{ "Event": { "published": true, "date": "2025-12-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-23", "timestamp": 1766534582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "757c73dd-fe1e-45f4-8e2a-09d724651cb5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8ffcca-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479129, "uuid": "685e9c8d-f703-4d25-aba6-2d68789dfba0", "comment": "Malware payload", "value": "21d394c8958d36a13b50a7932a1d8aad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479129, "uuid": "f6de4ab1-d9d5-430d-b90d-5ff6fa89a98a", "comment": "Malware payload", "value": "001e00ff8ccc58273317e20c71efd59260e6bdd29a8439d7b531ee5e6a303523", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479129, "uuid": "e7e4ab7d-f2db-4dfd-8d0e-831f2512abf0", "comment": "Malware payload", "value": "507a795687a412b90008430395a03ccba1a18ec8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479129, "uuid": "d301003e-6e25-46ef-837a-ad8a279e09c3", "comment": "Malware payload", "value": "73f4b4708e2a95124c35080e496bebe3c548b2fd890d86b7c8cfdfbf256594028a64373017564e0adaa2a3a7121e7fe0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479129, "uuid": "97cce68a-251e-43e8-9eb9-94f3a2d9af97", "value": "T1E4631B855AB64CB257378C5CC905176AE427782BA3FF83632FC7F2122F68759420D87A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479129, "uuid": "bf0e0013-3095-408c-bf6d-b29847358231", "value": "1536:I9l/AoSSMVlEix9ToZdWZvCjSShc3jxP3LOQ9P+H7NnM/nrKFWQYfYQWJDjooSSN:I9l/5MVlEix9ToZdWZvCjSShc3jxP3LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479129, "uuid": "b90bba37-237d-43a7-8bdd-eaaf0d659d67", "value": 72476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479129, "uuid": "e691de09-97e1-446f-9f2c-8054079cf3fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479129, "uuid": "d7c40063-3606-4940-b26b-90c932ef4223", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d54a75b-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451426, "uuid": "e2c29b03-f16a-420e-b487-b164c470ff97", "comment": "Malware payload (Mirai)", "value": "848b6556bc91b055509e1714f04eba42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451426, "uuid": "6f8ccb76-c865-4a9f-a675-9f3a3f7340b0", "comment": "Malware payload (Mirai)", "value": "007023030ff6df0ab515ce1fc7fae31841db841f81c638c1640feb59d045b441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451426, "uuid": "28dc09e7-02ac-46bb-91ac-f8a1cf4a89b8", "comment": "Malware payload (Mirai)", "value": "bb71ef3e281856716a71c8d56fc065cd4b074389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451426, "uuid": "1338bf99-1a71-4cb5-8599-693167222393", "comment": "Malware payload (Mirai)", "value": "3e9d88e355ec9ebd838ad58163a2f185a28e414d144ccedf28f28d6e2e285151b59d69a910f9bb6300f3d02f203a347c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451426, "uuid": "be8786e1-f2cb-433e-9215-a7330edda5f0", "value": "T19DC34953B400DDAFF88AD7364683CB35B53173A55BB306627653627BB83C3E4092AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451426, "uuid": "084ce001-94b8-4d3f-9bde-eca490970f9d", "value": "3072:pClYaazn9X8m9Va9IfGp6x+PDgUI9yeYejQyuEW1GGqJhC:pClYv9JuDgUybYOQyudqhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451426, "uuid": "f6dee5c3-875b-472f-b89a-34509ea2cbaa", "value": 122224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451426, "uuid": "c2dd03b3-657a-4a81-9c95-02713450b0fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451426, "uuid": "8592f5a0-0524-4e4d-a9b5-bce6e40cf276", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055f3ea8-dfd1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766474927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474927, "uuid": "3788ecba-1dc7-4be1-8a26-7198b8707af9", "comment": "Malware payload (Mirai)", "value": "87c4f65a1a59e1bec832ffe49b42b54a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474927, "uuid": "a24c18ba-0497-4643-a31d-94a619368ec4", "comment": "Malware payload (Mirai)", "value": "00ae90d158f2994a4c0472879baf6a0083c4d1bb28ceb828c5c583c868a83050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474927, "uuid": "9977c51d-417e-45a8-a688-95249179492c", "comment": "Malware payload (Mirai)", "value": "3af02542b23e4783f8ad7b089b4da97b977e7a41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474927, "uuid": "f8df690a-a152-4428-bbf3-e11e05883375", "comment": "Malware payload (Mirai)", "value": "147db22f2996b559d5f441417358a694902d4c3169a601dc6cd53d010941365288874851ce50a0670b49bbed2a75f6e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474927, "uuid": "9273660c-c155-4567-a947-a976df250020", "value": "T1B5E3630EA9218F7FF22C833647F7CA64B36522D723E7E24AD15CD5241E5438A582FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474927, "uuid": "a3357ddb-0a8a-4e35-9478-556f85b6912f", "value": "3072:GnhFworg98zSBZAOYjW0w+Jhp1AL+18hYgXjZfn8mRAIm:Cworg988ARdhp1ALkwjiEvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474927, "uuid": "d29b5499-4093-4783-b74c-f98f29c3450c", "value": 155008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474927, "uuid": "1369f8a9-701d-4023-b2c5-9665fab01e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474927, "uuid": "680e4199-3c11-4903-bc01-339ae1f80196", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb9b97f-dfc9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766471908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471908, "uuid": "b57beb0e-c904-438a-b5c3-bee5f627bef5", "comment": "Malware payload (Mirai)", "value": "3784378cf029206ed98e243cae45c129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471908, "uuid": "4b4303cb-ed23-4d30-ab75-6cfaf5594e6a", "comment": "Malware payload (Mirai)", "value": "00cc92b04fe85a7306e583e38d9c9162a9bbab20e38fb1e3f10135f0f1580251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471908, "uuid": "fd6f30e6-0119-47df-b648-3bccca4339c6", "comment": "Malware payload (Mirai)", "value": "739bcc12b8eced66cda8c42805e3826bd295bc03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471908, "uuid": "16a6bb06-24a5-47a9-a7fc-09ae46e70ff0", "comment": "Malware payload (Mirai)", "value": "678bc39d681e9a1c052750fb84e6f0a9393ab089a8d8d6041caa0b6c1823c950cf45aa49b50b991ac3024125f8b75779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471908, "uuid": "ed86bee1-c900-485f-8442-ddd4d725005f", "value": "T17CA3D044B605EE05C02262FCB0C44680E7B26DBA5F5795074663B9B87E7DCD83F0AEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471908, "uuid": "15a250fd-2c5b-4bb6-9a6b-7ab51f26840b", "value": "3072:11A6eCKW7fUAcpBzRh75A2+FPKqn+wu4n:1m63dDUAIlB5cSi+wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766471908, "uuid": "25a3bc8b-de70-406d-a7d7-0c265b4329f8", "value": 103672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766471908, "uuid": "19647d3f-086a-4067-adc8-22289ec6b0db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471908, "uuid": "51173a99-4759-473c-9857-a50171a6d056", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c583ae2-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468524, "uuid": "304f55f5-5d93-4286-9b61-e9fcda7c217e", "comment": "Malware payload (Mirai)", "value": "bfe2d76daf86e14495c7b12ba11468dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468524, "uuid": "66067712-d2f7-45e1-8a7f-f5ef62fb9477", "comment": "Malware payload (Mirai)", "value": "00d4cd4ad47504d9273b4b123fd8f9e35b1985fecfaaa5f5c84f93de17d054af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468524, "uuid": "1ef488f6-6f26-4b62-a5c4-1f4014e131bf", "comment": "Malware payload (Mirai)", "value": "33b056d8b9992c68ed14290c496c355b4a43d74f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468524, "uuid": "fe0103e5-047f-4304-b1f6-7ef1c8d5371c", "comment": "Malware payload (Mirai)", "value": "58efd36c539ceee148711dcc3e95732d4e40e924fba7ea541d21f4f3ae6eb8dbd8e3a809d6f2933f416ccabc3fd134f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468524, "uuid": "1c902df2-e5b0-49d4-8893-4c4d17002a3d", "value": "T10CA37C73C83A2E28C15895B4F4B0CB799B63E96080571F9AD1A7C37A9443DD9F44A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468524, "uuid": "8c0a3d53-97b9-4f01-ae90-51036f4e4ebd", "value": "1536:OB4BQodi27apxUNy+VHdvqJnTs1bi1wCxKg3Sd7nxyLFWcznzF:a4Wov7oOyUHRqhIbi1w9goE9znzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468524, "uuid": "bc49239c-6299-425d-982a-daf82cb15716", "value": 99776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468524, "uuid": "18774fc3-dc66-4625-9f8e-33b48f5d22ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468524, "uuid": "6d16995c-ae67-4cc0-94a5-50af6cbfda1c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c0a6b9-dff1-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766489081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489081, "uuid": "cf7041dc-50ab-42e9-9892-d15060ebd42d", "comment": "Malware payload (HijackLoader)", "value": "3dd6864377ab6af38f7ab2c5cdbdc5b5", "object_relation": "md5", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489081, "uuid": "70b9aece-82d3-41ed-be98-9b8e1040a695", "comment": "Malware payload (HijackLoader)", "value": "0113d9f3d93069a29458b3b4c33610aae03961014df60a9e859f3104086d886a", "object_relation": "sha256", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489081, "uuid": "ba5744a0-6b8d-410a-8b94-dbadc58f8220", "comment": "Malware payload (HijackLoader)", "value": "750f3cbe0b41a3f2230d9c15373461a6e7aba8ed", "object_relation": "sha1", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489081, "uuid": "e56111df-99b5-4579-8df3-410c3f98b2f0", "comment": "Malware payload (HijackLoader)", "value": "b39d995f751b4b5ddb2514637fd9e274252d77f6d00b6232943c41dbec7f947b9bf9b933b911c3dfef20409ed382d5af", "object_relation": "sha3-384", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489081, "uuid": "452ebaff-9f86-4a44-ac4c-aaa60ac9ffd6", "value": "T12DE633DE405AFEC9CAF35D784444B821C90FCA574CA14E27AC2F89581095EDF9E6C8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489081, "uuid": "ed030ebb-048a-4a1f-990b-5b896e13a934", "value": "393216:elJWK1FiTk527T79GIG4Psi9YuhX+KbGZqi:eWKaTm27T7Ys9H3q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489081, "uuid": "c14b8ad5-7b22-4146-a292-9fe9c24b39fb", "value": 14502442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489081, "uuid": "3c0ac80d-cc53-4f50-b0bd-d614576ac50f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489081, "uuid": "286002a9-8ed3-4eea-90f1-2e36d7d7cce2", "value": "0113d9f3d93069a29458b3b4c33610aae03961014df60a9e859f3104086d886a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d45afa4-e007-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766498375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498375, "uuid": "792ea2a0-6f21-4cba-a4ab-e8a9a9530e65", "comment": "Malware payload (Mirai)", "value": "036526c2ae3442538b00fbb8ccba0f69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498375, "uuid": "12ec1e17-5df4-4ed8-84a7-264e5897d573", "comment": "Malware payload (Mirai)", "value": "01a6e4d8e80b7090e1287238fce08de7bf135d537438845cbb3283f0c17f2d95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498375, "uuid": "1cca9ca0-3fd9-46e4-b5bc-dbf7973f7279", "comment": "Malware payload (Mirai)", "value": "0348fbb6dfa34e3261fbe6e13472cf51e8cba291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498375, "uuid": "f6efa37c-8f63-4ae8-a771-db893726f6a6", "comment": "Malware payload (Mirai)", "value": "1756b5f0bd3667f38ad2079e5e999f9090f97137673dfd4be68434e8a6ff7656ed4a1a68627028e0eeffc3c50fc88328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498375, "uuid": "3bc588e1-833c-440b-881e-ed77fa9a68d2", "value": "T1A383D659F8828503D4D816BBBA1E119D331627A8F2EE3312CD305F24778AB6B0F77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498375, "uuid": "c279b62e-4c78-47ac-baff-9231f8b01b32", "value": "1536:SdniRTSHPJPV2XNsJM5biU17BC7VpiSk5sqJL+IGi2nm8ViA9:HSvm5iU17B2m8ViA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766498375, "uuid": "59c96c8f-4a6c-4e04-a783-40401fff8521", "value": 82024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766498375, "uuid": "718d4dd9-37cf-4fb9-8a4e-6b632384a7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498375, "uuid": "56c2ca89-e13a-4375-8327-856b807e8815", "value": "shadow.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f9107a-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530768, "uuid": "f0f1cbfb-b287-45b4-b362-ded0e961665a", "comment": "Malware payload (Mirai)", "value": "478381952d9697e1ece0feba9ff5eef0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530768, "uuid": "ee7de267-1924-469b-a1c1-bf18837c96b8", "comment": "Malware payload (Mirai)", "value": "021e2b28fa7888092de6e5e34f3143a1fe3db48304674deb9368a8a9ad9c9998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530768, "uuid": "eb6fdceb-20fa-471d-9363-7fbc849c263a", "comment": "Malware payload (Mirai)", "value": "28ff191031cfcf773999ca23cd0fee3475927aa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530768, "uuid": "60118f7b-4d3a-4708-93b4-6d2d1b567b20", "comment": "Malware payload (Mirai)", "value": "b89c2db47929ebabc9b30fa05dba8e8d27b75e9c0943b9e926f343f52aa8fe2c54d11b4757ea31e81c27d917c581257c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530768, "uuid": "81c4aa1c-b0cc-45da-a03d-b3e6ec3244a7", "value": "T10A233AC4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530768, "uuid": "324e59b2-0618-4719-9e55-d3f770ea02be", "value": "1536:4LInPCqAAXJLE7cxtdg8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdg0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530768, "uuid": "049bc836-8770-434e-b5d1-4f49a19b0af9", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530768, "uuid": "b1702794-4d33-4db8-896b-d0e9e14769e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530768, "uuid": "030a8119-228a-44e0-accc-abd1e448bb1f", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f0339-df9e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766453093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "c6a645ee-15ba-4376-899d-eaa6ac7e424c", "comment": "Malware payload (AsyncRAT)", "value": "6f3d04815ceaca6cdbe72303e0d47f5c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "103c147d-8056-41e7-b361-86a16d200866", "comment": "Malware payload (AsyncRAT)", "value": "0234f311fc38cb7d8683df9da75ca7d4a0bd6c6c0e26aa3acfda110ef82075e6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "a570b8e0-14ff-4bf1-ae43-eac574c4aa1e", "comment": "Malware payload (AsyncRAT)", "value": "d04dbd024270935578069e275dfc2f63391386dd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "41f4d298-19b4-46d7-972b-6b48bf7787c7", "comment": "Malware payload (AsyncRAT)", "value": "fea18e6f06e15a48da5cb0ca8b018fa4af0c2d1b1bc95276f6058b6af32166b600c52042d1d697eba2e0c204f41a9701", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "10290b61-ce97-44ec-b8e5-ef922e2e5ded", "value": "T14EC22C0473F48266D1ED4BBE48329200E375E58B5D13DB9F6EC494AD2A337CD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "c42bcdc4-c526-4f95-a222-15192112b424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "98737c84-5d51-4419-8c71-0b90e7a5f24a", "value": "768:IL5O5OXTv9nM19EBQkuMyCJhxiFbHBFBNu+:I160v9nM1QQjtIkFbhFru+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453093, "uuid": "785044d9-9ce8-4ac4-90a6-c75ce5028b05", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453093, "uuid": "d67598ee-1315-4966-b00f-aebbab4890f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "3ecf426e-4a33-4dbb-94e6-cf4d53bc160f", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a8e8bd-e004-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766497000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497000, "uuid": "d4901863-3fa9-4b4e-b34a-01df055a414c", "comment": "Malware payload", "value": "5377ebbd97cff5c3124c5c75b66f9830", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497000, "uuid": "0e29c866-0893-4495-889c-3ead039b8f04", "comment": "Malware payload", "value": "02aa867eefbd311065099ec927b90a41da06bd409d905202ae959981cc4c812b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497000, "uuid": "0cec9ad8-4668-4ab7-9add-eb402ac1b308", "comment": "Malware payload", "value": "e224e6d2af996d904868197d1d3acfaa82d2fbc8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497000, "uuid": "848408de-1490-4dca-91a6-0a9fe5aad384", "comment": "Malware payload", "value": "472a74ed25e2a7c9352643dfea044ff914dbd061a6a71d57dc3c3fa7d74314f0c265ed50bc1bf08aa48c783e66f220b7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497000, "uuid": "a4185825-059d-44f2-876d-abf916a55850", "value": "T1DA7733D9E122A06BFA1ED439DAB18226CDD83D9704E758777411336269F7BF523E3208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497000, "uuid": "e2c20f30-03c7-4ea5-af11-111b384d7ab4", "value": "786432:CZENCEMkEt6Hz6nkY64wrIwrXS1qlz3o/xIkfIveT:CZ0CDNtMH14wrI8plk/xIkfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497000, "uuid": "a3bd01ea-0a98-44cb-a15d-d3e16a382047", "value": 33177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497000, "uuid": "410bd601-e5a7-478e-8453-49b310d9698b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497000, "uuid": "268e9a7f-6afc-4033-8e8c-b79571895c6c", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eea516-e052-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530635, "uuid": "28726bb3-df6e-46dd-af2f-6c21fc01da76", "comment": "Malware payload (Mirai)", "value": "d2f6b3e4b84ddb1ff513681226f36a87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530635, "uuid": "4ee2ef00-0357-4316-a892-b228750e70bb", "comment": "Malware payload (Mirai)", "value": "02aec80e83a227c76a500fe17d32cf416047d77e3b2e35713c34c51a6c23259c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530635, "uuid": "9e9ec222-a5ec-4bc1-9cc6-270d20e5539f", "comment": "Malware payload (Mirai)", "value": "a55aa0cfba4ee6384b7e340e6ba52f7d45d6ec04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530635, "uuid": "c270a40a-914c-45e5-869a-d5917add3c5b", "comment": "Malware payload (Mirai)", "value": "28276bf29a35a4e3f314f541920e10443da9a59faedaf0d25d0609b2c1a32865289bb7cca495c5f8794a3cbee696dd38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530635, "uuid": "ad93781c-a714-4d51-bf76-c48190d8fb08", "value": "T1514309C17881A626C7D05777FA6F018D37199798E0EA33538C295FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530635, "uuid": "a2621ba5-26b3-46ee-bb78-bcb360df8132", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP8PUapvTLwCVy/rCxH1:Nb24Th7ttujxynRPyU8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530635, "uuid": "e035c013-6a69-4721-94ba-ffbfdd653600", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530635, "uuid": "5f33ae65-af6d-4753-98ed-a290c6895296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530635, "uuid": "7640df08-c366-47bb-a3e3-4872768a73ac", "value": "Josho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dc0899-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766489098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489098, "uuid": "f1cd9d30-be7b-494a-9ea5-17d7d096f346", "comment": "Malware payload (HijackLoader)", "value": "da014e8260a3dad60e74ff2def635390", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "nuevos777-duckdns-org", "colour": "#574D27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489098, "uuid": "3d31a53d-187b-4670-a529-b033caa6ae53", "comment": "Malware payload (HijackLoader)", "value": "032d2462a90b19a43b3baff28e8df6678aecb6bbb406acd092a314abff06fcc8", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "nuevos777-duckdns-org", "colour": "#574D27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489098, "uuid": "46033382-2dd0-4161-adb8-579541d0e807", "comment": "Malware payload (HijackLoader)", "value": "0e6e720ea448c8bb093c83a031de89781ce423cd", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "nuevos777-duckdns-org", "colour": "#574D27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489098, "uuid": "efc74bbc-27dd-4004-94bd-1feb91c9a487", "comment": "Malware payload (HijackLoader)", "value": "af6b98ddf86b4c70b176c56041438d288da8e1b72c8a1af113832c865f15b18c2a492e7ae05603e5c3151a81914c31f3", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "nuevos777-duckdns-org", "colour": "#574D27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489098, "uuid": "73cb1cb2-2f1b-43b2-a090-ea90c048904d", "value": "T12426333B75D3921E600E8C5D5657EE8F6AEBD85A93B26730684EC8EECCC4448BD39350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489098, "uuid": "9f7ecac8-c887-463e-9885-d535ab282e74", "value": "98304:llPE2Yv1uePkdvS2cIsw52XHqBZcbtUoijeCiLHEMzrmu4:3xYmSzw52XLtYepgYa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489098, "uuid": "2eb9af71-6f16-4d2b-aeaf-66d56b02e460", "value": 4625048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489098, "uuid": "89bee76e-237a-43c3-bc5c-29a63f7459cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489098, "uuid": "0d0776db-6bd8-4d08-8b3d-473f4ed3f882", "value": "032d2462a90b19a43b3baff28e8df6678aecb6bbb406acd092a314abff06fcc8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49184b62-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457861, "uuid": "198c093e-3ef8-495d-b438-26b84640d346", "comment": "Malware payload (Mirai)", "value": "31a029afd91c9b250c3da88d942a1c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457861, "uuid": "fb03bd2b-46c6-4d55-b2a3-247484c4d4de", "comment": "Malware payload (Mirai)", "value": "038d5244e53e849055d5ff1a5bfa6ec17bf18f4d3972c628f524eff21abc1747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457861, "uuid": "e173d3dd-5c22-4aaf-8f6c-dee44805da9e", "comment": "Malware payload (Mirai)", "value": "992ba350f5c71fecbf8ef130deba779f5bbe4a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457861, "uuid": "9dc16b34-01d9-4b09-930a-381041bf848d", "comment": "Malware payload (Mirai)", "value": "06c11b1173c9d6455ac41062c026a08f722eb82c11dca9202113d1651be28c5c8ec683879a36c24a9a3602650c90348a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457861, "uuid": "dac55cea-5630-49dc-94c0-a1c33f808bd0", "value": "T15A93D506BB650FFBD86FCD3746A9070239CC551A22F93B3A3674C918B51B64A4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457861, "uuid": "b95d8ae0-2b2b-4881-bd33-776451b457a8", "value": "1536:SXVdbeEh/kc4YQIw17yfQ04rAM1gYuZ7hbXsVIGRwhwaBds/xV:SFdbeEh/kPj1rA4uwxeHBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457861, "uuid": "3621a679-6688-482c-89d1-5fb33cfa1eb8", "value": 97592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457861, "uuid": "0949e498-7ce7-4b4a-b05a-c4bc69ca702d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457861, "uuid": "61524b96-6634-449c-b801-a4e29ca82d4d", "value": "ntmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8de10e-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531905, "uuid": "e6dec36d-10a4-43cb-aada-34b4ea3c40fc", "comment": "Malware payload (SheetRAT)", "value": "af5864a3414f5437da8360e98387807f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531905, "uuid": "af2a96ad-aeee-4dc6-b45e-f81611012f6e", "comment": "Malware payload (SheetRAT)", "value": "044d8e41acb7ef6ad30c8e74f48044d7811d2d8110f088f281ebc697525b3b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531905, "uuid": "29b84868-6c16-4a22-a25a-d09a4ef8b9b0", "comment": "Malware payload (SheetRAT)", "value": "de232688fffcc9b5707be1a6c5600027683a8792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531905, "uuid": "42bf7d47-c243-4beb-80a6-5c03a703cc4b", "comment": "Malware payload (SheetRAT)", "value": "3e51d9fe56c25acf61db749b6b36242ba037233159f18db858db7d267c0b66dd817b4d2a1d718652beef152f4465e24a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531905, "uuid": "a04dd634-bf46-412d-9e30-a27990f31358", "value": "T1B1A4A30CFE91E805DE1E3D77CBE614004B7129C12E219286316A6FFD8BA63B758E657C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531905, "uuid": "db415dc7-72ec-49d4-9509-e83d12241555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531905, "uuid": "e7255298-d267-4fa3-ab8c-7b47366618aa", "value": "6144:oRZ7dZocBd7UhOJws7WR0Sl88rlCe6VlWT8b90pcPa1/OZqb5pXQh8:W4cjcOJwSW88EPVle80cPsW25Qh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531905, "uuid": "098cf10a-f497-4509-a488-b4379b731ec3", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531905, "uuid": "d2d1f3b8-77cc-4ab9-b912-32903965c291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531905, "uuid": "fd747537-9439-4783-836c-b9f6f8a448b8", "value": "rjvkkwvjcvpo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab24ab37-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479071, "uuid": "5ce4ca81-3a93-42b2-8f90-bee9573dba22", "comment": "Malware payload", "value": "ad09ecf2320324b24c081d14ac15bdd0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479071, "uuid": "56d4c8d2-84b4-4bc5-9f54-d8e7213b7217", "comment": "Malware payload", "value": "045184fbabebcf0ba3f37068d057ff367b1cbe6809de7c7feb1467d9f5bbff45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479071, "uuid": "7ec2d306-cab6-4b2f-832a-f558d73c424b", "comment": "Malware payload", "value": "033f62899f7aa5aebbeaa4d6ef2da750e2584b4d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479071, "uuid": "ad3ee1f9-a7ef-4c73-80c6-cd5745388c12", "comment": "Malware payload", "value": "7003f8815c82b7b8475b7ae6aca44d8fb287f1940847d31e06e340a3e1b5567efdfe169844da1fef9f47d780cfeadfea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479071, "uuid": "7577b81c-dd86-492a-a1a4-5bf9a91da5b3", "value": "T190735D9E8134A9655F0E2A5B494327BBD6D3A7541AFF2EE004FD5020D33CF8A2F05A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479071, "uuid": "2f998a88-185a-4386-81ff-fa8dc7534ca4", "value": "1536:I9l/AoSSMZea0zyE0ujofACp8E5FlSEVUDnDUDe4DXGsTFMMFewFpBtrUj1xy0Aj:I9l/5MZea0zyE0ujofACp8E5FlSEVUDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479071, "uuid": "d50083eb-ac70-4191-85ca-35d21d0f7eff", "value": 74398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479071, "uuid": "a43ad230-bf70-4a10-8e04-8a28d1325ffa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479071, "uuid": "ce61ca46-ccf5-43e0-a96b-0ac4fe26fbef", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d417af-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1766489128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489128, "uuid": "49c1dbf7-0aff-4a97-943b-b21d10f6a067", "comment": "Malware payload (ACRStealer)", "value": "7233ff0679227dc37001980fe7a27698", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "envio-dynuddns-net", "colour": "#668EFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489128, "uuid": "a339245f-81d0-4715-8cca-ee7ee7345fd2", "comment": "Malware payload (ACRStealer)", "value": "04706a7c7a14373c53a211b72aaf8a880c60db1953548f678cba9070541a4d1e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "envio-dynuddns-net", "colour": "#668EFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489128, "uuid": "0997de3c-567b-4cbe-aec9-312910efda69", "comment": "Malware payload (ACRStealer)", "value": "970ff332bf0372063e2134debf839a20e157e072", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "envio-dynuddns-net", "colour": "#668EFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489128, "uuid": "0aa71783-253b-48ab-8c81-83fdbe6d3d44", "comment": "Malware payload (ACRStealer)", "value": "fbdb4377c6dab5aa6218efb38bc40af1582bd9802b373c9e7a0ed09da9c813057560a92cad9bdd8a4f8f7e512750cbaf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "envio-dynuddns-net", "colour": "#668EFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489128, "uuid": "c7966f92-3bd1-43cb-8063-df79befc4020", "value": "T16206339AFC39F0EAAB3DCB2F539AA80FDD45C2514C686F5B67D819D907468321E04B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489128, "uuid": "4dbfb93d-bb66-4f43-bc49-273ff7d918b3", "value": "98304:ppZc5skSFH3kmX92Df1+ni0t5pm+WqLIOcAzZ3:ppZc5QF3zNRi0t5ELhqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489128, "uuid": "4d3f53f9-e6ef-4e13-893c-f788301375e2", "value": 3915078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489128, "uuid": "8ff60644-953d-491b-974c-6625332159ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489128, "uuid": "888aec3a-c755-48c6-8d8e-fede9544288d", "value": "04706a7c7a14373c53a211b72aaf8a880c60db1953548f678cba9070541a4d1e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e14726a-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479022, "uuid": "12d0631c-eee8-4010-a71e-de5c264eb706", "comment": "Malware payload", "value": "ffab73de8da45cdb81fbc9b0490f9a2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479022, "uuid": "8b57beb3-98d1-4aa1-8352-b0503f49dc4e", "comment": "Malware payload", "value": "04ba3c313cdfe4fe68d91d2ebf4e85201b3fae1feadb972b65d730f960f4b671", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479022, "uuid": "ba653f6c-1f45-406c-a9c0-71b351425529", "comment": "Malware payload", "value": "cb18166f531e0ac65d7c661863a4f03e240561c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479022, "uuid": "11fa487d-6c2a-4e73-99a9-f1a52d36171f", "comment": "Malware payload", "value": "bdfca1c3ab84ab01ea6c4e8d18cfce912433f8e84d77610b113b10466a689af07b9b35c4c41314bfb1e44c0c9227897e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479022, "uuid": "b76f8b2a-11a5-4dd8-a545-0c44aeede172", "value": "T1D5631AA3AB15CCEF3199A4618ECBA549CB4FEB1548F949027E98B10900DFE51F2CD4DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479022, "uuid": "b0240129-844c-412e-b79c-948960419e36", "value": "1536:I9l/AoSSMZwgLuIfK3FK8HIKab0U75xA5xtfNIPAEYHtI0tFb2sxbwoJ2yNxImVm:I9l/5MibusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479022, "uuid": "ae4b78dd-7e36-4422-aa20-1f765c554296", "value": 71517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479022, "uuid": "c70f0ae2-4788-4e2f-a823-bbc1c04e15a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479022, "uuid": "db441ea9-293c-4a2c-9f94-b0282c3a496a", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c202d9b-e02d-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1766514587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514587, "uuid": "31df97a1-c3ad-458a-bd12-e5e1e1afa8ee", "comment": "Malware payload (LummaStealer)", "value": "2c991f5092c34781f30c7f701d514353", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514587, "uuid": "904f0517-24ca-4596-a609-6663f24e045c", "comment": "Malware payload (LummaStealer)", "value": "0550c70388d308950b0167218b071866e56ac916bb47d1586f043729befc165d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514587, "uuid": "342465a4-d0c7-4969-b8ce-f0dafa1da469", "comment": "Malware payload (LummaStealer)", "value": "8b051eb5936435011693238a3b8b01c05fb98190", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514587, "uuid": "db26cc2f-4cbe-4e41-acaf-d7b48a508c3b", "comment": "Malware payload (LummaStealer)", "value": "61b87471e2642184236fbf8be9f9905e6ee12a3e3e03db7d6347ca2ca3e60357630bd05cc1dfee8683fde6b22dbbf1c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514587, "uuid": "02ea5e3b-6c31-480c-a741-924ff0aede0c", "value": "T13DF4B14169D60548E4B3DDF6797086D26CE6AD1F46F18C8E25BD383AF23281F062F726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514587, "uuid": "41e7043e-6bc7-487e-881a-92f5a3262d14", "value": "6144:apT4TktcZUbQWEVoEz30AIwLKCKkp3fnk12zLAHrDldreCexfADIiZnTWIZRnQ14:aKTpoePkSeok1AYMJf5cTWoRnmOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766514587, "uuid": "4f19e2b7-e746-4b7a-aeae-d9b47ab42f9b", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766514587, "uuid": "3bfa1aae-d84a-47ee-b795-e4c6b93bc76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514587, "uuid": "6721bdb5-cfae-46b0-a261-ec266a21934e", "value": "dondino.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2888c-dfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (CastleRAT)", "timestamp": 1766476849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476849, "uuid": "d0574800-c356-43e8-8e4e-e7fc73c1fa32", "comment": "Malware payload (CastleRAT)", "value": "c711bc35a88de291dcab885ddb2e7373", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476849, "uuid": "566cd5c4-14d9-46ef-b034-fc77e90f7caa", "comment": "Malware payload (CastleRAT)", "value": "05d2d06143d363c1e41546f14c1d99b082402460ba4e8598667614de996d2fbc", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476849, "uuid": "51573b9b-bb63-4137-ad30-c25dc5ef8a27", "comment": "Malware payload (CastleRAT)", "value": "0bf7e9c5929aad4e33cd1cd469c12ce52b443047", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476849, "uuid": "d51f3b3e-63c7-40d2-b5d2-3e137d526305", "comment": "Malware payload (CastleRAT)", "value": "dcc8b172d988823bc6ccb296d0079da984555b307217a2b3d2296ab0da0db1fe2ffb2566cfe4e09f876d858a9459b573", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476849, "uuid": "202810bd-f0f4-4220-9386-2bbe7f0daf35", "value": "T1CF573357F7A0D662F33079358CF06695CEF85F60C47201396044BAF146BE3B8857ABAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476849, "uuid": "68346ea6-e6e6-449c-9f94-ad27cc672b64", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476849, "uuid": "cccdd041-576f-49ff-a7ae-8e7f0f947498", "value": "786432:KhMhnxAFSAgC5V42qv51riMgByg2aIX47Snsn:KhEnxAoAgCfTqv61Byg2ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476849, "uuid": "a8c854a1-bf44-44a7-a477-381494cea3b4", "value": 28579888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476849, "uuid": "9fbea8c8-0662-4cec-a661-0cfd6ae3485b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476849, "uuid": "ba7e4151-59c0-485a-b9ca-eb522424fc86", "value": "05d2d06143d363c1e41546f14c1d99b082402460ba4e8598667614de996d2fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c232e3ff-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478680, "uuid": "1045bf43-c552-4a0f-87f4-e4113b881f62", "comment": "Malware payload", "value": "e06e37a851cd7c968327f79483d5bb6e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478680, "uuid": "e2a3cfdd-0e5f-4007-8cbb-31f04e9b6844", "comment": "Malware payload", "value": "07300433c310202024b85ecd8be59f804e9936d9ea536f2b266a5451589a58e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478680, "uuid": "5bb0261c-c9da-43dd-953c-c525ceb718df", "comment": "Malware payload", "value": "34f9ffcba4a4399fae134fae41ab87485402e706", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478680, "uuid": "4da97b18-8c14-47c5-8ef1-e8e8151fdcd0", "comment": "Malware payload", "value": "3370d4b5afe338e93a35e30210e881dcac09624c524edfaa1bb30f1a6fc599ecd08d2487cbfa4150f48e67a4ac47eb2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478680, "uuid": "c82095b0-d770-48e7-97ca-6ccee7d4e380", "value": "T10F630824FF6A6F3FBAB39C189FB97430541073FEB4E06624A5215B938304BAE4452F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478680, "uuid": "333cae04-b62e-4d06-92a2-5743dcf9095f", "value": "1536:I9l/AoSSMSMiTdhKxcuYC7buTolU6JcHn+n24lOuWd9UfevQSNQS27SEuWWABA1W:I9l/5MSMiTdhKxcuYC7buTolU6JcHn+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478680, "uuid": "cd193818-33e4-4a85-9466-3676a03a3913", "value": 72528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478680, "uuid": "0d11bd2e-4a69-4126-8556-38f8305a5a8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478680, "uuid": "b2b02962-5ed9-40e9-a4c4-388ae3088aaa", "value": "invoice-1645080830.pdf (92).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c4cbec-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478706, "uuid": "737ad520-85a2-4a36-8b2c-5cee5367ea6a", "comment": "Malware payload", "value": "d7e53d124602ab8ce41852051ae9c0f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478706, "uuid": "1c16d40c-2016-48e1-ab4b-e30f21dbb01e", "comment": "Malware payload", "value": "0806b1b8b4af0b15b1c07bf57620b158a05cba861e53d73ea93cb47c9b0dc6c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478706, "uuid": "c4b3f0f0-9e00-4640-bf13-9760813f7ec1", "comment": "Malware payload", "value": "b40778f4cb6514e2ee53231eaac61789aa4607e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478706, "uuid": "a112af4a-1be2-45e7-9f50-ffcc080fa8f2", "comment": "Malware payload", "value": "2aae650800a50e86b8462102fe93dd702c22970aa9a525457205a2a5d1aadea80679b47d11ce4c15e4931a67221f176c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478706, "uuid": "befcf056-8f6f-4795-bb75-2d868f6a1598", "value": "T16B63092B4C134DAB4632A78E6871F4E3D6090219E905E8B1773BDB877AC4B71B9E054F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478706, "uuid": "a4538800-2cbd-4076-9a1e-39ff194da715", "value": "1536:I9l/AoSSMeebylDAVzVIR//XwKWYrWHr2ytTtGTbQH3AI37jqihhPFEXPaVmzkJm:I9l/5MqWusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478706, "uuid": "536f8b34-f093-404c-94d8-bd8949644590", "value": 71570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478706, "uuid": "d8424d22-504e-45b2-91e5-11753d06a84e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478706, "uuid": "35497550-0e6a-4de3-8582-1847aa208a89", "value": "invoice-1645080830.pdf (89).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e196bca4-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478733, "uuid": "1cbcd2d7-e235-4f46-b484-e14cbdbe9a07", "comment": "Malware payload", "value": "ef38c725c7c1176b9b34a1d2f73588fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478733, "uuid": "ddf897d5-25da-4de7-8d13-7b14256c8faf", "comment": "Malware payload", "value": "0948e1aa21c04d7a0a5776508f1133c5a73aef0836ef1bfeebccf7a61c6b893f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478733, "uuid": "70c7f871-e326-46c9-bc2e-6a1c164f935f", "comment": "Malware payload", "value": "17cf0e1820e646b2451a610ab62c3ba9d6a5fbe2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478733, "uuid": "d209f137-8c88-4df6-82e0-0317f08818c5", "comment": "Malware payload", "value": "8a54bdf4b84786d47fc68a2689f0a3f8134f9cb02fa72e38f539b221fa84ce5b34b6902c2696cc79b8811a414b810360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478733, "uuid": "dfc0a4db-c83a-4240-a1cf-02cfd2898424", "value": "T1CC630AE25058F46DE5A753107EA369BF8A583476BC61001EF9823E81EDEC7D3D9F2092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478733, "uuid": "5b406775-c9ee-475c-958d-4f5fbfc03d63", "value": "768:I8w/h62/jWs6oS+xISN0vw7iINnFdkfScBYrwz2y8kTAlGB:I9l/AoSSMOLusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478733, "uuid": "cbec08e6-a050-4157-96ae-83c94a698300", "value": 70618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478733, "uuid": "b0f48bfc-b995-4a45-b17e-d6d651cda377", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478733, "uuid": "fe31a195-a40d-4b67-b2e3-b1d1553a92f3", "value": "invoice-1645080830.pdf (85).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1179b231-e028-11f0-a129-42010a9c0007", "comment": "Malware payload (CHStealer)", "timestamp": 1766512314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512314, "uuid": "d7fed6bb-b6b5-4841-982c-338aa080b099", "comment": "Malware payload (CHStealer)", "value": "90b699d1c60ed22d25476f35b3cfea86", "object_relation": "md5", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512314, "uuid": "066c6b9e-31e3-438f-ac5e-3415d80f6c8b", "comment": "Malware payload (CHStealer)", "value": "09528e1283f797f4145e746771ada5417a9aa73ec32945fd78afb437700c9563", "object_relation": "sha256", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512314, "uuid": "b9f2eabb-37bd-424f-82d9-dfdb80367c6c", "comment": "Malware payload (CHStealer)", "value": "cb903f08af602a26a513862ff6af37d9b3881111", "object_relation": "sha1", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512314, "uuid": "5ef4ae65-8c29-4763-9fae-143661eceefb", "comment": "Malware payload (CHStealer)", "value": "d0935292c77184389aa16cc6f1f324849b5c6da363f2ced1aa8bc23853f4dbaa4bc5faa97247ce3f274ac973dadf8526", "object_relation": "sha3-384", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512314, "uuid": "17a8edc9-ea17-4d9f-a293-f13cb9cb21ee", "value": "T1D4260233B34A673EF06E1A3749F292105D3B7A61A51E8C46A6E40C4CEF291A01E7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512314, "uuid": "530e3624-8c7a-4d24-b177-ca50b07a85cc", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512314, "uuid": "3c960fb8-cc8b-4d34-911c-a3e180efecb2", "value": "98304:HN66lBIOY/PoMoVrLucdlWnTBOEAN3v5IR:/lTMNoVXucdlWTUPN3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766512314, "uuid": "1c3775da-af9b-46fb-93f8-9a38a8c571ce", "value": 4559360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766512314, "uuid": "7ec4d8ca-784c-4e7c-b7f7-50850394a6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512314, "uuid": "79d2c397-5fa6-4f5a-bbc0-750e98d90699", "value": "The Simpsons S37E12 1080p WEB h264-EDITH_patched.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7630e39a-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478553, "uuid": "ff6e2d88-9418-4774-8101-9925873aaa63", "comment": "Malware payload", "value": "04fb1e35771b5dfa74a675a837148620", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478553, "uuid": "3cffffe2-bcf2-4625-8229-dd4d1ec5140f", "comment": "Malware payload", "value": "096fee445a22f21d266778a502f70bbedd98dea081be02f36df99661481cbefe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478553, "uuid": "9f8e20c1-250c-4625-a777-14f33e0d1b97", "comment": "Malware payload", "value": "514c0b93b960830098042e7c6c766faeffc9fc8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478553, "uuid": "c4d12e99-c985-4c9e-8e2a-5f381847bec6", "comment": "Malware payload", "value": "67fa9a1d0b4d98e33e2bb00e77b3603fda0e43ad9f0b5d58cd35442bf0bf391c0936dff39ef487bc5efbb3b4cbc5a775", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478553, "uuid": "30c4116c-4d0e-4f64-a6fc-181faa12e511", "value": "T1B9630963EB19F5655E1A4ADCEF7B0488979F16E010E48030EFC90A725F7A2A32D1352F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478553, "uuid": "7e924321-62f4-4de7-b525-0de23ebbf51a", "value": "768:I8w/h62/jWs6oS+xISN0vzy/JRNNnZdkfScBYrwz2y8kTAlGB:I9l/AoSSMO/JRdusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478553, "uuid": "af1a6cce-4b7b-48dd-99d7-2e857e52f9f0", "value": 69686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478553, "uuid": "ddbea226-7f95-4278-9734-cd554b139cf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478553, "uuid": "0b6949bc-393f-4e76-b1ab-68ffa22bc96f", "value": "invoice-1645080830.pdf (117).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8821986c-dfcb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766472570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472570, "uuid": "de55e921-d679-49b1-adb7-c38f05cd94d0", "comment": "Malware payload (Mirai)", "value": "94edee418efc823f0b00f5b261e1c959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472570, "uuid": "81d04125-5d8b-4a6e-ae49-7b5a12999c69", "comment": "Malware payload (Mirai)", "value": "09712d6752b9656be89bb42b952bc6b05b07828e445a2e5651eff2bb31f82a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472570, "uuid": "43710787-13d9-45fc-803f-9b7e81477de8", "comment": "Malware payload (Mirai)", "value": "1f64471bf944049646dd21124369e9510fa8dddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472570, "uuid": "259f3af6-d0b3-43fb-94fc-6a8eb044c1c7", "comment": "Malware payload (Mirai)", "value": "6dc29f989c0b3ecd47e6dade7b0e5df05a7b3e2bb80be82935dfa529a403a05763e8ad93d7b51630993042629afeeb21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472570, "uuid": "888ccfb4-cbf3-4cb9-a3aa-2e719f294116", "value": "T154E3F90ABF601EFBD86FDD3701E90B4924DC650722A82B753634D928F64A64F49E3DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472570, "uuid": "9c98d696-be0e-4c72-8fb4-4d473e395027", "value": "3072:xVpMjC/oAuWrigvtUHAQnvep1bacGnzWkR:xVpMDAuWGUUHJnvhHWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766472570, "uuid": "c6b886f5-cc94-46d7-87bc-7572644998a8", "value": 156272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766472570, "uuid": "dec0ae49-f1af-412c-9aa8-f77712d0bb30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472570, "uuid": "c168b98e-6478-42b9-a13b-41e8e9f33998", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f5fe45-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525119, "uuid": "8af5c498-c107-4696-a6db-cab25b81d58b", "comment": "Malware payload (Mirai)", "value": "40f17c0c6e1a020cbef12043e004be66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525119, "uuid": "fb3f3bf9-e4db-45e7-a4c6-b4d2753c05bd", "comment": "Malware payload (Mirai)", "value": "0973fe0a84bda5c164e1fe031d695deef02bc6364692831f6bacdb6a1efcfd17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525119, "uuid": "0b1980b9-a5de-464e-9a78-8f143e1a58d0", "comment": "Malware payload (Mirai)", "value": "f3f2859cef6bbab536bb05e922a50c638c87673a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525119, "uuid": "4c91aacd-9228-4ee9-bf81-c18bd6e9c98e", "comment": "Malware payload (Mirai)", "value": "b07c50a6ecd6d4d6e0cd812f2bb4a4938869873f995a0f803f1a05be9a7ab07a3636255e0a10a13329df28852d0a6ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525119, "uuid": "0075b732-fbdb-4d45-b115-24d640f62045", "value": "T158634BC5AA43ECF0E8160772117BEB2377B6E47A1028DA53C755B933DD45602D2873AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525119, "uuid": "a61dc8a6-644e-4852-8069-83a395acbc14", "value": "1536:LMP0vwEUkKD9tDmf7V0dlXdxBQ9rldQn6BK8q1SkMmwbZn5:La0vwEUkK5tDmfx0dlXdzQ9Rdo6K8qVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525119, "uuid": "6df4fe04-dc11-4ec9-8723-46fdce4fd345", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525119, "uuid": "e20c3fb0-e188-4fd8-830d-4475b10ee44e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525119, "uuid": "2cc05bee-b3e5-40b2-85b8-306357ff127f", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062619d3-dfd1-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1766474929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474929, "uuid": "84f8793f-e7f5-41b3-b638-51244b16e1f1", "comment": "Malware payload (RondoDox)", "value": "345ea24816e436986c74b2d639cfd542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474929, "uuid": "c9b9cd59-6fe6-4efb-a5a8-ee445c29cf94", "comment": "Malware payload (RondoDox)", "value": "09b07958c14e7a66150f46a05e4f800de5ebb78dc8741eca4a912fb586bffe3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474929, "uuid": "eee1f717-5401-4c40-beb7-baafb9843256", "comment": "Malware payload (RondoDox)", "value": "e735de80add4cea0cf32384b8b87e0be903c82d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474929, "uuid": "5ca6d986-698e-4921-9caf-22de6c63d8a5", "comment": "Malware payload (RondoDox)", "value": "667f1b552c90cae05a4a38c6370b3177aa23a0bfd566ed313d2cfdfcf1228d6b73838a96d40da8767b77b6a62e4f0fc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474929, "uuid": "6f68fcdf-b84a-482b-a475-baaa229c0b4b", "value": "T18CB33B6AFD818551CAC31AB7FA1D529A376712DCD3EF310B8E294F50279B82B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474929, "uuid": "8d4925ab-bbb0-4c97-9996-6ba477e732f5", "value": "3072:EN0lNFePb0lllLl/lKlXkl2ZlaSl/l0lAZl1lAl/Gl0lSlMlMlFlyYl9lIlqlMlL:EilNFob07lJ8NkAZ0S56WZT+tGagyun5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474929, "uuid": "02a7d340-3fd8-45ef-9716-6a269473610e", "value": 118068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474929, "uuid": "e25fc66f-bf39-4247-ab38-df6a29634103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474929, "uuid": "f42df66c-a17b-46e4-9a54-b579ffbfc742", "value": "rondo.