb83332", "value": "CraftStartLauncher-Setup-1.0.0-win-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49c7c2e-5f19-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780469970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469970, "uuid": "4a274e88-2771-4615-93af-49e8e4007f38", "comment": "Malware payload (PureLogsStealer)", "value": "891042ffe52ed63f882b70aa91dddb2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469970, "uuid": "84b48ef9-bb1e-413f-8bca-694a5e46f7b2", "comment": "Malware payload (PureLogsStealer)", "value": "b95012a5ed4784b632680ca3291db8dd17908c5137279e190a06563cd111665f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469970, "uuid": "c2e691b9-dbb7-41fc-923f-6933531e9d22", "comment": "Malware payload (PureLogsStealer)", "value": "9ed69eb84c90fa39dd367e0fa9007573e41e6b4c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469970, "uuid": "6e181aa0-18f1-4f91-8ffc-8fa0c619006b", "comment": "Malware payload (PureLogsStealer)", "value": "c1737a61f53c79635b36e0530ee99a816e62066c97699ccb6c8902d38dffdf5c9d46d52286a63674c768577b19b18ae5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469970, "uuid": "263774e4-997f-4b36-95a9-346db4279cb4", "value": "T14D05F73DC954412EE176D728C55A085FF8872A0B523CE84B64CB278FAF639427BD236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469970, "uuid": "6974fae4-7885-4201-a96d-1ddd230542ac", "value": "3072:qv8oI0pZbs1LeGESQHQX59JYfHQFwP0f89Re9OHpHjICh5FzsQN/fKe35mkzTHdy:IZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469970, "uuid": "ab7719ab-154d-4bac-b08f-4e926de81d7f", "value": 810368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469970, "uuid": "c78bf3b1-3c78-4b2e-844d-5d958652694c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469970, "uuid": "c7a2d374-71c7-4815-be3f-615a4840e0d6", "value": "Remittance_Advice_50percent_Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5be2749-5eec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780450617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450617, "uuid": "fb6f8d62-3774-4dfb-ad08-6a571e476bf7", "comment": "Malware payload", "value": "ea516a359712ea76838f34a6cf585e70", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450617, "uuid": "85f6d9e2-ecf5-4784-9831-baa0092a34ce", "comment": "Malware payload", "value": "b987be34f1c6ded1d8051137b403e2a71d5e8959a69c92fddcd8d4f4cc372f48", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450617, "uuid": "300c76c2-cf6b-4e2e-8c0a-d5f986b8a748", "comment": "Malware payload", "value": "9fa77c0a090cd5752cf9890490e9d2e4cb6b52e4", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450617, "uuid": "e4aff31f-4c03-427b-a6bf-63c68db39eef", "comment": "Malware payload", "value": "14d17e468850fa8b8b7c18703fe15d7a749b35a11324e59862cece4fb335b7618338283f9428ae7803bb8be881321ab7", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450617, "uuid": "3d25f02d-121f-4f09-8906-59244f5217fc", "value": "T1F3A6013BB14BA13DE46A1639B97291B0583BEE61A5024C0796E4FC4DFB35070DE3E693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450617, "uuid": "de39e03a-c9e6-41ab-ae79-92abe51da664", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450617, "uuid": "b475e04e-754f-4256-b568-5c511a80dcbf", "value": "98304:U5/L+QdozxBUSkwGJGK4Q4hK1oDjMyGTL64ZAsvcbyVVEIkWqG:wD+Q0ub0K2KaHsTL6QAED1kTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780450617, "uuid": "60b4c246-f8df-4dc7-af32-80f2c4b26dd4", "value": 10398324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780450617, "uuid": "d47ab331-7948-4791-b548-be4e730be4b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450617, "uuid": "7f170142-f403-44ea-97eb-e4d2d5c87e5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c43103-5f8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780519362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519362, "uuid": "dd0c4156-bc4e-451b-9b94-ba65e4b2ca57", "comment": "Malware payload (Vidar)", "value": "ae786a448fddb4c78862730b4e2c982e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519362, "uuid": "072e4f42-dad2-4af6-a635-c0a86bed06ac", "comment": "Malware payload (Vidar)", "value": "b995588fad08637d0a5e77ffd0e4f176df4af63a6572db71653c78b2a3a277e8", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519362, "uuid": "54371ddd-f823-4c23-ae5b-497adbca1293", "comment": "Malware payload (Vidar)", "value": "12ca130370b2789ee0a6b9a7463aeef03b01add4", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780519362, "uuid": "c79ad492-64cc-4459-9555-61a8f7b7ddb4", "comment": "Malware payload (Vidar)", "value": "fafd84090112786f783949b0d9ff6e0402bd25ffe5693302ceb51b123276b88cf3894baf78ec9359d2568e43fa892dd0", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519362, "uuid": "c85403ce-78fb-40cc-892b-5b0c5cad17ed", "value": "T1FBE56B437CD048ECC0A9B33589B17296BB75B8191B2523C72E526AB93FB27D0AD77740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519362, "uuid": "588026a0-eea7-42de-acd5-6afd969d51d2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519362, "uuid": "21b911a4-1af6-41ff-bc8c-49a28896809e", "value": "49152:nU/3hm7wK1Uqfibn9El+hum6e7sSRgN9XZ3RDfWYtVlnn:nM6tlK36QsSRgN9XZ3RDfWYtfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780519362, "uuid": "99bd9d3a-8e41-4474-a9ae-092e7171175f", "value": 3219080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780519362, "uuid": "29d39d89-b4d2-49c9-9393-b065689641fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780519362, "uuid": "520d8e83-ae37-4a1c-8cbd-c6940f865238", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24b3fe2-5f17-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780469107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469107, "uuid": "1f297ac5-d757-49e0-941f-d335c7ce2acf", "comment": "Malware payload (NetSupport)", "value": "f98122ea81e34a97e23a5f3d802284ce", "object_relation": "md5", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469107, "uuid": "47d72b05-06d6-46e5-a318-08dae78e7b43", "comment": "Malware payload (NetSupport)", "value": "ba313fb944cfc9aa4c2ef7b375a6a53ed7445a1839d7447d41b7058251caf147", "object_relation": "sha256", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469107, "uuid": "73dcb400-62b0-4669-b93b-8640163e6e4a", "comment": "Malware payload (NetSupport)", "value": "b9fd97cf51c5f3b1082bd78be995e702070190ea", "object_relation": "sha1", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780469107, "uuid": "a02d10ac-bbff-43c3-a9e3-5b2911277029", "comment": "Malware payload (NetSupport)", "value": "f0d4ebf211c6457d52583c78c38742b78905d9ca40d0d4152297ae69f28084ffaee47e9d0bc14c3c8f37176442b11234", "object_relation": "sha3-384", "Tag": [ { "name": "djkmgndkjfgndfg-com", "colour": "#42BA6C", "exportable": true, "hide_tag": false }, { "name": "iisexpness-com", "colour": "#1812AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "printerdrvrs-com", "colour": "#5F86A4", "exportable": true, "hide_tag": false }, { "name": "skadfjsdijfhsfso9to-com", "colour": "#98E86B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469107, "uuid": "70ebc95f-65f2-4d04-808d-d1e1478bb2a5", "value": "T1FEC5338EAA4D84DBC5674F75800B5E1EC33E3940E2ADB081E7318292CDDDB8B976971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469107, "uuid": "88250eda-4fe0-4a10-a5f7-dcc09596850c", "value": "49152:vfstk5WKcqua+NtGfYrp7VnqVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnu1N9T:vEtksquzNtKSJq/VYj3b2+30/wBQVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780469107, "uuid": "b67c9710-7667-44dc-a26d-ddaa2317b293", "value": 2535013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780469107, "uuid": "83a10737-37e4-41ec-9cb8-5fcafd64d446", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780469107, "uuid": "4dd43a2b-47b8-4cf4-83c4-0e37146db0b3", "value": "MpOAV2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c36b92-5efa-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780456526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780456526, "uuid": "0708eaf0-629f-4272-a6ea-846ffb65a5d3", "comment": "Malware payload (WannaCry)", "value": "4a85dbf0a781118a335afa44dccb32f4", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780456526, "uuid": "3ca441a7-44d2-4a82-ae47-01a3acb93759", "comment": "Malware payload (WannaCry)", "value": "bb7d8002440edff52c3f1dc91926e3e5deac49fdd425d2437cfa59a2d3cac541", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780456526, "uuid": "ba9c89b5-6d31-4ef2-bf10-fbb60775f806", "comment": "Malware payload (WannaCry)", "value": "adeb73826483cd5ccd4c2eb53aadd83ca1f53a4a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780456526, "uuid": "18e328fb-8170-47e4-8a6f-79cb6fe39eb7", "comment": "Malware payload (WannaCry)", "value": "df24cfcb97fce60608ec5e1f8b403b0d8c05eae0bba737b19348cbff1db3a1022256af65e5ae169703c8a96cd6f458f8", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780456526, "uuid": "461ce86e-5b21-4cc7-b915-5eece30e1997", "value": "T1F736234931B881FCD106197484B78E16B3B37C6A22FE5B0F9B40867A2D13B56FB64B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780456526, "uuid": "c8f1904b-dac8-4da4-ae42-c057f7dc4125", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780456526, "uuid": "167b783a-0ab4-4bd1-8562-7ad5fd8cc230", "value": "49152:jnsnHqMSPbcBVQej/1Ux+TSqTdX1HkQo6SAARdhnv:DMHqPoBhz1UxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780456526, "uuid": "9a4e585c-cbe7-4f26-8cbb-53d973c03433", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780456526, "uuid": "9d1a72d6-4a69-4d63-a8d9-0025547dc868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780456526, "uuid": "7c0891c0-5a8d-4afb-8410-ecffbb15a575", "value": "bb7d8002440edff52c3f1dc91926e3e5deac49fdd425d2437cfa59a2d3cac541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597981be-5f28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780476232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "d5c9c2e5-3c05-409f-ac33-153333a16309", "comment": "Malware payload", "value": "5073809fc80f0582ec5d95f544b0dd7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "ed29287e-7dea-4722-9c2a-b0dd8684a857", "comment": "Malware payload", "value": "bfab96ba9cc070006e1cd2b793ff14b896ac468002284253eeb36a514b532205", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "c7bbbdf5-9570-48d5-b112-69782933edf5", "comment": "Malware payload", "value": "9ad7295dc9e9a4b86ef4e0beaa6bd29c430fc842", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780476232, "uuid": "48d63a38-6007-4a39-9a23-bdba3eb68253", "comment": "Malware