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26150375-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766489156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489156, "uuid": "57b6d04e-afee-4772-acf3-b273efcc2e32", "comment": "Malware payload (HijackLoader)", "value": "bd4b18d65b090fbc2359f2e63b7c4a91", "object_relation": "md5", "Tag": [ { "name": "dcgrezzt-duckdns-org", "colour": "#FE71F8", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489156, "uuid": "077883d4-4ccf-4f18-a239-fe8e8079ff97", "comment": "Malware payload (HijackLoader)", "value": "09bcab4d8fff8fdf3d312e82c9300c5f312e8aba41c318c55dd066e88b0f336e", "object_relation": "sha256", "Tag": [ { "name": "dcgrezzt-duckdns-org", "colour": "#FE71F8", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489156, "uuid": "5ac9043a-bae6-42b9-8168-69e2eb41e269", "comment": "Malware payload (HijackLoader)", "value": "dc55d3a594913a9d5c7564180f5eabca13edfab6", "object_relation": "sha1", "Tag": [ { "name": "dcgrezzt-duckdns-org", "colour": "#FE71F8", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489156, "uuid": "4d8bb3ec-ba72-4c26-b9b6-2b3572d2213b", "comment": "Malware payload (HijackLoader)", "value": "743357b6a48a1481c24a4ed0e5b7ead41e05f789d052d2dc322e2697a56808fa6d21eb8498b5e3a311f1cdf7a1686371", "object_relation": "sha3-384", "Tag": [ { "name": "dcgrezzt-duckdns-org", "colour": "#FE71F8", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489156, "uuid": "36854dc3-33de-40f7-a8a1-f0090ddc9dd5", "value": "T1C6A533110803F246A55CE1B1A2AF3BDB0B7ACED79749A06DF89ED126113F4E9014FF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489156, "uuid": "9bc13c90-122d-49f4-a720-6bf0a31a59e4", "value": "49152:2pftKfZSnMxKkq4q66qwbn4nusIYdG8lD2U7GlmcTCvmde3:2SOkq46z78MuGn6GTmuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489156, "uuid": "394e98bc-1fe0-44a8-9234-534e10a648fd", "value": 2167549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489156, "uuid": "6709b2d2-a351-4c11-958f-069c4682f83b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489156, "uuid": "fea41e72-07dd-43cc-aa9a-5c7e859e8e1e", "value": "09bcab4d8fff8fdf3d312e82c9300c5f312e8aba41c318c55dd066e88b0f336e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f057dc8f-df96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449981, "uuid": "12a0ea33-23bd-428d-9326-47b87c452ad0", "comment": "Malware payload (Mirai)", "value": "37a8b56d819413f1285210aee69acd51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449981, "uuid": "0cd81f10-fa14-4d6e-89b9-1394106b1dff", "comment": "Malware payload (Mirai)", "value": "0a060b21c110950913e7ebf1d2d0992b75f208f978499dc9978260c5a768ff7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449981, "uuid": "3b5c86bf-2e20-4f45-9569-7e5f457b0e9a", "comment": "Malware payload (Mirai)", "value": "2eb4ad1cc6d309a778e4f294839ffa31e1194329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449981, "uuid": "d7233782-28b7-4715-a616-9c2304b90b0a", "comment": "Malware payload (Mirai)", "value": "da8a26c57a1282e477ee6c471170ad3227ed35811f9ea8e18d40c299c7f3a990e19106cc5ddc680c0b2acb9e800eb191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449981, "uuid": "1c76f1ba-6a04-433d-8793-4d6c8933998d", "value": "T1F3C31796B8829B10C6C256BBFE0F528A331357ACE3DE72139D181F64278B55B0E3E516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449981, "uuid": "b65506cf-4564-40ae-8207-0816b673abee", "value": "3072:F7ntzErc/ojlNLnLhaKrVHdXZT6a/n1k+TVHDavzg8jw0nz1:F7ntYrc/ojrLnLcKRdXZ2adk+Zar3ww1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449981, "uuid": "60d3cbf0-5363-432b-963c-11123a4f58ee", "value": 128144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449981, "uuid": "9fccf45e-7b89-4039-b07f-10e3ad05aa7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449981, "uuid": "24bc197b-7d77-40e6-a918-527629e52e1e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c7bd86-e021-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766509306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509306, "uuid": "c56de504-03b9-45d6-9f55-04eed71e14ad", "comment": "Malware payload", "value": "bde95346431aabf163561c7c4a5cfc0f", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509306, "uuid": "c595a02a-cae4-4497-b140-863cd71c1068", "comment": "Malware payload", "value": "0a29042e7fe4c834c268ff294243894011fb2584408685a53292deac875da7b0", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509306, "uuid": "9328d72d-2349-4b01-b738-af31bd655713", "comment": "Malware payload", "value": "cbc738bfd65c6889d6647ace69c80dfe3f2a1772", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509306, "uuid": "de7057dd-03ed-428a-b357-78248936af2e", "comment": "Malware payload", "value": "ab344dca39660b5cc539fb07bf1dc1f79ff6125f2e5be8579b55e4aed7b2d6765b3ac715db2395a706d0506c595a797e", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509306, "uuid": "829b846b-a855-4147-83db-54029907cd66", "value": "T109F71290DE3FA197BE1B12B7B783D40A66CD820DB254FD4345DCE613960B9289FC531A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509306, "uuid": "5b433f14-ca1e-449b-9c4f-4968b2e23454", "value": "98304:f3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3ER3Eg:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766509306, "uuid": "4b786fef-8956-4bb6-a0b1-0d2bbd1f0cd5", "value": 70930002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766509306, "uuid": "ee780cb8-1743-4ca0-a84c-67e5b13fbc84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509306, "uuid": "cd5bc5d2-a7bc-41c6-afb2-41da0735214d", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f0bcef-e040-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766522916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522916, "uuid": "2726d718-e60c-445a-8a69-504dd977d89b", "comment": "Malware payload", "value": "251eab99c52a8830bccac7f0a3302643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522916, "uuid": "4298e2c2-ef92-4fa7-a2b1-fb89136b86f2", "comment": "Malware payload", "value": "0a5c6c6d1c5429756c7e36e37dffba78ccb79dfc34ee191415382c4075d7355e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522916, "uuid": "ae9b92e3-b2f2-4184-b9ee-abea5fe2f433", "comment": "Malware payload", "value": "47622a04903601f6dc0dac14bc0c2941435cf59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522916, "uuid": "7352f8f9-b9eb-4b20-b2c8-d539278ff1f2", "comment": "Malware payload", "value": "f0a20262590c1f0524a3d90d6d099b065066e2abdd74cdcc69aea06ca4a80531292b28afd2ddf1d1452efaae7fff7e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522916, "uuid": "bdd6f628-d91c-4579-88ca-aa044a996211", "value": "T1C203E681B8819A23C6E4237AFA6E45CD33256798E1DFB31BDD122F10778682F0DA7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522916, "uuid": "18060494-0aef-4ab2-b475-f0ca89d209a3", "value": "768:1Tpx7v8JU36SAvM1sg0SxalhIt/UdRtTPmc9Cd:9pxDtKDvM2SxehyU7NTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522916, "uuid": "d8fc9aba-b2f2-4192-b936-44308e8dd46c", "value": 38936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522916, "uuid": "bb39a9cf-3a5e-4e42-93b2-e4796f37cfaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522916, "uuid": "32103251-6d66-4362-941e-dd617b6673b0", "value": "87sbhas6as.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd04b77f-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478779, "uuid": "dcc9bf64-2dac-4e57-9605-cc25002e2b11", "comment": "Malware payload", "value": "241977722d938205fa02470e4389b48a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478779, "uuid": "6ceb6a96-9d3d-4711-ab1f-b7ea036d7f67", "comment": "Malware payload", "value": "0a9e565749c885c36ad4fb040425ed2fb6cd18223226afea77edb197a8a4c417", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478779, "uuid": "09393f64-750b-4f32-a04a-b784881e0c8e", "comment": "Malware payload", "value": "b819b54a0427bc1cfb175e7c8e0ba56b894ae81a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478779, "uuid": "7f74aa97-134d-4509-82b0-fae1fa9ca3a8", "comment": "Malware payload", "value": "67db2f74ba7eb26089df62f3ce79491be8899353a4eed2bd22df0fa7697cd79568947fea7eb35109989362d964cc845a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478779, "uuid": "c87b0c95-2f35-4d5a-b55f-46cd72898090", "value": "T1B773E8A56DC0375E38B311C2E6DFA17876827C3339989FE3AB146891A270F192F545F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478779, "uuid": "7312a4bd-4e2e-4d71-a140-c36ee56b8e53", "value": "768:I8w/h62/jWs6oS+xISN0vyZteWxSqi+MAC94JNYTJiGdg1BOAB1mhLLWJS6RT8R2:I9l/AoSSMdJFusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478779, "uuid": "0c319a8f-e910-4125-9309-45450e829e56", "value": 74467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478779, "uuid": "94b50b92-891f-4487-967f-92f4e370dd6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478779, "uuid": "d08491f3-aefe-449e-b811-5511df640784", "value": "invoice-1645080830.pdf (74).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b304897-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479017, "uuid": "29694509-106e-4997-91c7-a608111af15e", "comment": "Malware payload", "value": "7ae9ac4a4c1cf3b1596ef1d413943058", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479017, "uuid": "44c2e2f6-4746-49b8-96a4-7ca95c010d2e", "comment": "Malware payload", "value": "0ab57df0d2c1a09e1fc58b6b15fc7cf6a2a21f75c09aebe20140121acec1870c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479017, "uuid": "6e9c78e4-cbe3-4bbb-b944-def5d5f051a3", "comment": "Malware payload", "value": "c6155e99348f5170af406d8b047d596f60ab19b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479017, "uuid": "7b66f0c5-b92f-4734-9fab-75121c405e2c", "comment": "Malware payload", "value": "9e76fcbe6d14cbe3d3bd80657c11ef4d5564175ce512dac8d4a2e2778fce2707f5235f1088f3b68c139173fdd9a0ecea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479017, "uuid": "768b8181-f6f8-4cd8-ba5d-fb3c2c0dbd23", "value": "T118632CE89B81BC56A4447C1828DF9139B4175E37DB3A96CC8A2FFB736757DC2408920B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479017, "uuid": "9e3beb10-c028-4c84-9e26-c679e70d604c", "value": "768:I8w/h62/jWs6oS+xISN0vdpYYiziALtp9amcljt2f9JLMMoT3W7S30h3bS1uvnE5:I9l/AoSSMpMusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479017, "uuid": "4bd7bb94-e7a0-4104-a8be-04a16725f543", "value": 71614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479017, "uuid": "bf2df725-b0ca-4769-ae82-3aba4fab8273", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479017, "uuid": "e994eb55-20d2-4e96-a35f-e8be4cc6eeac", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75c284a-df92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448195, "uuid": "0801353d-0fe8-444f-be82-e4dd9f8c201a", "comment": "Malware payload (Mirai)", "value": "0cf45d17332bcdc7028490ff315f607d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448195, "uuid": "b4f90f98-0885-44bf-bbfe-a56150d3bb09", "comment": "Malware payload (Mirai)", "value": "0b3a84e6b9026a574bf56df57ad63f769a28b7650b44cd589eea2cce8c681e85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448195, "uuid": "776501e3-0aad-47cb-915c-cbe91b2481c7", "comment": "Malware payload (Mirai)", "value": "d8372fba46d40c42a4d777f626a2df3cb997a49c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448195, "uuid": "178055b1-2748-4b4f-9d7b-9064c5757896", "comment": "Malware payload (Mirai)", "value": "215ec2e1e497afe286039e453f9b23ae1ab9de0a8053e6afb9f8687472b09477c3bdaca1c09dd20d9d169ac6194a6d9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448195, "uuid": "b8a2f98d-b786-4f9b-8b19-bbe618777e40", "value": "T188B3D74A7B650FFBD85FCD374AB95B05258D920721E82B3A7A74D818F24B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448195, "uuid": "ed2be017-1b43-4fca-a8be-31319ff5a5dc", "value": "1536:xt+wzhJYhVKRBNNsc9tn17IY8uQXxFIEKc43leVdfnxEEVRVxT2bVR:xl4hARBosL7IoQsMjRTT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448195, "uuid": "c1c4e9ee-1e76-409c-b989-ebf9676104c1", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448195, "uuid": "8a59b1dd-fbd1-426a-af58-1079bddc9c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448195, "uuid": "e757f5e8-a7a1-4520-a426-0cf7671faec7", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb07f16-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478805, "uuid": "d25e0a13-68ca-4f26-8a2c-d8d40e91874d", "comment": "Malware payload", "value": "2a88aa116cb79897bc0b1c89a7ee73b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478805, "uuid": "bffa8890-23b2-4f77-8495-cc8d4403d54e", "comment": "Malware payload", "value": "0b9ebc00256ff3bcf5434813bdbf406851dfa75783abbdb68e67a7459e236b0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478805, "uuid": "9f550400-628f-4197-a320-30a0c0c0ed5e", "comment": "Malware payload", "value": "30156b8b37f848f76019d7e705816a39d2ee294a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478805, "uuid": "bc65c6a0-d584-4b55-93d4-908455001dbb", "comment": "Malware payload", "value": "0ed88ef8907d625cd36c2ee2376304c6cb4b18bcffffb62a71ab4fcc494c76c017e72315b68ef7d70174f990974cdeae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478805, "uuid": "a56b4dd1-9a99-45dc-abb2-ae979e79e119", "value": "T1ED63085929A8B2240CEFBF269A8815EA5432CDFC6D53CC6D5B2735CE3B0189F1145E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478805, "uuid": "ff7431eb-476a-4548-8ace-3a99cf1d7223", "value": "1536:I9l/AoSSMJ4zMCPsloPzhJRNAd5SQu96pe6mDKNIW6b76onPUBc9osStamPVsyJm:I9l/5MJ4zMCPsloPzhJRNAd5SQu96peD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478805, "uuid": "00325866-ab1a-4335-83eb-f7d10d4b6d13", "value": 71556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478805, "uuid": "8b866da6-a14b-4861-bb17-64c6c0492845", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478805, "uuid": "2a7bd9d4-41ca-435d-a94c-872dc907b93a", "value": "invoice-1645080830.pdf (69).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17d19c4-e05a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766534111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534111, "uuid": "36fd5536-4bb0-400e-bfe6-d22ad4649d0e", "comment": "Malware payload", "value": "360d61b4b3e23af54b6348b7f4c5689c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534111, "uuid": "b9c55098-762c-4260-b54d-a8a32f617169", "comment": "Malware payload", "value": "0c6b93ebfbde3dcea3eb411da88e161a6a50165250bc614795c12cb451cc4677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534111, "uuid": "728b67a4-7475-46e6-a89d-7e533cdce365", "comment": "Malware payload", "value": "cf915c2a1b96d8a97c737ba81b2632d81a1aea50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534111, "uuid": "f3e13932-082d-4450-b735-e336f14e59ce", "comment": "Malware payload", "value": "65605dc6610b6813f4da6adce0d74683d0a7a2444d0f3eb3be43563ae70a9393c92a788c086eaa2816bff02f9cd979a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534111, "uuid": "7d6026c7-f3a6-43a6-9c98-f98e9f62bcbe", "value": "T109E31845B881AF10C6C526BBFE4F528A33135BACE3EE7213DD145B2427CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534111, "uuid": "a08008a3-6398-4a71-9b86-ad1e8a009469", "value": "3072:hTZtqJCmi7i2hmHh0brVxPT6VyE2aO0c/Nzi1TQBnkjqQIytIA300EegBZnzE:hTZtqJCmi7HhmHCb7PT6VZ2aOZNzi1TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766534111, "uuid": "f86b648b-c449-46fb-b341-aad340706d5b", "value": 150344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766534111, "uuid": "c9befb1f-4d8d-42c0-8a47-c04fd340b688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534111, "uuid": "636ea853-8ec3-4121-9214-85ce137d3a1f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abc3cd7-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766475849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475849, "uuid": "e31ab2fa-4325-4827-a7a8-9a0bf1c7e989", "comment": "Malware payload (Mirai)", "value": "b780f7336b94912dcc243693f2acedb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475849, "uuid": "738fe739-04f2-4d27-9ae6-d7514840a4d0", "comment": "Malware payload (Mirai)", "value": "0cd41af39b4cb9501b2a2e606d8be3c653e930debec2e69ea81f260f70fd6bdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475849, "uuid": "076a83a5-474f-4f57-8d4a-86bd0a6ef77a", "comment": "Malware payload (Mirai)", "value": "4abaa68f824bcb2e9f00a416bcf67aaeb3d8234b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475849, "uuid": "9a7d0624-6050-44d7-888e-c017bfc7bba1", "comment": "Malware payload (Mirai)", "value": "9039256c779bfa958c184e5b2c6f729840fc062ea56a0a08692cae4fa6129e0b4f9ce1d2e3e8bc3572f9f1c9396c7b68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475849, "uuid": "b7060a41-9641-41d4-8175-0c8214a7b493", "value": "T1A4048020FE0663B1CC721A3497966E5A6E7704559FEB26312D1F623DDE628508F30F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475849, "uuid": "7777daca-f21a-49ae-899f-02a9318676ae", "value": "3072:ZZFnn0qg582rnP4wnKd7Bg9ca91L0NFaZUKS:ZrnTgycnP4sKE1Q3a6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766475849, "uuid": "375cf7e8-7766-43b7-b1b3-2a0abd1dca02", "value": 189076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766475849, "uuid": "068f4604-8b71-453b-b6f2-a5359bf9c467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475849, "uuid": "cfa947b7-4e57-4d10-8a63-e52d09608322", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6d5236-dfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766474783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474783, "uuid": "53277542-63a5-4b2d-9533-4632dc74ffde", "comment": "Malware payload (NetSupport)", "value": "f5cc80de90c3aa50029a58953496b60b", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474783, "uuid": "302fe850-2b60-44bb-90ae-96dd0834686d", "comment": "Malware payload (NetSupport)", "value": "0cf3fb386d1f239872280e541515970c0392465015beabd51bc12c0fe9a5eb23", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474783, "uuid": "30995155-6339-4238-937c-170ab70f572c", "comment": "Malware payload (NetSupport)", "value": "c6b4a593c24af17153d1d67c67e189048cfedfd7", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474783, "uuid": "4bd32e40-3876-450c-bfd5-26f4ec99797a", "comment": "Malware payload (NetSupport)", "value": "e1cb44d51d8dae791b3942b582e10a8a9185f6725d3af4170c99ecd610abd760bd426dc3bf2c9df30c0733ea95c10e07", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474783, "uuid": "b0396a0e-1b62-46aa-92ae-5be29d1e5094", "value": "T152F68CA4AB84974EAE6E184BF039561E3BF27F66E08271FC53573303256FD14A63AC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474783, "uuid": "a2256fbb-896e-45ff-8fc7-cab5639579ea", "value": "49152:Q3tGXEAcIqi5tobanvVAymV3PMespFSBn2GstahsK+njnxlKFfCtfxpkfWGprCLt:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474783, "uuid": "7f909e67-d305-4287-9d53-312a9dd46944", "value": 16489918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474783, "uuid": "0ef12295-af85-414d-b94a-e41673c6debe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474783, "uuid": "27ee8c91-2561-4ab6-b9c3-8defb2cd81c2", "value": "0cf3fb386d1f239872280e541515970c0392465015beabd51bc12c0fe9a5eb23.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda84780-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525112, "uuid": "03dc04b9-ed4e-48ff-ac10-3efb39515f63", "comment": "Malware payload (Mirai)", "value": "28ed3e9d5424718af1c95009f0fcad6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525112, "uuid": "46f320a2-6281-4163-9857-c280ea00c11e", "comment": "Malware payload (Mirai)", "value": "0cfa4ea1258ff0593aafdd9c1ec4505cbb2ca6e170bcfe142c32ae088cd63398", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525112, "uuid": "0385dd32-3cc8-4035-9b0c-d1227a2187d5", "comment": "Malware payload (Mirai)", "value": "051ddd02fbf6bb76b659d1f6a4ebffe911894990", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525112, "uuid": "d8338a12-45a6-4f25-9559-4c5ab249bcbe", "comment": "Malware payload (Mirai)", "value": "96279ae94abd8d7d1ab12a42848f512ce0287cf1a393cd7f40d727b378c0b58ce5f02db82e74bb791d4dd48081a89500", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525112, "uuid": "bbbd2321-9dba-4e45-92a0-9015df03c9b0", "value": "T18EF0A7F7A820C47D3A4B4C3FF69AC6D46882086B74993D28B50BDC131B1C8C82179632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525112, "uuid": "9e5d24e2-90ba-4d72-b862-8dce055b9295", "value": "12:8aWAvDf5xZ2A5nFF3q1UUSYyEZ5yaa6yH++:8x2f5+qnFoDLanZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525112, "uuid": "cfbc06a6-5cb8-4124-9a2d-0942bed2f695", "value": 463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525112, "uuid": "285b407f-c244-4dee-8313-50b4848fe5c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525112, "uuid": "20072efa-47e7-4a62-8a22-515f882156b2", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cfd4ab-e035-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766518247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518247, "uuid": "69b50608-d0f1-4681-87cd-e3576bacf751", "comment": "Malware payload", "value": "da52b813501b1354aac1da3a58ff37da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518247, "uuid": "cbb2daf7-6268-4190-87de-78914692abd7", "comment": "Malware payload", "value": "0d2c1adf36df47199ee1ca42417660ac5027f77671d4f3c59cce0c23d94e25f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518247, "uuid": "18824ee6-fed5-4dc0-a3fc-ee755f89fd9b", "comment": "Malware payload", "value": "576cb46def201beac060d5f291f8290de572386e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518247, "uuid": "ae3064c0-ded1-468c-96f6-3661e8f70f23", "comment": "Malware payload", "value": "7582febda38d808f351251c9a0a26193b168d8585ce248dad8f6bda9b097b63841965624afa10cb37cec41877eccaf81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518247, "uuid": "116d2471-6825-420c-b0bb-96e9deed93f1", "value": "T14AF439CD9B7D8C6FF2125A374EE3BB379D3D59A92A306747122305D06E17BA82D12720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518247, "uuid": "b16d9082-3b1a-4569-8c83-d1c85c6a93ba", "value": "7b9b6613dbfe6e40a01bc0021d5d487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518247, "uuid": "3dcbead5-9a3e-4413-b038-e2334f7ad593", "value": "12288:0f5hLoDAE4Qck34ccHmho/hvV6/2ASuGqbBkUnj:2cD7tckoTK06/29uRdnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766518247, "uuid": "0e9a4b38-f5da-4412-a2fc-d5fdeb253da4", "value": 759904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766518247, "uuid": "6cbb49b7-efd4-459a-9aa0-761ff8bd5896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518247, "uuid": "1880f31e-4769-41a6-9e32-6a08679d8e8d", "value": "ImageViewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0af819-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479153, "uuid": "97a30d0a-3530-4cc3-865c-b1320c0b4318", "comment": "Malware payload", "value": "ae9994bf8cb7eff756b677c715b23640", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479153, "uuid": "fb76603e-8bf4-4526-bdc1-1f95c614089a", "comment": "Malware payload", "value": "0d3382f0df3f63387a8e3816d9ad4b3d04205f9ac76620b8ad80d75c5f1d8702", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479153, "uuid": "685251b8-0448-4ff2-a277-a60fecbb64e8", "comment": "Malware payload", "value": "4baf6d8e2a172a1a3fcc9e3b3f289e0df05b53d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479153, "uuid": "c00d505e-5748-41e6-ade3-72a15ae4b4b1", "comment": "Malware payload", "value": "594da9e61441c16e983563d41a6ec541cce774371ba4579920ba125b784be2583465c23f8e2107b474b6d53564c3b27b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479153, "uuid": "b9628665-81c9-4c9f-800f-2bce56b7f7a8", "value": "T13263C6EC1FCD59DDBAB3260CCA95A8D0170E9D8F4C495104FB7033EAAE96BEA540CE15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479153, "uuid": "b7dbfeef-2a61-4d8b-8015-5145207f0c04", "value": "1536:I9l/AoSSM5JbEc41QBzwraZlHCoXhJPSXyNKvE+IW1EXOXl4XOXy6udWd1Xwcbzg:I9l/5MTsusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479153, "uuid": "8dfa73da-0019-4d1a-833e-1c1754aee8f2", "value": 70602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479153, "uuid": "287402c6-8a8e-44b1-844a-e0e6b6e08d81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479153, "uuid": "2a9385fd-f35a-45b0-bea3-d393340954c2", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bbfd9f-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766532002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532002, "uuid": "b832411e-bb9e-4205-b892-c2a2c621db21", "comment": "Malware payload (SheetRAT)", "value": "17ce12b46d86fc39a5c9b6cd59702f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532002, "uuid": "d704ee53-cea7-47f4-9e2f-bf99ebcfd2bf", "comment": "Malware payload (SheetRAT)", "value": "0e22007a4742d3d7a756d85645c0717088ac2f593881c423d9a961fc554adc69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532002, "uuid": "77e70d18-80c2-4166-bb70-ce8079ed8ebd", "comment": "Malware payload (SheetRAT)", "value": "9a5240beda4fcc63fc3547171be4217595e55978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532002, "uuid": "44782109-7d6a-4953-80b1-bd6714882632", "comment": "Malware payload (SheetRAT)", "value": "d7dda09a60c2ef3a987fc5eae316ae5331f8d4dc0d6969ef4c61113370260ec4265298b445a11fba9f392b33f343889f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532002, "uuid": "2d5abef2-b880-4466-86d8-e0992dd0c8b3", "value": "T1EA94B30CFE92E905DD2E3DB3CBE510044B7129C12E2192963169AFFC9FA637658E257C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532002, "uuid": "b1f26020-933f-4866-93f2-25ded1219f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532002, "uuid": "85fc9fec-9c64-4d08-b290-79ed368e1e22", "value": "6144:O1J6JBne25LuH/vuxmxRe6VlWT8b9BllpiZbVzxbtoBcJSmNq21c:PVsH/9xRPVle8Blpi5R/oQq21c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532002, "uuid": "c2b4f73d-6ae4-4a35-9f6f-c3d597cac0e6", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532002, "uuid": "af239b77-9d7f-422a-812f-707d7c2a349c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532002, "uuid": "1dc9c42a-7aa6-43ea-b038-4d0b518cb451", "value": "wsualyxqpeul.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32b029d-e005-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766497660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497660, "uuid": "7ffa8d5c-c9cd-4a7c-b943-51496e7e3460", "comment": "Malware payload (Mirai)", "value": "d7bf2c47fc868f2171a680b9f06e8148", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497660, "uuid": "512218cf-6024-435c-a30d-1a35e6209729", "comment": "Malware payload (Mirai)", "value": "0e96a2b051308669018d8a9270e18b63d79348e962a920e4dc25025baac3a753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497660, "uuid": "1ac51e2c-a224-4c82-9b96-7e1ebed37378", "comment": "Malware payload (Mirai)", "value": "4f142aa9e65a96b92b3b15ca936e16d06321661b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497660, "uuid": "875f6c4b-6fd1-4ced-b8cc-866b35b0757d", "comment": "Malware payload (Mirai)", "value": "34516edae152dd472213719d239815b6c915641360c04e1a4edf243128af29ba313df04380ee59d85eaa5d960e8d8809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497660, "uuid": "f618670a-135f-47c3-a467-42d750e1982b", "value": "T1A2532BC86902DAF1DC255171E0BFEB7A47BAF67F4029DE9FC3949472D453A02A24239C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497660, "uuid": "a63a0e7b-fdb4-483a-92a5-c938b880072a", "value": "1536:9oMwUYuBeqcBzgAyVtDG/BmjPNl7/FvH5:WRUYuBeqcBsAyVtDikVlrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497660, "uuid": "ef307164-c6e3-4184-81b2-0985e7aea2d1", "value": 62112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497660, "uuid": "ab821287-a351-4db4-8465-97b407e2f802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497660, "uuid": "09621cb9-232d-43bb-ba3e-83d26e61a988", "value": "shadow.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2ada50-df96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449708, "uuid": "23cfaf3c-716b-4330-8a7f-a532ef26c0a9", "comment": "Malware payload (Mirai)", "value": "857d8425237c57ad145feef0ebf80f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449708, "uuid": "5d4a8667-2887-4ca2-9691-ded96ab12933", "comment": "Malware payload (Mirai)", "value": "0e9ac7b63fe88b33292a9d4baabf9fc71045c51bf4efad77be1a85a052242e67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449708, "uuid": "78ffc6f8-9cae-41c5-9591-f07b85881740", "comment": "Malware payload (Mirai)", "value": "1df5daacd02ca937072982840fdbbd0a551e3d64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449708, "uuid": "a3448177-eddd-4079-bfbf-171ccce6c96e", "comment": "Malware payload (Mirai)", "value": "ebe4bca2aaa7ab77afa7c51807257b6b898cf1bb798d8fce738012d6b7239653f1402c2e6161a1e1ad262bafda98cc2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449708, "uuid": "9f77f9eb-2b1b-4a97-9159-a505575bc3bf", "value": "T128534B42B3084943E5571CB1393F2BD593DE9AA022B4A787694EFACD4272E32850BDDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449708, "uuid": "243a354a-eee2-4286-8706-fa0727f38f50", "value": "768:rSkU4tdlSCpjYTWkxlI5nIXhVTvkt9SDRmcjY/SjWnz7woT2bVRe:r1kCpzkx2mXjK9URmcjnWnNT2bVRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449708, "uuid": "56da3059-c2b3-4c75-815a-f3cc7b79d220", "value": 61380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449708, "uuid": "ed0ea5cc-7a6e-4a7f-bb51-898375269d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449708, "uuid": "37520fed-2deb-455e-8c3b-110c7635ee56", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464c86dd-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766489210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489210, "uuid": "8a5884ad-bd59-4e55-9dc4-6df33031c1f5", "comment": "Malware payload (XWorm)", "value": "d0ec19114efe0d2c452ef73e9a354ebc", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489210, "uuid": "86c2bd19-bae1-408b-b44d-22fff77042d1", "comment": "Malware payload (XWorm)", "value": "0f1ee3fa8175d71e35adb6c4f3fdbfd4eb68b692cb576f559248ac7d067312b5", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489210, "uuid": "aaebc171-c3ee-46ed-8c18-5fef214c0cb3", "comment": "Malware payload (XWorm)", "value": "64a8084fbf6e3dbad8b99c50ebd61c95df376398", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489210, "uuid": "479b6079-4c43-405d-bcfc-d20b99123856", "comment": "Malware payload (XWorm)", "value": "045c866bc6ce72fb4f629a79b2808e425dc19e76e55e35f80cc1307af7bb421c443b6af5960b746baeffcaf18c0f9d86", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489210, "uuid": "a96a84d9-4e89-48ce-9c0c-ecc70402429e", "value": "T1C4A6337AA6BC3745F8029F3BF104D1FACE3FA34358B60B154DE5189D89B623976A41E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489210, "uuid": "3239e95a-b880-4f39-812e-805f25353872", "value": "196608:q5b8FSaSY1CZHNX7zma9uo4crRbEp2KY5qzYQ87N9eCAD94Ha//YvpL:YYFSqCZtXX9uotwX8z76Iaod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489210, "uuid": "1fe7833b-a5de-4f98-afa5-67cd23e35b7d", "value": 9970716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489210, "uuid": "459689bf-b647-41d2-b5f2-8ea409703360", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489210, "uuid": "10fcc75c-a9ce-4234-b626-5a27b55b0ebf", "value": "0f1ee3fa8175d71e35adb6c4f3fdbfd4eb68b692cb576f559248ac7d067312b5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68d7ea2-df92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448193, "uuid": "60400f00-25b6-4931-ae6f-e58f1531bbb5", "comment": "Malware payload (Mirai)", "value": "17ec092b993f3d333b39a6318f78c5d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448193, "uuid": "d5fbf913-3185-4a11-878b-08358c05f53d", "comment": "Malware payload (Mirai)", "value": "0fe54fda91ce051b9f0557b06e6e5824f2fefa4ac54876c0f25475575ad22eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448193, "uuid": "e664bb4d-713b-4a7e-80f1-b57e0048d6f6", "comment": "Malware payload (Mirai)", "value": "71237aa9c7abcf3cf1ee5f74c28970896e4f9f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448193, "uuid": "82ba7c33-2fe5-482c-b74a-38fbac06f029", "comment": "Malware payload (Mirai)", "value": "6d1750429162f3bf9bb577c2a29e2852a145bda0d81398a92230c1cd39a5eb649acbff27c79a6549ef9712099293162a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448193, "uuid": "f1a6d523-7fe6-4bb2-84cd-9af829bcc83e", "value": "T18253F985B951DA12C6D5A577FF0F82DC371703A8D2EF73039918AB613A8B86B0E2F451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448193, "uuid": "f30e9e00-b2a3-4e42-9ee5-d61af64bb63e", "value": "768:sN+Zi7u72Br3eMBUQKMCr2pU+WLIu+TNK1Z7EJNInFxp1ZCFP+lkxoMF47vIT2bb:a+n8tKMCapKx1duu51Lp17vIT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448193, "uuid": "b77be56c-c2f6-4ac7-9cc6-67631d81ae60", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448193, "uuid": "3d51c158-3dcd-4cc9-adb8-86751f27ca7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448193, "uuid": "a169426e-3d6b-49eb-9bbd-fd9328807750", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0068e4d3-df99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766450867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450867, "uuid": "1d76e814-36f5-40ba-a6fb-ec6788b6c7c3", "comment": "Malware payload (Mirai)", "value": "3315bd4a98b7ff1854d449dbcbd34e5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450867, "uuid": "e86376ea-bd1e-4008-85df-81a8e5c9be36", "comment": "Malware payload (Mirai)", "value": "10f7594ec5f6930d49e15835c40c1cac0dddca1749f3c0c69d15d7117b5e301a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450867, "uuid": "a63997ab-0627-42a7-a15c-f21d66b4bcbe", "comment": "Malware payload (Mirai)", "value": "e36cb7290e80235f3e1b7650f1913843252346b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450867, "uuid": "847a3334-99f4-45d7-9a42-31309d3e0c24", "comment": "Malware payload (Mirai)", "value": "7f0c35d90a5959b4a5fe51cb51cc1bbec09938d4216921b81d6edf351c05c02672418cb07ab7e09065f320b8f0a7772b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766450867, "uuid": "62b59bc6-8689-47d4-9fba-2595e0d60971", "value": "T129C32985B951AA12C6C2567BFF4F428D771A539CE3EE3203CD195F64338B95A0D3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766450867, "uuid": "51e384e7-619e-4811-bce6-28eaaeef5112", "value": "3072:g6wnPFJVn3s62+JISP4PU6GNYpVSd23p13nz4:1gPFJ93B2+JISQPU6GNgVSdmzD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766450867, "uuid": "3538b3ae-1d26-4beb-9665-1a0befb4e7fb", "value": 120040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766450867, "uuid": "bcbb58e7-9585-4845-9bb2-32eb4295f2cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766450867, "uuid": "eb55948b-649f-47bc-96dc-a29fad7fbfe1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f6e24b-dffc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766493556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493556, "uuid": "fc93b458-609a-4b71-9b92-0e6acf400da2", "comment": "Malware payload (Mirai)", "value": "0f040b77ddfb46ccd887019efcfedf18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493556, "uuid": "7f3bebdb-d54a-4dd2-92c0-f1af19a7ae50", "comment": "Malware payload (Mirai)", "value": "120f721c21891aaeeded4de283d53ad86e163bee21206c468eab066bb41780c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493556, "uuid": "bf6a34f6-8c3a-4fac-bae3-59b944a02459", "comment": "Malware payload (Mirai)", "value": "329262c0a8d5f12ea1bc80f2e8c7028b9540e59b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493556, "uuid": "e5982b1a-e174-482a-9b93-64d10870d34b", "comment": "Malware payload (Mirai)", "value": "5fb02928d1f5b2c546677048d54d80845bc277fd7f6572abf7914d366382fed4755dda9e325cdbe6cd1ec951890dbd91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493556, "uuid": "d4453f6d-085b-47e3-aa60-57bc583fc29e", "value": "T1DF83184273180F07E16319F02E3B1BE087AEFD6119E5B6C5A51EFE864231EF22546F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493556, "uuid": "c1ebf070-752c-4911-9805-e181714493a9", "value": "1536:EOCZ2QL2iYULzpiIY/PXNR7Kfa61kOJgDAP18oQl61d6yEZ:EvL2+Lkn//zc1TJfC4jEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493556, "uuid": "806fb98b-9614-40bc-9724-89cd26d6d5e3", "value": 88444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493556, "uuid": "1520d742-ec9b-4e2c-9793-6060757826ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493556, "uuid": "5b93758b-ba3c-495d-a03d-cebbe6ea630b", "value": "nova.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a82245-e00d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766500689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500689, "uuid": "aae99901-ab94-4214-b208-9e36dac75187", "comment": "Malware payload", "value": "f3eb9576e05b59a28130793bd455d256", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500689, "uuid": "5223ab5d-3be8-43b7-9bf0-939bc4e9a203", "comment": "Malware payload", "value": "12316be2b95f53e09eb8b53f430a963bd2f435f96d8ed6f67e2031fe04223e08", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500689, "uuid": "96ce73f6-dafb-4843-afa0-db7c3195b724", "comment": "Malware payload", "value": "88840cacb7d4fb01e3958c52d3b8eaa63382fe83", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500689, "uuid": "51784e92-233a-467a-a150-87372bcae772", "comment": "Malware payload", "value": "8a5866ed6d7f9ea24eac8c7fa8fb351722e1d097c10186e9744f5773fa82b5fc5e2d2f0b468071b06a7f160221f88cb7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500689, "uuid": "48f2a462-59a1-409e-b54e-3cddbdf8e14e", "value": "T18F55339A407D29844F3D0A6377EF9A1C91108AFC10420C736B6A98DB663E7DFC77499B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500689, "uuid": "86640102-f751-4b62-856e-7cd6ab046c5e", "value": "24576:YyJeXoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRj:9AoZ9bq+MmMEL+hcjXHC/wnwdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766500689, "uuid": "60983a87-2dd8-4c4e-b9e5-1db22fe72de7", "value": 1386736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766500689, "uuid": "d7a6c7a6-cbdd-4142-899e-5316c082fde7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500689, "uuid": "0a2ceb34-7022-4836-8ced-5b948ecb2ef2", "value": "BOT-1.0-alpha.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27634567-dfa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766455657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455657, "uuid": "a0c2b5c9-23e9-4841-814e-f92978157c3f", "comment": "Malware payload (Mirai)", "value": "f07187ba89319a49bc17f10c2736c476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455657, "uuid": "f008d554-b58a-40e6-935c-35f1e9586591", "comment": "Malware payload (Mirai)", "value": "134414883d23289c88c7306f0c1b56446b6eb45febb104ac07dd7dc891502a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455657, "uuid": "b9d38641-248b-43ce-823c-4d30259d9827", "comment": "Malware payload (Mirai)", "value": "28961787d7c4e726282728a4b537aa67002f854b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455657, "uuid": "f028bf8e-b5bc-4e6a-8268-052681b02b72", "comment": "Malware payload (Mirai)", "value": "f0946be1310c999f6a9508a000abd3a57c18c5be66051843de86bcc33234318cc68604c949201b6459ee570d83c0e3d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455657, "uuid": "fd0079e4-f72d-4154-a35b-311a02b81676", "value": "T145A38C72C8392E68C25899B4F4B0DB799B13E86095571FAAD0A7C3BD9043DD9F04A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455657, "uuid": "ba3dcf8b-9b3a-4501-b9cf-5a1eae882aa8", "value": "3072:Nki+bWmjeChVWPnqhrJx/lnl7A9ep0nzi:micdqnGFxtVnpwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766455657, "uuid": "f29df0a4-fecd-4e59-ae79-2f15dd607687", "value": 99776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766455657, "uuid": "54b1fa5f-4c51-473c-9088-d8b0d566b506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455657, "uuid": "b758e398-2dfa-4a63-822c-f429a06e6c6d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a750f25-e011-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766502585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502585, "uuid": "896b9928-2efa-44cc-8f5d-e0959b30c88e", "comment": "Malware payload", "value": "62620d4c521ae2e04e9a7d5c8b4aebe5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502585, "uuid": "82d27f8c-1569-405e-9621-496ec87368c3", "comment": "Malware payload", "value": "1362bd550b6bce1a99388bbb4a8eccfe085f7a38770a502701b3c064c0a1f461", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502585, "uuid": "b99cdc86-f571-4e95-aaa7-a924d3ed0775", "comment": "Malware payload", "value": "c098628d67d654175f787f0d9deb626ab0ce4a13", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502585, "uuid": "94c021b2-9a94-4b86-9052-01dd5cd13d9e", "comment": "Malware payload", "value": "7c6c83e5c413ebe16b1c8c1b4221cee21ec1b2ce18784df9a14c7cf641df5910eb33f9cab6cdba48f8866f0ce1bd3464", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502585, "uuid": "2b064887-5adb-49e9-8e86-e66a8182f179", "value": "T191246C8CF15AE489DD486ABD4A0983DB3B684E299EF4345A36177B7C1D730F1C0096FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502585, "uuid": "87f5d25d-d9e4-4694-beec-5e936aa15e56", "value": "1536:BfyxBmwhG3zvz8SCw+4gCUJs9MPanNQoJPBO1b8C5yqtgMIUMdb1K8L+pzD4/o1s:J0BmwhG3Dx+PJ78My8IMJlEgp6Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502585, "uuid": "f3fae0af-4f74-4289-838a-2296ca95c84e", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502585, "uuid": "ecbeb955-90e2-4c96-90ed-c94ea4147f36", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502585, "uuid": "35021a8e-c781-46a7-af90-3f7a0f81dcfc", "value": "1362bd550b6bce1a99388bbb4a8eccfe085f7a38770a502701b3c064c0a1f461.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44af2bbf-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511541, "uuid": "a1287315-58f1-4978-8073-081632098fca", "comment": "Malware payload (SpyNote)", "value": "b9bcda8f165e22c1347b4993175f62b0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511541, "uuid": "33cb7792-6bff-4b88-b7e6-5bac1a30eea6", "comment": "Malware payload (SpyNote)", "value": "14ebed0d51768cfa90ace0d74ce17763a7accd1c526976e5b4609156521e7ca8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511541, "uuid": "294157f9-0bd8-4b36-b9ed-25ebbfb5ca81", "comment": "Malware payload (SpyNote)", "value": "12c2d142cd908f612712fb42b276662676a19aab", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511541, "uuid": "abf9f991-7e44-44d8-9b57-401b854c4acb", "comment": "Malware payload (SpyNote)", "value": "116259d809f52d0c77038f9d069d9812b7e305390de876dba31b3c049cf9a8233a3752cf8eab6e9008f4b2bd3210f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511541, "uuid": "871a1a82-78b7-454e-91d6-79780131d7f2", "value": "T1A326F203FB45C79BD8AA83F26F230DAA1A170F15C642AAE715553A6E2DB71C10EC57CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511541, "uuid": "baeaface-7382-4f09-bd50-bf412b39b1bb", "value": "98304:XldaSixY0tsDg+7OHETyH23imz0zBgTs0tYhgPtA:7aSGY0To7i29z//2g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511541, "uuid": "cef0aea8-15fe-4914-afbe-24d762a5c6dc", "value": 4640213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511541, "uuid": "d7376f29-9f9c-4e6e-a7a8-469869dbdba6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511541, "uuid": "0047c817-fc8b-46b0-b3e3-c8ffef5d6c40", "value": "DeltaPro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310ec024-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766475860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475860, "uuid": "b30cd4df-c73c-4412-ab29-9b7f8320297c", "comment": "Malware payload (Mirai)", "value": "c7c23c1779f3282c471e01afe97ca505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475860, "uuid": "36ee7305-5fee-423b-bc78-5abd234ddd3b", "comment": "Malware payload (Mirai)", "value": "14fe22b3949c73e80f8b996326674e45d46fdd5440a12ed488f584c72d26dee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475860, "uuid": "8c953de9-b6a6-407d-b985-12b5a5c09aca", "comment": "Malware payload (Mirai)", "value": "f517100626a9501594e2443af3e384b1888cf337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475860, "uuid": "0e6ba8bb-91c6-4742-b865-1ad4f63506cb", "comment": "Malware payload (Mirai)", "value": "4667c50d86d5250ebfd5b77cb07b7a4c6d52b18b7d08d522ea0d37e95c5ac236bda8189298beaa4c6004d1fcba2132c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475860, "uuid": "ca7906cd-b441-41fc-98e2-dafcc4d6a61c", "value": "T186143B0BB7118FA1C368D6700AB3CB679AE6259216E19985E76DDD107F3035C2C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475860, "uuid": "8a02de71-8669-47f0-bc2d-e363fddd4b26", "value": "3072:F5cBLaOILwR/eocTAMeSddMW2osAfd9wyxpoVytztOfad+:F5cpaOI8eocHeCdMWsSTlpoaCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766475860, "uuid": "0a6f46a6-6c3c-4630-a8b9-59defbe828f4", "value": 198780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766475860, "uuid": "011a4098-ed2c-426b-bd01-690e719292ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475860, "uuid": "f4f07fe2-eb16-40be-8ffd-696117f3c140", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa20c797-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531897, "uuid": "eeba7d21-0db4-4c8d-9039-f4b07dedc076", "comment": "Malware payload (SheetRAT)", "value": "3bbefdbc28c070a39ab9d6c70b6d6f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531897, "uuid": "daba0b93-03a5-431a-97d9-2565a51034f6", "comment": "Malware payload (SheetRAT)", "value": "15b064a7d321fa0159ad94abcdf887f1dc641e33c33d6c691af298415e0a20cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531897, "uuid": "7337f2bb-f11e-45d7-ab5c-6af6756f0b39", "comment": "Malware payload (SheetRAT)", "value": "b73140a0fb6aa85f69dd87d579c21b24241bc983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531897, "uuid": "c2479bfa-5c3c-40a8-ba26-eeef131a5292", "comment": "Malware payload (SheetRAT)", "value": "e49d2d082250574b66d4dc4136e3f1f8d9ac2fb47abb0b7b8a0249bd78061b56c4ba1385c54acba7cf9dd2fd886f9c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531897, "uuid": "1ea0831a-8c6d-43d7-a588-b47ce9daf413", "value": "T170A4C41CFE92F805CD2E3D73CBE614005B7129C12E219256325AAFFD8BA53B658E617C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531897, "uuid": "78371203-da1f-4355-ab12-2021edadcd29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531897, "uuid": "ce50993b-2c6f-4fc0-8288-c5b8ad7a588c", "value": "6144:rXv6Bz9vmpwX8Ur9GUe6VlWT8b9X2QQNGkk1RAYHbbWD0j:Tcz8CX8aGUPVle8KF70j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531897, "uuid": "3d9f4396-de06-4d6a-8b1b-8d8e357459f4", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531897, "uuid": "df5f9eff-be73-4b26-9e79-7b68ba101bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531897, "uuid": "8a352291-6d3c-4d88-ba6f-5a9153dce7e0", "value": "nptavesfxjvj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd81f804-e058-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766533272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533272, "uuid": "9e5a1227-8695-49a9-b5b0-02e9cf0d3319", "comment": "Malware payload (Mirai)", "value": "882082ffe9f890b1eccc6fe314eae53f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533272, "uuid": "bd5bf288-55c4-42f4-b56f-1d1e2b4c95e5", "comment": "Malware payload (Mirai)", "value": "15d20d99330f147baa22ba36270382d25c05a52285dffcf73bfa6510bba2094d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533272, "uuid": "0810b94a-55c4-4f7e-8ea6-d818048af98c", "comment": "Malware payload (Mirai)", "value": "267516de73db173e507750ab38d132514957a3f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533272, "uuid": "b62c3568-1a53-4d36-81af-d4f6ac3a3b96", "comment": "Malware payload (Mirai)", "value": "a2f5291a154a295d223de1f034739aef803dca136174efab8cc1a216940f0673c52d25b267452b6193256bee47565c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533272, "uuid": "abdbcc2e-9cca-4654-b076-7c7f0bc3c9bb", "value": "T1CFD3F6327A211D1BC8CC533951F78320FAB27769A1A8C71A7EA31E996F3C38471177A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533272, "uuid": "3be8f3bd-9904-4dee-9c86-6512019e819c", "value": "3072:QyOPMK68Rpo9Y0F3E7XNwJjOvCrUbIVhb6:NmMKHo9YfXNaiqlhb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766533272, "uuid": "887df07b-1052-4f58-a808-a01da89ae81c", "value": 140780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766533272, "uuid": "0f80be8a-c8d0-47d9-aab1-7b2c94660fd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533272, "uuid": "8b71cc8c-b369-470f-9393-49c33222cfc4", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a8e87f-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478517, "uuid": "648b47fb-6938-48d5-ba45-caed9ca49ebf", "comment": "Malware payload", "value": "1e8b707b90dbea10e4525f6f85a9a629", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478517, "uuid": "579f6d4b-3df0-47ef-8567-f4a2405f1497", "comment": "Malware payload", "value": "16bc2790d1b6188626ee7eab731fe8f9a0cce26ae1b102aaef492fe42177979b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478517, "uuid": "e14caa59-9c32-47dd-839f-46acac6a1176", "comment": "Malware payload", "value": "018fb0e1d0b5e8cbe0ae30a48c92f93c7ba18301", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478517, "uuid": "858f0aa9-0364-4b74-a92a-b85cbc870e4d", "comment": "Malware payload", "value": "1682b94f1c82ba6641c105177bcb581ff6ba0edfca12f44413c1c7b9a43643a415accb85d957a2fce7a7022fc5bfe0af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478517, "uuid": "4c983d1f-4d85-4637-9c38-a3bbf3109cc7", "value": "T1B973F8468DC0286E5AFC24F09E202DE77F96225685FE70556F74F602987A7F20462BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478517, "uuid": "5690db12-c15e-4e6b-82fc-42573ccf219c", "value": "768:I8w/h62/jWs6oS+xISN0vgtqFtqktqstqktqutqFtqftqQtqKtqQtqDtqptqltqu:I9l/AoSSM13tusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478517, "uuid": "ed56e638-0bb0-4895-a131-6dddb735c82e", "value": 73522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478517, "uuid": "837c6613-01c1-4cb1-a18a-2badc2400f1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478517, "uuid": "278ebb70-4ce2-44a3-a3c4-d00150fbb284", "value": "invoice-1645080830.pdf (121).