payload", "value": "e47b1e55272bd7c980f5e5fbe84ee72906cf5cfc27dd676306b5fd794c1b66f8e9ac58c49fb422e13a2edab3dc2e9194", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "8999d8b3-7736-43a5-aec1-d07a0dcd14c8", "value": "T19705336D07AE31455FA74D46BD6B730090F26E943AE9DE0445EC2D3E23EA1F0AB10A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "98541182-542f-432c-8416-d67a23e946e3", "value": "24576:vnhRZ4obEZv+RSil+j6okRY/zF1qwuXF/:J//bOOl+jaqPeF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780476232, "uuid": "79a786bb-5019-43a1-8424-4cc3aa3b52da", "value": 801356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780476232, "uuid": "c02d72f1-94f2-49af-b6c6-9444bca845ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780476232, "uuid": "d8f5946c-1908-43f7-9032-3a9328064a47", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106485c2-5f38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780482982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780482982, "uuid": "8b50290a-a710-483c-8fe0-c4934b31da47", "comment": "Malware payload (Mirai)", "value": "5a7cbe65392a279a718f822a06277030", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780482982, "uuid": "eb414366-f080-461e-b15a-7519b22b913f", "comment": "Malware payload (Mirai)", "value": "c038cb040eb402241220baaf169bcb208181e9bbd87f502b7d0cfc3c9c81b114", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780482982, "uuid": "62f86fa8-d408-46ab-8d97-c03d9156396d", "comment": "Malware payload (Mirai)", "value": "acaba6c5f1daff548fb9a5d4c253de1942362619", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780482982, "uuid": "579add5d-3f90-494b-8fad-78ad49504939", "comment": "Malware payload (Mirai)", "value": "796bbaf95f18d92c40f26502c60e97de139ae86bc52efb247ef3621be7967e3b7ea3959db3f58743d20fe16e9a1aa0ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780482982, "uuid": "62b5f952-b947-4a6f-a43a-aafaa85981e7", "value": "T116E0DFEFA5352112D018DD41B0A3CE49A0B7F3D916908A8E7CCF34E584C8688F66CF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780482982, "uuid": "e6eb53fc-700b-4364-97b3-299446987e36", "value": "6:sGj5AANaa6uy15AAPKjX5AAvbT4eHX5AA6KH+NF5AASanGK0:sGj5AANf3M5AAW5AAjTFHX5AA6pX5AAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780482982, "uuid": "233bccb6-0e4b-41d6-9b68-a8053b1df6ec", "value": 354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780482982, "uuid": "0dcada19-c4ff-43ee-a0d1-c7104ac81b8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780482982, "uuid": "923728a3-cd7f-4831-a598-deb668337f0a", "value": "c038cb040eb402241220baaf169bcb208181e9bbd87f502b7d0cfc3c9c81b114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd19451-5f05-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780461154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461154, "uuid": "4ecc136f-745b-44e6-9014-8ba5d57ed452", "comment": "Malware payload (SalatStealer)", "value": "11ce29ac3df8e323c9e86e97957fe274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461154, "uuid": "58f6018b-5f0b-4e22-a5b0-207b6f8141c9", "comment": "Malware payload (SalatStealer)", "value": "c04e023de74d85739119b52b182618f34181f4ba532e3a9587fb95a17c47d409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461154, "uuid": "9f290ad4-920c-4096-9258-beefc1b66c58", "comment": "Malware payload (SalatStealer)", "value": "44cf0920d66d3615fb1de8f1141ec608a370da97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780461154, "uuid": "0d1d7c6b-d9d8-402a-828f-a6e9eb7493a8", "comment": "Malware payload (SalatStealer)", "value": "e242f3a4eaecf00ed0ab353ef7de371341bac49fd9b7f52c04e4afd4031a3e9d3226ad065e465c12fe8c3ba0474eedc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461154, "uuid": "25d7155a-3c49-45c8-83ee-a65c2ad9020d", "value": "T14FC65B11FADB95F2E903583141ABB37F27315D048B28CB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461154, "uuid": "46d6a551-34f7-4137-bf7c-b38f1a4a55d3", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461154, "uuid": "7e0862ad-7cb8-4124-84db-9f42753eaf50", "value": "98304:1BbA+H15zAC1d08E+Dbd5D4j3Hxm/ENvO/:U+zrd/NDxZ8llO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780461154, "uuid": "f89ce4c1-1603-4fd8-a742-748e53891a4a", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780461154, "uuid": "c77fd325-8964-4d75-b718-2535578565e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780461154, "uuid": "55fd1811-8a6d-476c-aa54-52102b15dba1", "value": "zapret.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5339953b-5fa0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780527762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780527762, "uuid": "acffbba1-b040-4763-95c4-271c05a17252", "comment": "Malware payload (DarkTortilla)", "value": "017adc965639332a6d9a582ece8f4157", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780527762, "uuid": "3d5950d7-87dd-4343-b3e0-fb3d7817c73b", "comment": "Malware payload (DarkTortilla)", "value": "c093e62de0d3698993542326b687de25ce961fa940d05b79809bef98651fef0f", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780527762, "uuid": "3661e2fb-616f-46ec-9b0c-e81009a394a4", "comment": "Malware payload (DarkTortilla)", "value": "3bfd3812839ea3dcbdae1c03aada313e06a22cae", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780527762, "uuid": "66d8eecd-f485-4fe0-895b-3bfd135c5aaa", "comment": "Malware payload (DarkTortilla)", "value": "64d74acdd243d928f8c2bcc147e4b9f1cde28849a14a37796774723e1d6e869995361865965082117c951efeb1c44d77", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780527762, "uuid": "b392dfe9-a34e-44e5-a5c6-81a0e6a17adf", "value": "T14035011573E86A68F9BE8B384570132047F1FC0AC637EB6E7E5981EA5C31B429956333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780527762, "uuid": "2cbdd6a1-00f2-41b5-b1e5-a0d1c2048311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780527762, "uuid": "4c05d57a-da68-4c20-8039-ebcebb682ae5", "value": "24576:T7v9KB4FjCrObFtcZXpljwTUTDWh672xGgzYC:a4FjCabFq1pien", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780527762, "uuid": "8680960a-56b8-4312-bcd0-a9e2f8394452", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780527762, "uuid": "effc4867-d659-440d-bc4a-57daa1352f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780527762, "uuid": "fcbb0d9e-7f0d-452c-8119-a6ead84aa73f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f33c01-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780494990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494990, "uuid": "76d4d104-27da-4efb-8054-3091da289640", "comment": "Malware payload", "value": "8cfc7903a392c590f3e8686bbbd8b219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494990, "uuid": "fda4f1c8-9036-41f5-9f6e-932d876a5c08", "comment": "Malware payload", "value": "c10364a6058731ca9e23749a298077f29d071b0f910da155e1d486883fd4a151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494990, "uuid": "282bc44b-7300-4dea-9de9-e4276e48950f", "comment": "Malware payload", "value": "8512ed31375e1abdd6a69a9b20de853893c71d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494990, "uuid": "4ecddff4-4139-4696-89a2-f9df1abb1df2", "comment": "Malware payload", "value": "17f71e666bbc23c1cf75780b4df8d92a40df8de9dc27ca66a767ee182c1be480bf8c1622984e47d70954ef81efbd48e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494990, "uuid": "b058a70f-4cf9-4a6f-a658-f68e0048814c", "value": "T1769633C9D6F6A454CD2FC9F8F5A34F5B8D445435202BA61F230CC478DDBBA8C626AE21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494990, "uuid": "e9ecff2a-e5fd-45e3-b1c3-68bd83324a3b", "value": "9a04dd44d612988612d7626c082c40a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494990, "uuid": "e27b3085-3c09-4bb4-8a85-87f1e2ae6822", "value": "196608:67BTHzj/VLfIubXI47lIBuXIalk/E8A6uGci0VxFpq0CFJQd+0tgfWn:QX7V8ub4470alr8AaqVxfq3JctTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780494990, "uuid": "5057a6bf-fb40-44b1-ad3f-b29e5e8b342c", "value": 9077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780494990, "uuid": "485cd074-972e-432a-9203-f413490429e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494990, "uuid": "3770ddad-1dc6-4b27-a680-309be566d652", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf4a2d5-5f89-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780518034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518034, "uuid": "1d473c39-4f31-49f5-9e10-78201a697e96", "comment": "Malware payload", "value": "75065e063ea9c5076aeb21827d139c97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518034, "uuid": "a2103831-2aef-413c-b266-bd8d9dce94aa", "comment": "Malware payload", "value": "c16a77c4f335e8593d0af48bd904fac7a9251d069c71d734030c54490558755e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518034, "uuid": "cbe77ceb-edc1-4bab-a071-2ff013e1f021", "comment": "Malware payload", "value": "645ea7900b2c0a0a067ca907f2f0bca718e6c5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518034, "uuid": "40e6f035-5996-45ba-b9b0-2327358648f6", "comment": "Malware payload", "value": "95c83ae1aedfda192c7eabf1b573b27c87fb9c81a999d7f8d0fc4fe4120c13e8c5fe6fc24d526c982113e2a52afb8f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518034, "uuid": "f8a1348a-6746-4c2e-8618-0414a0274424", "value": "T1E1565A17ECA914E9C4EEE531896691527B717C491B3123D32B90F2383F76BE06EBA740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518034, "uuid": "36dfd977-5d36-4c03-83b0-caa69ef93ff4", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518034, "uuid": "7060f27e-35b4-4413-b97f-5d24fc7110ed", "value": "49152:JX20HBDF0XYuEUXY5gkDSjm7LcEDLp4eHXM3u6MAi6GKQK1K6OQm8SI5E:JX5hOx4Cy4DOQm89E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780518034, "uuid": "da5a8b29-b212-4d43-a887-ec3e6c59b57c", "value": 6058496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780518034, "uuid": "3f306ef0-b3be-4c46-af37-590fb9ec9919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518034, "uuid": "7cc0f58a-c93a-4a4d-94e1-b2c63bc393a4", "value": "loader-latest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3f5ecc-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780529901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529901, "uuid": "85b91858-2cc0-460a-bc68-0e7152e5290a", "comment": "Malware payload", "value": "d7bba858c97531acefd3e5d0b44a76ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529901, "uuid": "33d3af05-8358-463f-9f8f-cc4417bee9d1", "comment": "Malware payload", "value": "c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529901, "uuid": "d4d48469-0798-49d4-bc7c-f45e1bc3c1f6", "comment": "Malware payload", "value": "c670bbcf70ba7c1d6168f36a55942f15d7a70e06", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529901, "uuid": "a3f8b28e-a978-4044-813b-290415ceaa9e", "comment": "Malware