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017a5d27-dfc3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468908, "uuid": "124e25cb-cd43-40f6-a935-069c183c1992", "comment": "Malware payload (Mirai)", "value": "df1e0c5add52af58d748901315703915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468908, "uuid": "ad4519db-f231-4abf-97d9-6a870ec1d67e", "comment": "Malware payload (Mirai)", "value": "16e1ee418331636fe990b7869dcf83c30b72b00a72c1ec034d75111613ab693d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468908, "uuid": "665d3d44-c412-455f-9850-a37392b5ac37", "comment": "Malware payload (Mirai)", "value": "bb847a4373a7937b8a03330b29f5419b8c9748ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468908, "uuid": "13f18383-b754-4cbc-a93f-5646dec5f3d9", "comment": "Malware payload (Mirai)", "value": "0175e4221f13caad27612e12566800680c0ee60d4a0759cae7b9e77e9fb19eba9063275c987a5d45ac2db88514812a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468908, "uuid": "fcd227ba-50dd-4dce-b687-55344d3be0d2", "value": "T1BEB34B82EAA2D0F0E18701B00517F3EA8A34E5306156DED6EFA93D71ED717825D9B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468908, "uuid": "2a530cd6-553b-4aff-9b3e-637524815281", "value": "1536:xQddz4q45jHhsgcvdcAUsesO0Os7bB4/SJBsCDguiRb2JAXrd1+5t+tvUBY5PkyK:/Q1cV/0BXe/JCDIb2Jkrf+2ZUmFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468908, "uuid": "7013eae4-8125-43e7-a3e0-d5a5e2210e87", "value": 115388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468908, "uuid": "95e461d7-7f05-4f21-ac1a-73b1e6f0cb94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468908, "uuid": "035d0429-079f-4b5b-b86b-a3b3c550a2e8", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb3a636-dfcc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766472979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472979, "uuid": "af8a22d8-8929-4d72-a4e7-f4dcea6f7404", "comment": "Malware payload (Mirai)", "value": "f2a1732205bc73a789b283b1a8f3f02e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472979, "uuid": "380627bb-7195-4cd4-bdee-2d58a108978e", "comment": "Malware payload (Mirai)", "value": "16f2803b5fce5e428bdcf67194ac31fab4888cf0c5137c8c6ebf0033747ac04e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472979, "uuid": "8546caeb-d47c-44bb-b246-8519c9df24e7", "comment": "Malware payload (Mirai)", "value": "7f4a44e1c941d9b4ead5439edf4f9ca67e7029ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472979, "uuid": "9e604c0c-137e-49e6-9a6d-078e0a24d7e8", "comment": "Malware payload (Mirai)", "value": "8ba4d8f7321a8f920e3bd158b09c94a0efeae462ba099de12a3ab8e4dc59d5f7bce227630515610df37ef09ce4a40fb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472979, "uuid": "5b06e868-aea7-475a-87e4-5e87d9a339ba", "value": "T1DFD38CA9FE8F6CC1C3C7E37DED4A0FA274177874D666C1B10A00969FD5DAAD88890613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472979, "uuid": "09d63f22-fd29-4de2-98ef-639ad2354b06", "value": "3072:xqFSC40Df2UGSDFd5r2dcy2qUAw+GbKeEtNjzPxm:xS40Df75r2dcyqLKNbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766472979, "uuid": "1d32ff9e-e3fa-4df8-a92a-4649e3c4a332", "value": 132048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766472979, "uuid": "96534e79-f5de-44e1-9861-97480de3bd4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472979, "uuid": "3acfe7e2-106d-4021-9d77-c951f33988c1", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909c68c4-e036-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766518540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518540, "uuid": "2b87dcc3-c5b0-4452-80ee-8e546178b551", "comment": "Malware payload", "value": "0eb9e5079eca7060077e6dc2cebdc1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518540, "uuid": "53598865-c250-44e4-806e-6a0f5c11bd3b", "comment": "Malware payload", "value": "17015486a4e36b7b8e7c76fecec5964b0ad375403fc49566edad2ce7561d51ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518540, "uuid": "86cadae6-0c53-4bba-8bd4-0b520f5faf1f", "comment": "Malware payload", "value": "59a55e674f0b6bd6c5587e7fc344909a6cfd6f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518540, "uuid": "e8662e2b-5e98-4827-92d4-1343a6e2304c", "comment": "Malware payload", "value": "bc4a15c1244f97301b5859cbece8a90a6ac93e35e81a616134787d9751be31fdaa4ddb89e9cbc04bbd61953acbe82d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518540, "uuid": "3ce2fcb6-aaa3-45a3-831a-21ed70d3afa1", "value": "T1C4663361E682F541C87F9236D83F90AE7ED68F89A0F17F96710008928F7954AF0B5E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518540, "uuid": "28804e71-f08f-4141-9d18-15b0dd38e05b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518540, "uuid": "5774dd4d-37e8-46a7-94d1-c226d733a1ae", "value": "98304:DYwILdSuuNuVsxbt6NiZ/IUzfR5SuMa2chYUoyML5neo/EvOWW8sL2V9:DYw2d6NuVqZ0k/nBMa21hJ5eo/J2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766518540, "uuid": "8813533a-6f29-44e0-82c1-d576da9f85a2", "value": 6500730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766518540, "uuid": "5bb167b6-9da1-4846-a171-45995092ad1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518540, "uuid": "8af89b5d-40ba-4f02-91e8-293f157fba1c", "value": "KMSpico (2025) 12.2.4 FINAL (Office and Windows 10 Activator).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1016afc-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451700, "uuid": "fe908c17-202b-4f50-a621-37090ab7ce86", "comment": "Malware payload (Mirai)", "value": "11cff06ee905173b6315bf86007d44aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451700, "uuid": "524a0286-23b7-4a05-abc9-3ace6c073dba", "comment": "Malware payload (Mirai)", "value": "1701951703ef39c28bc9b122408fe4f3db58dfd47a9086b055dc1f7a14139274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451700, "uuid": "4802e661-7f18-4cda-8720-f1d1a7ef7f85", "comment": "Malware payload (Mirai)", "value": "ccd878a240babe554ab4879cb3c724169b3fee70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451700, "uuid": "9039b3ce-36e6-42c6-acf3-b02a2f49c0a1", "comment": "Malware payload (Mirai)", "value": "bbbc2b4c3eb857ef3304ed5ae44c8b414036c26e4d02e35b62009231127f9800e390a0f53aff390013cc6f9f30f182cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451700, "uuid": "817102e7-71cf-4bbd-83c8-3376bd375e0b", "value": "T1F4734AC9D753DCF5E82A053115B7E7735E72F53A1068EA83E394F933BC12211A64A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451700, "uuid": "ac2d1814-3853-4188-8cdc-d9d3c2b8d001", "value": "1536:ydUJtGZZSLzUyPlvPzVXaGTexQFk1/JoO5PxtUP9XRR:ydwGZ0/DPlvZNGQFo/qiJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451700, "uuid": "bfd7a7e4-e923-40ab-9708-86ed007593d2", "value": 74704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451700, "uuid": "a1b1481b-15c7-48d8-83e8-63fb99ce4185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451700, "uuid": "946652e8-6ee1-4aa6-a3e9-4e4dee5c1c9d", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29345379-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510206, "uuid": "42638268-7ea5-4185-bee0-06980478ddef", "comment": "Malware payload", "value": "1cba6ac19b745742ac1b7fbbe7e7da5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510206, "uuid": "a7e95571-d5f1-4a0a-b81c-f606754cf697", "comment": "Malware payload", "value": "17215529c2b6867985d3d79a2aa4f2b07cbc02ae07a49441b5cf34981c9555f7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510206, "uuid": "fcc7b5e6-84ec-45be-bc2d-f3d3386a4aef", "comment": "Malware payload", "value": "0b8bcc6d8dce1c4eb87e2ca847a0009a9922914b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510206, "uuid": "1b6b5618-f7a0-4b1d-85a0-7f48ad5f8973", "comment": "Malware payload", "value": "967e2285f9c1b36c2c6a6e4e3e20835c48b41d97a5438c16532555153471f0dc8ba1df21466e20c97a25dbaa3d56c3fc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510206, "uuid": "4f9e0099-f242-46d2-9925-da85d20dc6cc", "value": "T1BC534F0C71D78E01E423453A4AFBC6946B37BD6EAFB15307225C3B2E6FB74600A91B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510206, "uuid": "a17fd30d-7bcf-476e-b3bc-f08d50cf6692", "value": "384:uxWBVtyFNHbyGcSYrmeJVBNK02tK+dqW+h7OhQJilz0rFMj6I:DV0fzErKy5WIOwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510206, "uuid": "464a7df0-1801-4edb-b7c8-3d17fda74cd2", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510206, "uuid": "6d8d3621-bd1a-4936-b53c-0f53e434fe01", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510206, "uuid": "c3de8b88-81eb-4080-a756-5e9d29cbc5f8", "value": "PE\u0141NOMOCNICTWO - D\u0119bicki M. Skorupki. 2025 doc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181a930a-dfad-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766459497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766459497, "uuid": "7f7054ed-7081-439f-b0e2-cb4ea4c30251", "comment": "Malware payload (Stealc)", "value": "f178e81fd30fe012f985b1773f789495", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766459497, "uuid": "7b497b87-73b7-4ef9-8b60-153f0d9117da", "comment": "Malware payload (Stealc)", "value": "1763df05d8308948c1ed4489c727a31832951f63e26ae895e0cc0fba75cee9af", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766459497, "uuid": "6c8b181a-0e76-4bf6-a4f5-4f574284f830", "comment": "Malware payload (Stealc)", "value": "687fe0af8b1be437a59fd5d0208019841863709d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766459497, "uuid": "5acbca9b-50a9-4633-a61d-d3b8ba4a9ef4", "comment": "Malware payload (Stealc)", "value": "417ae4670ea7de98dc4a2644f8010f7f1737dc4221c882b7f56e5f5948ab0eb36b13ae95e5dce2fd845fd429778e9cb8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766459497, "uuid": "91bcec8a-7e08-4603-a4ef-1b4889ee4b9d", "value": "T144F48D5EE7A502F8D0B7C174CE424556EBB2B8065370A78F03E15AAA1F376905F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766459497, "uuid": "e114d0ca-8068-481c-bd0d-f6ada00620a7", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766459497, "uuid": "9a1fd573-3c14-435e-add4-d469cad5a8a8", "value": "12288:WVFR6dYKVC9eym65QBZ8C89iIdw5fOv3YZtF15kjHKA:YREC9eym65EKCwi6KfS3UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766459497, "uuid": "9ce68ea3-b11a-4ddd-bcb5-8f7f0858733d", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766459497, "uuid": "bbd58452-63fc-4cf2-90ef-55c285fe890f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766459497, "uuid": "008c8145-d2ee-4cd9-8ca8-b25cca72b0e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21122a6-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522865, "uuid": "7c2d5490-0be9-46c8-930f-6d151c304bbd", "comment": "Malware payload (Mirai)", "value": "e745cb5fb0f85c14e0c64e378aa7079f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522865, "uuid": "48e23210-0117-46ba-b039-9fc915e57a22", "comment": "Malware payload (Mirai)", "value": "17cda7b9073c8d6dbf1d518d810a5b5bf67ee2f1b45e8b24f391b107ab6f42c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522865, "uuid": "832580a5-d2ab-41e7-bc33-ed039f713e54", "comment": "Malware payload (Mirai)", "value": "a54cfce54c29aee4bcc3e8f5c171ec79cb5a0e36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522865, "uuid": "b005764e-b3ac-4fc5-bf01-089428391874", "comment": "Malware payload (Mirai)", "value": "ce647f69a7f1e9f482955c72a3db16b1478c08daff1d522ca5733986beb42c527f4935c27a1c283402bdf7e52a96ef0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522865, "uuid": "a8c5a5f2-0565-4969-8638-85514665534b", "value": "T1BD72D1A7A36D848DD80CD137E23A9A9D9DF558D2034FEB0E942DE5DE10CF418CD62A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522865, "uuid": "c087fbd0-2ade-4a46-8c32-6ab155cb3c55", "value": "384:M44qiESXX3nICWXYLOxDfSwySWKhRA+XGDGLKX4+v1RB:3pSXnnIdXqOdKwy9KhiwGiLKXrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522865, "uuid": "f2f19ebd-3f88-4c5f-9b5d-bd38121b516a", "value": 17372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522865, "uuid": "91b4f8c4-10bd-4e82-b63a-918da9320173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522865, "uuid": "ea3aadc1-0c9d-4906-860e-5e20da5b716a", "value": "87sbhas6as.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70269e2e-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478972, "uuid": "2f01328d-f2b8-414d-8c0a-55f76d560a5d", "comment": "Malware payload", "value": "c2eebb341d0dd744455aa82984c3eaf2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478972, "uuid": "d7859afa-818e-49a8-9d78-1aa60ecc0284", "comment": "Malware payload", "value": "18132be3a0e5834c3e0ffb1bd5623226d6c368f530dc760740c2018cab43577f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478972, "uuid": "4eaed0c4-d2f8-475a-9077-d5c9c7ff21c7", "comment": "Malware payload", "value": "b006634fbd18256feb111dce8f05abf5e9ddfb08", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478972, "uuid": "147a0de4-7647-4408-8f58-59c9951e4cfc", "comment": "Malware payload", "value": "3ba11a1fff96931dca1fbb82cb02f051dd4284e3b5dd44d336940ba33a8d2abbc5a3df2d6f2cbd5bbf99f438b0198458", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478972, "uuid": "bdebcf3c-a998-49cd-8abb-018563c39565", "value": "T194634B1EF129D49A957725A1FDFA01D4A64122C9FF3CF02CC49E9E0A823427970E1E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478972, "uuid": "b4e778e8-800e-40d7-ac96-83b731314dab", "value": "768:I8w/h62/jWs6oS+xISN0vefVRTXoFFY6z3pQjWXodtH6wLVwcsHBTCxjPPtBOZUv:I9l/AoSSMlt5usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478972, "uuid": "b308efd2-e182-4619-897c-7fb3d71d03cc", "value": 72530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478972, "uuid": "daea59f7-9f0c-4858-9936-eff739c34bfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478972, "uuid": "22c9f843-e7c5-40a5-b7a2-f98aa342fd02", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572409d1-e029-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766512860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512860, "uuid": "49664f98-b0e5-4132-b871-eac31058e7ae", "comment": "Malware payload", "value": "10c4c3998ab82e8011cdcb03f58fd83f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512860, "uuid": "fdc16eab-7e3f-4257-85b3-c11f18b9e638", "comment": "Malware payload", "value": "181f0b9e171a0a49b46553efd10d6b2601acfff638efbf6f5ee9787803392ac8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512860, "uuid": "14880329-69b2-4235-a29f-858b122b27d6", "comment": "Malware payload", "value": "78ba5d093e64bf808c77ff8e0d51c1cca0343edf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512860, "uuid": "9b571fe0-2719-4c0d-b9b2-c6126c4c0aed", "comment": "Malware payload", "value": "4699f89bf647a4139458408965b28f6183f994aa462b0ffb3b4e0d931a3286573ed9f2e63b42878dc77bf91c4a6f93fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512860, "uuid": "d3b5082c-e6ee-4fa8-8003-110c8853c5c0", "value": "T180964BA3BE50476AC59FD23DE8E24246A2307804173125D77A9437665E3BBC41A3BF3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512860, "uuid": "a36d17e0-00f2-443d-9d3b-9017465567e3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512860, "uuid": "d2099dee-233d-4ba8-985f-c3be1df65c7b", "value": "49152:rHhAif5jBOrdoQMLrBZytOra5ofudcVjSP2YNeodyx/wb4Ora5ofudcVjSP2YNef:rmi+iZsEQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766512860, "uuid": "e658afea-e380-4ebe-9c92-7a1681620f56", "value": 8617608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766512860, "uuid": "98df6d5f-dd87-44bb-8f69-0716875a3340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512860, "uuid": "638ea3e5-c4e1-4642-9f3d-2d5a94053db2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09dea14-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525117, "uuid": "878da2eb-46bd-4a88-8e2e-61a4a6a026e2", "comment": "Malware payload (Mirai)", "value": "66056580a777a2ba366673b072ce742a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525117, "uuid": "435a993b-2ddf-485a-b976-50b0d16f3cb0", "comment": "Malware payload (Mirai)", "value": "1861e355a60a0449ce4118505ec38d0d2371d356154283b7a40ffafc641694de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525117, "uuid": "ead17413-358d-4a97-aae4-2581a2024365", "comment": "Malware payload (Mirai)", "value": "92c706b2162d59ade73f72f08d992dda2cdd453b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525117, "uuid": "a8ea49a5-8008-4ca3-98c8-59d889989b53", "comment": "Malware payload (Mirai)", "value": "dda98137cb254bb302c78b4712db11050927fd26139f37492b47c56d3de124ef229a7235434739d05b5147b606240cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525117, "uuid": "6a75ee06-af48-4f76-aeee-7554f9217f23", "value": "T166836C32B9751E27C0C8A57B21F34765F2F6078A24B8CA1E7D621D8EEF2465022877F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525117, "uuid": "b52eba09-1fd8-49c9-b42a-c4119068c646", "value": "1536:UR8pjwQWZkOW9T5krdSxhogjIHWMvyPS+Ce3EtFnvj5CKws3pJt+WwbZnDO9T:o8pjwQWZkOW9TsMvMvodXEvvdKEwbZnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525117, "uuid": "512571ad-09b5-434a-9cde-056dfd192c7f", "value": 86056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525117, "uuid": "1c9b504e-4118-4908-864e-0422d846fb82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525117, "uuid": "5301fa1d-6e74-4729-9de1-934f3f749f08", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a734dad-dfa0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766453971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453971, "uuid": "b971052f-b8ce-4b53-b3b2-3d8e73fc1bf4", "comment": "Malware payload (Mirai)", "value": "86bf0a858fe067d4dcbe3bf316d9ae24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453971, "uuid": "d3b88587-95a7-4d03-bfc6-749208687230", "comment": "Malware payload (Mirai)", "value": "18f7518d57f738d6743a8530abc41d99d968c26555fa0bbb45aa0de0165d2de2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453971, "uuid": "a5a0444a-461a-4081-bd43-da827bfc0bfa", "comment": "Malware payload (Mirai)", "value": "0b50aa969ae82c70378b0edddfddc2b7bb8c9407", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453971, "uuid": "3d0c44bc-5217-40b2-88e8-132e56810f11", "comment": "Malware payload (Mirai)", "value": "aff1ef0c7d932c1bb2e923a0090e3b82cbd86dc58f945e160aa6afc159fab53eb596d657e53af3f72b6e56a80ed11f8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453971, "uuid": "e51a5988-ccdd-4b2f-86ad-fe58d0bd1b53", "value": "T132A37C46D993E4B1F8521039163BA3628E33E2352432DD47EBB82F75ECA6610DF1639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453971, "uuid": "be04f589-3a89-4b6b-b40b-2b486afe4275", "value": "1536:Fx1mu/gqx94hHzqAfRJECP90kVkpY+o0fEYCBg4+TGTVuYlnAdoEWZj3XZYibSAK:FSkmzlH96k2K0h6TsYVQo/zlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453971, "uuid": "7db5b5b0-6b65-4bbf-9448-115ca05206e3", "value": 99596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453971, "uuid": "fae4acc4-87c6-4cf5-96af-d4e96799b0d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453971, "uuid": "181c7e61-fc70-4100-b488-d19e7b572494", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293c75e9-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766475847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475847, "uuid": "73b404ec-17a2-4c85-8e2c-825cf8d02c3a", "comment": "Malware payload (Mirai)", "value": "ce0acb6be5f79422eb826072ce18c5ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475847, "uuid": "198a59e3-1f73-4d46-b5b8-6cf49df001cf", "comment": "Malware payload (Mirai)", "value": "18f98a155ccb1d2db2b5ed55d71bd5f40556e5b783f0db9f0bb32cedc03600b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475847, "uuid": "6c89f8d6-21dc-4d02-8b77-86601a64e110", "comment": "Malware payload (Mirai)", "value": "21c37f4b9dd44d8f47380238c0cf909f90a6d565", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475847, "uuid": "90251c9e-0c44-4342-98fb-c6a7b082cfe0", "comment": "Malware payload (Mirai)", "value": "09cfcfb8836715f4bd1beaeaf5fb72bb0e5c4185435a83ef435513285e1ea431738d2c5e0078cac706434449a11099ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475847, "uuid": "b49a6f67-ed3d-4f19-9fa1-91f69a922bb1", "value": "T1EE6302C3F8E93AD2D3C0C2745F76D4397AA904F405BA90D289D8D8594E6EC1A244E7BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475847, "uuid": "8b43486c-bfa4-4244-a38a-42fd95d2695a", "value": "1536:VNngXyTwJG1cZ84apkY6FsId3pA3Q/H4scoT7NQKOorc:/gXHUs82YydH/4s5NQKOSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766475847, "uuid": "3b3a3fd4-94f0-4d81-b218-f26f2aa022cc", "value": 71116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766475847, "uuid": "1954df02-656d-43a9-84ef-766343ceac67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475847, "uuid": "96b48fdf-3168-487a-9cd5-d40128140777", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804a4ecc-e00d-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkComet)", "timestamp": 1766500904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500904, "uuid": "62a56ca1-5b42-4675-83a1-a505559c8bdf", "comment": "Malware payload (DarkComet)", "value": "4cb693208abaacfa7ff5565f04d99585", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500904, "uuid": "01094a6b-02d4-4bee-b060-4a542357e595", "comment": "Malware payload (DarkComet)", "value": "19b2a7efbdd71b4c79d15d2b32fd9330e3ae7336f72d4c3fe4b612f86030663b", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500904, "uuid": "fd8bc4d3-c308-43f4-80d4-9c4aa3ddfa87", "comment": "Malware payload (DarkComet)", "value": "1280254b7f152aeb02499239e526e6a1302017ee", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500904, "uuid": "68e91762-5ed1-45fd-ab5d-ac2c3bf1ebd6", "comment": "Malware payload (DarkComet)", "value": "9cb2727a8cbd7d693fae78e3c08afb9191bee852d3b939df8f2dbd6e407c5b43e29c16da105412c7ac2b80ee5bb6326f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500904, "uuid": "b8f07d9a-6d2d-4be0-b6f8-f3bdd70eaef3", "value": "T1AF442365BBC69C43EABE6AFC07190B149B5933DF1EDE82526F380608B051A87174B63D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500904, "uuid": "24ed0b22-9ed9-4f59-8eeb-22ed77dd7f41", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500904, "uuid": "5a2c300d-5dba-4607-b91f-9900eadfb12a", "value": "6144:FcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37sUK:FcW7KEZlPzCy37s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766500904, "uuid": "93754869-eef4-4b9a-b95f-9805e42b684c", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766500904, "uuid": "833d257b-5401-49fc-8672-93a8ef202c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500904, "uuid": "224dc129-8338-4364-894d-ba80dcd10cb4", "value": "\u00c7ALI\u015eTIR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3c4c8b-dfe6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766484039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484039, "uuid": "414474b4-d5f9-478d-aa25-fdc1dea783bf", "comment": "Malware payload (Stealc)", "value": "c953d9d4d3f7161cae4b8704ce09c1f8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484039, "uuid": "4081c2e6-effb-4cc3-9cda-b0529504da8a", "comment": "Malware payload (Stealc)", "value": "1a4e4b7381e2e95442e149a6bb551ffcb0eef49af999888d977c298b48c60da4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484039, "uuid": "6f81e013-a598-4f19-85d8-f7cbafe8bcaf", "comment": "Malware payload (Stealc)", "value": "de16c76f95793925c48c2e12eb8dd5f75b33f558", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484039, "uuid": "d16131c2-6a15-4f14-80bd-cd9bd5f31eb0", "comment": "Malware payload (Stealc)", "value": "75a6b2fc628ea4cb80a1ff2b07f1b12a45fd57252fdcbec67c2ba08dcb2d7fb2e69aa79009fdffdbb0a6a3b6a4b07de1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484039, "uuid": "15408a43-6373-4f08-8fa3-62405cd2ae11", "value": "T186B65CA7FE944665C59FD339E9A3024923747A08073121D76BE027694D3BBC4363BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484039, "uuid": "f794afbb-61e6-4de5-a7bc-a1b99affd4ce", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484039, "uuid": "5222b997-8383-4f89-b689-4b3fd17a1018", "value": "49152:fkHHvsURY0HA6q5GFIbwiX+WwBPyOzTUjMzY3Fk8BcRy3gVmrqENiXBMT6d6nX7S:fu/YvaTSMzuGMXba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484039, "uuid": "6a48b9bf-053c-48ac-b109-11eaa2ef360c", "value": 10642568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484039, "uuid": "4bc0b3f9-57f6-47ee-b000-5c58ed36b3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484039, "uuid": "5654d1dd-c8e7-4419-aaba-77f310847a1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a4819b-e020-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766509041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509041, "uuid": "29b12fc2-0bd7-442c-99a5-d4f3964a27af", "comment": "Malware payload", "value": "93a1b2c01b2964a8a8110e93a97548b4", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509041, "uuid": "c4bb3170-fdac-4f5d-8462-6fdcf86efee2", "comment": "Malware payload", "value": "1ac4f13534743be2ae855a33db85ef60221cc8b69303c8ebbd42af8a6c42cd8c", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509041, "uuid": "d82fe77d-13e6-4b1c-8f6b-1c095cacdf00", "comment": "Malware payload", "value": "50647f397b12d42d8ea58f6a6270d84671df5645", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509041, "uuid": "c50c971c-92da-41f6-b6a2-5be83c178ce0", "comment": "Malware payload", "value": "48a690bf2f9e4f826edca44aa217b43802f4d67d7d60622637b9b7e8109ace577fe6bece8eab86eb11dc621c78902f47", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509041, "uuid": "644184e7-7426-4dd5-af12-58e74ddf95a8", "value": "T1FCC68D09EC240674C5A9827056F304D99E3ABDD53B501AF726BD7ABD0F235C46ABE2CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509041, "uuid": "13cf0527-9ba6-4aac-90d2-2ca5b37d8161", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509041, "uuid": "39bb1142-f0dd-4571-a6f2-227310c145e1", "value": "49152:0Q6PXmDllrb/T0vO90d7HjmAFd4A64nsfJMBq+AQrNKtpMdTuV5dHJM/5+0zX8Mb:ptoBq+tWqSb+MMXFH5yU4BDGerof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766509041, "uuid": "fd92ce1e-1c73-4c37-8ba2-90005bf9619d", "value": 12295264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766509041, "uuid": "2194db26-f87e-4a2e-8208-a48ba8e78a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509041, "uuid": "0904cc51-9f18-4d7e-8787-b5ba0b2461f4", "value": "IDMAN6~1.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dd7453-dfea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766485993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485993, "uuid": "27608b96-54cf-4791-8c3c-24b8dea82b30", "comment": "Malware payload", "value": "ad88c51e409c563ca0886c9913250978", "object_relation": "md5", "Tag": [ { "name": "cf-prod-cap--cfd", "colour": "#23A897", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485993, "uuid": "34a18a13-b8ef-4a5b-b12b-80c0b58fe9d0", "comment": "Malware payload", "value": "1ae3af7517c66182b3ca64e025c4b9b74add830a7a2fc06c41914c6df17581f9", "object_relation": "sha256", "Tag": [ { "name": "cf-prod-cap--cfd", "colour": "#23A897", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485993, "uuid": "bfe8cb99-d8ab-4609-a137-df8e95be0202", "comment": "Malware payload", "value": "ff88268e3c48cedad7590af211b9f9e875b1f45c", "object_relation": "sha1", "Tag": [ { "name": "cf-prod-cap--cfd", "colour": "#23A897", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485993, "uuid": "41f359da-73b7-4639-b7bf-9b6237ed74ae", "comment": "Malware payload", "value": "b97a2f49dc30422914025b54d63b6cb12e0d1a467bcde154eb6b2082e3af2a3a653b2c57c3de4abb0ea2684e051a35c3", "object_relation": "sha3-384", "Tag": [ { "name": "cf-prod-cap--cfd", "colour": "#23A897", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485993, "uuid": "7fb632ae-60c9-4cb5-92cd-629f9c6501ba", "value": "T1B0F1EA29DA50929E4363327D08996C09B2DE812FC3612E54F51CB4F0AF8516DCFB4BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485993, "uuid": "dcc5ffe9-93b6-440b-beac-8890f06dae41", "value": "192:X40np3Ih8ySzJWt6PFCHMzG3gyLiiKGw0DJGMLtg98:24JYsCHQWq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766485993, "uuid": "f1b9696a-53fe-44e1-bfc6-54e03190d765", "value": 7790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766485993, "uuid": "3b00b596-cb89-4a7c-a628-6e7123ceb005", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485993, "uuid": "e5f516f6-8d98-4da6-b49a-05b3c460f722", "value": "1ae3af7517c66182b3ca64e025c4b9b74add830a7a2fc06c41914c6df17581f9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23355b5-dfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766474868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474868, "uuid": "c33ad24a-efb7-4408-ac41-799ab6f8d710", "comment": "Malware payload (NetSupport)", "value": "40c7c20cc0ef47a7f3b9f4794523f547", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474868, "uuid": "c00ea918-8c47-4072-a5f9-558cf5cc94da", "comment": "Malware payload (NetSupport)", "value": "1b7a6d086b366cfc7f46abc759233cf0b64c28dcf78f4ecf198baca9a3011060", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474868, "uuid": "18111201-67f2-4947-8051-d88553e28392", "comment": "Malware payload (NetSupport)", "value": "58d2268f6beb016ff6ae67b8c37d9df91494ebd9", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474868, "uuid": "fa7a8855-7913-422a-a50e-6ca44eec941b", "comment": "Malware payload (NetSupport)", "value": "18a6d03f0e346febf6f5393f1fed78588ed7a1ef8c754415e00c8f0c88f411a9b1be6331024aba770dd79d88a61f02bf", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474868, "uuid": "4d40e611-1977-4df1-b7bf-75709b5da095", "value": "T1C3A2D17B16E4C5BDC0330BBCAC725551C9F0D5DBC76E11F319256BA0B0AA004AE326B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474868, "uuid": "51a194eb-daa2-4376-bdae-19e576171678", "value": "384:fxUdt0/EdxVq8rJAxSSaJuYBNfjCI0p9Hv7yZeCW0G5GO1A/4dbO63mA7U:fx8W/Ejr+xSSaDb/iHv7y+0iJAYx3mmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474868, "uuid": "8d3092c2-92a1-460c-90a6-4ed1f673d81d", "value": 22221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474868, "uuid": "8292daef-1059-4bef-81d6-73edd20ca270", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474868, "uuid": "00808f42-ea86-410b-b4a9-c6ca609cad24", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bca68b8-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478831, "uuid": "1ecb9f78-6892-4b65-a52f-58be8104a808", "comment": "Malware payload", "value": "299eca650ae9cf7eb5bcff9640b846f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478831, "uuid": "30616e37-b69d-4673-9197-0b2f0644e098", "comment": "Malware payload", "value": "1b9b53fb2585cf14dc4c04a5c2646683ba69b511d8e87730dbddd59b8982e4c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478831, "uuid": "d075a91f-a92c-405d-9d0a-3e342afb8409", "comment": "Malware payload", "value": "4759eb5b379f36bbd182d3c8957507dfdb0eee53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478831, "uuid": "bb3546bf-270e-4a7e-8ff9-271bc0a6517f", "comment": "Malware payload", "value": "85e63796b59550c5e4d27169f395b2c91f0522ab601155176c1bb2fdf6b953ee0eea74263cebd9017ef9adee3c8d330f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478831, "uuid": "9c3ebee0-4c43-4167-b1f4-c61e1e0b1127", "value": "T1BB63D8546C214D1EBC86D7B87A9C2A83C5145C2D3FA770D4A208A7B22EDDF7B2525B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478831, "uuid": "6069cc01-08f4-497b-8486-2d1000b33dac", "value": "768:I8w/h62/jWs6oS+xISN0vqOPZq7dkfScBYrwz2y8kTAlGB:I9l/AoSSMTuusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478831, "uuid": "7e02fd43-cf7b-4591-bb80-f437eab15487", "value": 71539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478831, "uuid": "9af8aaeb-288a-4c5d-a1d4-d54749987047", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478831, "uuid": "e815c574-8f80-467a-a991-615a71087afa", "value": "invoice-1645080830.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16278244-dfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1766474526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474526, "uuid": "4748184f-3f52-4493-8534-f1b8cf5f2e76", "comment": "Malware payload (DarkTortilla)", "value": "7d0db50b3d885ab2d93e09f5eb3ca020", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474526, "uuid": "a04c2bd8-8a9c-426c-b9e6-7a0a74041580", "comment": "Malware payload (DarkTortilla)", "value": "1c0a6d90e8b34ef3b8406be47df82bccc16a1811ea3762cf5951b1a1f3ac02c3", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474526, "uuid": "5d88351d-ec71-4b6d-8138-2bc2d076e8f9", "comment": "Malware payload (DarkTortilla)", "value": "14c38b949f5558adb6ea0b21eda672519514a743", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474526, "uuid": "5fe8f2d7-1f97-43cc-ba84-7e36ecf42ba3", "comment": "Malware payload (DarkTortilla)", "value": "112fe573931665b77235b07259d9719ea5ed6e29e93ddb52e6405c895bf28c7ad2f403dc69377ae4ad00d1b41d1bfc78", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474526, "uuid": "d97ca530-9af0-4485-a3a1-c612fa36dbd4", "value": "T1A376B60A19D7E4F0F4949E70E7BC80E825BD923F1160B7B6910592F5EF0A72F62462B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474526, "uuid": "7b4e4af6-ea38-4fbb-814d-5da37bb14c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474526, "uuid": "421d60cf-51ea-4c0c-9d96-ca1b19942265", "value": "49152:umKSGWDB7A/CWpef72YynNn2nTDnPIW4Rk4kg1n3lLggmuHJKn2Wfaz2PMMgUX6G:HjBPrf7BGNsLQW4RH36gdQUeM+X6G4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474526, "uuid": "210c92fc-55b2-4047-8e23-6f91b4f2f88c", "value": 7816704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474526, "uuid": "6886b7c2-4eb9-452d-9cad-48438af5b5e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474526, "uuid": "e6744238-57ce-4da3-bb51-97fa9ec3729c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ed2c28-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524314, "uuid": "1c5c4887-22c7-437f-9095-8d12192f558d", "comment": "Malware payload (Mirai)", "value": "9fd81b778b14572234e7df5a8c61fa7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524314, "uuid": "8183a37c-3f38-4f08-ae3c-373dc8dc291a", "comment": "Malware payload (Mirai)", "value": "1c192206c5004c345b2f589e484f1e042f743f9b666178b52ad4185a680153e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524314, "uuid": "d92c327e-3a82-4ce5-a2d1-7e2eba6a7310", "comment": "Malware payload (Mirai)", "value": "6bab57cac11e5190f1d1ef2bc93d4ae742934c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524314, "uuid": "6c653c03-180f-4895-b134-1ad3b42adee1", "comment": "Malware payload (Mirai)", "value": "9e63bc399f44a9cfc14924897fb73110e3aff231b51802fac43f085c5c1b1b6096682b6d95d9c2b2fdd5809d4796095e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524314, "uuid": "fd38a9c0-16e9-43bf-ab79-49bd03c881b7", "value": "T198143B45B643CEF3E45304F111B3963E0B31ED394826D595EBA8AEB4DA33AC166163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524314, "uuid": "b53e81ee-e862-47b8-a23a-d9ddf0eb7582", "value": "3072:7UoWnXHc2U9aqu2Zhs6LF5hAh60a6q1U9C13lpzi:7XW3bcaQhDUMUC1nzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524314, "uuid": "13b8eff0-edaf-42c5-b5f4-badb45b284f8", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524314, "uuid": "f4fb5759-91b4-470d-9eac-9c5cfc03aa1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524314, "uuid": "3b4d68f7-616d-45fa-99ca-aa4d445af6cb", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c29a94-dfe1-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766482209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482209, "uuid": "0ce3ff12-cf6d-472a-b804-d3020ea9d6e3", "comment": "Malware payload (ValleyRAT)", "value": "5d7764bf1e0aea500fcaa21a69b8b43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482209, "uuid": "bd432fe0-1901-48f7-a15d-ca1c718db3dd", "comment": "Malware payload (ValleyRAT)", "value": "1c46675149b0f4d926783c855e860b20548568849cdec941a62abb72534d1e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482209, "uuid": "94085339-8c93-4951-8ee0-0443c255ef1f", "comment": "Malware payload (ValleyRAT)", "value": "60e4320b4e1ee7d657ffdb459dd84bc24421ee5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482209, "uuid": "c7147c82-59f8-4d4e-bafa-7c286d336bd0", "comment": "Malware payload (ValleyRAT)", "value": "e29bfe8c0322826a7dc3f23c7b748a4940fbf457d2404a1a276fd9975470391173bf62ce59f631a4a7dab64adfefde7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482209, "uuid": "d30e7c6e-323b-4ef2-a427-a5bd853a34cb", "value": "T12A47333BF268B13EC4AE067119B3C25085777A64A81F8C2B47FC354DCFAA6201E3A755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482209, "uuid": "b3ed8e51-4f0f-4fce-917c-a0815573ddf2", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482209, "uuid": "dc026cfd-2c9e-40b0-b725-ef8788cb8acf", "value": "786432:Ntn+K/LayX7MKM57zvGQPbKyaQ94ys2nH0RVe7z:NgKDKKM5+sbhays2URU7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766482209, "uuid": "24bf113b-5455-4705-96f8-8708b298d15c", "value": 26674928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766482209, "uuid": "c149250b-e161-4c26-8ae9-0457d5df1570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482209, "uuid": "e6d1461f-5b53-4c03-a20f-3cea804476ab", "value": "222222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666d6d9b-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478526, "uuid": "6b16aec6-1d1b-44fb-8aad-2a4c6e3ba923", "comment": "Malware payload", "value": "3c024103c877a0d1546c26ef60b101e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478526, "uuid": "39e26f12-7888-41f6-b22c-785b05fe0d63", "comment": "Malware payload", "value": "1ce13c0bbde4e38e6397fe95984cad30c5e9cd4737e4af69559d03bb01f978bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478526, "uuid": "95e39b02-981d-4979-958b-0377925d7bdd", "comment": "Malware payload", "value": "efaa8f572527135d63094e648b0b201bf836f7cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478526, "uuid": "cd57feaa-5405-4f49-89c9-d5bfb2db2c7b", "comment": "Malware payload", "value": "037b161b5bc06d52b1252c7d541e0e5bd5bfe73b82a0a63abf29900636620b9843027ade3c02c38e1891537bc0fa4e1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478526, "uuid": "575a3d4a-b759-45df-84b7-682de136be73", "value": "T1AF733CEF59040AD2027BC4D6A1247E672ED6BDF18B8E8490DC8FA977DB3E3672605053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478526, "uuid": "3ec5a76f-8f18-422a-8183-1d2ec9079283", "value": "1536:I9l/AoSSMLrwpi7TmJ/AzctaNG1eumIbDa6bZ8b1Y+2RM8RFXV25/gjz/gMg/XVr:I9l/5MFausriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478526, "uuid": "3373cf89-9d2c-42e7-a611-90d32f7b2621", "value": 73460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478526, "uuid": "4b42e6a9-0691-42ee-9fc4-35ac50f207ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478526, "uuid": "b928f46c-0d36-4e12-b6dd-442a058ef249", "value": "invoice-1645080830.pdf (123).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68fde55-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478661, "uuid": "57ce0030-7515-47c2-b94d-cfd60f222204", "comment": "Malware payload", "value": "f67e2af39dc91fb5a8e19be234d0b279", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478661, "uuid": "344f1bad-88bd-42c1-bbe9-3b93dc8a444e", "comment": "Malware payload", "value": "1e4e119cdf6ffb8e8679d09012f1ff9c1fd422e0e9a06fc5603527370f5dda50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478661, "uuid": "baf85a96-c70c-46a6-97fe-e362e453155a", "comment": "Malware payload", "value": "5a15ff696cf56227b5126d13da3b8f7cd5252aec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478661, "uuid": "94b5d4ca-0f6c-4172-b4ba-0d6777ea46de", "comment": "Malware payload", "value": "cf23b6d029f74bb99e65a452bffd87e80137f2390efef757777669725a9baa56e086f0ff16e9e294b35077862e64d406", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478661, "uuid": "a7b8b7f4-8b14-45b6-992a-0c7fc31e98de", "value": "T1B673FBE3CC335DF898D02F979CA85319876DDE5E4A235233C1BF3A618E5B0D992602E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478661, "uuid": "d93641f4-fe0d-4fd4-a4a0-a8c9ba4e3f71", "value": "768:I8w/h62/jWs6oS+xISN0v9WpGk/dkfScBYrwz2y8kTAlGB:I9l/AoSSM7WusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478661, "uuid": "bc5d7b01-671f-4e60-95cb-097aa741a06e", "value": 75400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478661, "uuid": "2741a995-560f-4573-a5ef-a9b345e0844f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478661, "uuid": "02d0de02-246d-4c8b-9ca7-c4efa5f207eb", "value": "invoice-1645080830.pdf (97).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df132cd7-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479158, "uuid": "80b9271a-bc24-4066-b4d0-d6dd0eed69da", "comment": "Malware payload", "value": "6972931477241b750986d22173397791", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479158, "uuid": "299d628e-9b47-484b-9ce2-d2dd83bdff2a", "comment": "Malware payload", "value": "1e4edad0d2a2e9c8bce31b265b3d17e7d9121273c13dfe339392faefa400a2b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479158, "uuid": "27137ee8-c2e4-47dc-a14c-cbece2577b67", "comment": "Malware payload", "value": "6d1f76988e61c0e20168dad51f70a547dc646195", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479158, "uuid": "01b44f51-ae9c-4218-bddf-6580ad172534", "comment": "Malware payload", "value": "6bc1030f3e7aa2f9c5bed0043652253b28f07f22d701bc4b75c3db3d7a0c01271d194652d52bb1a9d6901331139ce3d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479158, "uuid": "d15bc410-324a-46d5-9025-1225257f238e", "value": "T16A635BC46F204F78AA4818F9F7DD4F6B9D6E8D3B00784574E813A4600B893EF5D59E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479158, "uuid": "fb04c757-6add-4b43-be35-e13a9b6f6303", "value": "768:I8w/h62/jWs6oS+xISN0vV3N+oM5tdkfScBYrwz2y8kTAlGB:I9l/AoSSMx2usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479158, "uuid": "1f4ca4cf-952f-4ec5-9f90-1810a481f269", "value": 72460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479158, "uuid": "7daa9737-dfdf-4974-befb-8fa18eaf75d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479158, "uuid": "be6909b2-6808-4d2b-a405-1792097ce3a3", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0444a096-dfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766476644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476644, "uuid": "b5faaa47-79e6-4c2a-9600-f1eca5f01202", "comment": "Malware payload (HijackLoader)", "value": "6708d5a8cf739f8bf293dfa66a5c0892", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476644, "uuid": "86222c0f-9961-44d4-b64b-66ebf7bd005d", "comment": "Malware payload (HijackLoader)", "value": "1e5c4cf9c8637d40c4d0c67cc9ff0574a85b2c82e43e7aba619a96d90a916a81", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476644, "uuid": "65df0f4e-01cf-4a35-8788-468fcd579d10", "comment": "Malware payload (HijackLoader)", "value": "9fcbb48e90674de5da9ccc623790962646cb9960", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476644, "uuid": "5cec34fc-ff58-4aa2-948f-11769cdcd36f", "comment": "Malware payload (HijackLoader)", "value": "ee0ff097e2505fac86c64c1c6e6f3e311dba09034571f000c447fb3a85b8d4ed019197cd726c47ce059af785bf8507d5", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476644, "uuid": "13581771-9c58-4771-88a9-7cdc37d1ea8a", "value": "T1B4063386AAA41CD2E87F50EF7524D639A2F81B3DC0846B3514F065E0A5236D37B1E37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476644, "uuid": "db2dade8-d290-4e31-aa55-f675687d092e", "value": "98304:H0+GxgcYPQZI3EL0QGD07Nk90EEpd6hspxhQlaRD:H0+GlY4W3eWD0Bc+pd6m6ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476644, "uuid": "9564e211-16a4-46bd-a4f1-af6f2aced531", "value": 3955705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476644, "uuid": "257b8298-3369-43f1-be24-2281320a51dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476644, "uuid": "ccf37d01-ab2a-41c5-92bd-461c7c75c322", "value": "1e5c4cf9c8637d40c4d0c67cc9ff0574a85b2c82e43e7aba619a96d90a916a81.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024a40bf-e033-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766517013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517013, "uuid": "20890c34-40c8-4839-b945-2466c69d85a2", "comment": "Malware payload", "value": "325bdf9e5741defe1ee83f9a9c0d3c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517013, "uuid": "cf1dc945-c306-4bb3-b0e9-79257c290233", "comment": "Malware payload", "value": "1e5f2ff2fcd8b1069cddaab1f85698de4ee43dbc69820b29340f165560d22ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517013, "uuid": "7cdafc0c-4ceb-4e59-bc5a-72bd4db3aa13", "comment": "Malware payload", "value": "6bb849fea242c04515abb1bcef40a6cbb8ff0517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517013, "uuid": "a6ca4041-16fd-46c9-9eb7-b24b032aa0c1", "comment": "Malware payload", "value": "9b325aa32d5fbd0dc923490cd78cd33bdbd60ab56835143596e6ef1e722ba61d3af7baa691f25c92f57a16a8d8ea93b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517013, "uuid": "30d4f342-d370-4ecc-8082-27cf374c506c", "value": "T16E42B33B8163D0B9C10256F17EDF89A6FD757076167C104A2B826F30BB719A49E943A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517013, "uuid": "98b1fdcd-7af4-47c9-9ca2-dc3a0cc22170", "value": "384:36hHUHEZLwYzFlVqy6wucmChM5yc/8p+87Oi772S+:32HDMsbqcuuhhc/8p+I+S+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766517013, "uuid": "a5acc0b5-460f-4b93-bf83-c91dd05ec39c", "value": 12644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766517013, "uuid": "4f64e32b-ad1d-4214-b214-18c8dd6bd740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517013, "uuid": "cd08de12-7c5e-45c2-baae-505ea135d777", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5f5764-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478488, "uuid": "9dbe2502-7dfe-4de7-93ce-c323ba6cd719", "comment": "Malware payload", "value": "6f2433bdfb9a2a8cbcba7b99891a8ece", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478488, "uuid": "3678f6b6-a368-4ffb-bdfe-eaf5e3bc066d", "comment": "Malware payload", "value": "1eb4a689b8effee7c68b50f134443650d1861ea753cd4d4d11b74c0df896af60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478488, "uuid": "94e19df8-69d5-4487-9869-b78cd7bcbc8f", "comment": "Malware payload", "value": "3cd28abd87b5ece21902e4feaad568735b24121d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478488, "uuid": "df56d5b6-93b3-44b3-ad82-676aad42ac7c", "comment": "Malware payload", "value": "4f0c01383eb8c472877531a94ec01679af388f802328f1b95abff9e85ec50b6f409ae8f7047d85ef48b4ddc9cc76a435", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478488, "uuid": "7395f39c-2021-46ae-b36b-d528798f0d79", "value": "T12D732B8AFE612A226F7B4825416CF2230E80E72F985F74563F45694D020AFBD35A1F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478488, "uuid": "276cdcdd-9f52-4e12-8969-e4a54e1c9ac2", "value": "768:I8w/h62/jWs6oS+xISN0v7S/msUTdkfScBYrwz2y8kTAlGB:I9l/AoSSMQyusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478488, "uuid": "9a898820-f8db-43bd-b471-86330449c2b3", "value": 74384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478488, "uuid": "d0fedd9f-6825-46ec-94bd-d85d0b76b189", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478488, "uuid": "5920c73b-34b7-4ab8-af0c-fc95e1820584", "value": "invoice-1645080830.pdf (127).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3329ff3d-dfed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487030, "uuid": "11292c3e-7836-48c0-a120-6e4556e5a90a", "comment": "Malware payload", "value": "eb5e388eb61ebdc379339b7e27148243", "object_relation": "md5", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487030, "uuid": "8725947e-a4cf-4319-943c-8bff8c71f2e5", "comment": "Malware payload", "value": "1fdb55b5fe318f44aec95f2a55d1130d25b961e3cd3e008b9ce04424c9320440", "object_relation": "sha256", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487030, "uuid": "743cf3b9-1ba6-4721-8eb4-e53a539d2ccb", "comment": "Malware payload", "value": "5fb6111801adada43d3e8f113df1c128bcb9ce00", "object_relation": "sha1", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487030, "uuid": "6a762110-9196-4c7c-8873-c4eef34d643a", "comment": "Malware payload", "value": "8d73de5427bb276c9ec2c0e498c5e87429d9b3071d62c38930d46072710c47a84b7f586476052978b92e4725f6dadce3", "object_relation": "sha3-384", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487030, "uuid": "da01bf67-3fcf-48dc-ba11-2aac75f73e5c", "value": "T172263334D4C8857445C342F702625AD9E64A58893AE9B9B433D2F54EF6FE9A30203F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487030, "uuid": "88491968-6460-43ef-b363-d72eddba9fd6", "value": "98304:g+mKV5nNMD8dZAhrqh2xM200EOntYBuQ1mViqSPiFr:/mKV5nGDQ9olE+YuQ1mgqSqFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487030, "uuid": "f095042c-0a9c-465d-bb2b-445770ec8b81", "value": 4692366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487030, "uuid": "9290a0c8-4eb5-472c-86db-c1a6b85b8db5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487030, "uuid": "ad80136c-fa47-41d5-aba6-995969cb7c22", "value": "virus.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4480825-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510118, "uuid": "7b6be04e-249e-403b-9142-2a3bbc9c432b", "comment": "Malware payload", "value": "56e257f481be84feb046cb2a82a89fca", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510118, "uuid": "4e0b31d3-1eb9-46a3-909a-ea40c77212de", "comment": "Malware payload", "value": "20fb502b4133cd354c56502fcf3813844020773bc806682efebd217b47d394cf", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510118, "uuid": "430ef680-47d1-4c13-9975-ecd41ada36c9", "comment": "Malware payload", "value": "cdceb4a49b9d09cffd19cac5241aab3ec5ded43c", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510118, "uuid": "af347c29-cf5f-4821-a9e1-8dee95346c82", "comment": "Malware payload", "value": "a6b877b579f4e9d016e7a79191c013634cfabaa3468a9fe9ccf8dae92f20986f1dd571f1ae5bf4484ef0b02b5047dfb8", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510118, "uuid": "f19e3df2-0efa-4731-8e57-1915a1c2e533", "value": "T10CC6341B6AE301B5E4E9CE34A7B944FC46F16B2F5620B7BB154012F8CE6074A75236B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510118, "uuid": "187c48bd-8e6d-4ab6-8970-14dc76457664", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510118, "uuid": "ee61df35-5965-4813-9d8e-a351a712a4df", "value": "98304:l0trB03LpTThUMidHSCOX32FAhpWYZxlxA+13Y:p39h9iXcDUqlH13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510118, "uuid": "88c53b8f-7ebb-4cf6-b440-03acc71a0462", "value": 12283896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510118, "uuid": "f3a2d276-cf9a-4c69-b5b0-b3da4c5476e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510118, "uuid": "6cafde4d-782e-4b32-8726-d5feecb1df03", "value": "idman642build45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc62db31-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522909, "uuid": "8067c19d-aa8e-4d59-ae97-5e7138e5c51e", "comment": "Malware payload (Mirai)", "value": "63080e51ea8c451d23d2ff279e7c6c76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522909, "uuid": "51448aa7-3245-4c34-be4b-e977c230325e", "comment": "Malware payload (Mirai)", "value": "22aee05b1ace745f05815e65064e687b58d8c28f11633a3b4ed148e464989b85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522909, "uuid": "386dbc9f-3c92-4823-bd74-da8bffb05692", "comment": "Malware payload (Mirai)", "value": "33abb9738eae3f27c7df387eb6f1226be7efa3e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522909, "uuid": "3bd0c83e-3713-4cfd-99d5-3929a3ff4e6e", "comment": "Malware payload (Mirai)", "value": "9728f86156ee85eae26c762be2bee0d88934bba1f95b92dd1d00253f0ff7c01ccd12d615117528994c266ec974f5f6f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522909, "uuid": "075c5ba9-5e0d-40ad-b88f-80b7325fa43e", "value": "T14833840E2E268FECF759C63587BB8D65A34C338736A1D681E26CD6011E5024E605FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522909, "uuid": "0cd414c7-533a-48e6-bdf3-ccc9364a3466", "value": "768:1IaEEr7yyGjxJew5ZCQYZYpZ8M+XbF5A3O5hZ/l2F5rygaYz:1HFVGjxXCMEr85XaYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522909, "uuid": "c93a08d5-cc36-40f5-9b1f-a91667c45ef0", "value": 52216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522909, "uuid": "b5417c29-8d4d-41a9-baf6-2758592524de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522909, "uuid": "a86800fb-f231-4cd7-8000-7cc13feac1a8", "value": "87sbhas6as.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654ce8b3-dfdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766480242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480242, "uuid": "bacbd595-5476-4251-af18-f786c751685d", "comment": "Malware payload", "value": "6e6e3a6048632edddf9baf09003071aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480242, "uuid": "1467ff76-cb2f-4555-95a4-d30de8389dd8", "comment": "Malware payload", "value": "22d4b6abcb913f72e56915b76b6baaadacc48719e42b1776cbd5fc263da36a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480242, "uuid": "1d2aa909-c675-43e3-b8a2-a548753fb15c", "comment": "Malware payload", "value": "312abaf768d043cd12f034869a31235b87ecc342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480242, "uuid": "3aa2a6f3-2c6e-457b-86a5-9990606013b3", "comment": "Malware payload", "value": "e1b9df5c568ccdd7f5f4e4c8b0bd05a899469c7f94011b2d5b2cc39b3d288648db2cd3edb37ad842c6fdc163a16c25fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480242, "uuid": "5c34d014-743b-4c3d-8fee-66a223b0bbc9", "value": "T16705AD0DECAC8F50D25705B9A22209F2F26A6918673183337BD12F453C5E7A9579BBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480242, "uuid": "d95c4207-ce62-46fe-a078-47f194c6b790", "value": "fd8f2c88fa4436ebefce520cbe5d1799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480242, "uuid": "f5932055-8dd2-4186-a94c-7ae93dfdc065", "value": "12288:/RRhpgU6uMHvoe67jJ389pbREWGQ0utURSx7dPSl0nKMRWMr:fhpgU6bHW4bgz6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766480242, "uuid": "9fb0ac75-d9e6-4c6c-a373-e30bdafd67d3", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766480242, "uuid": "ca204c01-f418-40bc-97fc-33656c7a3682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480242, "uuid": "14912052-d66a-4b8e-95e6-5f9550f5ffe8", "value": "2025-\u7b2c\u56db\u5b63\u5ea6\u5404\u4f01\u4e1a\u8fdd\u7eaa\u4eba\u5458\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f616c4-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766475972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475972, "uuid": "0bb59118-0952-41ed-a8bb-4df7bdc019dd", "comment": "Malware payload (NetSupport)", "value": "702bde3e859d35ae51bf06c70e34ed56", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475972, "uuid": "498b2eb3-0ebb-4d90-84f8-55ac230992e0", "comment": "Malware payload (NetSupport)", "value": "22f2a672f252b885ec3b6898323fcce8297e0425d8480bcd71f4b3863f759f3d", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475972, "uuid": "0f49e397-c492-48d3-8cc7-73f6285f8dc7", "comment": "Malware payload (NetSupport)", "value": "fe1feaac45cc6935a29b2f377f6b90cfe30af56f", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475972, "uuid": "2ae5fdf6-a460-4186-b8da-d394294356a2", "comment": "Malware payload (NetSupport)", "value": "56e0b9c057ac8f61a59a95d6e86b28b2e69ec4769bc169ec57ba52512de8e3be207c507e5e609d87467440b181bba359", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475972, "uuid": "47585963-49b7-4db7-b8e7-ef5ac6efb3b9", "value": "T1C2829619A61100169537C3A8AB739B8EF7724007834286693FEC52935FB6C95ADB3EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475972, "uuid": "19ac7b71-24af-48b6-a024-87834aae4286", "value": "384:8zLkP3Sbc9mYG+YIPsnF/jUk4iIiwiyiiiMk4i+k4i8k4ihhbk4i/k4iFi7k4iK7:83A3SbMhRsnhjUkVlNbLMkV+kV8kVPb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766475972, "uuid": "456cf28c-9ce6-4386-b80f-a85de26f1ced", "value": 17619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766475972, "uuid": "f29ffecc-fa46-4ed5-94c3-8bb691922dd4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475972, "uuid": "be32381d-2cb0-4ba9-b5e3-1235e99dda70", "value": "vpv.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63626477-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511592, "uuid": "b57d653d-d9d5-48ae-b9b3-1b46066edb52", "comment": "Malware payload (SpyNote)", "value": "1282decb695fe25c9f0b6051df634225", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511592, "uuid": "2d02b147-9e3d-4ef4-b758-5d54c7ab69f7", "comment": "Malware payload (SpyNote)", "value": "2308afb58c08eec15d0ad9048e751eeca001bd17a2106484803c45ef351af752", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511592, "uuid": "4320d47f-5f7c-43b0-a3d1-c6f19596732a", "comment": "Malware payload (SpyNote)", "value": "d2c7c04d03aa67caf9cf9ea086d3ddaa6299e0f3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511592, "uuid": "df89cb67-0412-48bf-a9e9-f4c9ffc8b818", "comment": "Malware payload (SpyNote)", "value": "27fbc1ce4ed560754b3203ed2ec09d1f271b66e1252e14788566efcfa8f2204441016b6165aa5ac923cb9527af0f0479", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511592, "uuid": "091c9222-8910-4504-9c31-22ee7f141163", "value": "T17A26F103FB44CB9BD8AAC3F26F230DA929131F15C643AAD70559366E2E771C14ED5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511592, "uuid": "86a4a6ec-7254-467f-ae28-d9411995b182", "value": "98304:BakY4UDdSUYG3zJGnA4W/mzQzBATE0tIcrrG:OLqGDsA5uzf33G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511592, "uuid": "f167f6b2-4590-41ae-9724-0c4d7c87a5a7", "value": 4640213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511592, "uuid": "ebae053e-5a58-4004-83b3-33a3541bd9f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511592, "uuid": "5247748f-8a4c-444c-9d0f-8fb60c1d67f8", "value": "t8pml.exe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63586e42-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1766489259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489259, "uuid": "b9205ab9-5edb-4b76-aad2-2eed9c7effc5", "comment": "Malware payload (ACRStealer)", "value": "ba521a29c4868e0aaeba5fe1a7ba8cca", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489259, "uuid": "21e03841-06af-488a-a790-6623d06343eb", "comment": "Malware payload (ACRStealer)", "value": "2336d0778931e72af226ca5a9ddc6470487065da61389252fd6b782ef4ff562f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489259, "uuid": "4e555953-907b-473d-89e7-f791515fd5ed", "comment": "Malware payload (ACRStealer)", "value": "579194aef56567728c3f022454c5a40b5bc61d2c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489259, "uuid": "939453d6-32f8-436b-b9cf-6b12a40c32a6", "comment": "Malware payload (ACRStealer)", "value": "3295ed2d5d367397bd49767dac91313fa78aa3984fe0046e44f91071f460f17db7c82d6363091a55218a0c0533a1262e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489259, "uuid": "d7b453c2-4931-40d3-a110-852a2af255f0", "value": "T125966B13A692C632C0BD11B484AA9278573ABC151F508ECF77D8A93879E77E07E3135B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489259, "uuid": "1b491562-9a68-402f-acb2-0a42b859bcb8", "value": "98304:I8AdF3L0VpAhlQRv1LPt+lCRXA7MOTYvqQj63u0wCZa1sJbP3dqx4Bt/:rZpA47TtcCFS67SwyVDP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489259, "uuid": "fbd25f10-7745-4c2f-abc6-d77835115874", "value": 9006998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489259, "uuid": "d62a3f9f-c240-44a3-9012-b18c54b95314", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489259, "uuid": "f3c6200c-5deb-463b-9a01-998456f349dd", "value": "2336d0778931e72af226ca5a9ddc6470487065da61389252fd6b782ef4ff562f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f670f5f-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524336, "uuid": "48af1002-ed9d-47fa-ad10-563b37865aca", "comment": "Malware payload (Mirai)", "value": "e9d169004117928115173cdf258c7fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524336, "uuid": "75e6e3b2-dc92-468b-8593-5f8b23c6d001", "comment": "Malware payload (Mirai)", "value": "2362d89a0b46567403a8f462abf98c8511a9eb66f18827c0b27a255cb2c71264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524336, "uuid": "4d2f669e-fba6-48d1-88bb-b0428b108233", "comment": "Malware payload (Mirai)", "value": "1e4dcf1968ddd280f44c8d57960f5012d93f3b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524336, "uuid": "ea5cf0bd-c6f6-43a7-b833-8283653987a4", "comment": "Malware payload (Mirai)", "value": "bace022f3656ebba2638e8512956fe54bff35bd0d4117ed2ffb6afc79ba5cb358a2fc92c4afdd951f83d3ad1fbe83881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524336, "uuid": "0e92c07d-6440-41ea-8a03-f2929c783079", "value": "T1B304E5916C826A2AC6E023BAF97E51CE332077E9D1CFB167CC614B1076C595F0C63B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524336, "uuid": "c8b23d42-a053-4952-8498-e0d92223f8d0", "value": "3072:hDyQ+IhoQV+tNElKA8OUEHO4xNXixqn0UbHMw7Kp4:hDyQ+IhoQVqNEBxixQ0UDMN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524336, "uuid": "9e462b21-b453-4f4f-b1a0-f458411f09cd", "value": 186452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524336, "uuid": "3c9b7988-7df7-475b-ae16-9429eb282b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524336, "uuid": "807107f3-77e9-4e85-a12f-0480e0f77121", "value": "pandora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c56b32-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479086, "uuid": "12692378-39b7-4d00-99c4-beb9f94688d8", "comment": "Malware payload", "value": "7dddd5785f0166e69d519a0bcbdc9d60", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479086, "uuid": "a85d747f-8db3-4ac6-bb78-63043421fba0", "comment": "Malware payload", "value": "23cbcb45a710d484441376511fea587a24da872ac82b3921e56b566c006c264f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479086, "uuid": "0d6fa203-2a15-4296-88a6-4df289401d6b", "comment": "Malware payload", "value": "fd4923a5df761b36e600379d4c59156b789a5154", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479086, "uuid": "58c608c4-1adc-4a0a-8f49-7f35ace0819f", "comment": "Malware payload", "value": "6805b7d507e659b7543ad4ddbe4e23823bafc0191f3958403217eb54d83dc88ed13e3a9770fef97e9a01c0e5ca5fdca8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479086, "uuid": "da74e332-cfdf-4ea2-a73a-283f8dd2a2bd", "value": "T185635D675EC4B4AF029757F66ECEC2A39E550DE780B0122580BBFBF44624BA54930CE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479086, "uuid": "5e2808a7-1457-4915-8715-d9a68202de1a", "value": "768:I8w/h62/jWs6oS+xISN0vd2bosudkfScBYrwz2y8kTAlGB:I9l/AoSSM8YusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479086, "uuid": "6ea5e890-5701-4a2c-9f04-5d2a0d597196", "value": 70590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479086, "uuid": "95a71dd2-d839-43f5-8d17-67212f09b793", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479086, "uuid": "7c3a41bb-f3e9-4fca-b501-8b6145c373a8", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe16fab-dfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766473281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473281, "uuid": "e09f7caf-2aca-491e-a34c-de263b54e417", "comment": "Malware payload (AgentTesla)", "value": "695fc1f540b6674a0ea2b2d55d4e924c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473281, "uuid": "ba5bd3f0-31ce-447c-9901-a75362b90782", "comment": "Malware payload (AgentTesla)", "value": "24483f7376aee0f64971caf390c1eed4a6cc56d76e15c1f4b22e7626bf8e076c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473281, "uuid": "30388029-36e3-4659-b1de-08be4ff56684", "comment": "Malware payload (AgentTesla)", "value": "d90cb741ed1facdbb0468d0d3d44a0530b4af58e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473281, "uuid": "e9692cef-03ce-47d5-87f7-1822cb697b79", "comment": "Malware payload (AgentTesla)", "value": "3fceb7d095887bb8cf67e7bc1cbacb5f5c86e0a7f91e6860f0b3ed8fd30951ef601dfe122e3e9adc60b1af7a032f2eab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473281, "uuid": "ddf06ec2-3983-4377-87f5-1d3dbf280c4a", "value": "T12F35BE0273D1C062FFAB96334B56F6115BBC79260123AA1F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473281, "uuid": "6b4af66e-6cda-41ce-9e02-65270ff5d13f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473281, "uuid": "6d8fbd07-3764-46d4-8354-d943765a1c96", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdau444ByitKNg5fx:ZPVt/LZeJbInQRau444v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766473281, "uuid": "b8706668-895e-4991-808e-2e8feca8646e", "value": 1143808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766473281, "uuid": "77888769-e902-4743-bda0-7502456738d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473281, "uuid": "639fe382-6071-4c20-809f-9eb5dbda0027", "value": "rCopyofShippingdocs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b27bc6c-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468522, "uuid": "03f92d86-5160-4314-9667-6a8c2d5d1bfc", "comment": "Malware payload (Mirai)", "value": "62a91bf39f21efa98c83a69205edd144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468522, "uuid": "86079c0d-4f2e-4185-aed6-fcd6f2d35a6e", "comment": "Malware payload (Mirai)", "value": "249325a44c2cfe77983941e5722758e16970b9b38991462552e2174489eab152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468522, "uuid": "ddc8a2eb-b3e0-4e8d-beb4-03630e75be03", "comment": "Malware payload (Mirai)", "value": "4b9bb9c9394b5819783dba4148bf8b1ed2fa9704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468522, "uuid": "1744f4b6-0810-4163-b819-834584cf719b", "comment": "Malware payload (Mirai)", "value": "7da89dd31c84dbff0b1dfb63e5363ee5aabc27d5eb39fa2ff5c7f8c58c747645e55af252096ac3c604f6290b5252c20f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468522, "uuid": "61a29a5d-b340-4f75-9d1c-a27468dc6c76", "value": "T185C3E1D4FA5758C2D1B601FE98C015C647906E72CFA35209129CF6B8383D9FA4F69EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468522, "uuid": "c955ab1c-2b8b-46fe-b1ba-e444849bf0da", "value": "3072:k5UfnYu5u0nBoMBNFj5RrSyWWpjSgGX0ELEjJMMTn9:dfhB3BlRrrWW2XzEdxTn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468522, "uuid": "0a6d0528-6d48-4516-8c45-9579988c3ec9", "value": 119672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468522, "uuid": "b58d8477-315c-4164-a6ba-3d7aff560d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468522, "uuid": "7e8e158f-759e-4d51-9aeb-229370e65479", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7775bf56-e020-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766509049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509049, "uuid": "0fdeaf68-114c-40c1-8bbd-1432627f3b75", "comment": "Malware payload (AgentTesla)", "value": "0a523f890c3508b8eca3c13a1f4b6f96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509049, "uuid": "c31f93e8-199b-46d5-8c28-472ca97be1bd", "comment": "Malware payload (AgentTesla)", "value": "24fe87b1951171c60a79a85bd1edc5da865222b2065c8cd30de6d5dacabb5f85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509049, "uuid": "2486547d-7c64-4af9-ba5d-c51ffa3b6810", "comment": "Malware payload (AgentTesla)", "value": "60a51474403ceff7de31a8ad1490dc07aab7c908", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509049, "uuid": "c208ef37-53cd-4b1c-a41c-1205638e55d1", "comment": "Malware payload (AgentTesla)", "value": "cbead43eba079169f7bbff10ac77a7f1a04f79d9c50e4976e29a93bebbf197be9ef0f4c3279c423e3b3500b350a7b8e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509049, "uuid": "7e34ad6c-9df4-43bf-8bc0-7d10b564dbe1", "value": "T122341F037E48EB15E5A87E3782EF2C2413F2B4C71633D60B6F49AEA51451642AC7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509049, "uuid": "6efe34ee-ff93-4ff9-b334-96f9e396ee0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509049, "uuid": "f5241012-3cf8-4106-9ba2-48e3e9e265f2", "value": "3072:ZN0AwYogYBkn0f0/VAA7TA9B9yFOEjPC5sKJrTZf:ZuAwYogYBkH/CyUEjPsJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766509049, "uuid": "89b61037-f33a-4012-8b2d-1ef5dd80dee4", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766509049, "uuid": "65485393-63f7-4403-a724-cad5b832a50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509049, "uuid": "2fd9f6be-558a-48c0-b920-03750d8fd40a", "value": "0a523f890c3508b8eca3c13a1f4b6f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04544cfc-dfa5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766456028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456028, "uuid": "5cd863f5-627f-4b4c-bfcd-f8f1d0f1bb50", "comment": "Malware payload", "value": "37773820c414b90b085629ff945eb629", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456028, "uuid": "a584eced-c31f-433f-8081-68a7ebecce1b", "comment": "Malware payload", "value": "252d04f17b98b5e15583d80cd20cc44baa30e7d662ad4d2d82dc82b1db45dd5c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456028, "uuid": "f3314330-fd21-4fce-b835-ff13d4350711", "comment": "Malware payload", "value": "e95be61fe027887c9df7cd8528a6bd59fb9df0b1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456028, "uuid": "32390b43-252c-4b0d-843c-0dee73240077", "comment": "Malware payload", "value": "d8fd424a5c450861600046d8380da817af673c5d66e56aea1c40ab08e3b81591642d037986edb6d832d20d65cf5e339d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456028, "uuid": "b85b216b-380c-40f9-a557-788f8fa68a91", "value": "T174B53346364B2439CD04C77299D2627F72773F8B5CA50A0A23543F422EFFA4A19E764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456028, "uuid": "dd2669ac-88c4-4c33-9c4f-d6b70f89a576", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456028, "uuid": "b1ecbbfc-4a0d-4e41-802a-00953bc58b5a", "value": "49152:axwTAjll6cOjfzZAlLu7M2qYA/TQaGSd3eWttUTMrVWR7:axNllJslAR0MRYMTQVCtmTMRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766456028, "uuid": "5ab5af28-5451-4ae6-83be-0868227ad26f", "value": 2356224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766456028, "uuid": "4eec129f-6c44-4f3f-822d-6a992bdb63c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456028, "uuid": "460bba43-5bd1-472e-ba6b-3e0ee07b7858", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fd54ab-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451702, "uuid": "a844bf14-1a19-4fac-b49d-a73f6747f89f", "comment": "Malware payload (Mirai)", "value": "1a4963a5392858e8b72812271cddb6b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451702, "uuid": "8d04d0df-5769-4edc-99bc-bba80efbf1f4", "comment": "Malware payload (Mirai)", "value": "2563e9b4d224e29639b9dd4d5cbe64db9d452c729703490ebbdf10fed0b3c833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451702, "uuid": "e6cbca8b-7c38-42ae-9af5-a268c1d64080", "comment": "Malware payload (Mirai)", "value": "7f8b18d0184a9dca9afe24c136bab3daaa391350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451702, "uuid": "076f2928-d4d8-47d8-aae2-bde5a79844eb", "comment": "Malware payload (Mirai)", "value": "6bfd59ec98bf41d8896cdf9fdd83b699ed5a4ad98e81a8e10de25388181999835fa59e45823c5617a6aa3426dc15cd0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451702, "uuid": "fe9464de-4082-4fb1-ba56-1e0359caf921", "value": "T172E3620EAD218F3FF26CC33547F78A64A32523D723E7E64A925CD5241E5438A582FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451702, "uuid": "ea2aa2c2-4d48-4fa2-b7d7-5b4f12b562d5", "value": "3072:09Td1nPzxpAQqLzR1lfX8KaXpgRhJvNrVVFyfdO:kTd1nLxyPhfBQuR5rEfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451702, "uuid": "5d537d9a-48d2-49cf-a337-6d6f91fa0d49", "value": 155940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451702, "uuid": "75d1c870-fd77-40e5-97c3-d19dda159240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451702, "uuid": "a0ad20fd-2875-45e5-a923-93ab08b5f655", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e58417-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524342, "uuid": "add3b9cd-9fae-4308-b3fd-fffb78b3c69c", "comment": "Malware payload (Mirai)", "value": "d1cab855b6c8efcb8fd611108f15936f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524342, "uuid": "d5e79381-2ce6-4708-8d68-e334c328e1ea", "comment": "Malware payload (Mirai)", "value": "257bf42dbe19d4f4f63e1480e39057f393c45b1916cd0a0424cb23f05b5caa65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524342, "uuid": "01851b73-b0e3-4583-b2fa-d27182abf3d4", "comment": "Malware payload (Mirai)", "value": "6bef50d696f546c4e0cb5ac355f630f3eff5f58d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524342, "uuid": "040fecc0-25d8-4ea0-82b4-04c36bd63922", "comment": "Malware payload (Mirai)", "value": "c4ba766ae31cf3c0b1a5d7b2c57d208d868b3bb9334a530dbf3e35b43b4e67de6fb2f12186a9000422a9f7e6f894c997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524342, "uuid": "60a8c8bc-c29c-4551-b673-01b72dd5f662", "value": "T1BB043C21643D2F16D4D0B97E127B8B91B1E23A4D2BA8C58DBDB30D4FEF3564068135BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524342, "uuid": "66e41ce0-f9e2-4018-9cd3-a5ba8a2a7b94", "value": "3072:0qD16vE7iba9VmYgj0vVC/10xl/Pic+Gpcr2yv/7+mu:FD16vE7iba9VmYFpxlXic+Gpk+mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524342, "uuid": "a85b5628-9fff-4af9-993e-9f67cd664a7f", "value": 184888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524342, "uuid": "1c72ef50-831e-4c5b-8068-99f5140ce722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524342, "uuid": "16cec65e-6c0e-4935-bb32-2330658450bb", "value": "pandora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3abdc6-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478942, "uuid": "c10f2c55-c7ed-4f44-ac84-90e8ef2e131a", "comment": "Malware payload", "value": "d19dc693e59515baa1919fead9cbe01f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478942, "uuid": "823d54d5-6320-426b-bdda-e7518ff794bc", "comment": "Malware payload", "value": "25d91f010522547ddd8899468e43c63edf4c14d7aacbab58893961fefd84f8de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478942, "uuid": "f360a9d7-c4fe-4abc-a58b-3c6e52c882d9", "comment": "Malware payload", "value": "79b175b643c79b9a518780fb3ab57ce15dfccc49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478942, "uuid": "1d55054d-e520-4e7b-8c8e-89edf3ddde27", "comment": "Malware payload", "value": "bcd87306897ea3bc3e3024140591c9803192b9af56f43a8dffca9d36f694b8d36f3e1be30a8a47f1dee62ba2b350cc30", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478942, "uuid": "98a2852a-5746-4da7-be09-cbb42144508a", "value": "T1DB731B482E66AB7CBABFFC45FE142540DAE4FE2905E6C47C76A3630679C4A101A313D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478942, "uuid": "6b66d373-da92-452b-bd7c-fc5770960275", "value": "768:I8w/h62/jWs6oS+xISN0vK4bVOsi3ZkQIvaICANksmdarGa0TGaN0XxurToXUFBV:I9l/AoSSMd2YrusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478942, "uuid": "7ad8ec97-9e4d-4d04-8e73-71ea06e85bc5", "value": 73494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478942, "uuid": "550387cd-896d-40ed-95ef-cc0db7cb77ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478942, "uuid": "f1d41e45-c7c0-43bc-b70e-c0fadf249ff0", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258c40ab-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510200, "uuid": "13ad3b29-8a55-4c98-8327-8b15dd5d7246", "comment": "Malware payload", "value": "d91b52de89d335bc8d211894b8d26fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510200, "uuid": "0d04b69e-3bd5-4c71-afc0-afa335336bfb", "comment": "Malware payload", "value": "27288b1ee498fc8acd2ac043fc5150473f74da6d0572852e4ef97faf476579a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510200, "uuid": "8c4af8da-a879-4073-ab55-ec4210ce4648", "comment": "Malware payload", "value": "50aea94718b27bcc23d65bc68b1a5f65e128055b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510200, "uuid": "bae7af7c-e32a-4b0e-8667-c66e713e28f8", "comment": "Malware payload", "value": "f37442a46f73ade805c5511d38394c496dac6a065e31b710ceaa00ca13cf7e4d1c4dce0756835b19b39d4bfe2af6f579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510200, "uuid": "3418e62e-f26f-4ca9-b04a-507ce7ff0d7a", "value": "T1E1D44B90B745FDFADD8947B408D2231963BDF081971AEF2F2524FE3C0D1AA98DD6250A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510200, "uuid": "aef247c5-0950-4456-b2e0-54594d5275fd", "value": "3a2d0dde76dcbe70053e2bf54bc13e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510200, "uuid": "be3024a5-6341-45cb-8db1-8c6757118233", "value": "6144:uu1Wzo6zNRV5DGBmAgS/KS+yKnkJ2RuX20PKVuhiElHyTisuoNAH1O6sSTK+jmoD:uuqo6xR7wNSkEIm0STHW2Aj/JGBorFi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510200, "uuid": "37e9b92f-2607-4fdc-82d7-0c0c8ce56cf8", "value": 601598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510200, "uuid": "b209ac55-8129-442a-af5b-a02bdb475f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510200, "uuid": "92951706-1107-4c90-a691-eaa0da71bbad", "value": "raw_cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c916f71-dfdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766480201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480201, "uuid": "866e89f6-b0ec-43b1-bee5-b5ff2101906c", "comment": "Malware payload", "value": "9e9e84ecd0c6c47a6166e630d7790eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480201, "uuid": "b167d1a9-fe9e-4616-ae25-7515454a86f2", "comment": "Malware payload", "value": "2757e9cb4869f7716594ec5371bab3f2790ffd53a6e56f39a8805ff6e42f0269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480201, "uuid": "27447f9f-94e7-4865-86c1-1a8d1738a9b0", "comment": "Malware payload", "value": "29a7da946a5d21570c9fe3595082211159bcdd8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480201, "uuid": "48cbfb91-99e3-4a20-acdc-25aec6441f11", "comment": "Malware payload", "value": "cd7b917c5851717e467ed8ff2542ce56bec0e2a5d2d7a223b19e44f0c89771dd4ec681adb031f2cd092a65c307716925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480201, "uuid": "b0725437-0346-4ac9-804a-122e61bac2d6", "value": "T12CF49D0CE8AC8F50D29701B5632215F2F2697928A33193327BD22F953C5E7A95B5B7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480201, "uuid": "2a2f4be5-b86b-4d5f-b447-fd5bd1e18cc4", "value": "fd8f2c88fa4436ebefce520cbe5d1799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480201, "uuid": "94708d15-ceb6-4177-aea0-2b131c1ceb0a", "value": "12288:Qt2RSx7dPSl0nKMRW46BWNF5IcbTo3ncVTSNtV:26BWRbTo3cVTSNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766480201, "uuid": "61915b7d-0b66-494a-805a-8e85292c99c0", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766480201, "uuid": "5e730b2d-5f67-433d-8458-8c3b36e4f490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480201, "uuid": "06d99f49-8995-41b8-a037-57e4e1c01d7a", "value": "2025.12.22\u4eba\u5458\u8c03\u65741.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4818bc6-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478738, "uuid": "f5d9c3eb-50a3-41e3-bdfa-0e11fcd175e4", "comment": "Malware payload", "value": "4b4b6b8c69673df5f8c528c03b33ae20", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478738, "uuid": "3cbb93ac-24f2-47a5-ad1b-f62c4ad9cfff", "comment": "Malware payload", "value": "2831adc33580a426cf751b08ba0a10497057088f58efb5fd4a71caeee11c144b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478738, "uuid": "0f0b827e-94e0-4949-96e6-2738b48ad6ce", "comment": "Malware payload", "value": "2b64908e33335054010952a7e4ffc313cde28a0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478738, "uuid": "b0b782b2-a6a7-4ece-a855-0441755c12dc", "comment": "Malware payload", "value": "51fb0f617cee3da6a9665f8a6776d4f7e419e8da40f081ba05a11ca51aa4b67649d66cc5146c37704d71b3cd42a0e7f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478738, "uuid": "644f3c34-f214-4355-8a0a-d0c1ee49ce92", "value": "T1CE731A81A5521E68DE39F9E51C8F99082710FCBC7E2AC01CB5E7A495F9C76F0EE6181C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478738, "uuid": "db0ea42d-c17f-43a2-a5f5-bae49b193f2f", "value": "768:I8w/h62/jWs6oS+xISN0v6VpVDVgVMVMVQV0VUV+V53VsVyV6V0VOVW3VC3V0Vhw:I9l/AoSSMwGusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478738, "uuid": "b0cbb776-fdce-4bad-a798-164020e3ad27", "value": 75313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478738, "uuid": "e6b70df8-9d46-4974-9d1f-1f59ae52bac4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478738, "uuid": "bc9b7e19-c901-4a25-9c72-7900e35d67f2", "value": "invoice-1645080830.pdf (82).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6f35e3-dff7-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766491633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491633, "uuid": "d977a758-8965-4aec-933a-7d0e17b040a1", "comment": "Malware payload (Vidar)", "value": "f22f50d84666a2aedd3aace16eb1a4ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491633, "uuid": "5179d38f-afb6-40ff-8c9e-748e0ee12921", "comment": "Malware payload (Vidar)", "value": "285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491633, "uuid": "f527a03e-8a36-4fb9-874c-c8a233373193", "comment": "Malware payload (Vidar)", "value": "7c49d673cfcee301289870405358e511ad59bec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491633, "uuid": "4fbfc72f-b5a2-4ca6-b6a1-65f0fe8bac7b", "comment": "Malware payload (Vidar)", "value": "bf6d9550f3d8be9eacf2f2e780bbd99868a93f8fd5e70629daef0199df1b4fd7b063ccb3f3633beea3d42ac5feded606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491633, "uuid": "ec44ae9e-e3cc-46a4-895f-1e4f17d6fc8f", "value": "T143A43BBE9C60E375F608C0BAD285D3635E2178010636BBA71DE9E7201545973EB1A3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491633, "uuid": "a7d230ee-e22c-4dd8-aa56-24eeba20cc04", "value": "dc3120d7b4090566a887530f3c294893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491633, "uuid": "cb5e484b-f96c-47c6-b512-03bbe18b2fff", "value": "6144:NwKZP9bhEeCdIR3VgJ/IAPkC1Iy2PJWA/clw+Tz3YlbTl7GW7Fqrsvg+sXaByspr:OKZPBhxVLCV2RcG+/CZ7VZBx+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766491633, "uuid": "c06bb78a-5e7b-4ee2-ae66-70d32ac976b3", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766491633, "uuid": "1522a784-d5ec-4fa4-987e-7c2bb2e6d405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491633, "uuid": "2a3cb6e5-44c4-4cf3-bd56-c06f2ed34a87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a566869e-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522870, "uuid": "0e2ba76c-d8fa-4cc1-be07-b3f8ab0bd3be", "comment": "Malware payload (Mirai)", "value": "29d66decda2b51bcf7a303a2402d0998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522870, "uuid": "66addf7b-eecb-4eda-a631-ee27345e0973", "comment": "Malware payload (Mirai)", "value": "288678508dcaee6e8488754d6c13360ea49e69cbe7ef6d31bd2e25a2d87e7119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522870, "uuid": "d42ae222-1184-4415-8b7f-0915796cd5e7", "comment": "Malware payload (Mirai)", "value": "61c34847899655f47dda68a70bc8f2ce82dea5b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522870, "uuid": "da6b47a6-4fdb-49d4-ac6d-a17f269007cd", "comment": "Malware payload (Mirai)", "value": "2c3711395b2d0d2fbea18d338e43f09525d5cd5f4fbd9997bab68d3616a3b4c81fd70de1d6b1bc5e1ed1fa15e5a7bfe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522870, "uuid": "b26dbeba-baec-4908-932c-fa314a500981", "value": "T19A82E165CF4A6297DDE4787580D71722E7DDC4C623420C7BD73235E7A07C9806A05BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522870, "uuid": "8f3918f3-2bbf-428b-96fa-05c6c7b8ec94", "value": "384:kIVcoyqcEe4Vr1mvv4Z8GjsJpHX0IFNg9WusfLDyYkCPG5HZeF:kIVcoEWVEvQZ8/j3zFNWsjDyYkCe5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522870, "uuid": "d21ce365-f14e-454c-a1be-49241a3ca514", "value": 17980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522870, "uuid": "ac4645e1-86e1-44e1-8145-bb5ded67e5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522870, "uuid": "6f6eca86-dac2-4e98-a6cc-ba7b0360da5a", "value": "87sbhas6as.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc304a5-e027-11f0-a129-42010a9c0007", "comment": "Malware payload (CHStealer)", "timestamp": 1766511932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511932, "uuid": "721c0444-cdc7-4b3a-8497-6ed005f21f8e", "comment": "Malware payload (CHStealer)", "value": "ff7f12557f2550b434b2f1ff2339eaf8", "object_relation": "md5", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511932, "uuid": "65ade526-c375-47f3-8489-ad0b6ce038f8", "comment": "Malware payload (CHStealer)", "value": "29730ce718b2029a4c45089e4a95ddd52f3b3f7449eccc2f5b9c619877bb8691", "object_relation": "sha256", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511932, "uuid": "cc3bd1a8-266d-473b-a116-ba6422d679af", "comment": "Malware payload (CHStealer)", "value": "ae1ba67ec8794cabe631f044c60baa9021063247", "object_relation": "sha1", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511932, "uuid": "32ba4751-0b30-473f-9c11-26619832eb29", "comment": "Malware payload (CHStealer)", "value": "414379c464f00cb2695a2c48650002d5ae0de6c9e4e4af895107d8c7d194ab66fe630c784d5227ca7dae51fb0b421093", "object_relation": "sha3-384", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511932, "uuid": "4bc644e7-1ff4-40d1-a608-ac5152525dbd", "value": "T15116125749A70F81C969523A91CB4B57365EAB0FA606970B43B4E2AF7FFB3F08C24141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511932, "uuid": "638a79ef-7c77-4f5f-9aa2-8612a4b4e4a4", "value": "49152:IYyNvJM7rjxBuRze1+cMJVOjWofxNQEARH2xHbujfV03esnOMUBOArZhNtj+xM:IJmxENLJVIpfxNQVMlOVYvO4ArZHtCxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511932, "uuid": "9585e271-0e49-4998-9fbc-19a80f29c443", "value": 4358148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511932, "uuid": "d7a1497d-f14e-4bbd-be65-c2dbc5beae75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511932, "uuid": "df5ac8a9-bf11-4861-a441-0d6f0b8082ee", "value": "Landman S02E06 1080p WEB h264-ETHEL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041b2fbb-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524317, "uuid": "b91819b9-afe4-4f2b-a8c8-a1254dda1880", "comment": "Malware payload (Mirai)", "value": "6d27809c5e2253cc8e41e3338a433b7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524317, "uuid": "5e91ddc1-2e4e-42cd-a828-342828a28486", "comment": "Malware payload (Mirai)", "value": "2a81ff8011682aecbc5f70dc6a40f2aa8e3896613cd253454b3af3df1b727797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524317, "uuid": "6e5d0a77-a274-41c5-b68e-a572b7302182", "comment": "Malware payload (Mirai)", "value": "aac8c83b242d65631231171dcfbbe8f2232c8df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524317, "uuid": "465dd62a-ff15-4efc-b95b-4550185a46c2", "comment": "Malware payload (Mirai)", "value": "5f569e9e654772ee045a4279af6947554367ded924b92990bc74b4a1d9297ae10e1b3e335b2e1f0b158d12e03006c25c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524317, "uuid": "aadc59cc-4a73-44a4-9558-283a517d32f9", "value": "T1CF14F781A8828926C6E813BFF57E00CE331567F9E1CFB162CC511B1477CA95F0DA7A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524317, "uuid": "818afdba-896f-4b06-841f-2690bea37615", "value": "6144:3WIy/w6uK6Vp63xvAj+Y9mrsplDKZUXQBKXAVan5X+F8JyvTYuH3E6a:3WIy/w6uK94d9mrsplDKZqQBKXAVan53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524317, "uuid": "ae4d4b3a-8b80-4cb8-b75e-8444bc1f7917", "value": 202032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524317, "uuid": "39233116-a064-4347-afc8-0a602cedf36c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524317, "uuid": "57a0fa11-b6af-47bf-afee-133074de69c2", "value": "pandora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3870317-e005-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766497661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497661, "uuid": "b5c08f1a-0bc9-41bd-a8a6-54d2cd788aaa", "comment": "Malware payload (QuasarRAT)", "value": "9950cf752957adbe62bfd6d9b9d1fad0", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497661, "uuid": "51de4480-7af6-4d6e-b609-19795f5464ee", "comment": "Malware payload (QuasarRAT)", "value": "2aeef6545efb7b271af6e284b6128a3d7031cf2bcafc782d7912d312bedbba01", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497661, "uuid": "2eac31d5-35b2-414c-a51f-7b3b71866565", "comment": "Malware payload (QuasarRAT)", "value": "fabe2e7090814c6b6870a881f7d55126926fa0c9", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497661, "uuid": "9e863570-44c1-4f0c-9569-ad012d8bd608", "comment": "Malware payload (QuasarRAT)", "value": "789e9c034677b67bd0bc7c2dd668b01063e394ffbc4c6ef56dfe95cc1adb7603065603349edc51595e72b5b14dade84b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497661, "uuid": "4271e6e2-0385-480c-ac9b-45454a450d2c", "value": "T14DF53A143BF85F22E1BBE27395B0041667F1ED2AB3A3EB1B2151677E1C53B4058427AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497661, "uuid": "fbfaaa66-2e75-4cc1-92c2-c434aac6e359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497661, "uuid": "bf04f87d-8aa6-4474-b5e5-eca45c13f0be", "value": "49152:fv14U2FwaRoY/PVl5cy8TzdnmeOPxNESEgk/iBLoGdWTHHB72eh2NT:fvaU2FwaRoY/PVl5cyAzdnme2xnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497661, "uuid": "04fef613-8d8c-44cc-9ee3-a17083b4f250", "value": 3335168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497661, "uuid": "72d18b15-65d8-4b94-a071-b54379b2e80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497661, "uuid": "3cad6e81-da91-4799-83de-136402c80138", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4841c6e-dfa0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766454283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454283, "uuid": "9ef3e781-9519-4998-b6bf-6393938a99dc", "comment": "Malware payload (Mirai)", "value": "005ce539d40aa0a3c2caea1face9e898", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454283, "uuid": "1ad8899c-3ba9-4e30-aaea-f582b1108889", "comment": "Malware payload (Mirai)", "value": "2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454283, "uuid": "7d4c85d3-8d74-43e5-a1b2-1d015175c00d", "comment": "Malware payload (Mirai)", "value": "5674a6179c3ed46c3794368335ee2465d976d51f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454283, "uuid": "ca1e1664-e034-4a32-aeb1-bde93f9617f7", "comment": "Malware payload (Mirai)", "value": "a1757d400dc44f18d53d701894dd422b913c581dd6512d0c32fc26adec4d94571e8b20a9c82be7382cd2708c95d4f6b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766454283, "uuid": "af9c530d-7e65-4628-a2c7-ba42e4e0e161", "value": "T1B211219E1301DD90888DD47A77D1820DB4818FDD297B07656D5251B954E06CE737891A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766454283, "uuid": "5790c1bf-03b6-4476-9ad8-a4ac314b2c0f", "value": "24:+7NdJOa7AtJOa7rJOa7oJOa7vRDJOa7wJOa7goJOa7boJOa7AJOa73dJOa7njJOf:+wa1a8a/abqavaGaja3aLqakf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766454283, "uuid": "654f874c-2cab-49e5-a1b5-fdbd7ed9d872", "value": 997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766454283, "uuid": "570464bb-6197-4647-ab0e-d781c6621f21", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766454283, "uuid": "78191db4-7846-46c6-9e20-c2d9a1ec82ac", "value": "weed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c469f1-dfe8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766484810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484810, "uuid": "1dc0159a-a77c-496e-b3ad-80452a3ea1a5", "comment": "Malware payload", "value": "bc228ef3ea94c7757053d5e854f6583a", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484810, "uuid": "45aa467e-e8be-4b34-87d7-bbd4037b6f22", "comment": "Malware payload", "value": "2bdb175b24657e6a1c9344151f4e81bd454738d19361eda6957e01c520abb429", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484810, "uuid": "e7c8793b-d75d-4a6e-8387-d844a1296165", "comment": "Malware payload", "value": "ac556aff0102080e87539fe07f4d9491a7bca7a8", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484810, "uuid": "1c305e83-053d-42ae-a25b-b37a68b9ec82", "comment": "Malware payload", "value": "f1cfe293b2c1ba7b0d1a8de7c38f15b8426dfa2d91315b4b6d44ec25b1f918b49c15b74a9b3d59b9784d20d34668df4b", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484810, "uuid": "15768874-41fb-4d90-ba99-76e6f6bb301d", "value": "T108B63311BE7D6EDE4B1C933D20AF1E4E1BE00FD1C05DE0EA6BE1B48B625EB815527429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484810, "uuid": "44a1ba04-ebdc-422f-84c4-873b8fd29378", "value": "49152:ocWhIpr7MPgJOmXxl3S4kBlWHChnWIdvaaMc0VYfHQubh7fKc9bUhPTDM3YjlILb:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484810, "uuid": "e457fb85-7def-4c4c-8098-348b5298d5dc", "value": 10596171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484810, "uuid": "87d8faa7-64d8-4f01-bdd4-9b07f116844b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484810, "uuid": "4b38ef63-7f42-46c3-8a6d-40a535fe61be", "value": "2bdb175b24657e6a1c9344151f4e81bd454738d19361eda6957e01c520abb429.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716437da-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766489282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489282, "uuid": "6160120a-a209-4bcf-9acd-0fe68d451e0e", "comment": "Malware payload (AsyncRAT)", "value": "5623ac51be321497589504ab50973b14", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bendecidos8624blessd-dynuddns-com", "colour": "#35573C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489282, "uuid": "9964bb80-52e2-4843-aea3-1c579fbbf555", "comment": "Malware payload (AsyncRAT)", "value": "2c0255a9942b6423d3fe33d6768d810b8f00569df28978010e665f45f4dfebd1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bendecidos8624blessd-dynuddns-com", "colour": "#35573C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489282, "uuid": "a48e3571-5cde-4124-98fd-5940a5d0e8bc", "comment": "Malware payload (AsyncRAT)", "value": "42ff32fa57407a4f811c9a45b1733b7bc8446cc2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bendecidos8624blessd-dynuddns-com", "colour": "#35573C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489282, "uuid": "626577ae-b540-43d1-9ba6-a2aa95eea42c", "comment": "Malware payload (AsyncRAT)", "value": "2b750c66e93beb91672fe08af662b1ac7ed14f61bdf4b2fc5c4c9816a08568586d64a9d6ba1ed02f9cf1c9e35a4bb3dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bendecidos8624blessd-dynuddns-com", "colour": "#35573C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489282, "uuid": "e3e59d8c-e2dd-497f-bcfc-f30601c77df6", "value": "T174A6F1137690903EE5AA02718C6FAE64D5A97D738A314157F7A0FF0D2DF0582B623B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489282, "uuid": "390eb325-463a-4768-8e74-0dbde152e868", "value": "2ac0df3cb49d714c81e70b5b92c304f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489282, "uuid": "ecf25913-24a1-4acb-b47e-8c2705711f2b", "value": "196608:4igeTL9AncDVio4wsBYZSY6ore76ZhNqP0pYTOu9qhPix:weTL9AcDVi/wsY8JGg2jqPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489282, "uuid": "cadff566-6484-43e5-b0fe-fc1286d61db7", "value": 10403039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489282, "uuid": "ead27e49-2d66-4ee2-a4fa-0e86723deeb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489282, "uuid": "2c02496e-6a5d-4fbe-bf39-fdb43a8bf554", "value": "2c0255a9942b6423d3fe33d6768d810b8f00569df28978010e665f45f4dfebd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac9993c-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478614, "uuid": "21aad3dc-2d70-4a2e-a069-44cbb5abccfc", "comment": "Malware payload", "value": "d749192da0941a38cb4c9f09dc49652c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478614, "uuid": "24d049e4-baea-4a83-acfa-6bfb0e2f5c72", "comment": "Malware payload", "value": "2c677379ff0273e4669cf66d6d59594f245d5c83825f67fad40d80cd2e24a88a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478614, "uuid": "8e84413f-c6d3-4433-95db-59492a4ec214", "comment": "Malware payload", "value": "ca39aab5e6fd43f04c807d11ef54ac0e88770e0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478614, "uuid": "0c066b43-2658-43da-a57a-a848018728fa", "comment": "Malware payload", "value": "2f2cb89e926285b31097e6e2c33094d5ff5d37b03d3884635ea7265bbc18fb37d0a84776433bdef4c994b71a288ca960", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478614, "uuid": "51595e3f-ddbc-4c66-a2f0-0f8b70ce8648", "value": "T1FB6307A5E960340A93FE8E41C7F915A910F810BFE4E0878DF285DD23D638777E8968D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478614, "uuid": "3f938229-9c8b-47c9-9a77-6ad424e0e1ac", "value": "1536:I9l/AoSSMEYCeWxhQ5PzOfWYgUdVmDj9raPc8rjoAUb4Z8E/pEIJEFWHr6EJ6zlm:I9l/5MEYCeWxhQ5PzOfWYgUdVmDj9ra1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478614, "uuid": "5024d831-6344-4222-8f60-41750991af37", "value": 70547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478614, "uuid": "a3c7ea36-7463-42ce-8fe7-a43fdeec8e57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478614, "uuid": "222dae81-8262-41f6-bfed-ee1f752c3ce1", "value": "invoice-1645080830.pdf (105).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8084cd6-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479120, "uuid": "f4246a4e-4574-4380-af16-8a8e0230d0f4", "comment": "Malware payload", "value": "01f19700feb9214e36f4475e2a276fdf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479120, "uuid": "e7e0c638-1a92-44ed-9141-8ee43bda5544", "comment": "Malware payload", "value": "2c7bf67dfcb4c9a9860cb34a4f4f12a29e74d65383d15cc0e915aa7ffda90ed9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479120, "uuid": "e9c29cfc-e732-4e62-a6f4-280a989f03ba", "comment": "Malware payload", "value": "de681e786ed1a1d5e8a7c5c7ee310ad4fb6aba43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479120, "uuid": "e941b202-42ba-45d6-b59d-807fd8fea8e0", "comment": "Malware payload", "value": "48e08b09182a6cd1fa2baf6ee64adc8e4207312f2db389049ee5bc49fc8e41793c56a4fc17e8ac276e0abeadfffdf367", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479120, "uuid": "7621ebcd-9171-43a3-a7d9-4ff1ba137d09", "value": "T177633A3B432E57F3096BE89EDD4C081166542A8EF540614FEEB76A64E18DF1A2F37E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479120, "uuid": "8848558a-adea-4ded-ad33-fd8fa92c8abf", "value": "768:I8w/h62/jWs6oS+xISN0v90FcnBdkfScBYrwz2y8kTAlGB:I9l/AoSSMSwusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479120, "uuid": "2f11d9ad-b199-48f2-8d30-c94fa4ef4fdf", "value": 68741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479120, "uuid": "7124e1aa-2a65-4f62-85a7-c13b55101626", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479120, "uuid": "bbbf8672-4100-4653-a620-2180f32d4e26", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2afdc2-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478908, "uuid": "10ac2b4a-4206-4c94-a6ba-a3bf08b9a1ae", "comment": "Malware payload", "value": "dfd5b1cf478c23aa456810d8fff4ee23", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478908, "uuid": "a11f5c87-8ffb-47b9-9c7f-ccdca182f08f", "comment": "Malware payload", "value": "2c7d58690529990afc514b12c60f805abebfae9f798685f93de0b87eebbb240d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478908, "uuid": "6112caed-3004-4c8e-924f-7ebeeb24255d", "comment": "Malware payload", "value": "fd64c5962bee7221c28a955b4b301d599488a9fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478908, "uuid": "af96a23a-e631-4563-a066-b87560bd0794", "comment": "Malware payload", "value": "3c8a8a5c802b924c07835927ad48a42c09ebd65fb60a22fd0e757aa88d2930be5d675837af79c4144cb0d509e9fdb481", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478908, "uuid": "3f533adc-df61-477c-935b-03d4aea584ee", "value": "T112732BB89A11348EF4B9B6C2DE8CA8F3D86FD3544F9AB37199865DF50B960C30C9614C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478908, "uuid": "11ca881c-f47e-427a-80fe-9c790f5a0f9c", "value": "1536:I9l/AoSSMXrMNQNRQ0QvqeFoQrue2cZTEy/KBs9G/+lwOVg54KRNTyoTH//je0Py:I9l/5MnMJ3+PusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478908, "uuid": "4d0835be-2641-492c-8a20-6d4ddbbd4378", "value": 75440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478908, "uuid": "07fe607e-6732-4cde-aac8-f2fdbfdf23d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478908, "uuid": "0da3a567-5842-466c-a841-86042692fba2", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b419d1-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524324, "uuid": "95de4a07-23bc-4a55-8096-9ee93254f84e", "comment": "Malware payload (Mirai)", "value": "6c1f4737713f02c78bd66e2c0d4201f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524324, "uuid": "e50fdde2-951c-42ca-a79a-1197e1385a35", "comment": "Malware payload (Mirai)", "value": "2d48c937ada663b344e28ed2d3648a881f41ea757a98bcbc4a34d75c38d82655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524324, "uuid": "448c9bca-1aab-4e47-9b02-ec32acb9e2f3", "comment": "Malware payload (Mirai)", "value": "db18dfcea0b6d460c492dc48874ae055e8089bbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524324, "uuid": "b7618d89-9518-419b-83a2-f2140baa30a0", "comment": "Malware payload (Mirai)", "value": "c2c4d7e90ca2e4395030633b095624aa04de96b3382ee9310d816ae206c2f77848e2cfc02373ff3078db8016bf12e286", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524324, "uuid": "1a6b8c83-165d-4ff2-8368-bcd1879c77ae", "value": "T109F38E35D05EE5D4C0220238E9E58C3A9F117048527B2DFA9FE78492149BDB8FB297E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524324, "uuid": "2fd36f1e-e61a-4dfe-8853-6f11e1413b86", "value": "3072:A1anqnNqSaIqTMwA6flyyP9tq5dqdCdq9uy8BKFGSuR7WDNvpDf+A2fA/7xRaJAL:A1aAraLMwA4P9tq5dqdCdq9L8BKASuw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524324, "uuid": "157f4f0b-c6e8-4bbc-a366-9c94330ed352", "value": 171072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524324, "uuid": "3924d613-504a-42b4-9612-d0a063eb0a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524324, "uuid": "b45d1d72-4cd3-4ea4-8284-5d454503c215", "value": "pandora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2805f646-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510204, "uuid": "05c635fc-95e6-481b-8c01-139eb4035958", "comment": "Malware payload", "value": "486e0740c8dbe8322a3628cd74382b9d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510204, "uuid": "fd57c6c4-8604-47e8-b884-2f24fe9e3d1f", "comment": "Malware payload", "value": "2d8d41b91fa96a7c4d50b549927f510d06886405f9bd2423ab42c97ce65facc8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510204, "uuid": "3d6f60f2-5359-44a3-b9b5-a0885540281d", "comment": "Malware payload", "value": "54ffba9d6f0efab7c4b2acd46532ad731fea51d3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510204, "uuid": "030632ff-9803-4754-bc54-e18f22c5956c", "comment": "Malware payload", "value": "2d9a74c753ef8db0f5d4d911e4af5fc725856c356968daf662e63f5e62e3691483f16bc1f3cd0fbbdd58ba48d3be9ce9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510204, "uuid": "db6621d2-ea71-44f9-9fcb-7957b654e5f3", "value": "T15853500C31D78E01E52745364EFBC695AA37BC6DAFB15307225C3B2E6FB74600A51B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510204, "uuid": "8f2a5458-3875-4511-a015-3fa178bc97bb", "value": "384:MtpmkFNHoszYyGcSYrmeNcNCQs2tK+dqW+h7OhQJilz0rFMj6I:MHfIQopCQK5WIOwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510204, "uuid": "004a2063-29d0-4974-a435-bfda153bb1bf", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510204, "uuid": "81e34389-e47e-466b-a8bf-dc139e6a08d9", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510204, "uuid": "1be85203-c057-4c39-a870-d939db9147d4", "value": "PE\u0141NOMOCNICTWO - Wasilewski K. Skorupki. 