payload", "value": "ae6af30813776e618d043b4f5e4d117f8499bec774597b1549e14be8981c2b40a771074544d52a72af44ed50728878aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529901, "uuid": "c133ae48-1a58-4a0f-89e4-32f94b9faca6", "value": "T1115101DB0284EB72D65DC64EB7F4B174A10AA0C366DF9E08EE84582D8FD9D4C7296F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529901, "uuid": "2871eeba-56e8-4d79-a7b1-ba95f07002da", "value": "48:qIPmOm2JMI/y/biB87n7uZUSUScvyyyn2n2bwLNfvPoXerRORhM3IIm:M12JMg2biBQ7uZ02bwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529901, "uuid": "e2ed3033-6707-4bae-b284-253d11501fcc", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529901, "uuid": "d2974d33-e967-4cae-bc4e-ca3cd6004397", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529901, "uuid": "d6396bb0-b4c1-4aaf-a687-fad23cf7ac0e", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a79ceed-5f9e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780526942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526942, "uuid": "94cd77bf-2761-46e4-8a24-a543263e8c03", "comment": "Malware payload (CoinMiner)", "value": "4a3c39321b83f847bac5c9a8edeb3421", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526942, "uuid": "3a95e939-53d3-4c56-9ba1-0149c08215af", "comment": "Malware payload (CoinMiner)", "value": "cd4da450ee62fd96023c19139f977dbb924d0c631fa691d3c23370fc196175fa", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526942, "uuid": "3a24c346-9bdc-4de7-a17b-9f918c815d0c", "comment": "Malware payload (CoinMiner)", "value": "591e8ccf8b479adb959418454ee3a1861d5abdba", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526942, "uuid": "65d703fa-5775-4852-9368-5d170f1efde7", "comment": "Malware payload (CoinMiner)", "value": "f924939cbcd2e51479c7f5ae675b1f5b5e8f9925c5cf685ac35d0890396a251a1ea47747b6ad4388f2adbc5a47fa0e93", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526942, "uuid": "b798759c-267f-4ce1-ad2e-607ba746df3f", "value": "T1FCA5336E1B1094AED64FCE37621C0C4A5AB2BAFC657ECB898B5DF6180711AB7144F31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526942, "uuid": "9c70c524-226b-4673-9a3f-3ae72e4a7183", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526942, "uuid": "71e3d1b5-5179-44cb-af3b-ddf6c75a9fcc", "value": "49152:MWi2V2I5L+OzQlHx7Mz2jzuC+CFMMVYxmQd:dv06L+OoC2mChrYUQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780526942, "uuid": "fb5fb8cc-bf81-4b5c-b368-765972066bae", "value": 2201600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780526942, "uuid": "ed4e71cb-e28e-4de8-b836-c8e3d1fdfac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526942, "uuid": "f64d2acd-c23f-4d9e-80fa-e42d9e1015da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad72ee7-5f33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780480852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480852, "uuid": "9e331f4f-34e5-441d-a141-18487f710792", "comment": "Malware payload", "value": "ee3e38f15e7749c7943ec4b13ccbff88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480852, "uuid": "f5df86de-60d6-4ecd-aeb3-1b4320c7a92f", "comment": "Malware payload", "value": "cd9a398c85cde92482fe9a7c6015f4169d8f2d0a1d302ccbb738493794301a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480852, "uuid": "00b93436-111e-4757-990e-d427d41f4641", "comment": "Malware payload", "value": "6341e458c6882508a66d0ca7a6ccac59341430fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780480852, "uuid": "f4b2ff38-1915-4b2b-a7b6-866a80980beb", "comment": "Malware payload", "value": "f834e063613e500f12f07178a37d04467bc6a3e5e212c6b268ab9cfa25699f10878884ee622e28d9ebb130fdf905f02a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480852, "uuid": "d6dd01bb-03ba-467b-8646-d0edf5dbbf24", "value": "T18BD1A441A3FC862AE5FB4F38ACB3131516B5BE018D32C65D5C98424EAC72765CA61BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480852, "uuid": "df75989f-d89c-451a-b9dc-a92eebfd71f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480852, "uuid": "d8e752bd-f157-418d-bd9b-5aee9320176e", "value": "96:HZRletEvB4IVeJBb8Ws3K+TVw790jZlm//XwtC78drvxEPC:5XMeGyB3pVW98Zw/eda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780480852, "uuid": "3dff6562-bca2-41a9-b309-085b4ce69078", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780480852, "uuid": "2fa139a4-54f0-4ed7-a40e-f0d6f1aa94f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780480852, "uuid": "4813193f-6028-443f-9f70-4197e6d2cba9", "value": "rUltraRezendeSSAdvogadosAssociados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eeea4cd-5f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780494817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494817, "uuid": "d50e5624-c6a7-4698-9635-3bbb6396f162", "comment": "Malware payload (Mirai)", "value": "ba5453aa480c5a725e0e00cb952d1b25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494817, "uuid": "27564057-475b-4d94-b2f7-53deda6e2d69", "comment": "Malware payload (Mirai)", "value": "cf248507099aa074c966dc1a2d4b95beb86b464124a932f5a3472b10ba637340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494817, "uuid": "1a81d0f3-21cf-4aa0-8bbf-f48214511346", "comment": "Malware payload (Mirai)", "value": "aa5dce8b4264155cfd64809ce6e623976972cc17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494817, "uuid": "5964c4f4-edd4-4261-a3e3-4edd82ca8084", "comment": "Malware payload (Mirai)", "value": "fd130543012235d0d16422d6615c67a655efcc6ba4bafdb8d1163535595652233d35eaf2c2ec5d8745686a7e38d2808e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494817, "uuid": "ae7a16da-56de-4283-bdd3-26dc2403ba92", "value": "T15323F1044427A9709BB2A93EECF44B893E534E2C96C5F46B15D139582CC711E9F32ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494817, "uuid": "adf4660c-aa11-4652-8078-ad7520d3bb8d", "value": "768:ACRCrRTk45RMqINQc5o6c9g466v4mGA9ebV+OAdLCVrFKoxR4eiC69q3UELo:bYR5DMdNQc5o6c6466v5GAebNAlCZFzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780494817, "uuid": "ea527229-5c01-4b4f-8968-c05df0787691", "value": 46188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780494817, "uuid": "2c0264a1-cf54-43ae-91eb-20ce6bad3101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494817, "uuid": "561b567b-9d57-4b74-8666-165eb2e761f9", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc563890-5f02-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780460131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780460131, "uuid": "f6f1c428-71e5-4722-aee8-03369b498462", "comment": "Malware payload (WannaCry)", "value": "1b61960fd33fba07ba37ee57d5766eb3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780460131, "uuid": "be864833-b47f-47a5-a028-c967071fba3e", "comment": "Malware payload (WannaCry)", "value": "d008976e319219ff3b046c9d6adf90a3784d681fc0640d3df4f79b893d1be0db", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780460131, "uuid": "8b6c8aac-93fa-4e02-a9f0-f29c8e28813d", "comment": "Malware payload (WannaCry)", "value": "6a0df5a53a9f177ebf91e152975044289f8474db", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780460131, "uuid": "cf893100-1d54-41d5-9576-50f4612085c2", "comment": "Malware payload (WannaCry)", "value": "0ddbc1f5da18df087689125c7db5ade5f6b1fbbcfe06ec4b1eff99451b5b81262bc98aa36782fd22f775dc6f7a1327f3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780460131, "uuid": "46e1b58c-1402-49a3-87c1-f9135ac49111", "value": "T18E362359327CC5BCD106157884B78E26E7B37C5A12FE5A0F8B408A6B1E13B55FBA4B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780460131, "uuid": "51a51098-4da6-483e-af59-33050a0b4fe8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780460131, "uuid": "a108aba8-400f-4fc6-91c9-3b9ed59e88d6", "value": "49152:jnRnFQqMSPbcBVQejH1INRx+TSqTdX1HkQo6SAARdhnv:D1eqPoBh71aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780460131, "uuid": "a9711624-bf01-4136-b270-a291a8cb4b99", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780460131, "uuid": "24479b24-68dd-4498-b5d7-8a8942c7e100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780460131, "uuid": "07c3342a-8310-4be1-9788-250e3000fdbb", "value": "d008976e319219ff3b046c9d6adf90a3784d681fc0640d3df4f79b893d1be0db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1a59a1-5f71-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780507805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507805, "uuid": "03b607ad-cad2-4ed5-8440-ddb54c496354", "comment": "Malware payload (NanoCore)", "value": "53876c0e053ac8003e4ae0bac3d46b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507805, "uuid": "0f1c449b-ac63-48ef-bb6b-200e54640db8", "comment": "Malware payload (NanoCore)", "value": "d157e54b769c96ff86d7134f9111859f16014e58cfa4ec856992262a70802a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507805, "uuid": "56360909-6956-4834-ae63-9d7926b4a7a7", "comment": "Malware payload (NanoCore)", "value": "511e95e900efa7a398dd598afbf2c1f94d299e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780507805, "uuid": "737a0510-20af-4400-bc3a-a4cb6053b2d2", "comment": "Malware payload (NanoCore)", "value": "ba6d3094b3dc9fada333db8f2750345fc9149162e5c7371686dd332baa0a0aeb738ea3e54d78dab0dd9ad74ef71d14f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507805, "uuid": "7fe50699-4254-4a4f-bf75-c6745601cabe", "value": "T17114CF6537E4492FE3DE8678702242028379C2E398D3F3EE28D461B69F667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507805, "uuid": "f2ded4e1-a36b-4d33-9cab-df82d6bc34da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507805, "uuid": "251dd8e7-d081-4b88-90c9-86fa6b54fbea", "value": "6144:MLV6Bta6dtJmakIM586fA+eXcTTacsRy3Cj+T:MLV6BtpmkFuA+eXsaDCU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780507805, "uuid": "1ec98d4f-7400-438a-8cca-8dac9ecb2a2d", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780507805, "uuid": "d361d304-f149-4187-a06e-0958e85756bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780507805, "uuid": "e0871dde-bc22-46f9-a9ab-70e4783d9259", "value": "ph88phil.