2025 doc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb280d6f-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468871, "uuid": "14ce6834-1434-48ab-aa41-ff399ab0dfe7", "comment": "Malware payload (Mirai)", "value": "093b1ae9d5b104e91e501b6c2e299ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468871, "uuid": "9f4d5617-fad0-4e8d-bd6b-1984bcc14b06", "comment": "Malware payload (Mirai)", "value": "2dbc0a367b2c2cdc2b44df20086479e71cdcf4ba72114dfd8aec1e3ba9c781c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468871, "uuid": "c090ddaa-d711-448b-b6c8-573c4966c063", "comment": "Malware payload (Mirai)", "value": "ad466db0784815499ed5d0608f3b7dca2dee0058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468871, "uuid": "49131d28-44a7-47e5-91f3-c43f5c2b5aab", "comment": "Malware payload (Mirai)", "value": "b31cd19ee19bfd039dbabc99e4f78a10748d24f0a6cd424e96db5ae54fb1d7ac49380c14ca12251243ada9889fd7a36a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468871, "uuid": "85c80d36-51a1-428d-8081-702871168519", "value": "T112B32985B852AA12C6C256B7FF4F428D7716539CE3EE3203CD185F64338B96B0E3A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468871, "uuid": "c3306e7d-8e2c-4b3e-8ff8-c8d551ff630a", "value": "3072:Y7HPBz+bzzr3b+CUvGqMGKZOp1qgjRdunzR:YTPBa/zbb+CUuqMGKZOp1qK3yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468871, "uuid": "bd6e4d79-cac5-4a65-9ba4-82c93ca068db", "value": 116252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468871, "uuid": "89a8d8e9-fc6c-434c-8921-3b9a63327193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468871, "uuid": "19f46cf9-86f4-4c05-8d05-63eb7cdf6a94", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e244bf83-e057-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766532851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532851, "uuid": "edb2ee49-580f-4ae1-96d0-ba3181ca2402", "comment": "Malware payload", "value": "7868fa9740ed0fe25a7ac68c86db9d3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532851, "uuid": "2b2c4c03-055e-4a03-91a4-edb2a6dab978", "comment": "Malware payload", "value": "2e3f34d2cee0204aa2fad5120f9f32df03c88b3a9d6bcf15b33157c72138d628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532851, "uuid": "553aadb1-c7be-4d7d-9f0c-407018f1cba2", "comment": "Malware payload", "value": "7822691f76abd96aac99ab7483ce8cc845ec00ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532851, "uuid": "5d861966-1c6f-4fab-a975-231835ea5bc9", "comment": "Malware payload", "value": "a3e09320ac96508c564155cfaef8f5fe8fc9ed81e03d2bee129c24de7e551f4907c5ebe85d5f0132af84bf85fe1b64a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532851, "uuid": "f1a2b5aa-8370-4125-a9f9-c26b417ecf42", "value": "T1C0C30884B9419A12C6C256BBFF4F428D771A5798E3EE3203CD195F6437CB95B0E3A242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532851, "uuid": "fcaddaa7-f004-4bb9-85e2-c73a95c0ed72", "value": "3072:WW4RyPzmtTNyeBYtn6G2SZPoy9Lih1op5x+knY5nz4:W6PzmtT4eqtn6G3ZPoy9Lih1opakn+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532851, "uuid": "4a2b4840-cdf2-4272-be9b-70c53e43567c", "value": 124160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532851, "uuid": "6d695669-44d5-4cc8-876e-99d21a0b5f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532851, "uuid": "e87e690a-8a8e-4a06-aa0b-2e8f583009f8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318e462b-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766488316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488316, "uuid": "2893c66d-09d9-46b7-82b8-6de7dd476c43", "comment": "Malware payload (HijackLoader)", "value": "10344ccd3a32a49e889cbbfd11e0d271", "object_relation": "md5", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488316, "uuid": "79139efd-098b-4beb-a9ae-ae1c8efc53d9", "comment": "Malware payload (HijackLoader)", "value": "2ec31a8a36d73fa8354a7ac0c39506dbe12638a0dc1b900f57620b8d53ae987f", "object_relation": "sha256", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488316, "uuid": "aae69dd6-34fc-4322-bd7d-687692248582", "comment": "Malware payload (HijackLoader)", "value": "64aff06c57aa0c2a822c458ff20cf358170f4fa8", "object_relation": "sha1", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488316, "uuid": "6fcf8def-1b0e-4d39-bf41-66a03ba990e1", "comment": "Malware payload (HijackLoader)", "value": "cb961c69bdec7579cbf6bd712bcd9f30861fc05ed88c127d6b981b8b57b878f9c3b443fcbd74e03c3bf9470d1b36b10e", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488316, "uuid": "26592544-8903-4d3f-9e2c-a436001dece4", "value": "T1CA0633C3FB95B055097178BA873B1F21DF05A08751A9E12E48935EEB04FA98EC8D2F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488316, "uuid": "da2be5c8-5ac3-4e42-b82b-d30711533428", "value": "98304:X5+5yNCJ3BQQJjGtiU900VmnCdXxIq0bKFJkfm1qUIe:X5+KCW50ymnIIXbKFJ8m1qU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488316, "uuid": "0498eb37-4a30-4949-86fa-b5418318d0f6", "value": 3933762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488316, "uuid": "5906787f-dddc-491c-b88e-75ad5f5f8624", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488316, "uuid": "8288a8dd-1beb-4efa-a12f-6984aa3179ed", "value": "123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f8ee47-df93-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448516, "uuid": "592e7ead-c8df-4c24-875a-5cc6c6dfa7b2", "comment": "Malware payload (Mirai)", "value": "49888e383005e39d02b58bfbb3c6f922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448516, "uuid": "17f2c3c2-bf3b-4265-9ba7-9d068cb20aca", "comment": "Malware payload (Mirai)", "value": "2ed4820daf68819b81632f43b88efec2913755d6166c70ab979f148dd1984eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448516, "uuid": "91c40437-e7c0-40bc-a694-5c15050a28cb", "comment": "Malware payload (Mirai)", "value": "b3d3b761a496472b2326615228ff0ee61a9fdc8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448516, "uuid": "b237e922-2c29-4953-82df-2cb98337c63e", "comment": "Malware payload (Mirai)", "value": "226e344eccd500f2a54c9848a2d62e56f83142f010cb802260402fd980bec06d2a8111bcd57de63e59910ecc4851b257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448516, "uuid": "19755d4c-98fe-48b3-bab5-652676303ba5", "value": "T1D95302EAA0D87DCDD14A8334020F56473EC5B7B8A149653AB6C4B6694AF1750CFC87D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448516, "uuid": "cf26711c-527d-4931-8161-78bdc9a1ac9c", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAPRMLkg4azHO:CM5az1Fy0oPgdZX6hTo8R4RMLGazHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448516, "uuid": "142c08ff-9140-4c92-85a4-fb0b0db7f866", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448516, "uuid": "43821c54-4067-4ee5-a2f2-b467d5e029da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448516, "uuid": "15ca7f5d-3a53-4d53-85ab-774e2c363f3c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819be19c-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766489309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489309, "uuid": "432bffb8-d41d-47e4-8398-97f6f4f6d552", "comment": "Malware payload (HijackLoader)", "value": "f6e83283e0d0ec90e992b9696e9623f7", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "sofiavergara-duckdns-org", "colour": "#CD1880", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489309, "uuid": "f308615c-f028-4f73-b225-01cb4187ec9c", "comment": "Malware payload (HijackLoader)", "value": "2f10c96a4a1814bb012a7da2f37e60e6f0f87792cbba094f65a785a40588de0b", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "sofiavergara-duckdns-org", "colour": "#CD1880", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489309, "uuid": "077c49aa-c04b-4737-9ba3-189e7e239352", "comment": "Malware payload (HijackLoader)", "value": "0152b5bbd9bc85e84a093873549dc8c0a1696499", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "sofiavergara-duckdns-org", "colour": "#CD1880", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489309, "uuid": "7c7520e1-547f-4794-a5ac-b23569c704c9", "comment": "Malware payload (HijackLoader)", "value": "269bb2bce5e33437246519b9c18ba794052e279f24a5be17646622d089572440b071f144dbc54d225e2f277a80979719", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "sofiavergara-duckdns-org", "colour": "#CD1880", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489309, "uuid": "d8eca45f-61f1-41e4-ab40-a8a1abac89d5", "value": "T1E286335E71A712DF3CEA40281D5AB389698ECA7FC49384944B6D92F514827FC70BE48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489309, "uuid": "821abc23-105d-4fa6-b9a0-d864ad854088", "value": "196608:kwXGjVEDGa04R/eYXPymbYaepOxZBzcUTXUE+uQZTia:kYsyGL4R/eYfrtZBzraLJia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489309, "uuid": "12f0e8a7-1e49-4d38-897a-5f70c52ff580", "value": 8060175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489309, "uuid": "2432eb1c-2ed2-4d85-95df-d3a9454f3388", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489309, "uuid": "1fa67f4a-f66a-4625-bea9-4e13d963c3f7", "value": "2f10c96a4a1814bb012a7da2f37e60e6f0f87792cbba094f65a785a40588de0b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f223e4d-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766489332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489332, "uuid": "7aff50a5-e651-4ee9-886f-60cb0072e877", "comment": "Malware payload (HijackLoader)", "value": "58d21482426a0ee87e379931d23a939b", "object_relation": "md5", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489332, "uuid": "b14137f4-4751-4db6-8f23-3c9a4f9cdc12", "comment": "Malware payload (HijackLoader)", "value": "30be3ca09db5d5cb347c380215bad0efec926816265f0636efe26fd54f57aba5", "object_relation": "sha256", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489332, "uuid": "bf413d93-978e-4841-b70a-2304712391f4", "comment": "Malware payload (HijackLoader)", "value": "5b2d696a829328e7e94aaa75075dc3448a953d35", "object_relation": "sha1", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489332, "uuid": "0e42a998-d497-4092-bc48-da866a95026c", "comment": "Malware payload (HijackLoader)", "value": "c961b46e0f13c1014473cb423c7ccacca5cd99d58b58aed560e378bb997763644ad253cab3ab5916e80204ab162e00c2", "object_relation": "sha3-384", "Tag": [ { "name": "enviojj12-duckdns-org", "colour": "#BB97C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489332, "uuid": "95f99258-a1d5-4cc8-9688-bff47504e12e", "value": "T15156335C5185E8FC304F75296A2B167A32D488374BEC7E7F8341B66322B81A366FDB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489332, "uuid": "a4d10966-3256-4e9b-96c0-60fd93223db3", "value": "98304:qkUO6tT1VuicNU7k1aFiaV4e3FNH3b2ecn9anP+34fvM811+GRC82NPLDi0+8llQ:qL76NUa4iaVz1NHaec9iPTR1UG09NPL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489332, "uuid": "eefc7ada-6879-41c7-b054-ef45ee317928", "value": 5987063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489332, "uuid": "e332b5b6-2eed-49b3-8291-5b8ab3787dc7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489332, "uuid": "5374d065-e632-41f6-9c55-165c9fa5b94e", "value": "30be3ca09db5d5cb347c380215bad0efec926816265f0636efe26fd54f57aba5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86466c7-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524190, "uuid": "40362064-1fd9-47d4-abfb-36839e9e325c", "comment": "Malware payload (Mirai)", "value": "60a4d5078364003541924cae17bbbabb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524190, "uuid": "6c7dc07a-c0cc-4c8d-8fa3-b80f50e17562", "comment": "Malware payload (Mirai)", "value": "3110cc37354597b0d775371eb632582ba25a45e514ebc8ade7edf823b920b01e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524190, "uuid": "af820f85-3e5f-4cfa-8096-d5b93449b274", "comment": "Malware payload (Mirai)", "value": "1d96f3e2677c696d2643d3c162d764453430cb26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524190, "uuid": "7bc57d4e-a9c6-4c36-97f7-99142ae3b88d", "comment": "Malware payload (Mirai)", "value": "5b0e4596f063ec9619fa5f973e6ff3d96c232c20acadfb0fe1b450026a8c70f70fa75361f6479ee5421671bb4400b24a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524190, "uuid": "e50156f7-4a6d-404c-9835-4c7d5e169cfe", "value": "T117244A02770D0E03C1532EF0263B1BE15BEFFDA128B5E681755EBEC59271DF22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524190, "uuid": "ff42959b-4810-4414-ae3e-0856d60b21f9", "value": "3072:jbcIyzNIN+02tWxeeTTc5ooxoCNsc7ZnGVlS8IRjj4nGc/:GNIgnYeMQ5zxBsc7ZnGzSjjc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524190, "uuid": "b37523ca-098c-42ee-86e8-a8a04cdcc603", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524190, "uuid": "2ab5ccf9-a9d3-4f0e-a845-91a670917ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524190, "uuid": "7abb57c5-cf16-48da-817f-0f27bc218bd5", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea01048-e043-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766524067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524067, "uuid": "6e3f1fb7-5701-45a7-9649-16cbb105d6c5", "comment": "Malware payload", "value": "ac12c4ea89fff7733e90bc41675b3223", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524067, "uuid": "3fafa4f7-5d4e-4dec-b08a-46510acbaf38", "comment": "Malware payload", "value": "3134b84f9b9c74b3ce1a1145fc2cdcf827e2565594e7a8398cf8686ca7700b5d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524067, "uuid": "e4c8ffe8-f3d5-4533-be51-f3c16550bcae", "comment": "Malware payload", "value": "9abda2db2a4942796666c2b927db49b920669d0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524067, "uuid": "bb6557d5-a7fd-4e9b-97af-ff0274b201e4", "comment": "Malware payload", "value": "b3e6446e1953fc120b4e06f427c7585de65b7b86183ad59fdbed92680834926b0f36982d6b474a204f5c517803026208", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524067, "uuid": "1ccaa249-596a-407b-ba4a-9fdadfb74428", "value": "T1CDB012C5305980B03C69FDF731A9083231CBD48814C16E281BE83AF2408DE003D50B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524067, "uuid": "b39a61e1-2610-4b81-bcc6-774b8d9477c6", "value": "3:TKH4vGBwOnQzanFCKlyCAR1iQX7aaIOOdXra+PZn:h9OnFflR0gQLaDyIZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524067, "uuid": "72cf4857-6b82-46de-b6bc-8c7241f18ee3", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524067, "uuid": "638c0640-28a6-4c37-a586-5116a98335a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524067, "uuid": "dc23c687-be7a-4d29-8795-4b0fc8310c03", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8b8fe3-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478753, "uuid": "a16e1810-1faa-4937-9d6f-86a898a843bb", "comment": "Malware payload", "value": "dfdc6cbdefe4f468f5fb12ac40199e08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478753, "uuid": "3a9ce408-afb7-4ae2-8826-22688d937232", "comment": "Malware payload", "value": "3154bfd108bbb26ce3710acc892c0717fdfbfa43395e7aaa89f5a5b119382467", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478753, "uuid": "c53c2a25-cbaf-43fc-9614-f1937d146131", "comment": "Malware payload", "value": "b4cb16fe80e9e299dcb6fb297633187f83702180", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478753, "uuid": "ba2cf220-0eb3-4c31-992b-76926496884e", "comment": "Malware payload", "value": "1cbf44e68002a33621182fee58051e398169745ae6f55ada7682daab9309f119b0c4f6fec1ecb5c7de482053b22794a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478753, "uuid": "7608cf42-c293-4668-b0aa-a18053ed3e36", "value": "T12E630AF309EEB9E906F16FECDE2E00CC1D9F1E88690789A4F856739050A2D9D505722E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478753, "uuid": "27637f9b-612a-4af6-afe5-32294b7041aa", "value": "768:I8w/h62/jWs6oS+xISN0vJZqZQZFZSZNZNZeZ5ZAZjZrZOZLZBZsZPZKZWZ3Z7Zo:I9l/AoSSMVUusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478753, "uuid": "269378d0-6f21-4767-97d9-e9bead0198a7", "value": 72465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478753, "uuid": "dabaf88c-71cf-4727-8965-ad1afbffe43f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478753, "uuid": "55e90014-f64c-4019-914d-365dcf214835", "value": "invoice-1645080830.pdf (81).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffe35a9-e007-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766498138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498138, "uuid": "9455ed49-6c7d-4920-82bc-3eeb8c85d81c", "comment": "Malware payload", "value": "f5414b57d1e69295acf4b162d7e4d335", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498138, "uuid": "e2e93b4e-c13b-41ff-bd2a-e2f978bd3e8d", "comment": "Malware payload", "value": "31a4fd8489a1e2d3a3f6fff470d74831f4809ea60a2f0646d56f91a6ff25e7e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498138, "uuid": "7ffc7d48-3b4b-4701-a29f-b670d2b1ec56", "comment": "Malware payload", "value": "ccbf36e1950f2d191d6cc477f765948306a54bbf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498138, "uuid": "5d28a443-86c4-4031-a04a-36fd1f7f7caf", "comment": "Malware payload", "value": "639a31f06b4f920e5e6d26a06e74a0b56973f24a714cc4482defde1d5c8e7aa6386c28afa592aa7f1cb0984cb14e97ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498138, "uuid": "ddc1ceff-6b3c-4cff-8fe6-09e7a32d4f38", "value": "T116B3F149B796B4FCCF12E174A0EB9FB6F131F9210A609E3A5188DB786F105465F28473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498138, "uuid": "3d0959b7-246f-48c3-ad87-84ca3b6c360f", "value": "f54a16b74f2da8859f059ede3625ef2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498138, "uuid": "c9686a2c-1a52-4d21-9525-d957e7c761d0", "value": "3072:dZ7uHSu1juUDxF8MY4tUOWVzvw8cb6mfuM3inadu1:XK3IUDxF8MY4qOWVzvwHb9d/dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766498138, "uuid": "be9668fb-99bb-42da-9926-8197cdee611c", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766498138, "uuid": "f952ab7e-8537-4f20-bc56-8ecafc91fb3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498138, "uuid": "92a82dfb-caad-402f-9091-d58b182ee341", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d0d2b2-e010-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766502193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502193, "uuid": "76d29c5f-fae8-4ee4-b046-2b08b5509371", "comment": "Malware payload (Stealc)", "value": "d6dac6e34fd6e2a1669885a58675dfad", "object_relation": "md5", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502193, "uuid": "e9ed282a-702c-4d97-992e-e6530263356d", "comment": "Malware payload (Stealc)", "value": "31b9e19854e307d2aad542cdf7094319b0dfc67b3f1da9ae3205fb43a6422136", "object_relation": "sha256", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502193, "uuid": "cbc20912-2039-4bad-b8f8-4129634c5c1b", "comment": "Malware payload (Stealc)", "value": "71089ead6d39b056cfc71ad83932b1129df7fabc", "object_relation": "sha1", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502193, "uuid": "4ebc7e0f-a64b-4da8-8a8c-e72894788b19", "comment": "Malware payload (Stealc)", "value": "d4d1473e6ca4f3971ed5d1036df66a213a1d88dad808a8c48d31e889d632ab321754b7d9b3272405d4020ed345b7a9eb", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502193, "uuid": "9cd46c43-f8c0-4b75-becb-9fd1b6086744", "value": "T1FAA6330BFFE3900D0E6D48E8C355B988141FCE6DBE4749929FD782AAF793B4109E9056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502193, "uuid": "6b38563f-c179-4f85-9f54-f471b07825d9", "value": "196608:R11GeA+L1HHbfnCGOTfz72ZT7Qwz65ZgzP60yWpucws0rtqUru:R79A+VbqGODzCxHzQZehyvAeqUru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502193, "uuid": "289a7b30-3cad-4dbd-8b38-40c011b281f4", "value": 9842382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502193, "uuid": "1a09d5a0-6c61-4444-a0db-8cda1a63b5dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502193, "uuid": "63ef7b62-fb86-48f4-96e3-4f39fc688bf7", "value": "FreeFiles_20251223151217.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090a973c-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510152, "uuid": "915c0a7c-e0ab-45f2-9ccd-bb828a076e24", "comment": "Malware payload", "value": "0c41e49b7d372e7e8137bfae9f194d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510152, "uuid": "59564645-d368-423a-8bfe-579ca11f6dde", "comment": "Malware payload", "value": "31e43e5d36c7852f0953e9431d9ea27b98f52231a425d48d14bd1bc97bb47754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510152, "uuid": "728a083e-95fe-446e-ac00-eb0a628fd012", "comment": "Malware payload", "value": "8f326e2fb8a7d4bdcf8b535aca0b91d9dbb49f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510152, "uuid": "e3050163-7aba-41ab-b0dd-91bf17bcf3eb", "comment": "Malware payload", "value": "5f7129a1993e4ec9b3a19cbf277147554f7323642f7d6babff501889967dbdf550abab9001dc0408c0107040f15a62fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510152, "uuid": "9027fed9-503d-4d59-aa5d-2585e68aff90", "value": "T1CD733B17B34368F9C526C1748AEF6733EA31B8671630AF6F2758D6341F21E506E6EA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510152, "uuid": "8f37e9ca-d629-4bcd-86be-0c000ffea023", "value": "39f1222cf62e3e9db794884fb1d02403", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510152, "uuid": "7290ba3e-92e5-40be-9fa2-aecc3f49a765", "value": "768:OvN3/UzbFEt6ocu2bwyEFkJtDGukUpGIe0hs2msRxstUtW7XLZuvz1bNDLKGlqkO:q/jYu1F0rv/7nECtIL0vzGGqkUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510152, "uuid": "3c19a69c-adba-4ffa-98cc-2e18c48cbaf8", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510152, "uuid": "126913d6-d664-4483-b104-2a4182c1c2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510152, "uuid": "f3011a34-6764-4476-b5af-e7868b80a9b5", "value": "cbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8572b2d-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510124, "uuid": "c2467af9-a1c9-4760-908f-b4e545b4b271", "comment": "Malware payload", "value": "7a14a094ec07b734df3119b47e9521fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510124, "uuid": "97f2c51d-9dbd-47e8-ba46-a034a916fa38", "comment": "Malware payload", "value": "3204af9817beaecaa95bb0b0d8b0e21232650503a4543009d6fb57a73afdc603", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510124, "uuid": "e9c65f5d-75e2-4c8b-b2f3-94d72587bad7", "comment": "Malware payload", "value": "edf77438cc02011495d724c2ea0f3c23b82afbeb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510124, "uuid": "a1eab2a5-d4ab-4683-a2d0-51981d8818ad", "comment": "Malware payload", "value": "ce9b7ac64dd6a407278461a9844369c56eee67d86c1a387277aaa0bbc0bc3114a7dce6b885ea6c9a624139a724e15308", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510124, "uuid": "f26a319b-453a-41c5-87df-d31249b9ffa1", "value": "T1372612BDBB183C16FFB1C273964C81C4503A527D09074827796AA9A6DFB2DA00E75FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510124, "uuid": "084b29b3-a514-4125-98b7-048c9c9272da", "value": "384:xFQSyvQDrd6F4KzqEcWxdL3tAtkmAtKebCrqaZzC7NiG3d7S256B/zHV/hGJqaq/:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510124, "uuid": "339628c3-f22f-4889-9299-36fa82c181a4", "value": 4703630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510124, "uuid": "6c3ace3f-a66d-4788-a370-167b49e76aec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510124, "uuid": "504a22aa-21f8-4373-a7d0-364f65a004b1", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610f8214-e00d-11f0-a129-42010a9c0007", "comment": "Malware payload (RONINGLOADER)", "timestamp": 1766500851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500851, "uuid": "282828c9-01cc-48a7-b318-b18c74683de4", "comment": "Malware payload (RONINGLOADER)", "value": "2ed6cdd9fc98fb1158a20e6c979ac3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500851, "uuid": "8b5a3a61-bf03-4d52-abfc-e501488dc9e4", "comment": "Malware payload (RONINGLOADER)", "value": "3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500851, "uuid": "4a547f02-daad-4cf7-b1c0-1eb6a95ac607", "comment": "Malware payload (RONINGLOADER)", "value": "6e1e9c7116c42b44416bad21836221e838460e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500851, "uuid": "93943dff-ba35-41e1-b407-c1844b3996ee", "comment": "Malware payload (RONINGLOADER)", "value": "3fa5cff797547ab163fb83c5a07ad0347e11e898c6579efa34041759e2a85461df4755b42d5c8cb605375e988f0d0768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500851, "uuid": "31a4a69c-ee80-449f-91f8-46088492670c", "value": "T15F18334C16A92D4FE5127E30FDD4BF160B845CA56AFDE543870CF9B2B181AC4B6C682E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500851, "uuid": "10509c0d-4bfe-48dc-9efc-b618cb46a040", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500851, "uuid": "5fcb435f-5c71-4ebd-9a48-b6511aea41a3", "value": "1572864:9rJSBE6eSbIwck3oo9SU6KurqlzB4mAhL03iWnJwcHreXw/oUZ2V:9rJonCk3tSWumicznJw0eXw/oUEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766500851, "uuid": "1774e615-3f43-4c36-aa00-dd61534d5894", "value": 85332635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766500851, "uuid": "18686b3a-70f5-4239-9a94-c25bf65f18f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500851, "uuid": "6c74e937-c47c-47ad-b4aa-ac49e8dbbd25", "value": "Snoiekshiezioty_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee7674e-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478997, "uuid": "7e3cc854-0570-40b5-963e-3b6a2d8a1305", "comment": "Malware payload", "value": "1e848cfb42e55774269aaa953d255039", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478997, "uuid": "bfea3dfd-3c72-452c-b449-e75c29bfd375", "comment": "Malware payload", "value": "3251da6079da1333d4234ecc9958df183945c5ae348da750acba9c04e5f04441", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478997, "uuid": "ad51caa8-6a24-4ed7-ba17-d881dc00a901", "comment": "Malware payload", "value": "8be093b2809efd02f46e82ed7a2d549391f049db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478997, "uuid": "5dcb56eb-305c-4d70-ac8c-0ac4ee98976c", "comment": "Malware payload", "value": "113d7c96ab4b1709cf07e627eca7a236d6d99c313c65e2ccf054c37e9d680de150306bd10dc0b53e451f236fcecb6ef4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478997, "uuid": "374b310f-4bf8-4708-a629-7cef2ab4306a", "value": "T16B632B4BAF941AB8664EB445C7163DABB096EBBF9BED612C08397F35C13C3002255D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478997, "uuid": "54236c8f-dd1f-406f-85a0-5eb46deca0e7", "value": "768:I8w/h62/jWs6oS+xISN0vFGudNHdkfScBYrwz2y8kTAlGB:I9l/AoSSMnRusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478997, "uuid": "1a53f688-47a7-45ab-98a2-3aab7f9e2177", "value": 72506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478997, "uuid": "caeeb8e7-f76e-4e6e-9a21-8ec615aea894", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478997, "uuid": "4e5c01ce-b734-41c9-9d34-b370e1fb24ba", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc81b462-dfd6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766477382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477382, "uuid": "cec23693-46b3-4d90-ae81-4518ad3f5db1", "comment": "Malware payload", "value": "feab2d71a831d7f5b2e8026789c37ef2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477382, "uuid": "3930f060-4814-4030-807b-6d28344523ed", "comment": "Malware payload", "value": "33a93654ccb312c1705cd46702fee1ed3664964b1a1ae9da0fb18c9ef1066095", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477382, "uuid": "0fe8a537-64ba-4b96-9dcf-0050048c2679", "comment": "Malware payload", "value": "e7507ea65293b0f2923fc78d4f62b2fcdffc8147", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477382, "uuid": "f1e0e9bb-f4db-4cea-beb5-621762e61dfa", "comment": "Malware payload", "value": "de68e639c1f8496ba7d9156a7b983ebe83df937feec7d5e3a44369781bd3c71b431f673fd3236515f07515676f434e99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477382, "uuid": "94810f6e-851c-44b7-b8e6-280939b4c395", "value": "T198342B22316EC475F68F53F01815AFA3D6F849644FB281CBB3C4AD3A99216C75931E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477382, "uuid": "ffa19f84-0bdc-4655-a2dd-1ae73c778317", "value": "263b9fc008b31d881ecd175998ec5ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477382, "uuid": "7d1bd49f-81e7-48c0-a1b9-74070ce70f15", "value": "6144:LQIVtwzZbdnu3YpCQzw4USnhqsTAbUWgdP:LQTZZnu3uL84UshqsTAbbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766477382, "uuid": "977e6ac6-f7c5-453f-9d77-c3877803308d", "value": 247312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766477382, "uuid": "4e61995b-9a08-45f8-bf3d-f3a93b7ca68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477382, "uuid": "94b84321-5327-4783-a224-de277f824a53", "value": "33a93654ccb312c1705cd46702fee1ed3664964b1a1ae9da0fb18c9ef1066095.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4055c625-dfec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766486623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486623, "uuid": "ae4e29ee-a4f5-4aa8-9929-115aab83ba8f", "comment": "Malware payload", "value": "b8799d4e2f22391b5bb278def33677f1", "object_relation": "md5", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486623, "uuid": "749f8f6e-d030-456e-8167-f2affa6b90ec", "comment": "Malware payload", "value": "33c33430486523ffe61f945dbf2af0c94525d1cfc84c5b73d32a990512427965", "object_relation": "sha256", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486623, "uuid": "8ab3c1f7-8646-40c1-9558-17c0feeb1cd5", "comment": "Malware payload", "value": "a6c987b6af285793cd33991b4caef84ca9fbf884", "object_relation": "sha1", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486623, "uuid": "fcb34c7e-01cc-417f-932e-6368e936fee0", "comment": "Malware payload", "value": "eebdb15345126cdb8b5b6b4f4624f167b1b713fcff275796d430f48943a0db1c07fcc1dcf87143076b9b51dc4d8e26d7", "object_relation": "sha3-384", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486623, "uuid": "f8989447-876f-4c82-bd4a-e2e789efcbd7", "value": "T1678302DF699F5540D74FE2B7062B8AC4F89DDD883CB406A090B4317244ADB93069BF79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486623, "uuid": "820122bf-01a4-44ee-a5ad-3718b67f18e4", "value": "1536:jAT5u391SUd6myqABe/S9erfFfjBUHIoNjbcM8SzuipfhSIW0B/YtUlwmUka/h:jkg3jUVoLJBw/0MPrVxH6U3Uzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766486623, "uuid": "7a4e9e7c-a80b-465e-adc3-9db0477bbd6e", "value": 88705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766486623, "uuid": "bcabbafb-e027-46a7-a783-6080e7701e72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486623, "uuid": "7fc06171-03ab-4c7a-a8d3-1323ecadae23", "value": "d63296140a24ea73f92f018a744f0a472af371e43beed96be513dc90414a68e9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594a76a4-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488383, "uuid": "eeb7df52-035a-4d96-a7cc-420feb3ae63f", "comment": "Malware payload", "value": "4b917db1f7ddc803821b573f1bc2a91c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488383, "uuid": "eb62b40a-332c-4b7a-b922-983a89035f7b", "comment": "Malware payload", "value": "33d0c63777882c9ec514be062612a56fdb1f291fcb6676c49480d3cd4501c508", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488383, "uuid": "b5cc9d51-4ff0-4e73-8b4a-88ec34c80daa", "comment": "Malware payload", "value": "b60d10aa993afd8001b476f2f92588839f387eab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488383, "uuid": "d1f51cb0-1b40-4b2c-8485-dc4834fb0d5c", "comment": "Malware payload", "value": "5ff429adfb5eae4a3c1dee2897b2ef5c9f7f69db363fe2a2e28e843f37753e3f0d75521f2078cd091bba433f83126801", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488383, "uuid": "01b9f492-4496-4c19-b17e-756c87b2142b", "value": "T122837C217490C077C45E29364415C7319BBDB9226FF585C3BF9B0B7E6F622C0AB7A24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488383, "uuid": "c87b9e77-47bb-4549-9194-b58762f0642c", "value": "c0ba52fdb29c8bc53702ddc47f47d653", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488383, "uuid": "6ef762f8-0ac8-422b-b8dc-da8ed476a8cd", "value": "1536:4roo+V9/ViKkEMZSWyjlmxujAHno+O9t5ax:4roo+V9/yNImu8o+O9t5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488383, "uuid": "d9cd74fa-1c15-402b-9da8-3e03d06051e1", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488383, "uuid": "a4c4271e-5808-45e8-87ec-e0c90c18b231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488383, "uuid": "302da48d-8acd-43c9-aaa9-c4d4e0193b19", "value": "VideoUploader.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3736b2c0-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478877, "uuid": "57e164d6-fb96-4854-96d8-ac42a066af9f", "comment": "Malware payload", "value": "084b0e95e158ada1ec52d5906961cce2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478877, "uuid": "a1ce653d-e2a9-43a0-8e24-977ddc6e9072", "comment": "Malware payload", "value": "34d83942aeeeffde3a42f75f744b8f9e6eaccdee20c2ca3d2bcc2bb52d6054ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478877, "uuid": "5b004653-eabd-4f12-b73b-51752e8ab382", "comment": "Malware payload", "value": "0bc73b759ce31c80b6842d13e66777373e3371f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478877, "uuid": "52ac09a8-66e8-468b-ac56-64ede9787bfb", "comment": "Malware payload", "value": "73ba0c69a2a27484d79a9f55b10a37ef99ad613cf1a8e1e9d84a0523820e3a38ce37987f4965414dbcf4e2b843313d98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478877, "uuid": "99294560-7404-4df6-958b-83f552212096", "value": "T10B63F917CC6276EDD1EE799A188D35A429242F56AF8346BCBC023B5397CB8780C37647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478877, "uuid": "a5345ab0-83e0-4c43-b823-9d6e78366a85", "value": "1536:I9l/AoSSMHRERVR7RARNRcRhRNRpRsRKRmRBRQR6RdRkR2RNRURxRlRxR2R9RgRn:I9l/5MHiLpy7y/b32Ukf6obKcnO7bHMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478877, "uuid": "cfe937ed-a712-4c84-8973-9cfa4f096266", "value": 70533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478877, "uuid": "8d4d9de1-9184-4fda-9272-249a542fedf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478877, "uuid": "a832611e-7933-49bd-aac0-0b9ee46a7b1d", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9877a13-e027-11f0-a129-42010a9c0007", "comment": "Malware payload (CHStealer)", "timestamp": 1766512274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512274, "uuid": "6374e7cf-1f1b-415e-9aa6-4f09a1976488", "comment": "Malware payload (CHStealer)", "value": "34c06007bf947d14459c8125f16b8e38", "object_relation": "md5", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512274, "uuid": "0100b014-8f21-4ef4-823e-0b189eeb278b", "comment": "Malware payload (CHStealer)", "value": "34f6256062763b0aecd58bf6de0e1bd8d97253f8bd97454191cabac0f8ecaf85", "object_relation": "sha256", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512274, "uuid": "5f819d36-b2be-4b51-88a1-f6e8b4210987", "comment": "Malware payload (CHStealer)", "value": "624bb6eb68b5930e5544e44ce0d479afa76df4ee", "object_relation": "sha1", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512274, "uuid": "cea02d11-ccb6-4a7c-ad92-0b40a2c8e01f", "comment": "Malware payload (CHStealer)", "value": "42c30a0267ce4a545b6c829a05e2e50a3863038ed6d9225626e87ff48fdf6d7613bf4c752d00fa8eda9b57ba20c11740", "object_relation": "sha3-384", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512274, "uuid": "7dea9695-6cbc-40c8-8f46-687d90ffc628", "value": "T19526015769A30F94D89D017A81CB0B86336EAF4A9256875F53A5F26F3FF37F08868401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512274, "uuid": "ea0bb30e-01c9-4507-b9d0-31342b7a54c0", "value": "49152:oYyNvZ2xwuTW7PgMOpHyIPwcBrNS0wFMTT2iH5cnYYxtOuc1cKB3FvZjUg:oJkxwOW7PgMyNlBkaBHCnJrO4KB3ZZIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766512274, "uuid": "48eef0ed-4094-49d6-9da6-92288fcbb495", "value": 4454367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766512274, "uuid": "885d47df-52a9-485d-8938-cd860a90df4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512274, "uuid": "088b9617-aaf1-4d28-94e7-1a1067f9bdb7", "value": "The Simpsons S37E12 1080p WEB h264-EDITH.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f01adda-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530912, "uuid": "4833641b-5860-46b5-98ae-f2d60549f5f4", "comment": "Malware payload (Mirai)", "value": "7b33dee4d3d450b12d6f72a4a970f650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530912, "uuid": "76b6e8fc-ea63-4712-a9ba-cf0ee78ae86d", "comment": "Malware payload (Mirai)", "value": "35c181d51232f3146c695e6ba5bfa8a9f701702780c70da01e87fabac1d28950", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530912, "uuid": "940d4391-e962-4c40-8aa9-0b2f5941550d", "comment": "Malware payload (Mirai)", "value": "357478fa0465b609b23dd9e63d61764fea1b7c35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530912, "uuid": "71ad239f-5d94-44e3-aa77-537ce9b4a638", "comment": "Malware payload (Mirai)", "value": "31dec965f3b731b2628abcf5fc7ea49d58f3f739235efd2e4afb443c7e90c80c5cc9cf49c4e0448cdce5f8a1f70837d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530912, "uuid": "1d0a976d-595e-4c25-919d-0bc57cf86c0a", "value": "T19A332942B22C094BF9E65AB0353F0FE093BFF94024E4B585695EEA458236F331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530912, "uuid": "96b857d7-7008-43b7-be85-d3f5ffe85f4d", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1RRNRR7Eg3tbv6VFssuWXwdyWB:k6HAt1ezbnAXZUBv33tbC/3XwbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530912, "uuid": "e2813c8d-be41-44ba-b03d-09f908f00072", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530912, "uuid": "1959778f-3b7f-43a3-bb16-eb72f37e9ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530912, "uuid": "4b776340-4e21-47b1-81e4-b69f5061c7d8", "value": "Josho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62dee7f-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525126, "uuid": "20d01fb2-bf46-44f6-a8e8-16d2dc0eae91", "comment": "Malware payload (Mirai)", "value": "6375399594b61eb51bf9e16337c7c135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525126, "uuid": "1e9f4ce6-3bc6-4c38-817d-3150b7a7b437", "comment": "Malware payload (Mirai)", "value": "3638de129f4c1db24c0a93f6d75d1966f1466ea0f9a7339d403b102602ce9c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525126, "uuid": "903d1272-6416-427b-8596-16f8b6a674ff", "comment": "Malware payload (Mirai)", "value": "6f1e500f3329f0b1ca72813462e5c7b14f36d12f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525126, "uuid": "2bd87b52-ab9b-418d-992c-9d617eb8f3a6", "comment": "Malware payload (Mirai)", "value": "dbfe3e5f95166c4b607b96924e3c4a1fb94a8fc315520d0e567926f1062a47410a8279741ed2ecf5beb809758e278327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525126, "uuid": "5773805f-5c5d-4239-9cb7-b93bf7f02677", "value": "T1A9B3AE8BBB471891C86547F507DB4BDD3A5332118F27E8F7AC0E393A99391DA090A3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525126, "uuid": "5b06f053-08ee-41c4-b1b1-8f610d5b7cbd", "value": "1536:u/e3pRbE4iTIzJWtFxEMUDsYw/Rcsh0FxWXQGpg6GwbZnX/LW:ee3pRbBrzJkXEDDLqrh4GgfwbZnXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525126, "uuid": "68b77386-d775-481a-ba32-3062243789a7", "value": 116100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525126, "uuid": "e3866b4e-9939-41d0-b505-ca520144787b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525126, "uuid": "12c5d3ad-3911-4c61-9b29-c3d9b8895ad9", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f87e0f0-e04c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766527773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527773, "uuid": "903f7e5d-7558-4c47-b001-1b285d71dd5f", "comment": "Malware payload", "value": "11fe53d5738a1010adc780dfa01f02cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527773, "uuid": "6934fc32-25c0-46b8-a0a4-0172a5b8178b", "comment": "Malware payload", "value": "3649cb41a53aed9e4cee3e8027f5eea122a304fb3ebb1d5994b4e5f478e3e5e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527773, "uuid": "075a8a21-5d65-4606-92a4-fa8e5aac6123", "comment": "Malware payload", "value": "8ef2f3ba8a0d63d1f40194eb5eb45a9584d9bc5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527773, "uuid": "6f37604f-0911-45b3-a5b9-7449fbd80c6c", "comment": "Malware payload", "value": "9a8d122ff9b1d9b33644f7c3300af0a77d4df366818dd4819fdac118d8a14295ff94882d6dbea22d5de614986f8fd1ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766527773, "uuid": "dac232c9-22b0-4733-8f86-47e0629dbe77", "value": "T184C022D3006E00813F08D9EC304D31D4A00D818114C281CCE09D14E7A0561B2E42F4A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766527773, "uuid": "fa2187a9-fdff-482e-87c9-13ef68262145", "value": "6:cLMfEgJAdR+DEBsKPvAMfEgJAdR+DXgDe0L0zn:cLMfEgJ0IDEB7vAMfEgJ0IDb04z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766527773, "uuid": "0eaff744-5c85-48c7-84d0-9493f7352400", "value": 193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766527773, "uuid": "08a78a09-1a38-4b4c-bba5-6a9bfe48c57e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766527773, "uuid": "829e093f-06ff-4b4d-b4aa-0df47c6be102", "value": "node.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e37557-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457806, "uuid": "1b4a6e07-28c9-4afd-99d3-adaba5d4cadc", "comment": "Malware payload (Mirai)", "value": "d48c1d5f11905783d9fdea688151c776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457806, "uuid": "05eaafed-ca2f-43a2-95a7-a0c15eca1c78", "comment": "Malware payload (Mirai)", "value": "37490b35b3b2ad15b38e07c6d2614e277d2a43c76355f140c7c7ef6d7cf0f5ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457806, "uuid": "44cc0ce6-9802-475d-be48-9ed53cdeeba4", "comment": "Malware payload (Mirai)", "value": "69cd96af543abe8def8b1f26216357c8b3385750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457806, "uuid": "c5e61f1a-04bb-401e-92df-4d166242b77c", "comment": "Malware payload (Mirai)", "value": "404b5be559c13bb3b3e931c0a806b8da6007b0f14f52bc9b109b46a3a7a11a88333b72d5e9aaf44870c7640b3b6f99dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457806, "uuid": "2126a86e-af95-4fb9-a3c6-b9bf9346adec", "value": "T103F2F1A0B3A76D51C6B0E439C52C0CEBE5C3E369F4E9313A2C642268B4D51467DB279A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457806, "uuid": "f4be64f5-9b7e-4033-93f2-03f9e3de45cf", "value": "768:xln3vJ/H8WwyYZl/jfWP0OQePSVtvgVwPghLqkG8k433D/ps3Uoz2A:xJvJP8WwySBjfWP0OLiBgVwPgdDx3D/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457806, "uuid": "af1871f5-a621-4e5a-8326-767253bd6919", "value": 35332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457806, "uuid": "0657ba34-d7f5-4587-87be-2da5c4be359b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457806, "uuid": "31420d28-01a9-487c-a026-2171a930837a", "value": "ntarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4295774-dfe7-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766484777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484777, "uuid": "569161c5-5322-471a-a4f9-f0b07e6b2b26", "comment": "Malware payload (CoinMiner)", "value": "16fe30dadaf9be2a6e33730ae7d7587b", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484777, "uuid": "fa09c5e2-fc00-4a58-bef8-8a5df2f43059", "comment": "Malware payload (CoinMiner)", "value": "37f8a54ffb5377feb9b65b66e2da08ab3fb237321f2ae544cf597022d475a0db", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484777, "uuid": "0ffd43f7-501b-4463-844d-32e3e4b6d088", "comment": "Malware payload (CoinMiner)", "value": "98c08a4b44525c851d5e727e13b11431ce9219fa", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484777, "uuid": "2896ba2f-7fd0-43a2-b239-cca874a95ba4", "comment": "Malware payload (CoinMiner)", "value": "cfedb97e8eb40ac8fca42168c7166895dbf721e0650ba5a3682d7287748b4ab3e8fa48d5196d5cc912feed6736155b54", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484777, "uuid": "1f26c0b9-752e-4282-a94b-311f61db7734", "value": "T164E423E8B7856D8BE5BBFB7056E123ECD33B96A8C336C01D165802756B8665C4030EB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484777, "uuid": "86a3711b-aa4a-4f69-b08d-fe439288aa9f", "value": "12288:VeKkUPYz+33eOAJYr2M93Cfwg54NEcQXx9l0JAtkID3EO6OXIKl:aUcOOwELbh9l0JATEO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484777, "uuid": "b3d88de9-3381-4dba-8929-ddbdc67188c7", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484777, "uuid": "2f9cd49d-494c-4bc3-b207-4416e9b1e59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484777, "uuid": "089e7e9c-c3cc-4398-84c7-d977213c2704", "value": "37f8a54ffb5377feb9b65b66e2da08ab3fb237321f2ae544cf597022d475a0db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cd4601-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524339, "uuid": "5c1de7bb-4b1a-4266-8398-964bb39e3b77", "comment": "Malware payload (Mirai)", "value": "9e2fd854b9d00bd7171203e6cef6f524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524339, "uuid": "9a30a267-ca37-47f6-8d69-895ce4ec4da6", "comment": "Malware payload (Mirai)", "value": "3815bc78860766b4696553d20c8ac98f6690b6593ea56ee247f50e6992280846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524339, "uuid": "06ea6d39-11ca-4b90-914c-ee9624e5484c", "comment": "Malware payload (Mirai)", "value": "11b6e217075107cdf7d38c7e5e9abac42a161bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524339, "uuid": "20358380-04dc-4185-8657-19e6b4127348", "comment": "Malware payload (Mirai)", "value": "5e6af3314b6d32ea326d361d937b1d6a3a809d821cd6f5370126a77b2f9022503383eeb2c81d23ae637b527d2d0c1d39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524339, "uuid": "4074312d-8b62-4c5c-b45d-e0154b828820", "value": "T12504E5916C826A2AC6E023BAF97E51CE332077E9D1CFB167CC614B1076C595F0C63B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524339, "uuid": "cb8a69fb-87ac-41c9-a9cf-c7957b83c6a2", "value": "3072:hDyQ+IhoQV+tNElKA8OUEHO4xNXixqn0hbHMw7Kp7:hDyQ+IhoQVqNEBxixQ0hDMN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524339, "uuid": "93734656-7cf4-4497-848c-7326e43be632", "value": 186452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524339, "uuid": "668c0a99-3507-4565-89c1-90eb465e1e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524339, "uuid": "6700aea7-9465-42ab-9dd0-07c47d6166b5", "value": "pandora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340c079d-e019-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1766505930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505930, "uuid": "0c0dc62f-742f-4682-be0b-adf6ae58a4f6", "comment": "Malware payload (ACRStealer)", "value": "e99a23bb0493d7736ec74c59843a8090", "object_relation": "md5", "Tag": [ { "name": "188-137-251-128", "colour": "#769320", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505930, "uuid": "5d8c9418-4021-4541-af18-e27b2fb8bc50", "comment": "Malware payload (ACRStealer)", "value": "3897f810bae6f5201722f2ffc3da7a3c8c5bdf17a8f44f2c4063b2cea277068f", "object_relation": "sha256", "Tag": [ { "name": "188-137-251-128", "colour": "#769320", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505930, "uuid": "6129d86a-9014-42f6-b202-2878a7193bc2", "comment": "Malware payload (ACRStealer)", "value": "e6ad8e38a95ff01a1f6e025b7ce4f12f792daea5", "object_relation": "sha1", "Tag": [ { "name": "188-137-251-128", "colour": "#769320", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505930, "uuid": "ad45c3ca-8bb0-4579-a609-2491a073aad0", "comment": "Malware payload (ACRStealer)", "value": "84b7580524b568cf44e75c190b3c9902dc1454383c5b34259fd55e4464b733012d72bd48fcc7e637c455684276b989cc", "object_relation": "sha3-384", "Tag": [ { "name": "188-137-251-128", "colour": "#769320", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505930, "uuid": "9fa7f2e0-cd83-412d-8c76-2e453c22fbe1", "value": "T112861622EFD7FE62D76665330467B559CFE3DD02824070AB3C19320A5A71E8C1EA7276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505930, "uuid": "1e89adcc-54e4-406d-aee1-0c480fdd4cfd", "value": "e081b8ce9803d5164dbd3d1763efe7af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505930, "uuid": "2b079aeb-215a-477b-8155-9cdf757e2cd2", "value": "49152:GwBq4Jwhkjj03UMTNRJkkjCbtK7Mtk9t9Pb:XBqkwhkv0bOZVkvFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766505930, "uuid": "b1d76235-3a6a-4d49-ab8e-0366e03f7b16", "value": 7984768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766505930, "uuid": "f9b0d3d7-d930-428d-b1ff-5c7ea5d89bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505930, "uuid": "159a6479-4a1b-4f2c-a607-4f52418cfbfa", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afafb725-e016-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1766504848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504848, "uuid": "a93517f6-b227-4110-8a6c-60094fc65880", "comment": "Malware payload (Socks5Systemz)", "value": "fda5965d98c979cd6f75c27fb48361c0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504848, "uuid": "15a0923b-542b-468d-914f-aedb5abab220", "comment": "Malware payload (Socks5Systemz)", "value": "39e01b4b89265bd6cdbd867c23a542099d80e9577e21e87778aa7f2737780c0b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504848, "uuid": "c62d427b-3e49-4608-a232-f9eabade9cda", "comment": "Malware payload (Socks5Systemz)", "value": "060b061c3c35ca48c9fa3ff9dc9dd3a3cd25d577", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504848, "uuid": "30d25b1d-d0f9-47cf-81a9-36e2a2e15ff6", "comment": "Malware payload (Socks5Systemz)", "value": "3e2f01a72e0100173640a735ab174b4f5c3ef678e9c39f01175cface0cceaa2b37f4673a408bb95e8f6aebfb359989c2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504848, "uuid": "10c599fb-c872-4371-89c2-766f17e00f84", "value": "T1C7F533138362E376D4A2CDB4197BD208D133B85F1969EA8872BD86FEBF176135906303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504848, "uuid": "b88ee225-e402-4e9c-a07c-9e307d800f02", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504848, "uuid": "f3cb9788-155a-42b6-a3a9-9766367876b3", "value": "98304:MRA/Ia6C3UTQKfLLEjkQ32X30M6I0C1rAn2Kc:KFpCqLS32n/30CAnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766504848, "uuid": "9a9b14f1-c04e-4f03-b857-6314be8b0839", "value": 3492771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766504848, "uuid": "775cd146-5ec2-4c12-a5e7-ed5a771de003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504848, "uuid": "d708a3d9-84c3-4340-a683-b69f08f6b2dc", "value": "WOzciHx70Jhpn0Ul.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d6c41b-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478712, "uuid": "06c63b74-ad6b-4a69-a69c-b29050a3f6c1", "comment": "Malware payload", "value": "ca3f702a253d2f7a986044695a54a916", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478712, "uuid": "80953b4d-0352-45e6-b4b2-dda599859133", "comment": "Malware payload", "value": "3a1108af4bfe7864add18f34e0658f2da34930fbef90e34f176fd938065bf2bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478712, "uuid": "c068cc07-09bb-456a-8f25-1eac94ad7a72", "comment": "Malware payload", "value": "70c9c68849e4809c3cd1a992b264c69c4fca0d79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478712, "uuid": "9cdaaab1-3927-47e6-9b3b-6d887f6a699d", "comment": "Malware payload", "value": "4b2d51ed2a9584d5bd09f532f1033d0dc9020831fde9baf32a2272ea4fa433075447433e20b9057fde140ea8b53e9250", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478712, "uuid": "20ca51c3-9fc6-4f09-8160-451b1c5d5ee2", "value": "T1BC632B59FF37F1C23E42729A3BC8A30D9639586E170B457A0630A6D18E079F0B661DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478712, "uuid": "c2decec7-f22e-44b5-9a41-064ab15e6426", "value": "768:I8w/h62/jWs6oS+xISN0v0p03vD3SdkfScBYrwz2y8kTAlGB:I9l/AoSSM4UCusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478712, "uuid": "ac8f6f7d-5120-4110-8bb0-6ad9132257b8", "value": 72435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478712, "uuid": "a60011e3-de06-4c51-bcf3-57b23a661462", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478712, "uuid": "a9466b66-f687-4f55-adee-48b4072d1b5e", "value": "invoice-1645080830.pdf (90).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7314fd-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524328, "uuid": "0c622a3e-1351-48c1-95a3-94c2d7ffd95f", "comment": "Malware payload (Mirai)", "value": "374c775e1c36a30b3f2e6bd00c12e0c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524328, "uuid": "b3fa668d-3f93-4d28-a349-10798235c39e", "comment": "Malware payload (Mirai)", "value": "3ab75381fbe424d381071547c3faf24b130e98c25e9418a493f6e1819fd5b89c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524328, "uuid": "f7783e7c-b640-4f2b-9d55-c76484c31a79", "comment": "Malware payload (Mirai)", "value": "31d0fe6588cea7e5d808c339acb9ce49e59150f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524328, "uuid": "bf1812b4-e9b8-4bc1-95ba-0c38c6d5def2", "comment": "Malware payload (Mirai)", "value": "323e32d5e7cb55911b1373d8db6669c022ceafaf1f46148ef98aa9670541cd56930f9a2322216b1901f600f0a6fef0b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524328, "uuid": "29873c13-4aa8-48cd-84cf-abf573a49886", "value": "T169041B0335244F1BD9D212B4142E57E883BEE9E438F57689595F8B730B34F2A588AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524328, "uuid": "edb57cf1-0d92-4835-b8de-8df2e8011957", "value": "3072:m/AztG+oWgOKNIM9Rxh05T4x7kuQbEIX4d:KwtG+vSxOaVaEa4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524328, "uuid": "14f6669a-ba3f-4c16-b2c5-fb9f40b65ddc", "value": 173148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524328, "uuid": "8be41690-aea7-49de-a8ca-50c0f2226082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524328, "uuid": "a346356e-857d-4527-8acd-3bbd09f7c55b", "value": "pandora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb342d47-e036-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766518612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518612, "uuid": "def14589-7509-409e-b4f5-54f1c4c240a0", "comment": "Malware payload", "value": "c415344da156818b5fbc5e531a1bf80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518612, "uuid": "071f0746-48a9-40c2-85a9-d8f9cdcbcc03", "comment": "Malware payload", "value": "3b2107d95c3261840a86ae3b07666326289e631cb04246a300699469766c3918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518612, "uuid": "e982c215-cb30-454a-a98c-58c9fcc07a1d", "comment": "Malware payload", "value": "12eb55f2bdba06c4a488192aec6487346545e87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518612, "uuid": "369dc5a6-581e-4d88-82f5-afb4d87fbdfb", "comment": "Malware payload", "value": "0a6b1ef9068aa40d8890bba4b4657d2a3e40d3d253d14be35bbc1079e124df1699e656e3b840c97104d732864a33b6bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518612, "uuid": "5964f376-68b0-49d9-92d5-dcc176ab9f48", "value": "T1814733DBCB22A1A7D41047B1E36423AE279ED9180654F98183D4CB6EFE5534BCCB9F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518612, "uuid": "9eeb3eb6-d7dd-4c48-bd0f-f6260218f85d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518612, "uuid": "48eb964f-50cb-40f8-91bd-88c9615b80da", "value": "786432:Dgg3U9h7VB6xd7V6dNaTL2qELZba5mfUs7D:Dgych7LS7VoUL2llaSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766518612, "uuid": "bfb52e5e-c3a4-4864-a018-7eda10f33c96", "value": 25310053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766518612, "uuid": "d8863886-eade-4ea2-934d-eaebd5ecfb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518612, "uuid": "648bb4cc-0625-44bc-96df-fccd7e6b69d3", "value": "KMSpico 2024 18.6.10 Final [Windows And Office Activator].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e3901b-e017-11f0-a129-42010a9c0007", "comment": "Malware payload (GootLoader)", "timestamp": 1766505211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505211, "uuid": "f61df931-0949-483f-a7e8-4d7b373832d1", "comment": "Malware payload (GootLoader)", "value": "55958864c79f11216516beaa9da0a653", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505211, "uuid": "d87f615f-8500-4f77-8d0f-977f2c8f623e", "comment": "Malware payload (GootLoader)", "value": "3d39b187816419d657ab62b104626596cc53f15427f4dd3f582bc4e8083462d3", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505211, "uuid": "8264abe6-616b-4e3a-8ddd-3bc6ec96f9d5", "comment": "Malware payload (GootLoader)", "value": "681fa26f26a0190bab49a2e86dd94377dce53184", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505211, "uuid": "c20c54ab-d356-4f14-8d6e-b9746af272f9", "comment": "Malware payload (GootLoader)", "value": "c566937f81de3490cdfbd0559a0f176343d42a60f662d868e22c409aa17082a2f1a3183fdecf88bee179c2fd46c364f8", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505211, "uuid": "0639cddf-da97-459d-ab9b-dc28738eacb1", "value": "T1B71812F3DC69D828EA70296422582D79D0349839AD43DF1F356578CFA3ECC482346B2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505211, "uuid": "bbba6ff9-4f53-4b15-ab50-55b280b7e2db", "value": "98304:PUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766505211, "uuid": "e8c88626-43f3-4846-a603-eb72094f8b55", "value": 85189525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766505211, "uuid": "8998c4d6-2818-40d3-a161-4572265d43f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505211, "uuid": "4fd39074-c8fe-45e3-bc7e-50f248720c26", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e55f91-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478794, "uuid": "729f5c29-da73-492a-8bb7-c95674f46c68", "comment": "Malware payload", "value": "87ad4a2d760fa074e73ac355523b26eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478794, "uuid": "e49cda28-c001-48ee-96b2-855879c3bb10", "comment": "Malware payload", "value": "3d80715b62b6039794c4cde588283928d950e60a2c5fbfab7718b3055dac7957", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478794, "uuid": "86ce755a-c45e-4fc2-b3f3-e1b5d332d801", "comment": "Malware payload", "value": "ff391fc3997e0c69acb7d91b3e6e5f31fa4b70ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478794, "uuid": "d113ce7a-586d-4892-a619-a4eed537b0ba", "comment": "Malware payload", "value": "c9683d56521c0c4e7549a31de56c5b17c9c27a1303178e9c0a7e1bb47bbe639c697d88eacfcbda700c4efe3b876dcbd7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478794, "uuid": "70fa1672-2e9b-42ff-9f96-f478897dd62e", "value": "T19C632C1955E1045A0F0C1E7094886D37CC6FC2309F16F5DEEE314993FB9B99ABA9B087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478794, "uuid": "b2087e2a-7e1b-46a5-86d0-d6dcf3d47f15", "value": "1536:I9l/AoSSMBrtrRrdrSr3rIrdrTryrHrbr/rgrMrirMrRr3rorQrIr3r0rrrDrqrN:I9l/5Mk9usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478794, "uuid": "919e3bee-ef93-4bdd-b45a-32d8382f2252", "value": 72536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478794, "uuid": "56cc8042-3d3f-4cfb-9509-7f37e84cdbdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478794, "uuid": "a83d5b39-4231-4433-984c-7760759b39de", "value": "invoice-1645080830.pdf (72).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8937aa1-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478718, "uuid": "a323e3ff-7614-4f88-8e38-aaec895cb73e", "comment": "Malware payload", "value": "da737efd5d5795b1ae9e0c326e14e65d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478718, "uuid": "4d75023d-14f6-4275-ba52-24debddc1c8c", "comment": "Malware payload", "value": "3daea5fb1a770fd72ad2d08c3103f8ddb1d69767cb7431eec023ed9d0683f09d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478718, "uuid": "7e89b803-0bbc-4edc-bd80-2cfcedffca56", "comment": "Malware payload", "value": "f7dc446b4ef131679d1f87363d73c504f07175e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478718, "uuid": "e06d3046-9de8-4eb4-b9c8-0aa0e59f8f99", "comment": "Malware payload", "value": "52be73c95d75534564aad3bfa25180540b763267a4adb958ad42d9be5f93588a74d7856793893ae4c9ccc4184ae44e2a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478718, "uuid": "f358e6a6-5857-4c1d-8a76-a5bbe244eadd", "value": "T1E763F9B1E627CFFCD5A52C98F085B159DC6A4908C4917893A9847BD3004BDC3EEBB5B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478718, "uuid": "56deb10d-033a-421b-8a7b-771f759d8a37", "value": "768:I8w/h62/jWs6oS+xISN0vm0yXN4dkfScBYrwz2y8kTAlGB:I9l/AoSSMCyusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478718, "uuid": "1c76f73d-67fe-40e4-8dd6-305a16700122", "value": 71596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478718, "uuid": "500e759b-1ce3-4f9a-94ae-6c5009a51cfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478718, "uuid": "d9039bb7-2af2-4fb8-a891-d37927221822", "value": "invoice-1645080830.pdf (86).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a419f2-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510232, "uuid": "07135074-91b7-4fd7-a374-6804d149b2f2", "comment": "Malware payload", "value": "459a8eb5c77c6a257e9349246b18c664", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510232, "uuid": "ee40c7d8-f167-4c87-a3f4-ea965e5dc64e", "comment": "Malware payload", "value": "3dcc673a854935ef98a19331d51622000a866396a430f81014795b9dca996a04", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510232, "uuid": "4bbd5d23-c731-4a2e-ac4a-87d3d14fab4b", "comment": "Malware payload", "value": "581edcc35bb6751719b9f2a497021800885c0204", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510232, "uuid": "c94dccd1-8f34-4c7e-bff7-02394d9f323c", "comment": "Malware payload", "value": "60e18029c30da3a5ac446e242e11b8e5df048a64b26035e48e6f1e6ca3a826b08502a91861fac39d321477436554053d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510232, "uuid": "900aa527-5931-4f6b-880b-d74a544f382a", "value": "T153D4239E8D30F88EDD8864722E4F025E8EE575ECF1A6231D0DE142DE4ED8D421B479AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510232, "uuid": "7b65bfa8-4ca6-411a-a7dc-653261871515", "value": "12288:k6WfUhPlwLBa9qsoxbM7LIfwuM3ut7aVndUXTPYIH4pmQ:k6WfUl6LBrN+nIflM+RKMgRoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510232, "uuid": "0ea4a3e2-046b-4887-af89-92709e5aca48", "value": 612387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510232, "uuid": "8df7819a-c6f2-42d4-bfa9-79dcd6400c70", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510232, "uuid": "430a5cf6-c080-49a0-be22-34d5f8273625", "value": "Copia de Copia de 3.3.90 Mar\u00eda Grande 19-12-2025.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd2732d-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524330, "uuid": "2aa26c40-68ac-4191-820b-c732ce476683", "comment": "Malware payload (Mirai)", "value": "cc8b52f1d55ba2c746b8212359f40608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524330, "uuid": "be0a66f4-6403-4cb0-8fcf-45314c556517", "comment": "Malware payload (Mirai)", "value": "3e2f27f3fd8013aed57eea30a2c807e2968cba1a3cf4bc39e8bb83a93d10fd5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524330, "uuid": "a56b3df3-bfcb-4d61-93ac-04ecc16b4ade", "comment": "Malware payload (Mirai)", "value": "0e5f06ad951e6cf5463c8ed9e77cf044f15e6d1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524330, "uuid": "dd98b43c-cfb1-425b-9f54-0b42e984a1bd", "comment": "Malware payload (Mirai)", "value": "9e11f7e80ae19dbefb66b7e150db8c18b2eecf31082c5bb3ea685a96262bfc967bf1d6ab20f982dfdbfabef6204e3ce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524330, "uuid": "0cad36d9-a437-4fa1-9066-fd36bb153881", "value": "T158F33AC5B163F8F0DD1506742137FB332E72B47A6239E99BD3E82A63AD85B41C4061B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524330, "uuid": "62265c86-d09e-497a-82bc-2b83a38f910f", "value": "3072:xZ0OWLLnSt2tGbn5y3nDkUGJMC6m9vs60bVmwGKHgaCMz4LqO1Hr3e4GnaB5ug/T:xqOW/n/tGb5y3nDkUGJv5BDesbgTCyKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524330, "uuid": "81440ba3-3069-4a1b-a594-270ad7b7473e", "value": 164848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524330, "uuid": "88e5bbac-dcaf-4318-bd71-deebd8b3672e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524330, "uuid": "299be7e3-bf08-4beb-915c-aa8b5dd11132", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786f88dc-dfec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766486717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486717, "uuid": "784c6539-9009-4a66-8eef-64c1f4e6084d", "comment": "Malware payload", "value": "e5bfb42b625271e33ea944dc82d1653d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486717, "uuid": "8fc4edc1-3ae4-47a0-822a-44b93c025c5a", "comment": "Malware payload", "value": "3e50302290bb9a94c6849b431aeb26ca5d3342a40fcafeb855e649e7c13ae58a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486717, "uuid": "35e5a1e8-4d81-4c93-b59b-3f0b9b503632", "comment": "Malware payload", "value": "655345157dcdfa45816b65e65b49d56e2bf2d906", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486717, "uuid": "9a2cb4ce-e6d3-4490-a029-f6218c6cd5e5", "comment": "Malware payload", "value": "3a673e41afecf43ed3bfc1d3e65dc5a9ef43089ac6763ae847aaa62295b2c1dc63e97a37ef6abf91790fff5d4cac0aba", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486717, "uuid": "e3a46b40-a2d4-4b74-b157-c56b1e2ebec8", "value": "T18A41D40117DE5754D1714F375CADD71987B2F842DA354B6E4388898D2914640FC35F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486717, "uuid": "ae14250b-5a53-4093-aeaa-af87f8dd00d3", "value": "24:82WJ9Ir2HdvOAxA+/AbF8qjaDJdkY4I085vZ4Odro0m:82eZHvmR8qjLIjx4Oa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766486717, "uuid": "4dc03d92-e659-4f0e-a769-23bed9a84268", "value": 1890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766486717, "uuid": "3c20cbf6-49dd-4a41-b7e9-0c753793607b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486717, "uuid": "d7061980-8af2-443d-9d19-73dafca210d0", "value": "3e50302290bb9a94c6849b431aeb26ca5d3342a40fcafeb855e649e7c13ae58a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbafb55-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478810, "uuid": "32e48861-9552-4c05-8250-43d19177367a", "comment": "Malware payload", "value": "af84c22337d08f60c8c4399af073bc51", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478810, "uuid": "1ae93b34-6104-475b-97fb-747090c73022", "comment": "Malware payload", "value": "3e6ecd482dac083e0645a08d89ce49a3eb44d30533982c7db18a32a1ba3259cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478810, "uuid": "798d7f6a-221a-4ab7-a48a-a90e36ef7efa", "comment": "Malware payload", "value": "b161d1cca0b1505b957d0fb2f548e4c8981f5998", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478810, "uuid": "a3bc32e5-1c5c-4a56-bbbb-5f85e6cd4111", "comment": "Malware payload", "value": "9379005a8b4c054c63ae424ae00b56a80564102be252fc19688229172b3c1e5e3223e0f9f1ae7f4e2c22489563df6d03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478810, "uuid": "7f87a99e-15fc-4697-80a8-9a8321de3fef", "value": "T10D63F839A95AB41E1EBF1132426F527D6C2AB40B5C1F548F05CA5B073B933C0AA99FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478810, "uuid": "c92704d3-b745-460b-a713-6cecb35ceebe", "value": "1536:I9l/AoSSMVopylHA323NqwKAh6VKXBAyvdym0UNy6jdsOn/Oe/SQsUeDYZUH3OPm:I9l/5MVopylHA323NqwKAh6VKXBAyvds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478810, "uuid": "3639e960-c402-4c4a-a170-f7aab397ed3a", "value": 71548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478810, "uuid": "18ddd5e4-14a9-4d61-9291-503cdaef9c06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478810, "uuid": "e20f149d-03f8-4f2c-b5d0-0ba9041029bc", "value": "invoice-1645080830.pdf (70).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f4f8ca-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522920, "uuid": "09b189a0-a178-4b33-915b-8d1785acc33b", "comment": "Malware payload (Mirai)", "value": "cbf3f1a0317cffe9bedc7eba11ddc40a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522920, "uuid": "e2ffc915-509b-41e3-bcd4-3d1f1c1a65cd", "comment": "Malware payload (Mirai)", "value": "3ea25323be39908d318807fbd1abbb84af06acd2ffb6317d8820937a971ced3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522920, "uuid": "85c8c246-f345-4b9f-b978-06eafc70059c", "comment": "Malware payload (Mirai)", "value": "b3786574876ce405f54042512a2d2c1df74e434c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522920, "uuid": "0045cc9e-a718-4004-9224-460563c1d377", "comment": "Malware payload (Mirai)", "value": "38945ee79e33346f66a614aa119c72a8b5e02bf7c75ccdda4fdae3e613f200618becad6fff909ccf39f159de74547495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522920, "uuid": "1ef1eefa-ba45-42a9-a389-05ff44d9a07e", "value": "T195B32A46E7808B13C4D5277AB6EF42453323AB5593DB73069918BFB43F8679E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522920, "uuid": "a4fd80d1-2148-4941-b419-dc73ebdc42fc", "value": "3072:CeXh+K2eWYdqZyFQ2vfFIM/9v23zhEbnYx1oT:C6h+K2eD8QBvfmM/9vXYHoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522920, "uuid": "1130d2fb-4e81-4955-a279-d3e14d80fadd", "value": 117124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522920, "uuid": "168aa1f4-1901-4cdc-840a-c06eb82364a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522920, "uuid": "e4066673-854d-4249-946a-a432443bd51c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d342d76-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524333, "uuid": "154a72c0-91ea-40ca-bc7a-fa35f6d0c227", "comment": "Malware payload (Mirai)", "value": "0bdcde7a89323397317691f854eb8ba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524333, "uuid": "19f0954c-ac5b-4178-b533-1332119dbf5f", "comment": "Malware payload (Mirai)", "value": "3f0aee23faa892a9ad12d888009c5ae83e8c6202b64cb3efddb37c9a8a8a6da0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524333, "uuid": "df293707-0544-4498-8b9d-69d225412f07", "comment": "Malware payload (Mirai)", "value": "4ba386092e8e81212cbb344c006c864006c7cb99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524333, "uuid": "5fe95cd6-2378-43c4-9c13-c65a5a9f3031", "comment": "Malware payload (Mirai)", "value": "d3a5cc272d12e5e7be84c281e1b49d182081ca011380c33642f88fdc0f9d0428cefb4a251de86397763c8a6aa3693e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524333, "uuid": "befee0bd-a658-42cb-8ebe-98385149f760", "value": "T1CA441881A9818E26C5D817BBF9BF018E3321A7A9D3CBB1178C145B7437C7A5F0D63A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524333, "uuid": "53b6abd5-7440-4594-9993-15006872dea1", "value": "6144:pMtDF16WglC1RbRcZQaC9mrsplDKZUfQBKXAVantX+F8JyvM1G6xxn4J+fBhrald:pMtDF16WgQUo9mrsplDKZ2QBKXAVantW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524333, "uuid": "bf6039d9-212b-442f-9e56-4a4396d6dc3d", "value": 269924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524333, "uuid": "0d5c3bd5-d542-48b8-9f73-6c894915b416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524333, "uuid": "7ed064b5-2c4f-4b72-8e42-dcec799cd97b", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe77b41-dfec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766486676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486676, "uuid": "8f47aa7d-136c-4b84-86e8-60925b028db6", "comment": "Malware payload", "value": "2e278a52c3a1eb83064f7d1e8f7714be", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486676, "uuid": "6a3e1a79-2a68-4cb9-ad53-83e9428dbfc1", "comment": "Malware payload", "value": "40667dce013f1fe4e91dd4aa50b72c5f2cd5e5c51bba1c6a5c95a528c8d5d74d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486676, "uuid": "8bc91799-1b2a-496c-afe6-64d5227f1267", "comment": "Malware payload", "value": "fdb813d0e075460de8b1627212a3e99fb77c7c92", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486676, "uuid": "bd7617fa-1d68-408d-bf03-d376c033e140", "comment": "Malware payload", "value": "92579f0c6b22e4455fdf58e4a121c2451725dce412daa4a382e889485a80a4bb5daa760e3e0b71ae8fddece45d3ecb05", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486676, "uuid": "d3020e92-58f9-4b69-ad69-79645e6e135f", "value": "T1CA41BD0106DE5B25D2718B365CADD7198BB2F882EA318F6E8288C98D2944640FC35F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486676, "uuid": "a04175d0-38f4-4d33-94c5-8f843822abbf", "value": "24:8QJ9Ir2HdvOAxA+/AYeF7aD0dGO4I02m65vZ4Odrv:8AZHvmYy7sIj9x4Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766486676, "uuid": "0940ee07-4dfc-45e2-85e3-bb3c80028b15", "value": 1890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766486676, "uuid": "91914577-5d17-4290-9ef0-b9200c0d6bac", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486676, "uuid": "e6fd9244-25e4-424c-9671-d2a1f1d19f38", "value": "40667dce013f1fe4e91dd4aa50b72c5f2cd5e5c51bba1c6a5c95a528c8d5d74d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5160cf64-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488369, "uuid": "72fa3c43-b542-4625-a6a9-7f79f33a846b", "comment": "Malware payload", "value": "c256f37f5ae3487ca7cdf0e8134aab17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488369, "uuid": "52de018d-5b2d-499d-a3ca-a5958595ef0f", "comment": "Malware payload", "value": "40e2ab46fe12f792c51ecaee7d4b9666cd33985cc97c0c8664fcc2cffd97c50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488369, "uuid": "69e3268d-e271-4e55-8453-7c6f5933346d", "comment": "Malware payload", "value": "e1ec59c458d23bf1eaffb92c6de260f46844dcf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488369, "uuid": "4bd6e941-a238-4bb0-8915-746516b3ca4d", "comment": "Malware payload", "value": "33d368cb494a493c3f9b4f580e41fb0b97343905214316ca9171b3e84b1d67e636a31128fc9fef7d6328c836304fbf98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488369, "uuid": "20308b96-6e32-4937-a011-d53cdc96f119", "value": "T188E41200B0D25C75D176293249A5AEE88A2DFD204B51AFEFA3C8059B5F316D0E635CFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488369, "uuid": "27dd7a05-6e9e-4c81-9296-7537da23cd41", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488369, "uuid": "d49ad341-1df3-4bb3-88ce-13177c7c9939", "value": "12288:OHztGhqRHDDrupzo46XlgNNNAtHYUMJBhJ6kQR4CEFAL//HC2dhUTM:quKjHu0qNvPVrQaK/PC1TM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488369, "uuid": "789da201-0cac-4f69-a332-1ba279262270", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488369, "uuid": "bf811804-8bd2-44bb-b924-a43572e0f7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488369, "uuid": "bd0cb3fa-7d85-468d-be22-43381a477178", "value": "40e2ab46fe12f792c51ecaee7d4b9666cd33985cc97c0c8664fcc2cffd97c50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f2a34a-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524322, "uuid": "ee7efbc3-9558-4183-9cd4-0122fec1d1ae", "comment": "Malware payload (Mirai)", "value": "7768c490b2b572af40ee02ac987fa6dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524322, "uuid": "4cb6c371-84f4-4c0e-9157-71eadb672a0e", "comment": "Malware payload (Mirai)", "value": "40f13890c7f9bb19a4a12ae6216f19de4d88c87b20d694912059bad9ca31753f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524322, "uuid": "655fca94-107d-4f76-9da3-a73d10df8ecb", "comment": "Malware payload (Mirai)", "value": "557f7fb76323f628d3a96a7148990760e4ff368f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524322, "uuid": "f90ec336-e73e-46b4-b502-480d0b996edb", "comment": "Malware payload (Mirai)", "value": "12266b4ee34e61b2e3ec7c136921b6acfdfe5f04246793f8cbeb1f0f97b4938bc63eae9a9ccb4a8e27ccd61b01f0c341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524322, "uuid": "6fa3b3a7-cf4a-4d42-8811-56de42498aeb", "value": "T16E34A61E6E59CF3DFB99863987B78E26958833873EA1C442D05DE7015E6024F301BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524322, "uuid": "0632136a-c402-4a44-8b6d-4110715a6cc4", "value": "6144:AiM3puJxOjej4sRSVitP/JJwzYsxUfDaL9Y1Yd:E4JxAYsxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524322, "uuid": "183a25c1-bdc9-4a1c-8308-bc1a38aa3b1b", "value": 235932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524322, "uuid": "6b965093-3f7a-42b0-a6ff-4720e3f031cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524322, "uuid": "11784711-80b8-4643-b8e0-69e55a76cc90", "value": "pandora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7dff47-dfea-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766485762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485762, "uuid": "a181922f-b3e7-4890-9594-1cbea8099e0f", "comment": "Malware payload (RemcosRAT)", "value": "cb7123859479f5215f8404d5a7e3ce4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485762, "uuid": "60c34bbb-5b7c-4996-9f1f-7b2ea21d8b25", "comment": "Malware payload (RemcosRAT)", "value": "413a08efe39bc4eea9841564f4497bf2ab6e5e074d7bf4e7f9be6d80da274e68", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485762, "uuid": "4e3def29-8689-4e61-8a99-00166c05c465", "comment": "Malware payload (RemcosRAT)", "value": "4e32eecd66b6c000e7d60d7a1918edbe38c092ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485762, "uuid": "b1631069-128c-4b86-865b-cd11990f8805", "comment": "Malware payload (RemcosRAT)", "value": "6e76b953d96e0d90939df8bdc1ba4e62ebc919b300a1df37ecee22f1ab952592eebd558bca3be1aedd8b7b47dc98e965", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485762, "uuid": "cd30119b-166d-403b-8d3c-872e4579fa6d", "value": "T1FE4661156BF01088C1D2D979DA1E1A985C4E7A17A6D76CDB3038BC9B707F8C9B630E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485762, "uuid": "31a98e73-f7c7-46ec-97a4-7d5dc33dbdb2", "value": "98304:pdSDSWHoJb5BB9sEsUy43tlziDf8tlXWpOIixwsGdMXl:psmFN5BLTsO3riDfilGfixwBdM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766485762, "uuid": "95eb7cde-3995-4f0c-83a1-2d13bf1bfc15", "value": 5757814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766485762, "uuid": "0f3cc69c-9484-4093-b254-ac2292bfa34a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485762, "uuid": "ba121a78-96f7-4f32-b46a-8a0099fb232d", "value": "Doc 489333.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e765f9c-e053-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766530831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530831, "uuid": "bbd467e2-4120-40d9-8a95-765418709460", "comment": "Malware payload", "value": "951a011ecc3835567dd4884b17b8b40d", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530831, "uuid": "ced809ca-8a9c-475a-b4c7-c4a9010c3914", "comment": "Malware payload", "value": "415fdb9543cc9475caf9a1f1c4d41f086a8086e00f7572c08a3a3ce5c957c377", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530831, "uuid": "45e2134f-5dc9-4c4e-a208-80ac02faed12", "comment": "Malware payload", "value": "441ed5cac20394d576e85464866af6ed9f2ce084", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530831, "uuid": "2e56a47d-2f85-4396-9de7-5d762103e15d", "comment": "Malware payload", "value": "5b10919f0724b9d821a5a44a9285e98f52ec9a39c3a8f28bbdd812a3fc3979f6265ac567cc3a8b47c93d829162d3327e", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530831, "uuid": "41c4c0c7-7739-4a99-a81b-763703943c2d", "value": "T156F70242E381C64D0534722D2B6778E91635E81A9269C7C3AB16F5D02C3AD179ED33AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530831, "uuid": "eeb5c8fb-343d-4d73-a52a-76af074480bf", "value": "24576:bccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccH:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530831, "uuid": "442741fb-683f-4f60-ba83-f53c5a411396", "value": 71361758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530831, "uuid": "cd831377-4aa2-40b0-9af8-0907d83a2a1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530831, "uuid": "85ee51ad-5d4b-4bef-9f63-bebaa29ad326", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebbeed5-df9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766453093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "05c828f4-b890-473e-ade7-7401f19b7955", "comment": "Malware payload (Mirai)", "value": "1fdd2134c05e12b82ba3887ea98fdef4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "66775e47-a9ef-4f1f-8713-4d878ef2645c", "comment": "Malware payload (Mirai)", "value": "4260d9f393316890be4a06f4a3ac814da1970256f5b7f3042358d8acf8cf26d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "17f8a1f4-fdd5-4a50-b376-f7512c4365b1", "comment": "Malware payload (Mirai)", "value": "93735bbc32f4aa3553d5a62c71c9c293e2e2ec45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453093, "uuid": "c7976642-822f-4e10-9290-4b01e7589088", "comment": "Malware payload (Mirai)", "value": "844ee506ed9635a0e532de290b8506ccca1b6428d3efa7a753c9242c8922b286f6d41fad20b576e70993bc501ae211d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "a73e0fd9-6254-4f35-97ab-01dc76976bb8", "value": "T162435CCACB47D5F1F819187114BFABB35A36E53510A9EEC3FB949931B803201B14AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "d844e6d8-d2de-4ca2-917c-92c96e52e796", "value": "1536:CZczz9U2z9teU6OP24fRxnVuVxBbmdXRR:CZc2g9qOjfTVu/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453093, "uuid": "ef539789-e1b3-4d50-b542-ce540b24165d", "value": 55856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453093, "uuid": "4cdd207c-3315-481e-87a5-c663248eb0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453093, "uuid": "aa274085-4305-4511-8c19-767621f30e15", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7929bd13-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478558, "uuid": "92991b5e-4861-4f27-bcbd-4025944d5296", "comment": "Malware payload", "value": "59aed7cde0a82f32186146a508a50836", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478558, "uuid": "278456c4-68a1-47f7-af22-01dbd12a01a8", "comment": "Malware payload", "value": "428ecdfc21b7d8eb68d802b73a1b0da6d726d36b1bf3c25cc7538b0334abd982", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478558, "uuid": "16bc6fd8-1cf0-42fc-b2a9-d6846977c939", "comment": "Malware payload", "value": "4dfbf50f5abe5d4b7c49ad9c865347445d4d1699", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478558, "uuid": "ed8195d9-7f4b-4589-9e5c-218643ce60d8", "comment": "Malware payload", "value": "866c7838a5a0e0098d6b3d426a7fed1f0015225c1241226df4b6a6453bf8e0b93930cb3e1f3200ba50c2a766601a5854", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478558, "uuid": "ff4fef66-29a4-4b13-8d76-6f5c969936b5", "value": "T184636DD4BE525CFC99B239345B714C2E2E04A2519EBF722AEDDD71F022588CD69B3183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478558, "uuid": "614880bd-6029-4923-b26c-97dde2861648", "value": "1536:I9l/AoSSMQayw9vJ1I++azcafBo6b6OcZXvtUvFUIKOijTflaKvkZr/Fm8AXBPHc:I9l/5MQayw9vJ1I++azcafBo6b6OcZXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478558, "uuid": "099ff0f6-86f6-451a-930c-6c383a2d1fe9", "value": 71570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478558, "uuid": "7f2dde84-6779-4450-a3ae-5adb20bf5d2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478558, "uuid": "5cad7e61-53ec-4b80-97f5-0961ce831c78", "value": "invoice-1645080830.pdf (118).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e190134-df96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449709, "uuid": "83c87a8c-0101-44f6-b6e8-d652dbfe91bc", "comment": "Malware payload (Mirai)", "value": "cdf9ad171cc87d5a1fe8e5456381606c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449709, "uuid": "ca12b3dd-7986-4d85-8275-dc90ce661719", "comment": "Malware payload (Mirai)", "value": "42b0734f7c690a634bfa4c879517b455c51bf28616d532eeb89227b7f2a735fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449709, "uuid": "f5bb7b21-2a3e-4935-abf2-1b45e89459c4", "comment": "Malware payload (Mirai)", "value": "17a93d52f934385f0fdf9fcfe03772dfc3346dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449709, "uuid": "44c45819-80d8-4abc-ba07-29a28fa93a06", "comment": "Malware payload (Mirai)", "value": "b3b22ff24c19afac43b97e0cb60576e52b96ecbbce1031f8cc9d86e68fc8540204fc1a9243240c084235acb325df2513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449709, "uuid": "174c3cb5-6dfc-4204-8916-62bd14f0bf1b", "value": "T181833C86A400CDBCF84EE67784574F10FA35B7119F520F27A665FDB3A9720988E1ADC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449709, "uuid": "bf52c343-84de-49dc-8930-f447f23a7b4f", "value": "1536:AsFU4rgdrwKD4E5m5hzD8mNFxrBY/8QjOEnBkXc2MqxKR3IginETPN:RFU4UwK8EO9nbxr6HOvXc9qxKR4VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449709, "uuid": "aa2b2244-ec6b-46cb-a0cd-b6cd7a5ec83a", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449709, "uuid": "4cc818ad-7af2-4e86-8866-9d1e00f4a6f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449709, "uuid": "ac57651f-2ca8-472a-baf9-a1dda661587e", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e65c6b-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478579, "uuid": "3c73b0ca-9a4d-4889-ac43-649facb30c31", "comment": "Malware payload", "value": "c1dbd0b4f831312ec38d5400c8a57d5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478579, "uuid": "acdb46ce-95f4-435a-b556-89e3818bdf77", "comment": "Malware payload", "value": "4336156addf3a522bfa91df6b4bf6b0a1a5061147d68cff78c19c613735cd126", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478579, "uuid": "54833d2d-be7a-48c9-855f-7fe15444f9ce", "comment": "Malware payload", "value": "95e1a2bd0074f8918483dfeee74d30e7972333df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478579, "uuid": "3c717f33-3c77-48ed-bedb-84f87d2401e4", "comment": "Malware payload", "value": "339e5afc0b0e04f21763a991bc55524e5f855f04437c1a836d388d6b7821d14862b3d77ff4dbc534c7599e68e33d1148", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478579, "uuid": "567482cb-277a-47a4-98b0-012e2229fba2", "value": "T197630A1C7740B13A2B2C3DDC3E2B21E6442F9F437E67559E949DB043B7A1CB69229836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478579, "uuid": "8a8ee35a-7309-41f4-8391-98acedb23350", "value": "768:I8w/h62/jWs6oS+xISN0vxfLfBfSfSfx+fFfTfDfzf4cfbfEf6fTf/fqcfpcf7fJ:I9l/AoSSMRNGusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478579, "uuid": "7ff00497-3c49-4c5a-a11a-ae64070f5672", "value": 72477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478579, "uuid": "2698e585-ba3d-4930-93f0-e7692fc40ce8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478579, "uuid": "a6966bef-ccd2-4811-a346-7ca551187a3c", "value": "invoice-1645080830.pdf (114).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ca4b14-e05a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766534110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534110, "uuid": "b370e85d-d09a-4ca3-971d-b2b431c45180", "comment": "Malware payload", "value": "b4f95e018410240225281d0d174d04da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534110, "uuid": "db83c94b-f3b7-4a85-8222-754f09a26f95", "comment": "Malware payload", "value": "436d60a0eecd879b94cf2bba3683eb8e565e54f58571f00fd80c7d873ef6854f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534110, "uuid": "7bf7796d-a06f-4fba-9217-3f41b819d73a", "comment": "Malware payload", "value": "0ea502edf1b3d19842a396d89ccac788ccdd8053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534110, "uuid": "15d48931-3c59-41cc-8426-4533fba05af7", "comment": "Malware payload", "value": "33a7220ded3d9dbc7e5e123d9ecd57dbe9f901b49744917dc76d5044b7349372197828e33f2b0761f3582fafc1cf05d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534110, "uuid": "aac3eef3-3c3d-48b0-97ef-cd96de53428e", "value": "T14DC31884B942AA12C6C256BBFF4F428D771A5798E3EE3203CD195F74378B95A0D3B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534110, "uuid": "a6dbad2d-29db-4235-9c41-602140b30eec", "value": "3072:fv25OrfP1dUIsTOT2OpcmpXFTEbCJroXA1RKfu8nz4:fVP1dnsKT2OpBpXFTEbCJroX/mY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766534110, "uuid": "f1918c47-44d4-4d97-b483-d5f098615866", "value": 128256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766534110, "uuid": "11a43c24-11bc-4352-920f-5ba1b937790f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534110, "uuid": "3c6e0ead-4190-439d-b0ab-2e7e9536f44a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f52b27-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510139, "uuid": "49ba5dfc-f723-4d0e-8a11-a13f72055671", "comment": "Malware payload", "value": "5af023aab69627b3d5550f604b3d970a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510139, "uuid": "361b3256-cafc-4d34-99f5-996105ccb001", "comment": "Malware payload", "value": "4378e1c1b7ecbc7577bffe77b417a20711b5468cb159b4d4ba51cbfece742593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510139, "uuid": "36755843-945a-4d00-9528-cfc8d5792aae", "comment": "Malware payload", "value": "458058826fb0eaea31b79f1394292487246f3b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510139, "uuid": "1f28845d-86fd-4f72-94d7-9e347d598b8b", "comment": "Malware payload", "value": "4a85a90ba83c6512ce164d0877885a225a3575ae643f5107ebadd82772345723fd13cc2484315770817c866541319e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510139, "uuid": "192432b7-dfb2-4039-ac8f-8811043c021c", "value": "T1437218A8A5E6D1F8E78651F503AE4BFBB436A7325710D4E7DB219C7050227F24A7A08C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510139, "uuid": "cd4b987e-1b49-4990-aec8-7d74d27a4464", "value": "384:ZtkdWYBk0hOk0RJMJrwQiUnMqWlvi7NXyZfooQ07n8neFpY:cdm0jKJM6UnilyRyZfooQreFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510139, "uuid": "5283a751-0c8b-40a0-8c04-35f74249b43e", "value": 16382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510139, "uuid": "2cb84629-ae11-4c9b-a3f1-3fdd8adafeb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510139, "uuid": "02448b71-33f6-4cb1-806a-31b8ce2d08fc", "value": "Photo.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35ab6f0-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525122, "uuid": "8940a48f-76fe-4c17-969a-88342db73cb0", "comment": "Malware payload (Mirai)", "value": "9179e5ba0623c1c5cebf5e3390c697f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525122, "uuid": "8c6bcbd7-eedc-43a1-9af2-7e2a6a5515e2", "comment": "Malware payload (Mirai)", "value": "4406b74afbd1b28282dd3a94a46069806e11326cda17bdd6ec114c5de6b4fa94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525122, "uuid": "d9e4b0d1-41a3-4f75-abd6-cd980e381717", "comment": "Malware payload (Mirai)", "value": "799eb08b5da5e0d10942fba9b3398124dc9edb2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525122, "uuid": "5c14e862-04f5-4c47-a143-98eabe84805c", "comment": "Malware payload (Mirai)", "value": "8b36980ba5856b627e22a9b4fa13caf9fe5501ddadecd8380df2b21502b2de159c3fd4bbb8bb013109ac6b47425ddde4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525122, "uuid": "4e6b1d64-a0fe-4850-94bb-b860725aec36", "value": "T1EB733C02770C0E43D1A65AB4263F17E0B3EEE59021F4FB88650FAA86D575E33518AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525122, "uuid": "7ffbbbe3-55a0-4533-9f70-8cfdbd058e0c", "value": "1536:zg5WqxhDGwKWcabjCHS9bJgTbXcBImZG1TE07jOJIXcOUwbZnIq:E5X2C+0BIH1TyY8wbZnIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525122, "uuid": "dea6b195-7a37-44f1-91d5-55e5a940dd31", "value": 79328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525122, "uuid": "9209a91f-2a57-4dd4-b140-b94e99266cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525122, "uuid": "1a3fdd55-6b6e-473c-8c07-f80cccbd9776", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f015d4d-e023-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766510243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510243, "uuid": "dd44021d-0e44-4913-80d6-55c5794dd7ca", "comment": "Malware payload (AgentTesla)", "value": "fba4c8c07c3dff793e709b2bac8015cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510243, "uuid": "e44d4b8e-c25c-43cc-a314-27c1021e7bf2", "comment": "Malware payload (AgentTesla)", "value": "440b16adc385f603aaa8fa1d4d867f491cb89e7c1d484a7c5879a3ad0af99b3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510243, "uuid": "56ba8329-521c-4b8a-b172-e69bb9ceeff0", "comment": "Malware payload (AgentTesla)", "value": "61e344bbb4e9e74dd1e9d420599b16a193bbc944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510243, "uuid": "5d0c7ca4-ebf8-48a0-9133-3b2a53125564", "comment": "Malware payload (AgentTesla)", "value": "5fc9f4b0ef0ea5693b15aa37900d5d8dad081cea1ae8f7a1d565dc3f5a7dd3c8d45d7ccd4abdc88e1959f8146b250574", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510243, "uuid": "199a192e-cdb3-4cd8-9a7e-4e7b90aead6c", "value": "T1CD6315678D195AD7F21C87F9BE161CE96F09131CE9827EFF04622FD93E506230C4A46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510243, "uuid": "a9c65db1-0d7e-4e5e-b73b-0b7bc9840a87", "value": "1536:pIIlWhuIEI+/L056wQfxf28aBotckqVHmvru5266DeqkETIE:pIIlWSRz8kraGtcNVGvru526ge8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510243, "uuid": "420adda4-6d13-41b5-9255-397fadebe2e8", "value": 72303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510243, "uuid": "e5775d6a-f97c-4fdd-b60b-51762445e460", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510243, "uuid": "4565cf09-f1e4-4890-b029-17edbe188b41", "value": "List20252026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bb8620-dff7-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766491621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491621, "uuid": "c5726226-aee3-49b7-90b9-126fd546901a", "comment": "Malware payload (Vidar)", "value": "db409cb20e82dcf9c386f8e896632760", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491621, "uuid": "86c0624e-b840-4f0e-8d9a-bc5ddf824438", "comment": "Malware payload (Vidar)", "value": "4412691fb97f2c13adc61b1b4bf4dd6e34d1e10cd8e1f65398921f3f9df569ac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491621, "uuid": "52da4820-1f7a-45d5-b994-3c74ff7d12e4", "comment": "Malware payload (Vidar)", "value": "e89ce942504f7544159c17362973ca9307adefff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766491621, "uuid": "09157304-c2d9-465e-9129-96d3f65dcb7f", "comment": "Malware payload (Vidar)", "value": "6bd6aadc1752ee42eeedfbb1eeff41716e13c26c4493f12c71f600633402407dd7c0b1c1b2920bc2683fb5f4ba972992", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491621, "uuid": "a9392a10-4917-4a2d-b2d1-7dbd80f71a6c", "value": "T197F313D3D48ADC45E6A12E7ABAE87B24B07417CB236C38E69BCFCAE6C7507014715264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491621, "uuid": "f9ee0675-153f-4d8c-b4fd-2ae0ff38cfa9", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491621, "uuid": "33cae667-4915-4fb9-8bb6-509da8640f3d", "value": "3072:yeDtDmK9/cc/JVj2Op8+FmImKxRiFAA4QuM5RvGe7FrehBWx7QXukrmNvCYZZFR0:pDmXc/bC9fGDQ/5RV7FWyA4vCEF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766491621, "uuid": "ee1e9870-6680-4f12-81e7-fabc4704ae95", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766491621, "uuid": "2d9faff1-6205-4bd3-80de-f777a39bd773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766491621, "uuid": "05d25f6b-6b45-4b06-a910-9610bc1196a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420151ed-dfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766474600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474600, "uuid": "e67af677-7c70-4cf6-bf1e-2d88b4d85628", "comment": "Malware payload (Mirai)", "value": "2b26dee82de0c72cf0a7fa00db8cfde6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474600, "uuid": "b87ab7e8-e28c-4595-9afe-9b7f1a50eb54", "comment": "Malware payload (Mirai)", "value": "44eb185d273aff8e9c05becb0f72bf09a5bd0ba365ccb3b18476251e473d03c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474600, "uuid": "c5be12a7-ea44-4c84-8ca6-b7cb2e3f4b0f", "comment": "Malware payload (Mirai)", "value": "daf465f53f71b6efafed44e641443c2965db2e0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474600, "uuid": "c2f096d1-094c-4514-803d-63f5fe1f9a29", "comment": "Malware payload (Mirai)", "value": "2a18b7d96fede344067e8aaeed0088bc798af359fa11e281b82bb5ad5b3270cdea403b3f16fb9112059859e1a9e4ed32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474600, "uuid": "f8695299-80a2-4ba0-bb33-8fd298c15ec4", "value": "T133B35B02A31C880BE6E70FF037BB53E1936BA75125F5E2C6360997494575B329A06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474600, "uuid": "9bb2ab21-d2e4-4bdc-b2ab-7b67a3d81848", "value": "1536:gBeuYwSuVlLB3m/gmcT8tHMcbKAiI3sV+FlWeF1QAQ9Rw3l6CTF9wcem:gAucmG/gR03KAiI3sVUlgZcIcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474600, "uuid": "4bd7dc31-a128-4907-93b4-762b69192de8", "value": 112332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474600, "uuid": "0f584fb9-6aae-4834-bc49-ec113bfcdc27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474600, "uuid": "4f83ffe9-d011-4431-a1bf-ef1c60d53d67", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b09fd6-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478986, "uuid": "d28353bf-a02f-425d-9111-12d5d65ff85f", "comment": "Malware payload", "value": "2603c14822bd68ca346bce077bac1421", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478986, "uuid": "af96304e-e3af-4ff2-9351-413537f6daf4", "comment": "Malware payload", "value": "45d93d6354c4e23d8e87e9d163df6a59d9522fde149c01cfa2012c6d5c5132a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478986, "uuid": "8282edb6-3f1f-43b5-a609-16c541d4a2c4", "comment": "Malware payload", "value": "0c9f627ffc2f7fd5a7cace1c6a071dfa81a19c3c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478986, "uuid": "6a16ed3d-6315-46e7-95ad-1ae8cf799020", "comment": "Malware payload", "value": "185ed60a4d0d6de06f5151cac1f1d76f4ed99d90a65f89e2f60ad59f3221622b03160582f00889a93e6ffb193725f00d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478986, "uuid": "8036f2f3-b97b-47b3-90c0-e2d578502b33", "value": "T1A6631B1F1D13FE6E20ABCFB2889D82F500152AD59AE6749A4C06F9394F616130EF357B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478986, "uuid": "a417a714-abe2-4666-bc98-b8163b0a4292", "value": "768:I8w/h62/jWs6oS+xISN0vLQbCox6CW6jmNl+qrI9VZtFzgVzn5GJ/20FEpgL3Tan:I9l/AoSSMPg5usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478986, "uuid": "939d6744-cf12-4d74-acbd-3f7fd29f7dc2", "value": 71573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478986, "uuid": "f14e8a42-f045-44c5-91b4-fd8f518e4251", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478986, "uuid": "4ef8cce2-49e1-4029-8c71-bed5a4d7ec73", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c81527a-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478536, "uuid": "63e61c08-a0a9-4b4d-8ef7-7ae2eb52b6ad", "comment": "Malware payload", "value": "eaa51d64058f53305d267f24f2cc967a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478536, "uuid": "b17bfbdd-a367-4b0f-84f2-5dfeef5bf9d3", "comment": "Malware payload", "value": "46a7229ab927045a8f2e63d7323f913f66a9b02dca8671875c8b2e36d57e6d25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478536, "uuid": "53570527-a06b-4adc-a2a1-b9d9ae829614", "comment": "Malware payload", "value": "e5d107e9da6a9157364e79d292b61ef56595f1e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478536, "uuid": "4ae8bb98-c709-475e-874a-512bd1462257", "comment": "Malware payload", "value": "630edc3673bc8fb1275097c34d627892f41deccf0a339afb4cd787706c5e412506c15fa83e711ae5dc126ff8eb9fe4df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478536, "uuid": "e077783a-fd7d-47f9-a22f-d256c636e7ec", "value": "T17F632CCA5BA5376E03B0C0C46AD7912C364E1B851C39DD3527A746403FF7B62B8AA6F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478536, "uuid": "f3b9cffa-21a5-45ac-9e2a-0250543be7ba", "value": "1536:I9l/AoSSMI1V1B141Q1b1e1b1+1o1z1W1X1S1k1k1w1p1+1g1i1s1q1d1G1W1P1D:I9l/5MB1qusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478536, "uuid": "998f6273-f31b-4d2c-9b7e-11c5e2b07427", "value": 68758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478536, "uuid": "e1645ad0-d13c-4b15-b1f4-f182d255d148", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478536, "uuid": "4ce65991-bf3f-42f3-896e-7b4cb8f6a48d", "value": "invoice-1645080830.pdf (116).