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbd6688-5f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780506652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506652, "uuid": "efa4293c-25df-4d66-86cc-c803d639ef36", "comment": "Malware payload", "value": "257904eecf1ee5599d58d64b666c29be", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506652, "uuid": "23fa6014-8317-46c6-95cb-1cd68cf192b3", "comment": "Malware payload", "value": "d40dbfcf19aa5735387dbd88e088464c4fbb29a0f7dc7075a83c714a98fabd52", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506652, "uuid": "85a928c1-3c98-479f-b307-69d3b5986860", "comment": "Malware payload", "value": "516628efcd1897d8481b54a4ce65200f091e7173", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780506652, "uuid": "5f362cd8-79ec-4c8f-8e68-dda37b5110b4", "comment": "Malware payload", "value": "97280172b1a963460bcf0acb34880fc73c90c53e20688cf7614e0eda3eab5f9200b730932c4fa0a12d771b9f5f01422d", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506652, "uuid": "55535bc6-11c5-4e2e-910d-ab94e4e89116", "value": "T14431A6847C0B1D5BCAC115B16E0B05AA3A167A10978B37029D1AAF706AB15924EDF250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506652, "uuid": "ff668f87-061d-4fc4-8ac3-15e6a61613c5", "value": "48:1ihj3/U8wz1RPdjfGakroqC9j8nSubutdazUs7:Mhr88OPdjuakrPCYSuUdap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780506652, "uuid": "6572f17f-5f6e-4bee-bdce-d140e6b1fb98", "value": 1664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780506652, "uuid": "438217bb-fcf0-438e-be51-b665f0ce424a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780506652, "uuid": "94c9efa2-05c9-49fe-af84-b243003bc47b", "value": "d40dbfcf19aa5735387dbd88e088464c4fbb29a0f7dc7075a83c714a98fabd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225c0fdc-5f50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780493320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493320, "uuid": "cae2159b-ba1f-4703-bb67-e8ac8f7e903f", "comment": "Malware payload (Mirai)", "value": "892347038ba40974cd6615f9f180294c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493320, "uuid": "ce91f506-dfad-40f1-9ee6-0c6100f4e555", "comment": "Malware payload (Mirai)", "value": "d4437715c226b314218b891c243b2792245fec8ffdb7248223673fc0c1082186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493320, "uuid": "a27783f2-3cba-49e8-928e-6c76bf1f88da", "comment": "Malware payload (Mirai)", "value": "3ad2930ad6455779f19d5243ec1fd881605ab087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493320, "uuid": "8366c65e-e658-47ee-959b-e325afa7eaab", "comment": "Malware payload (Mirai)", "value": "12354e9c0ed380170949a15403d696ff2d408ce657e52d3f392da8336621475fcff9f9c21ff2acf2e6db31655b5a17e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493320, "uuid": "54b8cb87-45cf-475d-a6f6-2cdf3cc47683", "value": "T137D3885E2E228FAEF66C873447F74925976C23DA33E0D684D29CC1146F2039E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493320, "uuid": "890323ce-38fd-41d3-aa6a-535d8b5e01bb", "value": "1536:GFnFdvCINFomHDTxnc/eVeUhCI+FlT9VKcNXE0O7cU:GFPbN6mHDTxn3eUheVXNX6cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493320, "uuid": "70fb02b5-7ef7-4ab6-95ba-dadae4d07555", "value": 137208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493320, "uuid": "e490f02d-2df6-4e03-bb68-ebc85af4eab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493320, "uuid": "15249e79-42e0-4620-a147-adbd2b8b6a74", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71af0b37-5f67-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780503331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503331, "uuid": "fa9d08f5-5012-483a-908a-cc00d663329f", "comment": "Malware payload (WannaCry)", "value": "008600df4ef9b87b749259c74965859a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503331, "uuid": "4ade5210-0844-43a4-aaf6-ebd6f3e52da6", "comment": "Malware payload (WannaCry)", "value": "d5a8f6f69e9da3b280b599ec3834b95aff7675c0444b97937b1138c9e4672ca1", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503331, "uuid": "4763c4c6-8b3a-4136-84c8-953108b13520", "comment": "Malware payload (WannaCry)", "value": "e1f6724722c2bd923b533d7b123802988661647c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780503331, "uuid": "4e9bb238-d4bc-4a46-9df7-8891e281ea99", "comment": "Malware payload (WannaCry)", "value": "b340f91d551cd24195ba16b72e3af0f3bb1a62d15ddcd733ec20b99912ddfddc462c94dfe490835b73e541da3c601141", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503331, "uuid": "0c1263f6-1a9d-47b5-afeb-3fd1b434aea6", "value": "T1C1365B037285C065C4280639CC6BCAFC65A3BD95FE2D910B3ED67F0F7973A85AA51B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503331, "uuid": "586862da-4999-4967-84c9-8414a5e21eae", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503331, "uuid": "8d144dca-bb87-45bd-ab7b-97df9c71832d", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0PSrHV7YoZnA/70CUiaE:jnXnAQqMSPbcBVarHV7YoG/QCnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780503331, "uuid": "4a5e867b-7bcb-487f-80e0-5b767e2ea92d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780503331, "uuid": "6cc785d4-b22c-4986-8ac8-2ad32861b254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780503331, "uuid": "414f359c-e092-49b3-b58a-611aa07e0806", "value": "d5a8f6f69e9da3b280b599ec3834b95aff7675c0444b97937b1138c9e4672ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522e6056-5eef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780451739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451739, "uuid": "1c7c3fb5-e771-47a6-a73f-0cb7d68ccccc", "comment": "Malware payload (Mirai)", "value": "af38c3be2ca77575f40d3b749095e3de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451739, "uuid": "e2bc0606-0ec1-42f5-97ad-127d08733b65", "comment": "Malware payload (Mirai)", "value": "d6b424304be476de65eae81a78a8bef591021e18483010837979c96f1c2b3081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451739, "uuid": "fdf2e28e-126e-4350-bcc5-7fef9d0e2550", "comment": "Malware payload (Mirai)", "value": "4aed1949741c7b56a8d7c10aa96ab504513b7ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780451739, "uuid": "e69d4322-1348-4182-b041-898faf22ad49", "comment": "Malware payload (Mirai)", "value": "1f9c16766069b9ae45e0c28606fa8054ab2dfa212aec1950369b778c8545d4e534c382b553447aabfe2407605e78e254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451739, "uuid": "d23198a5-9fda-4b32-aeed-1a5d1c766a36", "value": "T148A33962DC65AE9CD628E070F1B08F792B53A950A18B5FBE6963C3748043D8DF6453F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451739, "uuid": "56e7f989-2fb9-43db-9a4a-e6a8daf29482", "value": "1536:lyJWYoIdeZ4UZVfICMKpOotHZEEKTxbNylkW0bBQG/ogl:M51evZFIypQEKTxbIkW8BQ/gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780451739, "uuid": "2e65b6fd-0109-4861-a589-ab5ba6e6d754", "value": 103172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780451739, "uuid": "10c114f3-dece-4e0c-8041-535989f41e45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780451739, "uuid": "5ad53504-ba89-4c86-9783-138470f7b3a5", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e836d7-5f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780516755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516755, "uuid": "7d050314-8784-4bb5-aa2d-4f5667032b9f", "comment": "Malware payload", "value": "d557287b1f384762cce8022ae18be70b", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516755, "uuid": "92a2c431-52b7-4142-8beb-75c883e18755", "comment": "Malware payload", "value": "d8219ff7bb309b660a61008793f8250aeff1133be9be3a7747fba28500b0362c", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516755, "uuid": "a96dc07d-ef3d-4f1e-9fbf-d29c21f59299", "comment": "Malware payload", "value": "4c8fcd5252fbffeedd65658599d2d1c1fe824e96", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516755, "uuid": "7ee8b0a6-0b4f-4129-80a9-cfec9ca9f197", "comment": "Malware payload", "value": "4a230ab84e239243e11094bc8fcfd58966896df8029f253268aec0bc4680707b2b5848093592a3ccb0f73b0d2f83b66b", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516755, "uuid": "7cfa213e-2683-4d06-abe7-3feaa858cae8", "value": "T169272967E8D26554C5AEC170D672827BBB717C091B7823D713A0F3306B36BE0A6B6B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516755, "uuid": "1148f822-ba6b-4103-af63-e35e1c6b88d0", "value": "98304:JUOoek6NyfiVuu2gRRnyhT0yk2CeexpRCdI6qqavg9EL0T7E2lQRK6x:e7IATcRmk2CeejMI4avgqL0To2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516755, "uuid": "290535c7-89c5-44fe-ab46-1691c2580e64", "value": 21515824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516755, "uuid": "b4a69bb9-05d4-41c7-a27f-a7a14f10390c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516755, "uuid": "aa3281a5-ab54-4a4d-b0cd-a0e36b9ca33e", "value": "confirm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c015bf7c-5f95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780523220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523220, "uuid": "2181d1de-b56f-4396-8ced-6477a17360e9", "comment": "Malware payload", "value": "57ea6ecfed465b62db26fa4db56c622f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523220, "uuid": "b8a179ee-10cf-470e-a3f5-0313a55c2e44", "comment": "Malware payload", "value": "db6c67a4692e111e94a5d275d8c5b7f8a763f41696c8aeacabacb5254c9857cc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523220, "uuid": "88d295dc-7d4a-4319-957b-de19c983a96c", "comment": "Malware payload", "value": "654c51921a5c007f5a69d90eb3db4f1cff861740", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780523220, "uuid": "316954d6-d762-4708-9136-3787260f5494", "comment": "Malware payload", "value": "ceb2e16e164d0430ffd0d1948e0ef7121032f78593b596fb5e7aac0e00d425b9219fc6ba1e91947a5c21f1f139f57995", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523220, "uuid": "0ae779f4-f07c-4ddb-9d9f-3b8782fc654d", "value": "T190825B0FB8424726C1E100B09636967BDA79A87137C408DBF7D08ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523220, "uuid": "13bcf2c8-77f4-4ae3-a1a3-9b705b2e49e5", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523220, "uuid": "07f1a6f3-60c4-4e7e-a720-982041a40f60", "value": "192:04KaqCngTtXWQQzbytjt0CzSATzl/le6f2vKUSvu9zw+ghSMCgbO5qXEd/FN2GJe:T0W/ytwAN/0Gu9JgwMhoav8U9cA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780523220, "uuid": "f9322472-a2d5-4278-a105-042a4cb2ffec", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780523220, "uuid": "db70acc2-e603-4a0d-8cbf-b90db6a77c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780523220, "uuid": "c3b23ff3-55be-42b2-bba8-23ee2d64405d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b09e8e6-5f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780494999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494999, "uuid": "fa4248ad-65f2-40a7-bf7e-5a744080c1b9", "comment": "Malware payload", "value": "91b17ca0a943a4708e562b5716e1a840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494999, "uuid": "e136c205-a22f-41d0-b50d-07cf2a9fb446", "comment": "Malware payload", "value": "dd446df533e5e4dff2c3eee8e1d4bb41427800531fd03a739b1fb502354b243a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494999, "uuid": "a2fb7ef4-9f55-4385-b42f-539d6755fc3d", "comment": "Malware payload", "value": "975135366e167ddfe3dc408bef30c54b1e3a7e08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780494999, "uuid": "293cff3c-e5b5-42da-bbaa-544898f3c3c5", "comment": "Malware