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca33704-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488361, "uuid": "2bc00ffb-fbab-4b3f-b740-66428701928b", "comment": "Malware payload", "value": "09836bb6a2a0b550b4c146e15e029139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488361, "uuid": "9f9ca4b0-d97b-4af7-bf97-ad3840345396", "comment": "Malware payload", "value": "46fc04d8b0695f705d8f695044c09be517a53c669c441a982802ee707784d78e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488361, "uuid": "360695d0-2279-456d-834f-c91451380c5f", "comment": "Malware payload", "value": "7f17e807b75014718e820d8fed09b813fa910eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488361, "uuid": "082ae205-eec1-4d42-a296-32380cb49bf4", "comment": "Malware payload", "value": "d7241eb9f685a2cde3c94711c553eba9bd5fcb85485b2337ab4e88903a7aa479f7f0944563b01352e410fd2094fc938f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488361, "uuid": "2bdade85-56bb-436e-9f91-b77493e10269", "value": "T1A7F40200B1D1E471E9B32AB14AF98AB8996CEC2007515EEFB3C865FA4F259D07D31C5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488361, "uuid": "f859986d-729d-4e89-921b-3e3fdb960d7f", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488361, "uuid": "cc33f382-99ae-4955-b3fc-e8fbbda39d83", "value": "12288:yHztGhqRHBSIkK1Q0bSQ5aV3wvKG5c5zKaVORbvQHUf+ZY5m5FDJItFzZyKJt:WuKowSuyV0arHu+e5mzD2t5ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488361, "uuid": "152c1a68-0c24-4381-898a-703d14d635d9", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488361, "uuid": "a2e8e9ac-936b-4f0b-a9cd-611f355f94b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488361, "uuid": "324a9d04-9c83-4ae5-a72f-03a2654bf0a9", "value": "46fc04d8b0695f705d8f695044c09be517a53c669c441a982802ee707784d78e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e2d99f-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457804, "uuid": "8ffb9154-ed65-43ad-8d1f-55c95e03e678", "comment": "Malware payload (Mirai)", "value": "c81a5471ab45b0416ff1c9481322b032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457804, "uuid": "848636e2-29ef-49d7-9d38-a0cc88f378ba", "comment": "Malware payload (Mirai)", "value": "4822e668692794fad83477e8ba761b11c25d57428ee6665f0f0cef3e7ba4873a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457804, "uuid": "de6cd4d4-f834-4b40-8fef-7241cfea75db", "comment": "Malware payload (Mirai)", "value": "effe1189102329fb9a2594ece69b463c1bce61ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457804, "uuid": "1b9421f3-94ea-4fcc-b088-edd1592aa5aa", "comment": "Malware payload (Mirai)", "value": "27e33f548f63f1802be41de9216d67c2af8531453dd54d3f50f6a7a150770af4e2cfef99dae0c68730cfb0613e1ad394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457804, "uuid": "eaecffd7-c178-408b-b75c-2cdac9aafc39", "value": "T18F03F175A69241E7C5BB86B09C9B81A0364C17F58C9E3453791C269839D9C0F3AFCEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457804, "uuid": "cb5955fd-23af-4563-a8b6-618477b4bc2c", "value": "768:8ABBPtDKom3jKBKLhVd4ZJWaDwIF7znKjJ9q3UELOU:jP0ommINwZsI5o8Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457804, "uuid": "d3974b6a-3ab3-4774-8de0-8fa01d237dca", "value": 37848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457804, "uuid": "b11611ed-2ca1-42e7-948a-aa62fc0fa477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457804, "uuid": "a465cc90-552b-45ac-ba97-dbaf02a5a04d", "value": "ntarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce02512c-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510053, "uuid": "be825031-33cf-4cc7-9226-db43594140c1", "comment": "Malware payload", "value": "e836bfa7f96a4b141724b3b6faec82fa", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510053, "uuid": "f4bb77e0-4897-4c48-ac42-f1ae1b09bccc", "comment": "Malware payload", "value": "48ac9183df54aa8ea2ff37f91cf9496efd8b0f76e7bcebd9c84ce608c9e1f930", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510053, "uuid": "8c2670d2-b80f-49ac-a6e6-126b892e0cea", "comment": "Malware payload", "value": "df911a99e3d7b70e25555246d685bf4b33d24b14", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510053, "uuid": "f426324c-21d6-4598-abe1-b1e5c8e3fa9c", "comment": "Malware payload", "value": "fd2fd51dbcd77d1111570e0410c372e9e1b61ed2962f7863c4ea9c9c47b3a6d61abfc3281db1d66acaf1be27a1bfa729", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510053, "uuid": "84ae609c-6491-4832-976d-24b67bfbec14", "value": "T17557341B2AE301B5E4E9CE34A7B945FC46F16B2F4620B7BB154412F8CE6074A75236B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510053, "uuid": "3cd2237d-4eab-4f57-a005-606634e367a9", "value": "196608:Y39h9iXcDUqlH13039h9iXcDUqlH13039h9iXcDUqlH13:2lScDUqlHQlScDUqlHQlScDUqlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510053, "uuid": "3109b120-2bc8-474c-bcf8-eca14f174fab", "value": 28114944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510053, "uuid": "1b25cc87-8739-42c0-bebb-c68cdd5eb8cb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510053, "uuid": "00aa3199-0749-418d-a7e6-6ec9b32b2410", "value": "Internet Download Manager IDM 6.42 Build 45-[FTUApps.com].iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff7ba5a-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531880, "uuid": "83e5c63e-4c5a-4fd8-a3e4-7f27afd6afe6", "comment": "Malware payload (SheetRAT)", "value": "1209f3c172b031317813d40c877b8b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531880, "uuid": "c4270a9f-bba1-4487-93a0-340aa11ad8be", "comment": "Malware payload (SheetRAT)", "value": "48cb351586972d880f7b8316ad4c0872cb88a7411943465f565eb526dbd7dc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531880, "uuid": "1f6b4f7e-09b1-4058-9dbb-8063e50e856c", "comment": "Malware payload (SheetRAT)", "value": "cccf16cc4850d3eb6729e7baf10b526eccbb8bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531880, "uuid": "745c1361-e9e1-49b7-9ef5-12adb8c6cfea", "comment": "Malware payload (SheetRAT)", "value": "8f4a42a27ac726f2c739f30b1910a041d0925df4e75554efc5d9d0f123a579a0939f83a61a5152b8f28f7cae4f57c409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531880, "uuid": "4c2d10fb-0b4b-41d6-8033-006d8b8ad885", "value": "T1BC94A30CFE92E805DD1E3DB7CBE614004B7129C12E21929631696FFC8B663B758E65BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531880, "uuid": "29400d2b-04f6-4b32-94f2-ebf5152dc8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531880, "uuid": "1cd09853-f81a-4dce-8668-3fafae92e408", "value": "6144:guc5okwTXNPemOo2nVjoWVe6VlWT8b9tXhCwCXN7ToPf1b4lsCFN:fcm5NeBPVle8vXhsFT4VCFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531880, "uuid": "9221079f-10e7-44e8-894a-fa9fcc5100a0", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531880, "uuid": "a80e7df4-438c-4b48-b6b1-d543065efc5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531880, "uuid": "d78480c4-43ea-4b46-981f-613808113f4d", "value": "hyudynjwiqmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19553443-e03c-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766520917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520917, "uuid": "fc3371ce-cb0f-48b2-aef6-135386d61281", "comment": "Malware payload (Stealc)", "value": "1f59e3d31c17a80eec1db5396e2201db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520917, "uuid": "8f07c1fd-a6a1-4f79-9cd1-57918108d5a1", "comment": "Malware payload (Stealc)", "value": "48cdd76bee9557da7d9100caa6bf151a3efec0e32f4cbcd3ab14fcf5311715d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520917, "uuid": "7bb8463d-4136-4876-8aac-a77fc021df0c", "comment": "Malware payload (Stealc)", "value": "d27c7b06b1dd7a79e52cc87b50aea5741ef91cc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520917, "uuid": "6e4377df-ef63-40ee-98ed-1ce4b2767879", "comment": "Malware payload (Stealc)", "value": "82bcddc448561a974b16214a7827bcf05757e4a406931c715c86463f76f7c695480e10244544375440a09b6e7893a1cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520917, "uuid": "449cdff5-e548-423b-a2b2-ec990de8e9c5", "value": "T1E5F49D1FE3A502F8D0B7C178CA424552EBB278654330A68F03E95AA91FB76905F7EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520917, "uuid": "4615762b-c7cc-4a98-9071-2c74790086a5", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520917, "uuid": "c0291b49-763a-475c-8135-4faac2c73dd0", "value": "12288:yVFR6dYKVC9eym65QBZ8C89iIdw5mRGv3YZtF15kjH+A:UREC9eym65EKCwi6KmRq3AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766520917, "uuid": "f41e0249-51de-4222-bd85-67d39dd52e6b", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766520917, "uuid": "439a770d-ca2c-4705-866b-710cd00cce86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520917, "uuid": "c6ebd4b8-0c75-4ce4-b503-e198231cccac", "value": "1f59e3d31c17a80eec1db5396e2201db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e827204-e01d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766507826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507826, "uuid": "c28fef24-d80f-4665-8aeb-43cce7d0361c", "comment": "Malware payload (Vidar)", "value": "d0da17a2ea43182229dd9d240f9cd7cf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507826, "uuid": "9a6dfb35-3eb2-46dc-b011-b58f8704e1e8", "comment": "Malware payload (Vidar)", "value": "490fb0c1cd0ee2600969a1acd54213743f1629d52809fc9512874c82658208f7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507826, "uuid": "ddd7809b-485e-4167-8280-3c8673f69b75", "comment": "Malware payload (Vidar)", "value": "7398ce5bb2ed13cab2189a0cbde84f01fd052b8f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507826, "uuid": "6dc025ca-36cf-4334-be53-f9e60f944dec", "comment": "Malware payload (Vidar)", "value": "85f475eb4d253ca30a28648c84165c21c6edd906dd54fac0f22d0d7c8d62f2cadd83652899aadceed152edc5c5ef56fe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507826, "uuid": "8a08cbab-a619-4aa8-845e-ebc64f504cec", "value": "T1829523113AD8B4EBF53D427060B2C54749713C764B6382AFA5BFF12A59B13528D3AB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507826, "uuid": "b6a27088-17d8-4bf1-ba9e-3a33bf57e9a0", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507826, "uuid": "d3746757-9977-4261-b1d7-f105c2a34149", "value": "49152:/SLwFWFB61SHcmVo0qFpobzPuHsFXFlVdHu:qxHcG5qFpwzPuMF1lzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766507826, "uuid": "3073dacc-817a-4f5e-939f-7f4f6c84885e", "value": 1890816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766507826, "uuid": "60690aba-cee5-4c20-9b47-f28a431084f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507826, "uuid": "a476a1c4-d849-482c-ac6d-ba659a2bb8aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031f2108-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478789, "uuid": "57529e84-e4bd-434f-9f14-5726225a8e74", "comment": "Malware payload", "value": "b96bda33dc7ad4917cca45efe5de8824", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478789, "uuid": "e046e647-3890-41ec-b0d6-99c053bd11cf", "comment": "Malware payload", "value": "49d429ea6b0ca8239265bfb4f419553e55d25469f53c2c95571bb42f4895ff16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478789, "uuid": "f99adb09-617e-443c-9250-3324480f2873", "comment": "Malware payload", "value": "a81655c03f0da365ea4dff7da48db8af1da7c8e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478789, "uuid": "c9b7efb1-1c01-4e6c-90b8-ca20bae0dc66", "comment": "Malware payload", "value": "45ccce9176b1803943892ecdde8e4fd8b846f5b3ed5357af9c704f94cc986f9042e564d2ba5270ee9c6f83a6141dfa20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478789, "uuid": "ad2ada7f-4c11-414b-b721-fb88a04e75fc", "value": "T1D1634AFA36433C5262FA13D8E9F50D59F637C900277653BE9B0CE613B94989CE96C248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478789, "uuid": "467c4dab-b67a-4223-ba2b-ce95154a2a6d", "value": "1536:I9l/AoSSMQYuYHYwY4Y9YLYlYjYpYqYFYaYLY+YEY2YcYkYCYJYSYRYRY0YzYnYo:I9l/5M5uusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478789, "uuid": "9230cc1c-8827-46ee-baad-468de278480b", "value": 72523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478789, "uuid": "424d3741-d8ed-4d66-b3f1-8e3628d2fc63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478789, "uuid": "06ff381a-017c-4b2c-a276-657a7838df37", "value": "invoice-1645080830.pdf (71).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab38556-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479124, "uuid": "b39b4f05-0afe-41eb-8d78-814dabc62439", "comment": "Malware payload", "value": "9026728ba6b6c4a63144ce3c925fa59c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479124, "uuid": "27d9367c-709d-41c9-90aa-fa2ed7bab76f", "comment": "Malware payload", "value": "49f28b850e1eaff7b5df21fa4aedbe1c197131e39ca63e415bae9af50ba63455", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479124, "uuid": "c73d8ba4-011e-41b6-bc6c-74fd221d258c", "comment": "Malware payload", "value": "4960d8de936f595367d5adb65887f48432d356db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479124, "uuid": "fdb26141-a228-46e2-af42-2c33d67a206a", "comment": "Malware payload", "value": "bf5d4338dfa770010c70b4ad824017b3bc24a612189f4101d7858ab7af855f08f662fb4a77605299094d61ae106b604a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479124, "uuid": "f318d357-7d81-4211-9c47-4421f58a24fa", "value": "T1D6632AA91C061D94BFB18532F0139AC4ADAFC63FD0E7919C96B8763C7D8921F1039DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479124, "uuid": "222037b2-853f-4c18-b6b8-307b99d1ed55", "value": "768:I8w/h62/jWs6oS+xISN0v8Pj7CpA/v2Lcjgh9b1FGcgxxexf2xex6TUJHs2M/Gyn:I9l/AoSSMd1usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479124, "uuid": "1ef58454-3dac-4b1f-aa03-69e0f4ade51d", "value": 71606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479124, "uuid": "1291f291-6cec-4f8f-839a-596330e5d695", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479124, "uuid": "218b6ddc-15c5-4330-b58e-eedf54d38c36", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c461439d-e010-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1766502306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502306, "uuid": "7f044233-d95d-4b71-a8cf-44ef5396ebc2", "comment": "Malware payload (NanoCore)", "value": "07984259c0e59532851c9105207ddd87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502306, "uuid": "6fced203-fea2-4d0a-9430-9369015ee13b", "comment": "Malware payload (NanoCore)", "value": "4a0e6efe7da756a13dd1f1f7fe3a9a24f62e03ac4181e56a9b1e9e46045ff036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502306, "uuid": "ae39f8be-9914-46d3-bcd0-cf61db87129b", "comment": "Malware payload (NanoCore)", "value": "9cc217ca6bc422153c0a0bdd42b45e15c6794808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502306, "uuid": "7b68450e-40d6-4415-a302-8556f76e4a8d", "comment": "Malware payload (NanoCore)", "value": "a227f43fec3294827d34a928251350b38728f60b728580964f5b6e3d2f2198d444fa861387ae22714d13519a036d513e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502306, "uuid": "2bc2f231-7583-499c-9d61-dc1078ae1de3", "value": "T15624CF1637E84A2FE2DE8A79612156138779C2E3A8C3F3DF68D455B64B623E4070B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502306, "uuid": "94b4627c-adbc-41b4-9508-60d69f763482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502306, "uuid": "b5b402a7-3cd2-43ec-b8b9-306255952908", "value": "3072:AzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HINBucXYIVTMsJ1wym4NhdaInny:ALV6Bta6dtJmakIM5bTIRJ1JjNhnfkNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502306, "uuid": "e7b723e9-dfee-4b55-9a50-3873336498ed", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502306, "uuid": "b4b96048-a6b0-41cd-9028-9c3ccf3b80a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502306, "uuid": "1718d86a-0824-4cce-a497-02f19c05f6f8", "value": "07984259c0e59532851c9105207ddd87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e53f28-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524185, "uuid": "09d2d940-ba41-4125-9b01-67a467268e6d", "comment": "Malware payload (Mirai)", "value": "5b96e75b369e18607c6db129a66f896a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524185, "uuid": "29b59af3-7888-4da8-849a-d7cde94cbff2", "comment": "Malware payload (Mirai)", "value": "4a30fd23b4cbadc18606d76eb2e40547040190617af0230d9c4ff7d97bd931fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524185, "uuid": "4ddee830-9932-4ca2-9e4b-f603e0ab9254", "comment": "Malware payload (Mirai)", "value": "aa1538e1482f46766eac029c0b084fb12e592bbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524185, "uuid": "9ed23c53-6e4b-4f71-9c98-6955095eac09", "comment": "Malware payload (Mirai)", "value": "e60fd31c77b0c7ebc4f21282a288bdbf832752b43b0e1fcff0f89a75cbe49e7b6bf3e1c14c43cc528ea2b4134902858f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524185, "uuid": "f916fc13-e3ba-431f-bbbe-b965768ed94c", "value": "T11904F842EA43DEB3E55310F202B787310E71ED7A6C66D542E3BCBCB4A9615D1A60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524185, "uuid": "fc90acc6-16b1-4791-97f1-5fb02b089952", "value": "3072:nfmM6+/g5eOSSSvk4sOmdc6AIFX3PElOxi32KpzyPN7GE/elpGe:nxk5eOLLgIFhA32OuFT/sGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524185, "uuid": "d11a8b07-2703-4104-b7a9-ec1853fcb3e0", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524185, "uuid": "4fc7f685-e12d-47d6-9d96-16f9c483b5e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524185, "uuid": "c0db4ac0-7843-44a3-9288-bb1ef9a37303", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb0452a-df94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766448905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448905, "uuid": "1c935bb1-31f3-4a31-9123-eac553f72732", "comment": "Malware payload", "value": "5c106fd09d47cc5193943c53a574205b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448905, "uuid": "504c39db-8fd2-46db-b941-8668ae437d03", "comment": "Malware payload", "value": "4a986b1a5b5c620bedba2356becb8c69521f4587acc45809e39a69b53de5fe98", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448905, "uuid": "13d9812d-a45a-4c6a-af1c-44dc8912f0c0", "comment": "Malware payload", "value": "8e2f5ee8d0b9aed4db0ae69cefe7ed5a48764252", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448905, "uuid": "c257bd81-ee90-4fb3-b593-20bfd2032e57", "comment": "Malware payload", "value": "c12f3ddbdb3294ac0e28313aef69ffa7c9f543118fb952c2f8ce107e5cdf6751ba748d048e00a87004015f0abdb05066", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448905, "uuid": "d1725265-f252-4823-9361-2bb8bad6cad3", "value": "T114553347817C28C88F3D076276EF965C62258EFC100608776F5A55E3283F7AB8B74A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448905, "uuid": "76300790-132f-4fc7-a0be-2b0a741bcb99", "value": "24576:AbNTJBiBVVroZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRS:S1BiBVBoZ9bq+MmMEL+hcjXHC/wnwdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448905, "uuid": "f2732501-4d43-4548-b37a-ebc6fba6bebb", "value": 1394742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448905, "uuid": "1a71f7d5-9484-4f57-bdef-f4485049ab95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448905, "uuid": "65025268-96b9-4df0-9d44-ae03f234b38c", "value": "hh-ru-job-scraper_3.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16970db-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522863, "uuid": "1c0ed6db-80e6-4635-8a43-34bfbb9eb06f", "comment": "Malware payload (Mirai)", "value": "c368f1e15ab6bb2fa4e9053567c8cd14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522863, "uuid": "2584f30c-4c59-413f-8d02-638e387a85ed", "comment": "Malware payload (Mirai)", "value": "4adf7e437eb11c1f470db0b4e24e56c9c2d796e03f4b4701d81d3aa353abab8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522863, "uuid": "a72c5bfe-2efb-4149-acb1-1eb08ca65440", "comment": "Malware payload (Mirai)", "value": "a67df11da9c53542d7b34cc7573408ac5d9f0fcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522863, "uuid": "ea56c6da-6bc6-4686-b542-1c5bd4e60a18", "comment": "Malware payload (Mirai)", "value": "60f489ce676e29434b735754681fab81821c564f2ce2f9faa03eb829eafce8de564aa942e0f100032a1b74564b78837a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522863, "uuid": "feb46c6f-aedd-45ff-af14-90f968899a16", "value": "T1B292E12635214937C64350F86D409F32B6B2AEF7539E1E85E3929E21C0B13AFD0296FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522863, "uuid": "7d6ab096-8755-4b3b-8e32-a7d6a9b360f6", "value": "384:H1TVKBtORQJNScXi53IxKgYTmhiVs4BdaS3b3x/vZlU54KJoA/KB2NkUKxA1qoEE:H18IQJNScXieYS4MS7RQaEoA/iUKKqr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522863, "uuid": "919d3487-73ed-43c3-94d7-c51c74437e17", "value": 20064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522863, "uuid": "f4ff64de-b66d-4091-b452-9069a288491a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522863, "uuid": "e33b545e-492a-4c46-9ddf-46edd4df00d6", "value": "87sbhas6as.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e505fa4-dfe8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766484821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484821, "uuid": "f4204dd3-a9f1-4412-90fd-8d39a7b0a59b", "comment": "Malware payload", "value": "4792b5a07ae9d7ea6c8a09b703d34c8f", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484821, "uuid": "3423b6aa-e02a-44b2-ac74-59af851a627b", "comment": "Malware payload", "value": "4af9e347f599aee93f9e7cda7c81e1975c6e646c9e4c0936d37d1d4fc8170f48", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484821, "uuid": "0138dc72-3868-4f1f-9e8b-c18c3ab80993", "comment": "Malware payload", "value": "07d0dc3b5425de9610ca704189d2688f659ff49c", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484821, "uuid": "5886f66e-1646-4918-ac54-03cd5b2ba69a", "comment": "Malware payload", "value": "f21a210253681d2aa7bab6de51e9d9fcc3714b6f9ee5cfb84ff52f31d8700de7460ec106a3ceacdbaac5c6b330ca268b", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484821, "uuid": "a0bcb1b1-6068-4e0f-b3bc-27c34007b408", "value": "T1FE031A90633DB8263BB9C3658EDC5CEEDE25CB50B168D45DF20035DC2E5FA9B1A581C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484821, "uuid": "0a9d8003-ed6f-4acb-b95b-848f8789167d", "value": "768:lliEkcc3chJV6cu4sNidozfcg86yLFLPc0S3nObR3zCmZIgwQllZXPxTqp0:NkcwchJ69idoz0h7L1Pc0SebBwQl3XPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484821, "uuid": "5ac3715e-a4a1-411d-b5c9-9b933a3568b4", "value": 39102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484821, "uuid": "7d3b8ac0-8a3c-4840-a6a8-f160bc05954b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484821, "uuid": "d7fdb14a-1282-435e-b834-a41736e3e899", "value": "4af9e347f599aee93f9e7cda7c81e1975c6e646c9e4c0936d37d1d4fc8170f48.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e32114a-e011-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766502618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502618, "uuid": "b0aaa28d-b376-44d7-834a-195b440a7842", "comment": "Malware payload", "value": "007a93764e6860ba257a2167890594d0", "object_relation": "md5", "Tag": [ { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502618, "uuid": "0f916215-4c18-48f4-9312-a8e23d5a2aad", "comment": "Malware payload", "value": "4beb899a712dddcf15509605df6bb93b58f168bfcc6f064bfee2315d1333fb38", "object_relation": "sha256", "Tag": [ { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502618, "uuid": "f6a778b2-30ed-40b7-a9cf-c9820f54b177", "comment": "Malware payload", "value": "dc405fbb8e2a1197eb7097f52381187206b5ea67", "object_relation": "sha1", "Tag": [ { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502618, "uuid": "5941cb3e-6d55-40e4-bcbc-8c486eb00bb7", "comment": "Malware payload", "value": "a8252527b69d3bd575292676888b1b2378fe1b32f9c952cefdfffe9b4b0e5e4b1efe186950fb361111a5212f4a29fed9", "object_relation": "sha3-384", "Tag": [ { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502618, "uuid": "0be6e6c6-68ab-4a7b-9653-5de6774c96be", "value": "T18D613BD4BB3C0B5CE15B43FB78E552E6656C069A2E948F0EA0A48FF35D1B362C493860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502618, "uuid": "5c9ecbb4-96b1-41ff-899b-b872c7d6df6c", "value": "48:gn9othnooOT1/qVbqdGIVp4NWjORVFQ55AsybKpGbDtzD1thJYERaSuXWBk1:gnOn584VbqdTp4jZvsybKYb1lJYEE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502618, "uuid": "9a3610ac-9f23-4d71-ae51-f4bc42214029", "value": 3272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502618, "uuid": "bfc2350d-1bc5-427b-9c40-ebd72cdf07b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502618, "uuid": "cdd3418f-22c7-4e73-ac8c-b8abb070bd37", "value": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6418f051-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478952, "uuid": "0aa65e1d-6dc4-4397-8bfa-5d4018043d74", "comment": "Malware payload", "value": "c4308072664594a76fb7f34ebb774d83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478952, "uuid": "27bfdcde-7357-43b0-88c8-978dd00acb7b", "comment": "Malware payload", "value": "4c15b86acb87119ef69ff641229283fb470964c006ca32d73270c734b8f29c04", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478952, "uuid": "12b1e61b-3735-4b01-9b78-8f98bd661933", "comment": "Malware payload", "value": "07f1689bf9489fb3cd346dd55897dd0afa28d68e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478952, "uuid": "ab06ca64-0201-4133-bf4b-e40c71621ce8", "comment": "Malware payload", "value": "16d662a4294d7f697d5a8cde3860c32dc3fb201c959b041578401a013247e9a8eb44e23f9918ce8be5e4f98a61c30aef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478952, "uuid": "b3156583-3805-4c18-9e22-9ec2b0526b35", "value": "T1B6632A17666BC9230B376E16FFFE8281155B22243D539C12BF063883BA74E7C75A6358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478952, "uuid": "c9746be8-9aa7-4c00-9c68-6653f2f01d7d", "value": "1536:I9l/AoSSMXqKpq823OMqD8zqDqmqnoqzEq+s8D/iMrXRoFn7q2RUqKR9FqLq1mqC:I9l/5MXxpd23OMk8zaNEoOENs8D/iMrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478952, "uuid": "7146a210-91d0-4192-bf7b-c3e3dd89410a", "value": 70572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478952, "uuid": "d7a5e3f4-bbf2-464d-9d5a-57cdd18dd977", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478952, "uuid": "83dfdef2-4762-49c1-8771-50fca2e9cf1e", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4946cca4-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488356, "uuid": "a20994cb-595a-4754-acac-4a066c06de96", "comment": "Malware payload", "value": "a7fc9d69843e110ce6f7b372ec4fef05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488356, "uuid": "38824bbe-36ff-40cd-bca1-037f4504145e", "comment": "Malware payload", "value": "4c35f0f5a81eb78ee167c2def3864d84d6f2fbf368eeab916f8be19e0ad049cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488356, "uuid": "06a7a884-4e41-433c-b136-bd375e85781f", "comment": "Malware payload", "value": "1f86b021e30daf1a663141d9f4122560f6ab00a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488356, "uuid": "5957b922-b9b8-4658-aaa3-6f1ca5ad63a7", "comment": "Malware payload", "value": "6d3d6f18873765541fc6fed14af9009a91026accfa2ac3b98e44dd77add69394e0811e6f95041478fd582d00440f9006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488356, "uuid": "94642ab5-9447-41f5-bb95-203d0609ac49", "value": "T12BF41200B2C1D075E4B310BA5AF689A9162CFE7017296EDFB3C819BA5B719C07936C5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488356, "uuid": "9700dd83-e59c-40f0-adf1-1e3bd47581b2", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488356, "uuid": "02b96bf5-7949-46e5-8983-1e219a7ff5e0", "value": "12288:QHztGhqRHPA5iJCoXkjpwN19d+mXqB14OlvsGWRGbf7i2ZpxngbbPrIr94PRt:AuKI4qjaf94poYbDiExn4Mra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488356, "uuid": "a5475223-5af6-494c-8290-151f7bf45461", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488356, "uuid": "0b8c6b33-7293-4857-9ff0-a866c28757c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488356, "uuid": "e813f2cb-2cf2-4822-aafb-493eb701633f", "value": "4c35f0f5a81eb78ee167c2def3864d84d6f2fbf368eeab916f8be19e0ad049cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67173200-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478957, "uuid": "eb0e2780-df67-42cb-8537-06941ac64ad0", "comment": "Malware payload", "value": "dac49925a46bf1d223915000a4092859", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478957, "uuid": "681fda84-65f3-4b9c-a294-ec78350485b3", "comment": "Malware payload", "value": "4c701844736c1a3efcbd080637ad6187b4c7a2abada2be4f338b82dd53d08f37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478957, "uuid": "33ae030d-5995-481a-abe5-415b4ddc3bde", "comment": "Malware payload", "value": "34076b35cc4471b9266e17f84363322b1c86a01f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478957, "uuid": "bc903a53-7155-4520-9f48-a79c8ac05334", "comment": "Malware payload", "value": "224805c1fc51ba7181d7d0d7966b02571288a894448985fcf5a83364e9ba42c50c7e4417d0c4adbdb537723387ce8027", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478957, "uuid": "68727700-9a99-45ea-91c1-796db5f8a89e", "value": "T1C473F63E9D337CC85E73329C572D1730A4D4BA78C940F17D8265B60B467A25B29EAF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478957, "uuid": "6a6fa969-2bf6-4c1d-8603-df013ab10715", "value": "768:I8w/h62/jWs6oS+xISN0vTB/GNrdkfScBYrwz2y8kTAlGB:I9l/AoSSM9CusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478957, "uuid": "56c59b3d-7571-40e7-82c0-6a6a53fae16d", "value": 73442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478957, "uuid": "392f991b-8734-43c3-b6db-082a5baa0ad7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478957, "uuid": "540a43c5-424f-4f31-861c-cfa9b8494590", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6656172e-df92-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766448032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448032, "uuid": "038b9b0b-4804-44bd-9413-46f23b80f596", "comment": "Malware payload (ValleyRAT)", "value": "475f3816eac696998d989fddd8299e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448032, "uuid": "bba89a1b-e5a6-4433-ba0b-7c5a6ed54a40", "comment": "Malware payload (ValleyRAT)", "value": "4c993a15232b3a3f78261be4d01c24ded4df626ca571b2113482aa747fbda19c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448032, "uuid": "ee974fdb-8b69-4bdc-8155-61060fbbe632", "comment": "Malware payload (ValleyRAT)", "value": "c70e981b0f6e1f350b3f5ecdb74d7a8dabd86df3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448032, "uuid": "af6c9854-7441-463d-90aa-09b5338594bc", "comment": "Malware payload (ValleyRAT)", "value": "58f21db313112a8cce414ce2e3bd05a0de80683d270c0b5da80d6f222e9a1ea4760715f93698a12fd9cbccbcb1cfeda9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448032, "uuid": "5052bcf4-c122-45fb-814f-64e9b92e9b39", "value": "T1E496339F1CCFACDAC5B10170BB3B9BD7A3B6AE550995CC2D66C03445B1B5AA3302E6C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448032, "uuid": "94670b8a-c0e5-48f0-acc2-c28cd6ae9068", "value": "a6e88978190402037523e1eaa1add838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448032, "uuid": "ee5f2be1-4332-4b3d-a53c-b39a270a8b69", "value": "196608:puXlYeEG9MKSHtj8X0FggtB9z7Q3ghWIdWd8xi9VXG:pilYybSxyU9z7Rba9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448032, "uuid": "cf67349b-cf3d-4109-a31c-f4f8a732b4ec", "value": 8760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448032, "uuid": "b49b6d82-f71e-442c-9cea-f41e02ef2026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448032, "uuid": "c2fff43f-030d-4f3b-988f-d2c414eba6e9", "value": "4c993a15232b3a3f78261be4d01c24ded4df626ca571b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a43713-e051-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766530174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530174, "uuid": "a4f2a6ec-2464-413a-94a4-d56926326968", "comment": "Malware payload", "value": "88221de1964b82a9ad79988b0cde4ea2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530174, "uuid": "43dc8547-989a-4a29-a39b-4f401e130e96", "comment": "Malware payload", "value": "4cc61331730543fc1f257190da8b85fbfd590ad506cc61007aa5a602e18439ae", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530174, "uuid": "cd9ff4d1-df57-4198-aed5-689d1befebe9", "comment": "Malware payload", "value": "165ce9bbe10b1f6cb0976713efd11ace90606f80", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530174, "uuid": "98dc1eb2-c117-46b5-92e8-a498183977c5", "comment": "Malware payload", "value": "ceb8822bdb9b98e53c003a0bf754fef9f7175858a226ac2631fe703ade7e64813e2672c958b200d5b1e931725aa0b4dd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530174, "uuid": "e44782e5-faa0-4240-87e8-430babebb0f4", "value": "T19CE07D855C24200BDE9AC9994612930AAC4722C1551A8741172CE8253902EEAC69E466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530174, "uuid": "7b7abd9d-2baa-472b-8367-80de8b388f5c", "value": "6:hHNGDXvay2olNHn+YWjvT9Ds81R3KupMFXA98WFYekWpIJR3Kb6:myyrXn+YWjvT9Y81kUMhA98WFjn2k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530174, "uuid": "35ecd253-ee19-4fbf-98b3-4b729a8fa2ff", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530174, "uuid": "552c96a6-2897-4d55-a1d5-7ebccecf16e1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530174, "uuid": "d1505f8f-6823-4140-b83d-42ec733c1acb", "value": "ghost_crypter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8262e319-e006-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766497901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497901, "uuid": "798423d1-a9a7-49a1-95ab-213d99b76f9d", "comment": "Malware payload (Mirai)", "value": "0db3beb9f15db5cb6a7a71a54abeee72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497901, "uuid": "815df4af-0eea-4fff-a61f-ea66bb411f38", "comment": "Malware payload (Mirai)", "value": "4d5a9a2f2e81daf2490c91bbc8f8a9363cea14da81749fa0131ba80512542b30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497901, "uuid": "9c1b6765-ac4f-4e2b-ad9f-c0d3f8b87ae8", "comment": "Malware payload (Mirai)", "value": "b64d16af725768a681d48a1acfbe298d3d376d3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497901, "uuid": "9d6ec78a-89d6-4968-bf76-119882c93110", "comment": "Malware payload (Mirai)", "value": "6435fc4ce5ce394c80df3118dd6460b9e9ab25e0a859d9fa21237787963100d570f4e52682fa33ad56aeef7a12294e93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497901, "uuid": "417ac73a-7795-4949-8d5d-c75e50f356c1", "value": "T13263C752B8819117C9D892F7F21E119E331513B8D2EB3303AC356F613689D9F0EA7E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497901, "uuid": "301bccff-9410-4c85-b264-d6165f66b70f", "value": "768:K8MpKyiskYMBLAZ9xryvSMfp3NgBEnFx+QO9tzqLv0BohoW/mv/+OTOrNomdNVjC:jMAyQ7AZUnpwC/47zQF/mv/LAdz7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497901, "uuid": "92fbab05-7617-4234-b5f1-0f471fe34d08", "value": 73072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497901, "uuid": "d8080f4e-e981-45c4-9b9a-72349d6eb5ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497901, "uuid": "6ce08e5a-bc82-44be-bb41-70db9b8014b1", "value": "shadow.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba60526-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510184, "uuid": "6fbfb7e5-fc17-4a9c-a08d-f332151193da", "comment": "Malware payload", "value": "4f7e85ecfff9fdc7000df49ba571a014", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510184, "uuid": "ef850011-ac1a-4d5c-9950-96ee4b05b9cd", "comment": "Malware payload", "value": "4def4e80c6c744dbd0057ae877d33ae371068308e97e199d6b740c00cc8d0365", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510184, "uuid": "31938bc6-31b5-44ee-8905-bdc0302f9659", "comment": "Malware payload", "value": "6a27244989ad26e2aafd004fb6a77a017ef31ea2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510184, "uuid": "0cd2d07a-f945-4e69-a50b-335ac8ea0090", "comment": "Malware payload", "value": "cba3d6fb559a70492d58add95099f68e988d16217d6912b91e3c635e091120525762929cc9053a1d74717358676ebd46", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510184, "uuid": "bea495e1-75f8-43b9-b5bd-3e902885d160", "value": "T157A633516FD41D3D0AFD5239F46F2B9E73560FA208ADE4CF82D5318607AEA06693EC06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510184, "uuid": "705f54c8-7808-4dc1-a477-1005cde497c8", "value": "49152:U4uPavUkjFeT6aVMoogtS6WNIqKLRKe2SgkTVZKErSsJJrClwXLxVDfd0TfhQ5ID:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510184, "uuid": "cdab0569-fb44-4465-95d6-ac1b3755206a", "value": 10115814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510184, "uuid": "5326c19f-ba3a-46b4-b295-9eab1227e4d6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510184, "uuid": "d06bf053-865a-452b-b073-0784816628c8", "value": "Captcha.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d599ae4-e017-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766505086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505086, "uuid": "6f150184-edb4-41d3-b685-94b78f3d9ba2", "comment": "Malware payload", "value": "2f43f7899acab657414e9b42e57dd1eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505086, "uuid": "dd3dcc8e-5dd5-4722-9170-41406a6efb38", "comment": "Malware payload", "value": "4e0bc6b4ca402ad64e3abc117db20e85e1c14daca8bbad08b244e1fb8dd0511f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505086, "uuid": "6a9e96d8-4a8f-4498-ba04-b448cc44128f", "comment": "Malware payload", "value": "f70a2dae4601e2c7a5ba8fc208165c80617f0cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505086, "uuid": "cecd6fc4-5bba-48f4-95b7-cf1bb5aa4ef9", "comment": "Malware payload", "value": "02562b5d932e16889fca8bca67e0c8b63095397d393ff8e9e0ee10aaaab16b252172a7bfd737a676403de2189f2a5cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505086, "uuid": "313cbc04-d43c-4de3-bd74-2c88d6f1d9fa", "value": "T129187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505086, "uuid": "38988d66-2403-4aeb-8f69-97018ff9724e", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505086, "uuid": "5249caba-39cb-4a47-bead-844f3d55df70", "value": "786432:4AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:4AZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766505086, "uuid": "fab757ee-9942-45a7-9842-35b97618e905", "value": 90432512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766505086, "uuid": "e9eefffe-b430-4b97-bb1b-f7d704b7cf90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505086, "uuid": "bde21b68-5270-4696-a8cb-9f8fc421861b", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458ea1a3-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488350, "uuid": "efaec4bf-a551-4ebd-ab42-c49e516abaa3", "comment": "Malware payload", "value": "1478bb98b923390b0923f7eb0328afc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488350, "uuid": "68374b6a-9d6c-48d0-a744-0e2b193129a8", "comment": "Malware payload", "value": "4e9ec4cbd19d75cae2d69e03e7dfaf55cf2d28bf45ed41a864887c2db219ba95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488350, "uuid": "e34a7596-5a51-415f-b465-78667b2f5c5c", "comment": "Malware payload", "value": "8a4d7f92a351b9d6ec79c1f50daffcb52e862e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488350, "uuid": "4c612e15-f43d-454b-8fcd-9892891fd2c8", "comment": "Malware payload", "value": "9e54b46e615e1668c53485702dc4ec55f6a3756d715cd3fa588af19744df09647a2b4aa13869eb1a0d4e061ad15a6b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488350, "uuid": "72733667-f457-4bab-ad06-c66828c24301", "value": "T1FEE4125074C19432E47E167646F46CACEF7CFA301B9856EBB7D828674F304E0993A86B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488350, "uuid": "e235bed1-3739-4a10-9655-2e503518a914", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488350, "uuid": "406295f7-e8c0-4124-89d6-b8a493bcaaa4", "value": "12288:yHztGhqRH93dc6qRsb+nn86iVtXCDtxq2zKzI1c0nPMnDLpLN5pf3ie7CZWUzD:WuKd326ysb+nHirS3q1zI7MnDLpx5FSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488350, "uuid": "0cca91f7-033b-47a1-a2b3-7bca396d74ae", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488350, "uuid": "d8892776-4aed-48ea-9ae0-93b9c6e13a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488350, "uuid": "1e4fc850-f562-416c-b698-76a8756b86b3", "value": "4e9ec4cbd19d75cae2d69e03e7dfaf55cf2d28bf45ed41a864887c2db219ba95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632133ce-dffd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766493983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493983, "uuid": "c1ed3fe1-6caf-4732-b45b-c686fbd7849b", "comment": "Malware payload (Mirai)", "value": "ef24b2408a3da29886e8fa6fcd5b9e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493983, "uuid": "b26269da-bf5b-4376-9b9b-f5a368c83799", "comment": "Malware payload (Mirai)", "value": "4ede7c117fc9bd6a1f24271fb825840c4ca67897643c20ba6e064b2088c770e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493983, "uuid": "4f925fdf-898f-439b-8324-ce2fa43ac3f2", "comment": "Malware payload (Mirai)", "value": "84b9f0cf2560ccf0849679fd75c3b6811ba9f096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493983, "uuid": "0774f817-a41d-4994-9924-12bd5b37c5cc", "comment": "Malware payload (Mirai)", "value": "6d4b20ed50783d33e15dbf08fcb0b1a9c73d2fe95f8e8cc931fdd0bc308164a2dd0f51906b132926bbc3bbcf3fdb0083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493983, "uuid": "7b26ab87-92a0-4699-8dc4-c49c2f79ead6", "value": "T1225302A24932377BF52860FDBBB1919489C95DF05FAAA25B2B9C116B32B0F4C611D0CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493983, "uuid": "f76689a3-b2ce-47af-8e4d-4f1d179042c4", "value": "1536:87S1symLz4ab7sU4Gpk+x5cpzT2M2h5cBE+NdAQv:8W63jsFhzKME5AqQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493983, "uuid": "5ff6ff0a-5ce4-424f-806c-e154bccb4d96", "value": 60676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493983, "uuid": "0933e1bd-5adb-4b50-b992-a1fc686345d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493983, "uuid": "3b39a86f-626c-4e57-af6d-a30be052c4a4", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5ed054-df96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449706, "uuid": "7868e82d-f1b3-4769-893a-6e092ec5211b", "comment": "Malware payload (Mirai)", "value": "d49f5284cb3f02fbbd5401638189da4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449706, "uuid": "feb3d162-734d-446e-a3c1-77c562b9892a", "comment": "Malware payload (Mirai)", "value": "4f44dd1fe97d6304c0ea3b15394796012859e2d5a7f19871af851b60d5c57e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449706, "uuid": "c1977d5c-4a62-45ef-9991-6b5f3bc1233c", "comment": "Malware payload (Mirai)", "value": "65e35aa7fb348739a50842e68755b87e79071201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449706, "uuid": "cb36cccb-b011-45d1-b184-ab53186e3bc1", "comment": "Malware payload (Mirai)", "value": "df5cc0a2504115e9637dba0e31e35fb6988690feca04cab0606def9f722cab0d8e647a9d8dc3e1c97dca3a619e58b905", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449706, "uuid": "a3a7019e-4b02-46c6-aa74-08a0b04e4f8d", "value": "T137733A97E002DDBDF80EE677845B0B11B93577415F520F27A69AFDE3AD320848D2AD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449706, "uuid": "1ca65592-64b8-49b7-94b4-7da4e08e12ae", "value": "1536:YffoLtKLQlDElOFGPHact2FAz8QSZODbMieEH1CQsZgoWTPC:YffGEm06ct2mqMdeM1CQsqod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449706, "uuid": "3f761aca-108b-4286-b93a-a6cdac3ffa06", "value": 77808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449706, "uuid": "0aca090d-38ed-4f25-b13f-189cd60837e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449706, "uuid": "fc5a9a5c-ba03-4db7-941c-739215483e1b", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8710bfe4-dfcb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766472568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472568, "uuid": "8b35f4fb-00ca-420f-9219-2cd6d1a67241", "comment": "Malware payload (Mirai)", "value": "b30677dbdc44f5be7fbd16d2bfe07fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472568, "uuid": "7c33a932-2326-4a2f-b71c-2d69ecab0a3b", "comment": "Malware payload (Mirai)", "value": "4f799f6c834a8fcc22231b2b52fd8f3c1d8aa26843e87d4eb4adc3d4ed67e156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472568, "uuid": "10efe338-0389-4d4c-bcf9-d93905ab9e13", "comment": "Malware payload (Mirai)", "value": "18d96a2204dc6a44a7abf606d13c57a693ed39d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472568, "uuid": "6ad2c8f5-1a45-4713-a03d-1b109854b602", "comment": "Malware payload (Mirai)", "value": "4fc3a6ac3d12a089707c37171443ad9416fefd52e1d07a0b46abca87cf15179c238b949091163262d99239e45d932c69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472568, "uuid": "2ae4dcb5-24a9-4ad5-907e-5543d5842545", "value": "T129B36C46E643F4B0D8161035125BA37A8A399E316432DD9BFBE47F32ECB5F029A1532D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472568, "uuid": "f641df07-80bb-4282-967e-d6536e102c8a", "value": "3072:MO0oEghRRvwHyUYJ+V9SAyWuzr+w5kS11/:MOV1PR4HyUYJ+MAHDSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766472568, "uuid": "3de7d489-21ce-4135-8f15-b01dec64f550", "value": 115436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766472568, "uuid": "31a2643b-581b-452b-991b-655ccc162077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472568, "uuid": "0a48f243-7840-4b71-807e-110493b85699", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9315e774-e01d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766507807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507807, "uuid": "9c9c82ab-90c9-4a14-be52-fd77f88f7626", "comment": "Malware payload (RemcosRAT)", "value": "6a9a6782ea0255c4d5e24cc5102f593e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507807, "uuid": "e31119ec-942b-40f2-9438-e0fca6e8cb29", "comment": "Malware payload (RemcosRAT)", "value": "4f7b4002a9e394d691fc7595d9b37fa2c5d711a486085e3799d0669922b0f8b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507807, "uuid": "2164b406-294b-4bf2-b81e-b737b7705c15", "comment": "Malware payload (RemcosRAT)", "value": "ab6537282e8fb6c4e8e75ee94ca578434c2b2602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507807, "uuid": "1cf3f8c3-f83e-4fb4-9635-522de7639175", "comment": "Malware payload (RemcosRAT)", "value": "e0f6f7c420a82b4526a3ce3078684d56d5fc29cba82e01325752ca49c6dce629aead35b95d3ecec19007aaf83e6531c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507807, "uuid": "22145dba-fefc-4070-9b50-8e652d3544f9", "value": "T110B4AE01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507807, "uuid": "79e44ad9-647d-44c0-9eb9-a11b264686f4", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507807, "uuid": "cfbd96f1-5656-4f2c-b072-3bbb41cf1283", "value": "12288:46pxxGI8gvGOHJpAbDYGxLhZ+sPZNTmPFNF:46pxxx8U+bDYGxLhZtZAPFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766507807, "uuid": "11f3e142-34d4-44d5-938a-b703a0a44094", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766507807, "uuid": "07235b68-66e4-41a9-a25d-79234a0145d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507807, "uuid": "0eee996f-1fa8-4393-be9f-d83832d5a5b1", "value": "4f7b4002a9e394d691fc7595d9b37fa2c5d711a486085e3799d0669922b0f8b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a2bf88-df92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448192, "uuid": "c8685e41-3f36-4b3e-8dd1-ada003f610a5", "comment": "Malware payload (Mirai)", "value": "3092bdf203fa48cbe040f2bde3a8f793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448192, "uuid": "35fcb9e2-ce36-4da5-9971-c3b71a037e5a", "comment": "Malware payload (Mirai)", "value": "4fd84762899b7f1c0f482d4fa689a8a0e9cd47f80441645c4bd49a66488f079d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448192, "uuid": "cb655592-ce0a-48d4-92e3-83835e8af00e", "comment": "Malware payload (Mirai)", "value": "bcecc2be9d405386caa2dd4e8fcc66e0e7dadf09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448192, "uuid": "701a063a-b494-4307-8b2a-e33175fd42ad", "comment": "Malware payload (Mirai)", "value": "9901e0a5f40d1220e828f0e636aef3ec35a754edebc65ec6a6e6f781bf28fbd0323082c88bb2e538748111710228b929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448192, "uuid": "4d124967-eeca-4b3a-aafe-241d121c95ab", "value": "T1EE830996B9818A25C6D452BEFE1E51CD331317B8D3EF73139D106B247B8A82B0E7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448192, "uuid": "2037d242-6a45-44a3-8e61-2c10c1fbabd7", "value": "1536:esnWaWZv399iczqTp7eg0hsA8XqRB03DdDAxl/3JoMabKMli52gM7KxvH7XAYYTk:Omtpk03DdAxl/3h2gM7KxvHbAzTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448192, "uuid": "bcbc6cac-fd0e-45c5-b100-0626c4517de8", "value": 84892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448192, "uuid": "10a7db36-37d7-47b5-aca9-4ceeaf73ceb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448192, "uuid": "c0c29f9d-e77a-4437-a3b6-2ea63cd87bcb", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34a6d96-e019-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766506143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506143, "uuid": "7d04faa8-700b-4cb7-8cf1-cde7ff61f794", "comment": "Malware payload (Vidar)", "value": "90cd223a31c62ea37fc5f70e2ad0897c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506143, "uuid": "58e61c12-e634-4716-aeba-2c16640902cb", "comment": "Malware payload (Vidar)", "value": "5016becadad4b0feeca601a7a86e7c2a660531e106363182d771b33b5426d972", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506143, "uuid": "ac40ebd6-2f52-44e1-be13-c77cf41c5c5d", "comment": "Malware payload (Vidar)", "value": "764f89a1b39c74cca5403aee5052d5c3f48e1bf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506143, "uuid": "405dacf5-8b1f-43e0-9afe-d97c6b8d5681", "comment": "Malware payload (Vidar)", "value": "50a6f9f5dc83dd188998da1490bf620ad126765ccce28be4a2c647f4e3d09f0dd54e5f60f7d81dac2fbeb29ca048f242", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506143, "uuid": "6a1ba32b-bcbe-4f86-bb19-e44caef82871", "value": "T154468D31E541B170E8F914B3A3FA4BB74CE58D483726D0D3A1D538D986722D726FA28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506143, "uuid": "0ee3abc8-655d-43cf-9653-7433bb3179a4", "value": "4200aa356213a0a1ae7ebccde91ba4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506143, "uuid": "6ebe266c-552b-4427-b467-acb8f5c7302b", "value": "49152:GSnOnr19d1FqAAIEtrGcNvPdX2I7WEHPWnHMTPpPOUSaOq2GIMe6YKu9/ubDEAyH:GT9bq9xtf1X7zHOHMFPOUr72Ieh1QLyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766506143, "uuid": "02e35ec4-c48b-4826-935f-4a919bc2dc89", "value": 5862352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766506143, "uuid": "ea3eead2-fab9-4ce0-82b0-2d731ebebf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506143, "uuid": "4a90292b-0045-4d3b-8049-a33787174580", "value": "python310.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df5e15f-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766524066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524066, "uuid": "0af7793e-ec03-4c3a-9ab2-324e7b414324", "comment": "Malware payload (Gafgyt)", "value": "f15fbe26cde2510269ccd991b84ba857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524066, "uuid": "428bdbac-c315-4c71-b6ae-9041030492ec", "comment": "Malware payload (Gafgyt)", "value": "5053ed060495da0ca38b342fc5b17c5fd2e3cb47f63a64c7b7e7dcce2590f833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524066, "uuid": "d1bd92df-e197-4a66-ac67-c2892d28f981", "comment": "Malware payload (Gafgyt)", "value": "0081009c2265a14120cc70cbbc400aadc266df15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524066, "uuid": "b7359db0-400f-4912-8942-a58ee763465f", "comment": "Malware payload (Gafgyt)", "value": "b8f1ae9a643ef9420100af710e5e3532ad4810c7dfdff2b1226ddfe9a9bd7abda13a285f7a25a977f6d35bcde8ddac3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524066, "uuid": "89538a65-1be9-400f-8797-5bad948780aa", "value": "T1B8F46C1AB2F3B1BCD007C03047DBCAB25571F87526222D7B26C5FA352E7ACA51359B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524066, "uuid": "1f5f408b-d8b2-481f-b283-54919007f3e3", "value": "12288:kGtYTM2JD1NglL6tT/EQmehdsH7N7clguPnnWmc2ayfUVHX:k8KLD1Ngo/Nm8euPnWmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524066, "uuid": "5516c0c5-718d-4050-a09e-a8b90817ac2b", "value": 780744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524066, "uuid": "26ef8128-ae14-4bc2-aeae-55325b985e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524066, "uuid": "4ddfe89f-3e9f-4b91-9a58-7f3bfed8f22a", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46863b2c-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478902, "uuid": "86b995b8-ca2e-4401-8e16-ba7bdafa2f23", "comment": "Malware payload", "value": "d01fb5494e0c7a87d586d70bc8a8d50a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478902, "uuid": "f2de5e9f-e4ee-4be9-9a0d-d77674a91e1e", "comment": "Malware payload", "value": "50c9eacc3f953ae25a157eb29aa973fa831622af34d122bb80bad2556854e70f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478902, "uuid": "e715ced6-b2d7-41d6-a3a9-715258e4e6dd", "comment": "Malware payload", "value": "543bb912953a6e9dc618265479a6151747784988", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478902, "uuid": "d75feaa9-2bbf-4a8b-9256-8a1462ec092d", "comment": "Malware payload", "value": "573a8e60aab8af288f07406d002fea7f8b49b8b950c3a7b3af63765403b82fedb3839e8063ce569f53bc8f71416c4605", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478902, "uuid": "ff9e97a0-ddf2-43fd-96d3-64d750710467", "value": "T1DF6309843C425157F2DFD0A5E900ADEA376A6625EBE75B09E270F4A8CDE935F1023DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478902, "uuid": "ac898a9f-89fd-40eb-a1cd-997eb53a44a2", "value": "1536:I9l/AoSSMFUuYUuRUuSUubUueUuqUuuUueUumUufUuSUukUulUuqUudUupUuUUu1:I9l/5MFRYRRRSRbReRqRuReRmRfRSRkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478902, "uuid": "35a3b5a0-357e-4628-878b-7c3c95d20ac4", "value": 71499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478902, "uuid": "545edb07-82da-4fae-aa8d-3a3e0a20327a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478902, "uuid": "8812768f-72e7-4080-9045-11abce8c007f", "value": "invoice-1645080830.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c845794-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524332, "uuid": "08a64bae-64cf-4c85-9611-ce3fe17c91d2", "comment": "Malware payload (Mirai)", "value": "16ac294bc810887410b87f8a3ab61d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524332, "uuid": "57616a2e-88e1-49f0-ab3f-40f553d0badb", "comment": "Malware payload (Mirai)", "value": "51199c18cc13dacef97639210426861f862d5bb99562ccabb8136ba102c531da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524332, "uuid": "acf22e50-3cc9-47de-b385-c6910f88ced4", "comment": "Malware payload (Mirai)", "value": "3b07fc422e23e17ab87a0639c52c48b02f55095f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524332, "uuid": "13f990bc-44ac-45d1-9191-759e4404f80f", "comment": "Malware payload (Mirai)", "value": "172184860f6ed5ff43c1493240178d01576f1c5cda5482a170424b3055d880a236c3b5a0fdb658922cfabb2cea8bed32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524332, "uuid": "eee0c75e-0bfc-402f-9435-3eafb94edf94", "value": "T1DE441881A9818E26C5D817BBF9BF018E3321A7A9D3CBB1178C145B7437C7A5F0D63A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524332, "uuid": "a3f85fc1-ab3b-42cc-8719-1eba50c027db", "value": "6144:pMtDF16WglC1RbRcZQaC9mrsplDKZUfQBKXAVantX+F8Jyvp1G6xxn4J+fBhrFld:pMtDF16WgQUo9mrsplDKZ2QBKXAVants", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524332, "uuid": "1ef7f3a0-b54b-4bb2-8464-2a12b59c265e", "value": 269924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524332, "uuid": "8e9be2e0-f43b-47e0-b0e0-2afe8b93883a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524332, "uuid": "614d76bb-e2b3-47d7-8605-9c08afd287b0", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b2109e-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524189, "uuid": "3c5d1ddf-3471-4ed6-9dbd-b777a292da0e", "comment": "Malware payload (Mirai)", "value": "0d1c8e82f16f8d38f0baaf797e00d58d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524189, "uuid": "834da891-25f4-4ea0-9772-eb5e991032c3", "comment": "Malware payload (Mirai)", "value": "5126bf1b8469e10acf03a536b1ede24ee2c45c21a671a530bdaaa2d8ef95f296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524189, "uuid": "c3329347-81a2-4c9f-98d5-bb9b1a426459", "comment": "Malware payload (Mirai)", "value": "e853a21dbf7f2835504cf6a54d6c60f9070e476d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524189, "uuid": "aa180ddb-bb78-4ef5-b249-c1ae8f7a5b7f", "comment": "Malware payload (Mirai)", "value": "9369bb2dd22721e233dd62a83abf6ae13f79507aa663f007a4f5b124766870c69b1ee58ee88a1e6cabd128d45e43f82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524189, "uuid": "9c4a3976-73cf-41e6-9345-e23583f6c299", "value": "T1D8241A90BA59EC32C05E1D3667FBDB593B0369D14EA2D100C460EBCCFB875C0AB9857A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524189, "uuid": "b24b767d-3261-4f5d-9b5f-80bdd347796b", "value": "3072:fwObuMhXw3VZRO1nPqaamynmetqu4R7vdkiVh43PwH/jv7nGGs2+:btOFZsdqa3y7quyPVh4ofjNs2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524189, "uuid": "847fa87c-bf65-45dc-88b8-56f07af4cc3a", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524189, "uuid": "3969ede5-5c2f-401a-aa24-7ee0537cbc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524189, "uuid": "e8c9ea42-3a38-4714-b70c-bc95f2da032b", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c08f55-e040-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766522862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522862, "uuid": "0332b0ae-0790-42c2-a1a8-2b2fbcde5752", "comment": "Malware payload", "value": "8c5a057b8e7bf2daccd839b57e5c240e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522862, "uuid": "c65804a3-624d-4f94-9ac8-6717c2ab84e5", "comment": "Malware payload", "value": "512997aa6d8f23ec8ec58e54c8c8db47095c5f8c2738c36dd54bd1e1f651825b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522862, "uuid": "428b0be0-f9c4-478c-a4aa-c9fc5dda834e", "comment": "Malware payload", "value": "342230d5e05e0f2c8162ebacc6f933086e7d43f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522862, "uuid": "38e18e5b-13d0-4b35-8c9c-c6ae3b46278a", "comment": "Malware payload", "value": "c78ee8951256be7e1a3ad170a90b9233413b5bc68b8917da65c8e51f3c8a135271f1b054d80fc492b161c1cc6cc2636e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522862, "uuid": "64105ce8-fd56-4cb9-817f-a0db9d80aa09", "value": "T10962D1F673055F9EE7F0883310DF469D8B9B5E5CB08B17B060808D57942A1DA372A0B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522862, "uuid": "57bf9e15-21d5-4c0d-a9a8-52fd42db9938", "value": "384:ECKRMCjnTgpxsioHIZdyk5kEQaswOhTp/ftBF:9tunExUSdyZE39OdRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522862, "uuid": "c7c8de37-75b1-4bca-8a10-c53d7d162373", "value": 15728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522862, "uuid": "194932ad-34db-4818-b4a5-f1a8a33315ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522862, "uuid": "eb70c28d-b507-4e7f-8278-32ec077d8bd2", "value": "87sbhas6as.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74161b0c-e03d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766521499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521499, "uuid": "7f7b307e-f975-4f24-9325-1989cd27deaa", "comment": "Malware payload", "value": "d818867cccdca4f32347a1d1e15d36b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521499, "uuid": "2e04d974-ae37-4be4-9b28-dd6486d6901e", "comment": "Malware payload", "value": "5135ecc7f0189f65e8c10a4f5f9970ce2d3f35ec462c66df6f6b4db3b8126802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521499, "uuid": "cb09a8a0-121d-4491-972f-cd8c60f652e9", "comment": "Malware payload", "value": "2c96710cc18a47dbb8671fb637e32e398ae8cf63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521499, "uuid": "903b48fe-49ab-4d63-95c0-847dc30c64f4", "comment": "Malware payload", "value": "f668f78c8e55b7c07c5eddac9e2a49f94b213f9b16531fd4dd973cdba4cc827f0a312282887b458e43e0f3dd04c19c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521499, "uuid": "300b46e7-ff7c-4398-9f84-9ebf92694eea", "value": "T1C4086B4263EA05C4F9F7DA758AE66617C673BC122F3095CF221C17291F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521499, "uuid": "00b11ca1-0784-4f13-beda-e1ec5913152d", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521499, "uuid": "2da43273-f30d-415c-811f-b7126ff62134", "value": "393216:5IFqKb+iUHdZQKPAg9hAJLPU689cN0DshEQu58EASEhoIaE2lShUcBs4DJ7G15PH:5ndQmQJhnVn0vSa5rs3wbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766521499, "uuid": "c3b9ba9f-d5c7-4275-8cd4-0484fd68c494", "value": 82160160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766521499, "uuid": "90e6742b-d35d-4b22-bc1a-3db87cc76e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521499, "uuid": "c7bc1dd2-69cd-4d9c-ae4a-0adcc3bb2e1f", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65e2333-dfdc-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766479922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479922, "uuid": "f5c7cd5e-a222-4b63-9e92-d60662df3e6b", "comment": "Malware payload (NetSupport)", "value": "af0f325596cf9773285ec1e0dafb1ca9", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479922, "uuid": "e39f42fa-9d4c-422a-8984-ae8206953b1a", "comment": "Malware payload (NetSupport)", "value": "517273bf0621aaa2c2bd71ef9073e914573308f4352c24c501db0cbfe45bd03a", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479922, "uuid": "79c4a041-3ff5-4b55-9f3f-b1a644594386", "comment": "Malware payload (NetSupport)", "value": "96b9d5b77deae187b61a25264c0cedef9e5121e1", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479922, "uuid": "2d259111-06b2-4f8b-bf9e-138be606a0f1", "comment": "Malware payload (NetSupport)", "value": "54f214132973902d4a0e08475971300e80823893a2c730c34d86b0204d180fb9d77e9549fabd6e56d1cdbc1d14c1a4c9", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479922, "uuid": "d3996f7b-21bd-47e2-8ac2-7c77bbdcfc56", "value": "T1E6E53333496ED635E15FA8B9D03CB619BCB51688D7FD7A7AC82B7C80D8A3B640671090", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479922, "uuid": "af6d4b0f-254d-4331-afd5-0893f8947ee0", "value": "49152:l6DgpbEKfSwwyMujj47Rdzy0C9jqgGZetvjOhxTzjR4p8JoiTJhv3dwLivR:lj/SNyX+3yzJqgG6vi3Op8dTDv3dHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479922, "uuid": "69f1856b-67c3-4e02-a146-cea8a3548c25", "value": 3237468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479922, "uuid": "390d5548-46b2-45ea-9a27-23d201e5cf30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479922, "uuid": "3ea37222-8129-4990-9534-2ee297d8f270", "value": "yamityyqsopa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3215cf8e-e020-11f0-a129-42010a9c0007", "comment": "Malware payload (StormKitty)", "timestamp": 1766508933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508933, "uuid": "01f636f8-9e1e-4eb3-a715-3eab8c8801c0", "comment": "Malware payload (StormKitty)", "value": "7f3925dff382cadcf0b296046a2c1fb3", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508933, "uuid": "3992c296-0574-4de7-b5bf-6b4cd6b77ee1", "comment": "Malware payload (StormKitty)", "value": "528da74bdb9e2d14c7efdeae6e6ec95f5311edc6eb894cd29d91c8371c42e88b", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508933, "uuid": "cb30b96b-1739-4e4e-9daa-29e59b8bade2", "comment": "Malware payload (StormKitty)", "value": "5442ec5241b98ee4b99bb3589fd0aff0e4e9e5a1", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508933, "uuid": "75fa360c-3b20-450c-b296-21117a6e2fa2", "comment": "Malware payload (StormKitty)", "value": "dd7c923009ff45ad1511cf7c97fbb629ea18423104acad302665d62f313fe6a935ff9a7e58e1ffed65f5ecddcfe9ce74", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508933, "uuid": "c2486896-2ede-4ddb-bc69-2f45f4c2d0a1", "value": "T1B3078D09EC240674C5A9827056E304D99E36BDD53B501AF726FD7ABD0F236C46ABE2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508933, "uuid": "82322cf8-65b5-49e2-9d34-2e63ff922404", "value": "98304:6toBq+tWqSb+MMXFH5yU4BDGerofitoBq+tWqSb+MMXFH5yU4BDGerof:goUS6+MMXFQx8fYoUS6+MMXFQx8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766508933, "uuid": "78a0806f-c6b2-4beb-a1d0-c0b1948c80cc", "value": 18284544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766508933, "uuid": "fc6edbf5-43fd-42d4-8df0-e589ececc42b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508933, "uuid": "f1a60fb6-de39-4d0e-8c41-69716b7312e2", "value": "Internet Download Manager (IDM) v6.42 Build 42 + Fix{CracksHash}.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb76ad8c-e018-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766505835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505835, "uuid": "2d3087f1-c151-44a6-a647-7d22c7d5902f", "comment": "Malware payload (Amatera)", "value": "bfbd253f8ec4fb4c4d8361f8708fceb2", "object_relation": "md5", "Tag": [ { "name": "89-124-66-114", "colour": "#B2F67F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505835, "uuid": "bf6156d3-7715-4748-bc4d-47830f42cfb8", "comment": "Malware payload (Amatera)", "value": "52c8f8a24b3316b92cb36c3eb9c0cc4467a000176c5208b5611ed092f05289d4", "object_relation": "sha256", "Tag": [ { "name": "89-124-66-114", "colour": "#B2F67F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505835, "uuid": "174b0ff1-4618-4ef5-96bc-f118619c4f5a", "comment": "Malware payload (Amatera)", "value": "ada10e50b08a539bfdbfc031c2732ab4463002e0", "object_relation": "sha1", "Tag": [ { "name": "89-124-66-114", "colour": "#B2F67F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766505835, "uuid": "ce93fd75-f056-40d6-be26-7361e77279d9", "comment": "Malware payload (Amatera)", "value": "50c4355ce26e3cd101d61ddef4fd6f44ddb134423644ffac78d91f650f96267eb77e83102bd818dfe84cfc41561b75ef", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-66-114", "colour": "#B2F67F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505835, "uuid": "4913965c-a9f5-4406-8262-6b3e39d40b99", "value": "T17135124273E45096F8F2437188F286529272BCB8567663EF21A1B27E8E733C1AD35717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505835, "uuid": "f2ce0fe0-0817-403c-b999-0db7f8b27ab8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505835, "uuid": "2a690ab2-e035-4b01-b3b7-76c468c70755", "value": "24576:BN9r5akBR+JQxWNzEuh2gwg4Tc+Y7pS46gz45lx+creewW927:J0QOQxWNzE+2gw6+gElxzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766505835, "uuid": "3934b2ff-8b0d-4b89-bb52-b316626de664", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766505835, "uuid": "54ba0995-9ac3-4af7-9c2b-f73902d6c550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766505835, "uuid": "c1a5402b-c434-4d74-8eab-d8d9a85ced23", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a752920f-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478635, "uuid": "0b4e29cf-06ae-4530-be2b-14946357deb2", "comment": "Malware payload", "value": "3233246ab40f844033cf9153c6db1b2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478635, "uuid": "539b5962-0d50-42ff-a530-4b3752593253", "comment": "Malware payload", "value": "52ea9dc415cebd10add0ddf96e1df88d070218df79cc00935ee75a6d90b01f3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478635, "uuid": "9af60244-2c24-4c83-90c0-7fdbdcc6d923", "comment": "Malware payload", "value": "9de7499c475663db9848197f98e232a8b98f90b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478635, "uuid": "d8438a2d-05a3-475a-9913-729f24aefc23", "comment": "Malware payload", "value": "1bc6e3dc8ef6ebaf2c201219529aca5127c31af60083c3b790d70f900deeb0f19b471c202951bfbb31b9ee850ddb46ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478635, "uuid": "d5430a2e-1fba-485f-87ca-c97c747225e2", "value": "T11A733AE8D4703CCD92375E380EDE8AFD4FB0ADC82D9E44B96DD6A1811E35FD82865246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478635, "uuid": "0b6403a2-9952-46d4-b9b5-652158397752", "value": "768:I8w/h62/jWs6oS+xISN0vNGLKNDdkfScBYrwz2y8kTAlGB:I9l/AoSSMrZusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478635, "uuid": "d0d59dcd-6c32-415b-b13b-a666a15a369a", "value": 73470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478635, "uuid": "10c00af1-ebe2-4fc5-9a60-015e186dc8db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478635, "uuid": "f4b511f8-7004-4196-86a8-273322ac4637", "value": "invoice-1645080830.pdf (103).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f406c23-e014-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766503881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503881, "uuid": "4eb70a19-ac04-488c-8818-a466d2ec195a", "comment": "Malware payload (Stealc)", "value": "6ccdb25dd90c8a1957122813ee48f3eb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-144", "colour": "#4EA127", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8314", "colour": "#C6D6E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503881, "uuid": "1a38c989-0404-4e9a-a059-1268db26d6da", "comment": "Malware payload (Stealc)", "value": "53823495a48996f8908b9e7fb472f482c99c520746d12a6b8bd9a36f1a138a4a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-144", "colour": "#4EA127", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8314", "colour": "#C6D6E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503881, "uuid": "1b2f3270-b570-4b94-b2e0-8d59803cd2d1", "comment": "Malware payload (Stealc)", "value": "2c58af416f39c1ab1403449b9da4a12d314bf3e0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-144", "colour": "#4EA127", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8314", "colour": "#C6D6E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503881, "uuid": "5bce86b5-d892-4f50-a439-b6fd4ac873ec", "comment": "Malware payload (Stealc)", "value": "965bce513f995fea23433a5e9509453c819be430572271c7b5ecdfe28068d684373e44e2b9dbfaa0035fd5550a314199", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-144", "colour": "#4EA127", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8314", "colour": "#C6D6E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503881, "uuid": "459a24e1-dbeb-48a4-b7ec-96ce048ba349", "value": "T1B1E633943CE08A567143C859B6E1C164EFEF7A062B7DA053A01DCD4B915C2783B1BB7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503881, "uuid": "7749110e-a9bb-403d-8657-292f8db2ce8e", "value": "393216:d75IJDcfnSCaS+7B+JtbqYxdlx917gR+ju6:d75DSfSyB+jtxdlv17gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766503881, "uuid": "a64a4084-67d7-4038-a15b-78c3db1a7f7e", "value": 14800371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766503881, "uuid": "41e90fab-3dee-4892-89a1-cc03024470b0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503881, "uuid": "f12cc3c4-bad1-4406-a0a8-43999f2c38d0", "value": "network topology mapper solarwinds crack 395.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2814f9c2-e02b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766513640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513640, "uuid": "f28b2c8f-63ff-4559-9776-d3eea4b2a7ac", "comment": "Malware payload", "value": "bd767aaad67134a3dfb38e4c708f9927", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513640, "uuid": "7bd52c13-d8bd-4d4d-ac30-fd51d137dd6c", "comment": "Malware payload", "value": "5398dfa9b21d13c9881b8775353022160a05f203b981432c15d0d7ca17e2eb54", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513640, "uuid": "1097741b-2b03-4f51-9847-ad1ea117cd5d", "comment": "Malware payload", "value": "a5195fb9d2b72101e041cbc592ef1497b5e2e165", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513640, "uuid": "0659cc13-2227-4eb2-be79-0142513e560d", "comment": "Malware payload", "value": "11ae0a377f856a9f1fe8ada23f4fc9c6783d27a0da4268149927856adb3bb0811bf3558bd93c68d337f25d75879f5c06", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513640, "uuid": "c96ef073-c185-432d-8587-0cc58da58257", "value": "T1082200BCC5E1FDC04B5F31E275DAFAD2129BCB13BD7A1968E98844940B80714EBE954C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513640, "uuid": "8511e52e-11a2-4e32-967b-1508747e9ea3", "value": "192:fzdDqyJLxR61rxTAPzNVw9XSafBtkUHD41tcY+OferUIVfrtXcyQcT1vDht:fp3xR2tTAPJmhSaptkUHAtcYPluf5TQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766513640, "uuid": "4b32ab67-189e-4242-9653-76329fc0c80f", "value": 10283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766513640, "uuid": "ff8afd53-0e6d-41c0-882e-051881ac99af", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513640, "uuid": "e183670e-997e-44ff-9857-c2dd6d8e0342", "value": "txsnd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cab8f32-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531875, "uuid": "1067bb24-fe5a-439d-be36-367af3318137", "comment": "Malware payload (SheetRAT)", "value": "3bccee03bf59c4601c0805d6850c0e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531875, "uuid": "10d38f45-3d4a-462d-9823-2fe7645e1bd5", "comment": "Malware payload (SheetRAT)", "value": "53d2caf655411502709eabbe29b017f9e2ee684f61deeeb4b0f3a56c6bdad26c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531875, "uuid": "c012467a-5f5b-40b2-85b6-d9b3da30da54", "comment": "Malware payload (SheetRAT)", "value": "ecf2b380d7f0b280a30fa227aa28f14546ac69c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531875, "uuid": "c929b902-aaa0-4525-bc6f-dabad953f70e", "comment": "Malware payload (SheetRAT)", "value": "75543a4da816f6024e0ff91758626defd5610e78d381e9004459c0a96989bdd8c231da9603721cb41c649db573b14aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531875, "uuid": "ce20f229-58de-4bcd-9ff5-bcc2b86304d9", "value": "T17494B20CFE91F805CD2E3DB3CAE514044B7169C12E2192923169AFFD8B6A37758E667C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531875, "uuid": "fa80c7d5-f7bc-47c7-a794-bf257ab5d1d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531875, "uuid": "5246e166-8f76-4df8-9e2e-e60578eda0fe", "value": "6144:gXnwB7GiQ4FQyQe0rjCe6VlWT8b93+C129RvYlTgzbfhGxJbuhnvV:gXkGCjhIGPVle84CeY8G6hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531875, "uuid": "fac178e6-2e56-45ca-93bc-1d4fc4de015d", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531875, "uuid": "4583a491-dfec-40b3-b920-4d5a22a5540e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531875, "uuid": "8c9dc1b6-cf20-46cf-bfbb-17bfbc6b2cee", "value": "facquulesnwm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e248d92a-dffa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766492907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492907, "uuid": "768649fc-82ee-40ce-9930-e90f6eb3d5ac", "comment": "Malware payload (Mirai)", "value": "f272b57f6f40644896a478c6336b8be0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492907, "uuid": "8443cd04-1b55-487e-a63d-5fa08da4bd6c", "comment": "Malware payload (Mirai)", "value": "5442e5301eab8ab38d0957494067d4b1e5f0df7123945e9fc2a19ca0e82eb502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492907, "uuid": "8bb4e0dc-7be5-44e4-aa65-c6e5cc4201be", "comment": "Malware payload (Mirai)", "value": "049f8d08bd0fec728b0b71f424a9db3ee6ce3aec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492907, "uuid": "34823db7-2908-4353-9f6b-d6ca9952bee7", "comment": "Malware payload (Mirai)", "value": "38f1aeb033fb241ae33558082c9d8a75a218b0dfe7f4c747e4fc6e2f8edb1b8fffbaded2ff339c554e8e949d7d2ec285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492907, "uuid": "495ebce6-bfd3-4a41-8c54-026ca649fd21", "value": "T10E630695B402EC3CFA4FD679C555450ABABCB30491530FAF927BFD936C321686A2BC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492907, "uuid": "91fb9b5c-a209-4149-aab0-1115c1c27a06", "value": "1536:hrywHlSh/l9+cuDrzIYXNwoC4U9ri58v843:huwAht94PsWCrriON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492907, "uuid": "f670da21-63bc-4fde-8e23-1406bc4aa45e", "value": 67900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492907, "uuid": "489ad11e-7042-4ddd-b4d0-92d702b77fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492907, "uuid": "5529462f-fd9b-425b-94d4-8489ee7f8df5", "value": "shadow.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a773831d-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522874, "uuid": "6919daf1-bb43-43ac-966e-3c171cab5d77", "comment": "Malware payload (Mirai)", "value": "89638aeeb8de332eb6991942a6b34dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522874, "uuid": "c62871f9-a21c-4072-8b41-df868fa198a5", "comment": "Malware payload (Mirai)", "value": "5489d9efb6ff460c835ecff7cf0e0d948fe851b6f37bc9957e2b659be553a534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522874, "uuid": "2821215f-01ff-4749-b08c-f07003e52abf", "comment": "Malware payload (Mirai)", "value": "ad52d17168171ab1982e07aa903c21c0feca3170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522874, "uuid": "442a740c-1998-4cb9-93d7-b6fa41bf73b4", "comment": "Malware payload (Mirai)", "value": "7dcd7ddf6d9eed0dd47ef7b3b3b8e4d77534e576b4538a1da4e3ddf4f84c1f82b0748dc00cf3363dd8a6f45573b39312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522874, "uuid": "5f4d60ba-5450-469d-a45f-6bf443bbda63", "value": "T1D2032A8AB4029E3CF94FF77F54124918F5617356D1D30B2A53A7FE53A8332682E52E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522874, "uuid": "32644092-ff11-463e-a8a9-752fe2a3396e", "value": "768:vIQJ3fiZ0t+FqD806l8lGAq2GfxTW3AGDQY:gMfiuIqw5l8saGfxTOA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522874, "uuid": "7d127fe5-67d5-45d4-a4b6-e876a7509dce", "value": 39040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522874, "uuid": "7377ee6d-a56b-4f1e-9520-4988fc587ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522874, "uuid": "ee2dbecb-38f7-4faf-a8f5-bf5814705cc2", "value": "87sbhas6as.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06eb8e80-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530765, "uuid": "71c00052-5880-4a3a-a23c-acbd7af33e4a", "comment": "Malware payload (Mirai)", "value": "0a87aa79733acbecc0d0a5d395eabce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530765, "uuid": "4e0ba213-b13b-4fd1-b8d9-875dfca2fbfd", "comment": "Malware payload (Mirai)", "value": "54d4ac8209ac5e13a980cb6a57383f140c92fb69e52c797e7d887e139306438a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530765, "uuid": "c61f5d0d-6464-434d-a738-6f016006ebf2", "comment": "Malware payload (Mirai)", "value": "67e2f72a0cb0c6f3ad6b91b8393d6c3abeec3a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530765, "uuid": "3d303c7e-16af-4d31-8f89-4e85835e3172", "comment": "Malware payload (Mirai)", "value": "1075eb4a762a4c439ad861610e67598b0743464f078f49178d8b57aab2473ee25d7458f58c7368d603f5ebea5489b226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530765, "uuid": "95abf0f6-6bd9-476e-b5be-e482fff7003b", "value": "T17763A506BF214FF7DCAFDD3749A91B05259C640B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530765, "uuid": "f2d0c223-ed81-4724-95ff-7b781be26b32", "value": "768:QxNCJ0EYlDYhHnZwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYl3FwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530765, "uuid": "299c435a-8429-481f-9c27-f3578b8c7f76", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530765, "uuid": "47bc232f-f820-4114-b07b-85a403932a53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530765, "uuid": "7d4329fc-ce09-4e15-ac5c-13447bb93ad6", "value": "Josho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df5f122-e000-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766495155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495155, "uuid": "3e78e393-0a1f-453f-bab5-e99d0f28b70f", "comment": "Malware payload", "value": "eefe61559159b80cc515e4757142ab4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495155, "uuid": "d22f884d-ce99-444c-a57f-c18d8bfff988", "comment": "Malware payload", "value": "5503b22b8ad338da4426809da6aa7286a37224ceb4db6adbda68fdbb84a53a23", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495155, "uuid": "882b829a-8f4e-4cf0-b20a-8be961cbe42c", "comment": "Malware payload", "value": "180e493404d6ef91e843d33dd5191b455257a9b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495155, "uuid": "d236a1d1-680f-4321-9b5b-fffbfcfe90e8", "comment": "Malware payload", "value": "9e0b08719e9138b4083981d8fd9a5775f7c48af8518245e63922a8be60ed60ac9251df04f93be60a44f3cb386557fb50", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495155, "uuid": "edd89553-30d8-47ee-b85b-e0d2f0533307", "value": "T13E65A660F394E86E3C37DEF2361AADE3EA197F183114078AD74D6D18D2AB9245690F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495155, "uuid": "ab7eeac3-2b8a-4639-93c5-2e4aab6cab34", "value": "12288:52BrsRoLlsg5gCP8FFgyBLstkincrwem+AV5RZrxJO/LG5IsZBrPGtukM0E0AF/S:55Pg5TP8E2r3rc+sY4xPpNAAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766495155, "uuid": "24633925-3e34-4d5f-843f-3725c9b2ec86", "value": 1500417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766495155, "uuid": "f579c458-7589-4fae-a4c1-f80f678b188c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495155, "uuid": "dff55140-834c-4b43-a186-4d781fa50a54", "value": "3aeb34a38.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f374d28d-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478763, "uuid": "d69ceecc-c737-422c-9762-62edba3b3290", "comment": "Malware payload", "value": "968d800b0d77947bd3bab54232733941", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478763, "uuid": "471b0e97-05ee-4840-9b8e-a518fdba883e", "comment": "Malware payload", "value": "55ad516d8e13fe32e7ac5da48da200f25327ea85b93b5705cd395908b8566852", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478763, "uuid": "3b5ae573-74a7-4caa-8a54-03886f999e69", "comment": "Malware payload", "value": "dc14e3e4ec5c2dfeaa1a23258cc4033fba42dcc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478763, "uuid": "d0f8d58b-e689-45d1-9309-fe11ab04df74", "comment": "Malware payload", "value": "9b7f87485a35e178bb2ffd0920b8ffc74dec5574c653783640e62c76b8311f5ca02b6bcadf69b4d4b7e81f2caf435809", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478763, "uuid": "63652e7a-7088-4ef1-8e17-48171502443e", "value": "T114633BCDC2C293F930A40BCC3E5275036A6366C616438AF5729265F149E66B23CB7BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478763, "uuid": "b4c52630-4041-4964-8b17-7a41424ab304", "value": "1536:I9l/AoSSMRMhIL1+7UASUc41aCYcV08Tz8gUaJIwLLOlAMjW76WkrCv1uOfa9Z1o:I9l/5M82zusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478763, "uuid": "c5e141e8-f6a0-433d-b7e9-dcdee8d332ed", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478763, "uuid": "cb32cab0-6c3d-4582-9a19-687fcc248201", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478763, "uuid": "3904d6b4-c39c-445f-9bf1-809f6cb6d826", "value": "invoice-1645080830.pdf (76).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c0a197-dfab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766458951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458951, "uuid": "f3c47691-6f09-421b-9f3c-16ddef7a6569", "comment": "Malware payload (Mirai)", "value": "e86e55acfc9c47c4b9502286d224ae0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458951, "uuid": "3aab972e-97f9-4642-b9a3-605c6e2a283a", "comment": "Malware payload (Mirai)", "value": "562f58604b6c7b9a5a7f174b53301b48afc8fab79fff7de2086ea8943978b735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458951, "uuid": "70753791-8fdb-4bca-878b-9976efa9dc21", "comment": "Malware payload (Mirai)", "value": "093c9437e0983c6e0731a783e2806925398c1afb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458951, "uuid": "8b96b284-4516-4124-a6b2-1d708f8d4185", "comment": "Malware payload (Mirai)", "value": "268b9eaa523191ee17109d2e0685d752bdd24f86f3b32fc91d88cb82bd3c397df3e2b68f47acd2ceaf7aba12e4df99f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458951, "uuid": "0f16c89a-99f9-4943-992f-222692b9fa13", "value": "T12CE2E124C1850CDBFFF3BD61C9A9F6D26B61494EF592ADA24448A330CA5AC0BD90DFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458951, "uuid": "885edfd1-3f56-439b-a574-249b4e15e4ea", "value": "768:HvHuRjoMzYIfSWBlAUEgmHeUAEfksFriptjBbl4uVcqgw09R:fuiMcIfSW7nEZHEsriptjBp4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766458951, "uuid": "3a10e7ae-1f67-44f8-a773-e943b5655e79", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766458951, "uuid": "54820e62-ad4a-4e1b-90b4-7fd8468d35ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458951, "uuid": "8e3b53c1-b2d2-40d7-8869-9955e95323e6", "value": "ntppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ea0866-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525127, "uuid": "648fbedb-7a1d-4302-847d-4bd6848663d3", "comment": "Malware payload (Mirai)", "value": "691e20821405abc2674c2e37c9479a1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525127, "uuid": "2a20aa05-71aa-4f42-80f3-424ae686b895", "comment": "Malware payload (Mirai)", "value": "565681f5c662a9eda592e0057aa6be86f84906ea7a67a6b83e75b222735918be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525127, "uuid": "98681a95-d22b-42f0-abd5-305c43817161", "comment": "Malware payload (Mirai)", "value": "5501f66acf2173e9da3205e243ed96e9cde60718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525127, "uuid": "f5947868-993e-46b3-8afc-42936f2a189a", "comment": "Malware payload (Mirai)", "value": "b84f74da51803cafe3180c639e428142d050c7f16fc2e176d9bafe612af87c5b6a561ca70b28cbfcd3c53cb2f8ca127b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525127, "uuid": "b2c9acd9-1d55-472e-9268-ecbfa05dca40", "value": "T10FA3E80E6E119FBDFBA8833107B74E20B69833D63BE1C685D15DE6015E6024E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525127, "uuid": "dcb95add-c12d-4c35-b99c-14e95260894b", "value": "3072:a6bASRNfr1HB3NUdWz5n0CBDFXJWRBwbZnOk+:aNANT1h3NUdWl0gBXeBwROD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525127, "uuid": "4389d0ed-8961-44df-920a-616e75f9f654", "value": 105252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525127, "uuid": "e6e88941-76b0-4153-a1a0-6c32f65f562c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525127, "uuid": "666f25fc-d812-40eb-bc6c-9871a55ef414", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4bf9c0-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478620, "uuid": "3ab545c4-4fac-4cc1-8b13-793f40da5a47", "comment": "Malware payload", "value": "b884fbfdd6b4570bbc8c9e50fabf23a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478620, "uuid": "0e7fc6c8-5a5b-4e6d-9a89-08757923f3b2", "comment": "Malware payload", "value": "574e3eccf103de0c9f6d08f76b220abda8a9fef17c9b7495c33fe5260044a5aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478620, "uuid": "2b4d3817-167f-47fa-9815-7ad7fb9fd5d8", "comment": "Malware payload", "value": "c9eb0a5c530e041d14c57a05688a54c54a2d2476", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478620, "uuid": "e5acc778-2c5f-4fdc-ba5e-ea99af28ce3a", "comment": "Malware payload", "value": "39de79c16c03bcafd131ef5909c81391c8805d6e61c9c674a43316f130c3f6a177dbf115bc0636d4e1cb98827554bdc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478620, "uuid": "64b926c3-04d3-4b8d-b529-f96b66e1334e", "value": "T138630C9BDCA5C6CF3A47B4724BE12B8318BB74A11EA350287E9774F816B9C7301CD924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478620, "uuid": "f5d49029-6516-4945-8ee9-18bc0c12cef3", "value": "1536:I9l/AoSSM3MppfdkllfaOsLo3+3uVtGstIsAHS1gCX6CCFoDXQsOrvfNlKvox59t:I9l/5MnDrusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478620, "uuid": "bf55ba69-055b-48a9-a014-c37c5b55ebf7", "value": 70603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478620, "uuid": "d3b85b39-ce86-40d7-8536-03eb8cf74618", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478620, "uuid": "ec74653b-91e8-4399-ad6c-e9f29a061372", "value": "invoice-1645080830.pdf (106).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313db80d-dffa-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766492610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492610, "uuid": "6f56576d-f617-4af9-b22c-2d53ccdc0c39", "comment": "Malware payload (SheetRAT)", "value": "d3e043be6b577b2c25385f91c60427cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492610, "uuid": "2a63472b-a8ea-4406-a262-fa38421f5805", "comment": "Malware payload (SheetRAT)", "value": "57be639cf84bea56ebb2373cc01d65639c15cbc24bb0a5d45e75350e518267a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492610, "uuid": "d47cb259-76a4-4be8-8e12-d544f27a08db", "comment": "Malware payload (SheetRAT)", "value": "c4992d096a11ad8f7b4157c0817e09c10e5460e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492610, "uuid": "ff32de1f-f704-410b-9cf2-3110aa430f0d", "comment": "Malware payload (SheetRAT)", "value": "4640ecfe1c0f178f8ada0c5ed7c8dbda2aafa61ddcd95a145cf6bd77ab9ea1dd54d6ec4a2a0f928627340296fd7369e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492610, "uuid": "f02c6493-9d70-4611-ae83-42f900cce8db", "value": "T186663394A063C7E7D13F75B52A234F317DFF618C18EA7A1D89097FF01A21A8648E7819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492610, "uuid": "f28c0766-efd1-4877-b643-76b6e03140cf", "value": "196608:l3d0ka20TDCam0wHLeDB+UrssFDx7a/jx:3I2QDCamtHLeDB+UrsaDx7ojx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492610, "uuid": "959405ed-d3b6-4f30-83e2-4947f8f56e47", "value": 6514176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492610, "uuid": "c507f6ff-17cd-422a-9922-fb1bcabf4568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492610, "uuid": "8a6c0452-cc0e-46b7-9960-d9130dc64264", "value": "BootstrapperNew .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a86d6d2-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510155, "uuid": "843330b8-c202-4f0e-80f5-9ece767bfd02", "comment": "Malware payload", "value": "010df58c12d6ab04b83dad0f97ef3181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510155, "uuid": "4f2dbd58-d1e1-439b-aeb4-65cb8fdcb8a5", "comment": "Malware payload", "value": "5825d9068ac063054cb745d7ba8a4745e0a56d8ac0e8c307034cdd1e9f612e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510155, "uuid": "8eb0415f-3950-414b-b865-35c8ee578535", "comment": "Malware payload", "value": "6ff1e7f7409628e6c7c4187b6f6cc2011209b0b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510155, "uuid": "21307bd5-9464-4a00-b6bb-05fe853642d0", "comment": "Malware payload", "value": "00acd00a34403581014ff139fb3ad5da62a9ca32afe54b56e197d5c7f586f7e31651f78d2fdb818a3e07685c8b9716c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510155, "uuid": "8531a651-fa39-4fff-9193-f3ae7eba95c4", "value": "T164633A1BB34368FDC516C5744AEAA733EA71B86306309F7E335CD6301F21E606E6AA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510155, "uuid": "0ba7666f-e8df-4d17-a8e0-97c05cb5868a", "value": "2bae489a39ca6c1d0c0a9187ec771b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510155, "uuid": "e0938c63-10fd-4281-aaee-e9802c447668", "value": "768:XE+6G09zT8cEtkrL9L4arLzilgb1r4O0hs2yYRxsKUtx8XsZuvB1bTDLKGnC52PN:NG2cl4QzO80L/EttUs0vBQczPh7g7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510155, "uuid": "0f023d22-3944-47e9-ae6c-ac184af9e223", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510155, "uuid": "ea12d759-f708-4580-8225-65741b20d385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510155, "uuid": "0e605738-edc1-4310-8339-7b853d87fe63", "value": "raw_cbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036da0b0-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524316, "uuid": "27a0b61c-6609-4f2f-8ee6-f8fec847873e", "comment": "Malware payload (Mirai)", "value": "d0adfa39765ce4ab4438ce3d5867a331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524316, "uuid": "0882fca6-141c-4578-af86-9c741b93c111", "comment": "Malware payload (Mirai)", "value": "586ccab650eb9eabd059044f2dac36ac4d7f3582d4acf52577108ba6fce23a73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524316, "uuid": "ad6f56eb-e88f-4e73-bc3d-fb3a4f2fbc26", "comment": "Malware payload (Mirai)", "value": "0f6487aa970a6fa7ef5a976387f01d7a04c04f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524316, "uuid": "6fc4cac5-42d2-4546-a697-43fa4c25fddb", "comment": "Malware payload (Mirai)", "value": "6cadb4551a8d4db192a3a4e0aaffd8d1214851adf982781da63769795908475b0bbe9bb07de093a77db7039ebcd890d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524316, "uuid": "6e1cb282-4397-4ccb-988e-25669944d0bb", "value": "T1D1043802E603C9B2C01301B212B7CB760E31F9B7AE25D452D3FCFEA5AD656D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524316, "uuid": "93750ff2-094f-4a72-ba41-19640bfee0a8", "value": "3072:6pvxSRDkg9jwwcV58ctaiJE7/CRDh7qU835lpm8X:yv+pf1ctaomi7V8Zm8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524316, "uuid": "34129291-0451-4143-94d5-5764a0ddb981", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524316, "uuid": "4cc8d621-f47c-41ed-a7d1-da79157aace0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524316, "uuid": "fc1b70b7-d903-45da-879a-3d2c2b21aea5", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ba1038-df99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451146, "uuid": "5dbb6a2a-9474-4c18-a793-a449c8632f7b", "comment": "Malware payload (Mirai)", "value": "deaa9e03a7d1733bb7cc9831c02f923e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451146, "uuid": "2df6ce0a-47ed-41ec-a5fe-00e76645d4d5", "comment": "Malware payload (Mirai)", "value": "58d02c1db0cfbecb319e04e5258710c07c33d635517ddb25e8c7c1f785633f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451146, "uuid": "3403ad97-4a95-4f7f-8fdd-131a2d8d021d", "comment": "Malware payload (Mirai)", "value": "1260566818864e573dfd5cbe4b7be4ed273535c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451146, "uuid": "631bb622-017e-457a-bd66-e5d9efe4435f", "comment": "Malware payload (Mirai)", "value": "360075feb8b54ffc4d3d0cb542ca35f73d5472a2505dcdcaa5df712a1566b3362fca78b08c8668b2ecc6363573612979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451146, "uuid": "f9f6888c-39ba-4c47-87b6-6dbdf0df38d3", "value": "T171D3AED7B38B1810C42202F01BD79F9E2E6362019E1BD9F72D1DA67F29766CB1946782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451146, "uuid": "24c78b34-4562-484d-9caa-3bc26ebbb5d9", "value": "1536:SxAWnhdKjjepbuOqR1fIFQu3XoLqZuXClhfIQVxDDKVlg+4Sn1/LWB:Sx7dKjapbuOmIFQW4WgXCvIQ2gan1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451146, "uuid": "cb8815c2-9e3e-4a85-ac5b-954525ed6d54", "value": 140676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451146, "uuid": "615228f4-6efd-430c-b7c7-03845387382b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451146, "uuid": "6cd1f8dc-4067-4416-9920-a1041414dbbd", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4b8404-e02c-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766514025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514025, "uuid": "0bcb561d-181a-40d1-8c0e-6be21fb8bc7b", "comment": "Malware payload (ValleyRAT)", "value": "15a33e6fb14b4f31c3bb6963c2c18110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514025, "uuid": "63f03aa0-369a-45d8-a0f6-7b6552a4db9f", "comment": "Malware payload (ValleyRAT)", "value": "5923f294f1f89ca8789e4afb27d88804dd6ae7d092e99e2095c70335a9b5b22c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514025, "uuid": "bc5c5dcf-c6fd-4016-aad0-1720e8ce3e2c", "comment": "Malware payload (ValleyRAT)", "value": "b41598860baf17776cf65663c95a3c1ce7b2b412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514025, "uuid": "f0d2cb10-cdd4-400a-8563-f51f41b6dfba", "comment": "Malware payload (ValleyRAT)", "value": "aa3152bb7307c2b43258554c00440b604aa212107204a4bf009c43356b7d6d8f8aa58b3c536c74a7a3b12dec97aa9c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514025, "uuid": "69c161fa-6b75-43ac-b318-5fc0ee3531ef", "value": "T164F36C6537AC20F9D4978275C9B28A06E7B3745607B5A7CF0F6086A62F137E06D3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514025, "uuid": "3ad09733-0be3-47e7-acdc-a8857c7cf3c0", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514025, "uuid": "f663ac1b-bdda-4811-b9f5-1324c5bcef3e", "value": "3072:4O55k/y5dAj+BMTYlgEQnB+Y+pek7+3OhVeUqe6oU:4O5n5d56TYZQnB+DpekyV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766514025, "uuid": "49935949-9ab9-4c90-ba4f-83a65cdd2511", "value": 165310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766514025, "uuid": "3441c73b-c601-4162-adfa-d89e5d364f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514025, "uuid": "3fce1b76-471a-44e3-932a-4c8f75c6a836", "value": "15a33e6fb14b4f31c3bb6963c2c18110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f1ec94-df93-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448514, "uuid": "1d754e57-0697-4747-b41c-6c07af9c4188", "comment": "Malware payload (Mirai)", "value": "9980fd2e9031e453e2298004eaed1469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448514, "uuid": "41cc8f57-b79f-42b9-abba-f1b9e8703a11", "comment": "Malware payload (Mirai)", "value": "5937bd35e612a3febd25a671ccffec0a4e43fe303ad15a4bb7fcbffef4127116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448514, "uuid": "97d0cde4-ed4b-45a6-8776-bc0e0fbb47f2", "comment": "Malware payload (Mirai)", "value": "d6fe3f0004430d2851fe4dd8b16f069b63a8239b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448514, "uuid": "c5502836-f341-4106-9c0e-2b6e6ac71853", "comment": "Malware payload (Mirai)", "value": "106592dd9633b406ed0ce17e54bea5ac7d9144ecde270c1d3f7231bebf7f7885678ae3301d7d28b1d41f8f519aba2b83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