payload", "value": "487779f58a15ccf8fd99c563959775ebead3daa77de4ebd1287f620cd5d884a8c0fd14b7b3bcfc7a32e01d7f2d5cb1b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494999, "uuid": "e5ee801e-28d9-4851-a105-c08780509fc4", "value": "T15603F181E2450C72EBE4487FEDB90AC23DE755B8A2DC3B9327105D702A00CA5E5B8E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494999, "uuid": "7638f270-d6c1-4349-aa4f-ca584a789017", "value": "768:U28S024D9UO5N5vm4vnYhacb0lGDLr7hQfgqx2Hv5KWqJG3m6as3Uozm:QS8D9bN5vm0n1cIlMLmfgqIHvy8Wazm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780494999, "uuid": "b8c8eb8e-9217-4bf8-a8ad-fe1ce73d0ce2", "value": 39016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780494999, "uuid": "cd075b00-c3d9-4efd-9804-9cdd62d2cf99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780494999, "uuid": "7884c994-161f-42b3-80a0-c02cf58395ac", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abf7c16-5f3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780485630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485630, "uuid": "a348b0c1-d601-4824-8a34-f2aa70be786a", "comment": "Malware payload", "value": "6f0fe02675f67ecd195b97bbe1067ef2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485630, "uuid": "c5f2cf02-f768-4f4f-aeec-9620237dd747", "comment": "Malware payload", "value": "de1a4c4438dd69ea6c994b73f30d8ffbfed0f67d44aa5a7827949bf78e082d6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485630, "uuid": "d566bf7a-7710-46e6-baf8-32e6ef9be692", "comment": "Malware payload", "value": "5e2ba3c8e9077b8a212df37a7d71a95264b15ba0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780485630, "uuid": "56511372-2d8c-483f-bd90-e8668923290e", "comment": "Malware payload", "value": "589527a033f3fd8a574dd0d0c4f10f3733660609cd36dac367b6ca1b0f0fc91449c77493d50a6c7d10751c89fbdeaac0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485630, "uuid": "fe754a9a-7476-43d6-a034-59f88b2878b4", "value": "T16334F1198CCE21A04A3EE22ED69195151A9DBC56FCAF016F830E88317D79F4D2BBF543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485630, "uuid": "78171a8c-af2c-4d8a-a552-0a1346c4c1d2", "value": "3072:QfFnBGioKVZ05wgcslTgiKAbK3UIvqGe1EIpPPhHFV3VQEwwwwwwwwwwwwwwwww5:cBVLTuwZV1CN5tnVQq22pCDc+KyFw7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780485630, "uuid": "73a3600a-c390-48b6-b4ef-ed3dae043a1a", "value": 244916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780485630, "uuid": "24fdd785-a04f-42d4-8ef1-379d75115e4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780485630, "uuid": "ec3cc17d-c5f5-4539-93b2-e8045ce98732", "value": "Sulfhydrate.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031035dc-5f88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780517319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517319, "uuid": "025948d7-f751-4ef3-bb93-f5e0c6549a03", "comment": "Malware payload", "value": "f2834739cf8e78c681bae540b1cd5fb3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517319, "uuid": "2ce0ad45-fcb9-46c9-85ab-a04c6efb45a3", "comment": "Malware payload", "value": "e09d1d65dab0453dfa192e174c88f42f416e888e86759a83ba379363aca500a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517319, "uuid": "2cf8e541-2722-4a95-8760-65ef785ece79", "comment": "Malware payload", "value": "9252806396fe509c71a985f7b4acc8ba7283fc03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780517319, "uuid": "48527eb3-ce88-4d86-a51a-9816f9f7bb01", "comment": "Malware payload", "value": "fdba0c31c9f33820503a8dc24673d94b64232e1aa7b418ed019326c286ae8c85d0f5ce5c2028612bf07052b95c8622bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517319, "uuid": "9585e2cc-e39d-4822-8900-a48aef9563cb", "value": "T163C18511D79C1293F967033CADE30712DB70E8915B7B875B0DD5A11A6CABB741A31770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517319, "uuid": "76044b58-1d53-4921-af54-4c1f95c2152a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517319, "uuid": "ef11b4d2-7e35-43fc-9e62-becbbe9e0e6f", "value": "48:6JnjY3k8xLJpXsOVXWZY/Mc8FfxOzEvhpzmmIfib1gbmgDngdJNpjBcYoB1ulVaQ:WYZx9pXsO837tpkr2cYXHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780517319, "uuid": "57e6c2b1-0539-4299-93c7-8ea868645c56", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780517319, "uuid": "9aae19d2-3328-41e4-aafb-58305e6f936f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780517319, "uuid": "cc8d3241-7cad-461f-9344-869fc5e9dc5e", "value": "lwkgdfac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aa1bd3-5efc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780457436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457436, "uuid": "b5084514-01c9-482f-9ea0-23e2c2acb182", "comment": "Malware payload", "value": "0d3ca791b0e5cb0642a78f535626f642", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457436, "uuid": "1c3f12a7-f2ea-4522-b030-3aa838dbd6ef", "comment": "Malware payload", "value": "e22661ddac773e55ed94c6eaa60754e7faa3329bbfce2d02881b3677e9044ad8", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457436, "uuid": "80325c68-e729-43f1-a187-ab3942bcd0d5", "comment": "Malware payload", "value": "7b0a6123e7e7cb6b3c05dc7a0d340902f21bdf32", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780457436, "uuid": "37b34016-ff87-4927-a058-e7952be565cf", "comment": "Malware payload", "value": "389b89907912e5edf44a7722c449e23cfce023b3c2764cd54a35786b0532b6d76ea854d587c8b2d4b4410024a0c589c8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457436, "uuid": "aa56d14e-a717-4bc7-9541-3e56008ad252", "value": "T1D2F6123F624BB93EE02A2735B976D160543B7E54A5124C4792E4F88CEF258F02D3E786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457436, "uuid": "cd661ab5-de57-43e0-8a4d-b48de419cccc", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457436, "uuid": "a8fe042f-2da1-49f8-ba98-620f1113c22d", "value": "196608:gVUYRppH6xnfyCdJ3ddrGyx6ZpaBPcyrj:g1Rf6VdfGyx6n4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780457436, "uuid": "c3defc3d-65bb-48cc-a8f9-e3e64cec3eac", "value": 16175658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780457436, "uuid": "1093c419-51f9-48d1-93d7-933441932299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780457436, "uuid": "d8469b79-d46e-4881-a56a-1d0ee05ec5cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bca1338-5f42-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780487296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780487296, "uuid": "149c8ea8-38da-4f00-b8e6-ae6b08267bea", "comment": "Malware payload (RemusStealer)", "value": "47c46d38d0c1777792fa98449cc5026b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780487296, "uuid": "4eea5593-983f-4d61-a82e-26d97b10bd90", "comment": "Malware payload (RemusStealer)", "value": "e2881e5216805c5d592e1c3f4c20be417249dd9d83ad0d03fc6bce2e7934b54a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780487296, "uuid": "eb92275c-90d9-4211-b702-ae6d61234b4e", "comment": "Malware payload (RemusStealer)", "value": "91ffb630918409ce2e404a684e6be7a99e95b67d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780487296, "uuid": "05403671-c273-4b07-b0aa-fe167f265b9f", "comment": "Malware payload (RemusStealer)", "value": "21c657399e255304a663ce427936f2d627e9225242a27541176ecc96dff285e519919d10285539f79b772885190fb4df", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780487296, "uuid": "ac63f751-5865-4838-9290-9256e2ddc2ec", "value": "T142F408C85281ACE9CC287BB35FDC11A056985FCE9BEC61A9D5097387B6B3ED0C72C506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780487296, "uuid": "90d07995-7ce8-40c2-a0c1-14becc91df5b", "value": "6144:YZ3D6DxX3BePGxZB4m9yGf+dUO+KgSJTwUmPuBuPCvYna9VaI+EcdMsK:YJc9RgVm9zo1JbSuBuPCv0a9VaPxMsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780487296, "uuid": "6dc6c78b-7dbf-43d9-a0e3-68f2c60b0094", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780487296, "uuid": "b9811a51-1333-4760-9781-b3902092dc02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780487296, "uuid": "2454a3bf-e3e7-497f-85a0-31fe8316f5c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e2f923-5f65-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780502691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502691, "uuid": "fe36d53a-f3da-4cdb-acd8-cea660c92df0", "comment": "Malware payload (ValleyRAT)", "value": "2b4f1d7fd29abda3886bdbff2e6570f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502691, "uuid": "ca974f58-ec10-4dca-9fa2-f39462f91d15", "comment": "Malware payload (ValleyRAT)", "value": "e306f2ec7aa41e7c60802c8156990b3d9c6949451ae72409646e4a7c15b6ebff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502691, "uuid": "b81f744b-f1e4-488f-bc1d-77ea0acb4956", "comment": "Malware payload (ValleyRAT)", "value": "f6c34f4c436490d2b6c7e1960efa12c7987a3011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780502691, "uuid": "e41631e5-abdd-4bf6-bea3-f06b5bc2bbd2", "comment": "Malware payload (ValleyRAT)", "value": "af24d96fb060faa55fb7a0dbdf21fed6710db50978a50e116dc78133bbfae97be041bbe5733cafa869c5ecd35d2e9191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502691, "uuid": "90c6672b-9d07-4e5b-a57d-314d84955d78", "value": "T15495D0A3B6CBE03EF05D0B3745B2A25854FBA661A523BD17D6E484ACCF250601E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502691, "uuid": "29055251-2425-4001-8281-8a08f7fb6a6f", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502691, "uuid": "fb285899-b3de-4cfb-b7e0-a9d4729452ee", "value": "49152:g+MRvHxVSIMTgNVWIuBS0DChcyTytGhbk:grZoNT0BuQfPuGhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780502691, "uuid": "7f217651-6779-42df-98e3-cd054d58027d", "value": 1999795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780502691, "uuid": "cb79bb3c-34d8-459d-9e6c-f0cad06f7a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780502691, "uuid": "8b3a0011-25aa-4076-b24c-ee91f84f54d4", "value": "xtzjhyonz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7152ca18-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529960, "uuid": "b860c90b-f531-4bd1-be34-94fa6643c845", "comment": "Malware payload (Mirai)", "value": "5bf0059387ce69f68068860341b4379f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529960, "uuid": "8b2d5296-9620-4f20-b369-25c6ac33be1f", "comment": "Malware payload (Mirai)", "value": "e38c8945c30dd1050b6f205fd1b45fa92376fcd290a12ed25c599b8035c742fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529960, "uuid": "e9fef09a-485f-4bd1-8d78-25a82775a46e", "comment": "Malware payload (Mirai)", "value": "1ee382c873cc0f14dc5c75ed77ebf7492cc14838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529960, "uuid": "a34d197b-fc5b-4713-88ae-ead5eb22325a", "comment": "Malware payload (Mirai)", "value": "0fca7c8b9a8e3437165c19a8aa0dd4e52aead4bd20d35daec28e15af4c79d3fb9ac44559f6effbb42a88bf5f21877aa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529960, "uuid": "7bd4f92b-18a1-493f-a12e-257a653871d1", "value": "T198B3E1947114EE5AC42735BCF0830990E3B15D7A1B5B1A0698A3F57469BCCD83F0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529960, "uuid": "eab3a5c4-4f41-4375-bb29-055ed85207be", "value": "3072:nOfhXBZx91PS6yhP57375l4qlxSsGV5wuV:OpU6y77r5Bp05wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529960, "uuid": "967ae5de-eebd-4e48-92d4-a13de5c4dbc7", "value": 111776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529960, "uuid": "fceab8fe-902b-48a0-8f3a-471a2e4ca4b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529960, "uuid": "678083b9-2e48-4d7d-a2b9-2898aa0f2329", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202923c2-5f16-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780468405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468405, "uuid": "9b28ef1e-c904-449a-950f-d4eb65e3458e", "comment": "Malware payload (XWorm)", "value": "a1ea911e1a52877455cd62ba133a675b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468405, "uuid": "45ea2cba-a8f6-48bf-a85c-5cb3a642b8b1", "comment": "Malware payload (XWorm)", "value": "e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468405, "uuid": "f233e9e7-83c5-4d35-9333-0f15ecd0cd28", "comment": "Malware payload (XWorm)", "value": "e5eb800b4b4c294403265deccf87abe228cce6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780468405, "uuid": "bd643d39-c685-4afa-b027-2e0bae77f42e", "comment": "Malware payload (XWorm)", "value": "fbc234821a1e363b133c4be7e0f8de0e9a5afcfe9dec31caffc7612d13814df5a43807b2526d82bf23830bd89c392987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468405, "uuid": "b4784a0c-0f27-42f3-8ef7-4b81650265b8", "value": "T1A016CF976EE624F6D0AD82744A16A5127761FC491B3153C72F20B27C2FF67F029BA702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468405, "uuid": "3395f73e-fc0e-47f0-bf84-416ce7c3bd6a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468405, "uuid": "747ee491-26db-4b08-9aa1-4dd8a0ced2b9", "value": "49152:n9gGVCcte4/VkhwxWFvhPWCV87+V0GRyLp:n9J4wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780468405, "uuid": "37537adc-496e-4f78-bba8-2a8bc1735495", "value": 4166656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780468405, "uuid": "31560a21-c139-4962-b3a9-18560bcc1608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780468405, "uuid": "4b6e5dfa-0640-4a30-ab4e-fd4335bb20a7", "value": "xe6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95a0f72-5f4e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780492714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492714, "uuid": "403d06c6-a05f-41c9-9875-6109fd123cbd", "comment": "Malware payload (Mirai)", "value": "2900b3349643a58e8748f0455a826f3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492714, "uuid": "1ecadfe2-9daa-4d67-bf32-9514488e0f25", "comment": "Malware payload (Mirai)", "value": "ea217c25f9e75736a0427543ac4667bab7c6eb9c652ef8aa0a1bdf725415db34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492714, "uuid": "baee7081-8348-4b1d-a996-537f5123667a", "comment": "Malware payload (Mirai)", "value": "ed2486b2f094cccb31a063802b92c3318007865d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780492714, "uuid": "e6e2dbb5-a250-47eb-909b-02b83f1f740b", "comment": "Malware payload (Mirai)", "value": "04665b376523be2cdeb002309c0c43771391676fa1d196ee92a5a522099e88950384417819ed7dc50663d9f1c18c587e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492714, "uuid": "0c80dd9a-b95b-4293-aa2a-cbec210dd51a", "value": "T16013F1AD66A071D8D42DD03042B69FB00F652BBCD0076E0EF765CAE7DC271352AD2AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492714, "uuid": "72a08963-8129-43f7-a0a3-b2ece9e2d1fe", "value": "768:dbLkYYIZZyuph0ILA44MPsO4bNVDFoJWv1RabsSzGuQAduFykZomv4+pJgGlzDpg:KeZZy2h54MPsO4bzDFoSQQuQwuFCmvfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780492714, "uuid": "68ada595-a7f6-4e2e-839a-2624cdba1c04", "value": 44964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780492714, "uuid": "72af0148-9aac-4796-ac72-8a8210c2f375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780492714, "uuid": "df4562cf-4cb9-4585-8fab-0ec2f6467f47", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d2bed1-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529915, "uuid": "b3de565c-b0c2-4360-ad26-b755e7489a4a", "comment": "Malware payload (Mirai)", "value": "bfb53f2808d7cd3d1248e20d71f3fabd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529915, "uuid": "f53902c5-0cda-435e-8858-f54d78c59ff9", "comment": "Malware payload (Mirai)", "value": "ed2ee09c8bb6452af02cdd688cdc0b1fc983a2b14cff4e85774dc9257a28d4ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529915, "uuid": "f308a0f1-eccc-4001-9df7-1efd7133f5a0", "comment": "Malware payload (Mirai)", "value": "89fe9aa0baf9966d02c9051a6864d516fc6114ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529915, "uuid": "0d185b57-ad4f-4f8e-b7d7-822698f76b19", "comment": "Malware payload (Mirai)", "value": "646feb0d5cd7ccdfcc96db3b88b9ec08bb9ba80586513941b085b16505966bb0232c9fba1365987c736249d6bc921b82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529915, "uuid": "fbbcdd88-1985-445e-9d75-fe7c11a4481e", "value": "T127145A16FB0C0463CA935CF08E3F4BF9A362199115F99111250C7F5A2A32E77A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529915, "uuid": "b8cfd2a5-f082-404b-a7fb-f1d25274ec49", "value": "3072:Mi6GUuh9UkDAE8me7QNDZrGyd3mfcnl9DEUaZ:Md+EZh7QNbAUnTBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529915, "uuid": "cc575429-94c3-4aee-852a-4e7b09665b2e", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529915, "uuid": "53235642-e8d4-46d7-848d-3ffc59b5442a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529915, "uuid": "4f24dc6d-d8dc-403d-8507-abda13f24128", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6701e8a5-5ee4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780447049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780447049, "uuid": "0bd1c4d7-28e6-4344-a0ca-04240c0dd5f5", "comment": "Malware payload", "value": "c59bafa4b091bafb2dfc80e3be1d534a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780447049, "uuid": "fd1ee4bd-faea-41bb-8689-3da48eec29e4", "comment": "Malware payload", "value": "edbf3ab1b50f2e3450834dbd788a21b2a021686d65a70c422e2d62e99619e8b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780447049, "uuid": "3c0160b1-6931-4358-a7e2-6964aea5285e", "comment": "Malware payload", "value": "7c0b398e90cca52eb97282f29fb1e7497f9ea9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780447049, "uuid": "bc9b92b5-03e2-4837-9e9e-1e5773184a63", "comment": "Malware payload", "value": "a3f43df65491963ea254153587333e371ab8f554acc697d1844858c74958a7447543f0f9cbd8b9529851c42bfe0152d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780447049, "uuid": "a304b8fc-8a86-4fea-abca-4be1b40dfc56", "value": "T1F2F7334F0B6B92DFC2AD7CF925121E22FA04FE693670155AEB9E88153CC839E11563D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780447049, "uuid": "4e927aac-cb3f-486c-b07b-58e3db00c10d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780447049, "uuid": "1ce620ac-64b8-4abc-b0f9-14a41180b212", "value": "1572864:ht9IKPcb5R+ORWYX6ttcpCA21INJGnm2aTEohgwo8yd7:hUKEb5R+ORWXttcy8UGTHEDd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780447049, "uuid": "d39e3751-5149-44fb-af52-5022e51122f3", "value": 77103350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780447049, "uuid": "20740a93-e3d8-40fc-8154-db05b171c2ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780447049, "uuid": "33e26cf9-23ff-4b79-b6cf-39a698d4d4c4", "value": "Setup_2_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaa732c-5f55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780495728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495728, "uuid": "88246d9a-2633-475f-b660-f6f3dea3d816", "comment": "Malware payload (Mirai)", "value": "d5c7786f2f972ad6663bc35195acaefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495728, "uuid": "67e01998-5de4-41f1-ab84-68405a1f8d8b", "comment": "Malware payload (Mirai)", "value": "eed654d8b46a11617ffdd02ad49a17d3561648799cbee7f7428993319d080938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495728, "uuid": "84f92800-acff-4e17-873d-d17e8a7dc1db", "comment": "Malware payload (Mirai)", "value": "a79dd4f73a086df98aef8d11694d3f98a4f6dc79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780495728, "uuid": "30dbacf0-6cd3-430a-811d-fed1eb8e3978", "comment": "Malware payload (Mirai)", "value": "936b73273e2a35c75e46bacf5abf54d39e1fca79d7b49920c0f1c14e54a8c4b7488e82c69576dd9b48c21ce2541ad5b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495728, "uuid": "33a762cd-b36c-47c1-9ee4-4e3005860f05", "value": "T142A3F945F8518B57C6C612B7FF4E438D7B2A1758E3EE320399256F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495728, "uuid": "4bac0d67-df7c-43e0-bf40-2adc90bd5729", "value": "1536:eMMgODGRU2jiiR4VWl/9TFB9OT1hgg0Y/KJlkOwywXWsgHcKc9KBUSBxJ2dv0:pOyRUyR4G1xY0cQDZGl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780495728, "uuid": "5e2f7784-5e0c-4a61-961f-9fa0b578a49c", "value": 104428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780495728, "uuid": "9c558121-2ec7-4914-9c08-9a047e8ad576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780495728, "uuid": "0565c6f4-e5a4-4061-8758-1bffbd9ecae8", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee435fa1-5f45-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780488937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488937, "uuid": "370c980c-4033-4342-bb41-ebe5999742fc", "comment": "Malware payload (WannaCry)", "value": "e15894e8ef3c78c33450d8389a8b1b7c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488937, "uuid": "fa4c15e1-c8b5-4639-a70e-d899d518a422", "comment": "Malware payload (WannaCry)", "value": "ef3f1c6150cde264cbb33e2bfcaffa7960e53b7dee84b0836db41b79fc260ced", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488937, "uuid": "d89e89e9-3a51-487d-b85c-030d7e857e75", "comment": "Malware payload (WannaCry)", "value": "b970bd81d15eef9b7e63db97a357aa7a10711341", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780488937, "uuid": "91c8255f-d080-4425-b93b-2aa9d8e463f4", "comment": "Malware payload (WannaCry)", "value": "eb85ad7e5707721af87494650251f629b2943035c17c2a0903d962f5d09d2f44b569ec0b4e3adf4f21d85649dbaf74f1", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488937, "uuid": "ebdee28a-5e8b-4b2c-9881-96e2d369b7d0", "value": "T1E5363398726CA1BCE0450EB444B38E1AF3B37C5967BA4B0F57C0867A0E53B97AB90751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488937, "uuid": "7343ab71-0a38-46eb-977b-7d97367df84a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488937, "uuid": "9f5922d2-6bca-49cc-a78e-7955476fa0ec", "value": "98304:DKlqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DKlqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780488937, "uuid": "5bc43fee-0c4d-4f8f-82d6-9330b0663ff0", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780488937, "uuid": "74aa333a-ff12-4c6d-9fba-9de4df97c273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780488937, "uuid": "f5c7f70e-1e77-4ded-b89d-38ffcc6c6c37", "value": "ef3f1c6150cde264cbb33e2bfcaffa7960e53b7dee84b0836db41b79fc260ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77f8607-5f8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780518588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518588, "uuid": "2ff42476-de85-4a39-a032-86a31c824c7c", "comment": "Malware payload", "value": "8f1b9bb908c69b5ecc6498f69e5cf54a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518588, "uuid": "3c732fec-271c-4596-b759-dc14e4e6c456", "comment": "Malware payload", "value": "ef42b30b9b8eb300a1ea698fe205f494a9017ddf07ee984aad6763db9ce64c83", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518588, "uuid": "1849f8cc-e1b8-4dbd-bbf2-7c2c68d71b07", "comment": "Malware payload", "value": "a87d6e59e9c9c5040928e84901f5316e8a3d8cb6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780518588, "uuid": "340997b8-8a45-4947-8e1d-f99cc2a5d71a", "comment": "Malware payload", "value": "7f2beff7178d77bbe4d4a6c109ed1242fcc80462c6593f7d07a66c3652d1b59505859ba6dc3419a3960d152bbd87d644", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518588, "uuid": "294c9e0d-f2f8-4743-8452-1205e00aa001", "value": "T1D801CECFC112D7104095E8AE62A761907412C7CB26864BB8BF9C483DDBBD75C7125F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518588, "uuid": "6730519a-b7b4-4289-931c-abb0adddc667", "value": "24:kXCKysE2hi0ziQvZoha0zkcE46aO3corv17:e9Qp+Ms07qaOMgv17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780518588, "uuid": "a488bb54-e8e6-47e1-8650-51b42f71d61f", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780518588, "uuid": "18f6a8fa-f376-4b95-aae5-ae7404bc920d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780518588, "uuid": "7c1f7c5b-c3a5-4f84-8984-efea5b745f2a", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03d2910-5f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780514630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514630, "uuid": "d22f915d-0c52-420a-996c-57fa185028a3", "comment": "Malware payload", "value": "f56ad74e7514e61f455a7b79aa6368bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514630, "uuid": "d5c20902-60ff-4c53-8ec0-92d9fc6761da", "comment": "Malware payload", "value": "ef9dd729814f6833e41ddc99e6fcd1b1a12fe7d0d60f954335c0b4a7a56d9adc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514630, "uuid": "76572089-ac58-4dbb-a541-a4446878520c", "comment": "Malware payload", "value": "eb3f11d7e9bf10604fffdb2f121df3f03af7f134", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780514630, "uuid": "5ee32dff-18b7-4bd0-ad82-9a49223ae81b", "comment": "Malware payload", "value": "df3a45be26aba64279b9a864e23492ec2a62e15a4788f49b336bafbd1552f22ec138782a55f17376f5ed34a1e3fc0718", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780514630, "uuid": "d29c3b4a-ee33-4909-b601-8b83a3db02c2", "value": "T12AD0CDEE4042903554845E8EFCB53C104742E1C034711F287FC124B1E0C9D55B231A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780514630, "uuid": "89a0451d-8005-4168-9bca-9e802cc18252", "value": "6:ebnySvygBXXQOvPBENI3gHd9XQOvPBENgHd9XQOvPBEnXPHdy:kvyLOvPBENI3g9aOvPBENg9aOvPBEXP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780514630, "uuid": "7a7f5dad-681b-47fe-89a3-6b17a5e5482a", "value": 284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780514630, "uuid": "22206c84-28ab-4e21-9174-0647fa77530c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780514630, "uuid": "9a944160-8f27-410c-a679-8dd915b6f2b8", "value": "v.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0255bf-5eed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780450901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450901, "uuid": "8dc94bc3-f11d-4177-af3a-920c8c9744c6", "comment": "Malware payload (Mirai)", "value": "ff679317cc913e0addcb9f066aeb9898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450901, "uuid": "bb235bbf-f7ee-451e-a6e9-3c087f49975d", "comment": "Malware payload (Mirai)", "value": "efc7fee5e4b9829efca670275ee940e66e2855bbc11e13be142b40ee04808787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450901, "uuid": "1e7f5d79-c569-44d9-80d1-3fb3bfc87825", "comment": "Malware payload (Mirai)", "value": "1f526d81d6b480201d1e0d392339a49ae41bad32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780450901, "uuid": "32c5f2ef-4650-4758-92f5-f0ca203a694d", "comment": "Malware payload (Mirai)", "value": "fe57f49452438e362be221db8ec5403f2553ea16a5f4544020661c5ad19aab97942131bba3b6f0c46e9f431bb0a3cf73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450901, "uuid": "62001001-a7cc-41e4-82c8-f78292246906", "value": "T17EF2F122A5676921E014283F2F5547CA7B3B5DF0E1AEFDD726C45A8068CA40B3AFCD53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450901, "uuid": "a1714f3b-6867-4251-8d83-f3e9140909be", "value": "768:VQpgV+XF2BViTtHjGel78BvWZrBwhjTC6r9q3UEL4:VtVS2V4DGE8MihjyL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780450901, "uuid": "37d53724-e354-427c-954b-6b8551922b0b", "value": 35448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780450901, "uuid": "36ec6288-ac8a-4728-87e8-68bd5158b819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780450901, "uuid": "db34dc50-1f97-4ff1-aedf-88dd0f66d913", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c6679c-5f60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780500523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500523, "uuid": "55a865df-f4ed-4fa4-9488-097b54b8f879", "comment": "Malware payload", "value": "d770326e9dfae520814a56c59a3becd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500523, "uuid": "0c42b418-a2b8-442d-988f-e3bee25df204", "comment": "Malware payload", "value": "f2268e1d199bb054585fd151908aa6721219c5c7c873bc1c54c5a9a5a1c6712c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500523, "uuid": "0df0deec-fd46-4918-9678-4468f791b9d1", "comment": "Malware payload", "value": "364f745a2d58d2a9497befef54d4bfb6d83b6e9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780500523, "uuid": "8168f80b-0510-4bc1-9589-ea39ae2b3cf6", "comment": "Malware payload", "value": "ca957461523f4c9f298490fed5c4d5a78ccb2dbe322bfc34de1be8f24dfd2d2fc3eef0012c6eeb079d1fc06f1b747c8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500523, "uuid": "0372ccb2-789a-46a8-a8ea-a0155136d334", "value": "T15B3150D104D27B7ECCCC96253752A86DA038A8C53E6B9FD8D8DF18ECB740A92B514E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500523, "uuid": "9280197b-6902-42d6-886f-2caabd449c76", "value": "24:UHEBvi14DeBFBvK9hhi4TtqBvTm7Tek1BvWPlKBXX7EByTvDp8egrQtqBVSjRe8a:UHovieCB7v8hhlcvIikLvAlaXU07pjS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780500523, "uuid": "f03c9007-8842-41e6-8eed-ddf0b131be69", "value": 1509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780500523, "uuid": "d5f22026-7d5a-4c8e-ad88-6a5ff41f881d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780500523, "uuid": "286ffb08-7c52-4398-8cc1-2dc08506fe24", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce92ff3-5f12-11f1-a769-42010a9c0008", "comment": "Malware payload (ZuqraStealer)", "timestamp": 1780466736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466736, "uuid": "50b3cdc4-0190-47c3-b555-42465bc73d68", "comment": "Malware payload (ZuqraStealer)", "value": "f3f1d776126b2231e9f5ed3f8e26136e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZuqraStealer", "colour": "#B2D90E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466736, "uuid": "8ac55456-7019-40f7-adf0-19298808eeb0", "comment": "Malware payload (ZuqraStealer)", "value": "f325e0c933afbda80937319c71aa95374d36d8d0e09c2096b94fe28ea41d43b7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZuqraStealer", "colour": "#B2D90E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466736, "uuid": "064e265a-ed82-4840-b205-4bdef431a7b5", "comment": "Malware payload (ZuqraStealer)", "value": "935edc2edf85880fbeb1c9388a5f604e4a9e1c31", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZuqraStealer", "colour": "#B2D90E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780466736, "uuid": "c5839dcf-e120-4180-95d0-6f7a9e81edf5", "comment": "Malware payload (ZuqraStealer)", "value": "dfee37e4473c1f3d2990c262f0d12a5944bbb6fb92c863b2c211c027d5bebf4f0037913dffe1bdad3c653375a230479d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZuqraStealer", "colour": "#B2D90E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780466736, "uuid": "0774ec77-8f8f-49c5-b94c-6f6647f6d673", "value": "T195C08C3A22200750CC428E00D80581C3E9035180F11A88EA129A68042A020EA108CE47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780466736, "uuid": "f3bf76b3-53c1-406f-b911-fa2e8d5ee3f2", "value": "3:qGQTH3x8JCRViuTtMZFKBK4m3LApqXJAFHZgWLAAEXu1MFIwpWE7GWLApyKJoM3u:q3Lh8JSAuhMZwBK4pytAEXu1MFIsfspm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780466736, "uuid": "cc47e389-bcc9-4509-98b6-6a7dabd26a0b", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780466736, "uuid": "a3b3ad3a-4221-4c1e-972b-21cc8f1b07d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780466736, "uuid": "4823780a-04f5-4369-b0ce-a98d952d611b", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02a5ebb-5f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780526629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526629, "uuid": "551d64fa-deb7-4afd-968b-811980b85dcf", "comment": "Malware payload (LummaStealer)", "value": "10bec3b15e671f7415e9c556820acc41", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526629, "uuid": "ddaa301b-d3fa-4970-aee3-af9fee8f159c", "comment": "Malware payload (LummaStealer)", "value": "f4a9f960ed846958d2e5c17e4f548aadf3c33fc96a23818c2e4320bc68f297e7", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526629, "uuid": "b8d2b8fb-1fa5-4e5b-83f5-b26c1439e9a9", "comment": "Malware payload (LummaStealer)", "value": "831b1d2387a4ba09d5bf9e4644f8f0d326a4a6c1", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780526629, "uuid": "b4274bf7-df3e-4b7b-a74e-cd37d0ba7a7e", "comment": "Malware payload (LummaStealer)", "value": "8a4786014d3a02c069fbe0945eacf7c7622033187ee0605f252151a44a5e9950f14966720ddf59327c6a0f44ce27d9be", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526629, "uuid": "9e30fa5c-cee1-455c-a90c-aec6e96d1573", "value": "T173E428C9EAF40B9CDF8A3C3DA4B53A29952AFC9510F1918706DBDE14162D845C236F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526629, "uuid": "99f8189f-ee55-4c15-9ef6-8bca4c9eed1d", "value": "12288:XBCOhkBpDh30MOW2Su5prKj6aYODfaAtsddId2:XBCOabqyvWrKjXgAtsddId2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780526629, "uuid": "15207d82-f706-4abb-a132-03e352ce60fb", "value": 702352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780526629, "uuid": "f4cb7ae0-a571-4b35-b8b7-8ebbc43fd130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780526629, "uuid": "a79ab686-b7c2-405f-b995-7194da4a3680", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d21c3d-5f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780516656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516656, "uuid": "ab57b2bc-33b2-475f-b1c8-39b8db48b85f", "comment": "Malware payload", "value": "942a56fd8bd16a35a8216e79c6cca6cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516656, "uuid": "d08c7cec-7fe1-4042-8a03-23a5c2f760b1", "comment": "Malware payload", "value": "f5cb9194e3e34f10171be656d9a55a70ca96ed1258ffe371630f1086637a8d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516656, "uuid": "68149cc5-3516-41b7-9920-77152446e0eb", "comment": "Malware payload", "value": "155f694dddf4e30072af91d4282427ff88bffb79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780516656, "uuid": "a596c35b-cf99-408a-9ab0-f9d8b911482c", "comment": "Malware payload", "value": "7897aef85a112bcd3d2a8859421817a72d6626516035b843a62c71427942eadc46aa7eae13e8a2b234ab1f8f7d7ddb33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516656, "uuid": "f879b4c9-0c20-44e7-836f-f6267401c391", "value": "T1857633AFCB552BB9DF93D22A6B011C48AECD055F01E5FBA7879CA4DF27319E201D6018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516656, "uuid": "41f1cff4-d9b6-40e1-83cc-27d28776b4b3", "value": "196608:JPc9pxxVnpYXfRFAj4mPadUXXm7IP7huGbekoSv3:eDB6VmkUXXm70hlbLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780516656, "uuid": "fb36381c-a251-4341-bc20-260b12c96ca3", "value": 7821968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780516656, "uuid": "48d6e447-5e18-4ba8-94d2-e185ca39d1bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780516656, "uuid": "312b27db-b50b-43f4-bf01-bb04300414f5", "value": "linuxuser", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3eb57a-5f4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780493018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493018, "uuid": "5006d537-f3bf-4ed8-a4e4-441607ad274d", "comment": "Malware payload (Mirai)", "value": "1a61b53decf26e552bea4c98b9767bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493018, "uuid": "73845b28-0cde-45e0-93c6-f9d28ba2667a", "comment": "Malware payload (Mirai)", "value": "f8e0a5877ed87dae179975095ab4ade3052f7f331de749e4d1ad36a979d8f8e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493018, "uuid": "0ded65d7-0da5-4f38-b229-1573f30ff3e4", "comment": "Malware payload (Mirai)", "value": "a3957b65605283e37fdf6d760546c139e002ad9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780493018, "uuid": "0e2ea3eb-4c95-4d00-bc96-4a2c27fe85ec", "comment": "Malware payload (Mirai)", "value": "c108acafa47d07f882d8e6cc6edebe77995991d2015acbbe16c5eb900409e7e1fd84ccc8d46bd539c73e3210c40222dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493018, "uuid": "99d5c274-8a53-478c-ae6b-8fcd38a1efab", "value": "T194637D89F6C3D0F6FD4761B265BBD3225773E12A2099EA42C32D5931DD62810E72B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493018, "uuid": "79a02383-db1b-4080-a7e6-637704eda122", "value": "768:DesrREBvYJvu1/E3j/NuAbRtEQWHh8Bfd0NLIS629JetS22cKI7:sBQvu1cz/lTEQWeF6MSYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780493018, "uuid": "42c885d9-c24d-4b2e-9605-0dfdf64f9912", "value": 67624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780493018, "uuid": "ebb3e0c6-ebd6-40d9-91c1-7f9bd0e87947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780493018, "uuid": "177b3388-3604-429d-b974-1495efc01713", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d69fca7-5fa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780529899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529899, "uuid": "9777d386-e347-472a-bd41-3c124c41218a", "comment": "Malware payload (Mirai)", "value": "a58af503afc8125e28e536e3644d5668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529899, "uuid": "ad65eb34-de66-427b-a205-52ba183198fb", "comment": "Malware payload (Mirai)", "value": "f9fe616c3416d29c383b3fe349b0b3812a83b8957e2659c65f0d04785edaaec2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529899, "uuid": "1a2600b9-2b73-455a-8919-917497a0735c", "comment": "Malware payload (Mirai)", "value": "fa64312871f45d7dccb0e43b0c16c4b296a235d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780529899, "uuid": "439c4f4d-dae8-4237-8e98-cbb4dfbc7254", "comment": "Malware payload (Mirai)", "value": "fdab1a2c4d6daa633f5e4fa7b059fe9e5a2703fe117e102b4a029b0efb13ca00947dfb14758e653cc038bdf64938eb3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529899, "uuid": "51e00e9c-08ef-4309-9ab7-7d98e0aa3141", "value": "T19BB3BF83A15179BFF4E46A7FD4534E1696269FB019830F2E61BCF9C05E3A3943292E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529899, "uuid": "6ad62fef-6d3c-406b-b52b-ff415e24470e", "value": "1536:3gN+iD1OrXvQMpc3zWZObdcmuN3yTavJ5zDwUkHSdKVI1Xr4kOkQ657356ZL8rSu:3G+YeXIMOchN3XR5zDwJnI1XQ65LwUSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780529899, "uuid": "f6799f04-2c07-49c5-ad9a-31afa09e8e7b", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780529899, "uuid": "a1d743f9-db30-4e62-9fb1-218caee56cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780529899, "uuid": "e7917660-1ba5-4e82-89bc-253da31c5ee1", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ad0cf6-5f49-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780490561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490561, "uuid": "f9205ea4-7e13-429a-8566-4db76a0efb14", "comment": "Malware payload (MassLogger)", "value": "6d06edc43eb791e8ed7c6ec2c279f7b8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490561, "uuid": "98e6ce5b-7919-4a2f-ad93-5da767ac4a0c", "comment": "Malware payload (MassLogger)", "value": "fb045f216f6a05f75d76db11e90f276ce138a04fb50350d806358f5e1190f48e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490561, "uuid": "3f9ac702-d836-4963-a2ba-c4d5589c05fc", "comment": "Malware payload (MassLogger)", "value": "ca4ffea0ca4bd86c87039eba1c07521ed3caf7c8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780490561, "uuid": "106aad9f-3422-40ed-bbdf-2d4c343fa603", "comment": "Malware payload (MassLogger)", "value": "7de589f0cc31681390e269ebc6d13b62f8c52454e20e51375cc16b7931f82a4da02f2f27faa9a62a63492a4a0689f23d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490561, "uuid": "c166175c-1777-4295-a651-744d6c3f313f", "value": "T15AB555C5630F4D20D8B75B2A0E5FBC83DE06DABA97276DC97C0CB0C576494B81B96A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490561, "uuid": "d03369ee-1c8d-4eec-bcce-ba050d5737a2", "value": "1536:wHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHj:Vyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780490561, "uuid": "a271b47f-9c66-4296-a9bb-d62ec66fd0c8", "value": 2353056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780490561, "uuid": "4ff828a9-30c1-4264-a74e-a4e14d1b3e16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780490561, "uuid": "30ac9f25-83fa-4811-a554-581ef9debc01", "value": "rcko009434.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade5d1e9-5f6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780505150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505150, "uuid": "ab84cd6c-4eaf-4181-9b3a-1a56924771d9", "comment": "Malware payload", "value": "205d15ca1df6a70f7a2a375c1f92690c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505150, "uuid": "c3eb5dee-6d40-4a21-bc2c-c3d1c8a4f9e6", "comment": "Malware payload", "value": "fb52958eb7a003540263b299b0efc77ce3263fc090f666ec00a832fa9a546e38", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505150, "uuid": "8ee842d3-caae-426a-9d8c-697622b0a916", "comment": "Malware payload", "value": "ca9a98d7a0e9ca20ae4f95800883259e413a23f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780505150, "uuid": "92aaba6f-ae78-41f8-86fb-cab7b8951645", "comment": "Malware payload", "value": "0590fe9e6eb970089bb952b21680e728813f2268f5ab95eee9e698100792e499ad0a041fec54af897de052c04c983e47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780505150, "uuid": "a4c45021-a3e7-4ce2-b555-16054214143a", "value": "T1A601CEC9C502979040D9E86E32D76284B421C3CB16466FB87F9C503EEBAD708B015FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780505150, "uuid": "72c2063b-6d1e-41be-aa5c-e824c887a4d5", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkavFIQcuSIQmxKXI9SbOFI0WWh4EISZWkaa:kXCKysE2hi0ziQvZohadrSTalFDqk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780505150, "uuid": "1faeb740-81bd-4109-9e7a-feb87dd06267", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780505150, "uuid": "7b9885e5-93bc-46d9-8591-5d34ee3944cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780505150, "uuid": "521b9f29-d20d-420f-8af4-a8dba5fa1925", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb8c393-5f21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780473149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780473149, "uuid": "f4ccd8fe-eb05-45b4-bb75-d5345bb1886c", "comment": "Malware payload", "value": "0cb15cd01cf8a39820f587fc56d4bdd1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780473149, "uuid": "ba25ec42-246f-4bcb-990a-089f96fc8529", "comment": "Malware payload", "value": "fb5d57400de520aaa308cabe30194f2abd0d4219ccf6d2623f5671dcc778f8e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780473149, "uuid": "59b313e4-f3bd-4fea-aa0c-1491a7c0261b", "comment": "Malware payload", "value": "06824ae1b07584a60c473a19ebeae9899fd50f44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780473149, "uuid": "62538077-1e75-405f-8e67-30d1ae683332", "comment": "Malware payload", "value": "a1604a67d5dd7458c8cf9f7c9c884674abf336d70041d502bb98fd97099d892fe9ba1cd1120b38606aa652132d4488c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780473149, "uuid": "8fc6c433-f20e-428c-b63c-c83b4236f7a6", "value": "T160137D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780473149, "uuid": "ee8ae53c-afaa-4899-be26-b9099352d13a", "value": "768:BXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:7lxrco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780473149, "uuid": "09c32b1d-2369-47f5-b471-38d2389e9ef7", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780473149, "uuid": "13e11ea7-6a5a-4eee-8445-0e3fcd9a82f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780473149, "uuid": "0be83f53-fe60-4d0c-8a11-6110b4942c73", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }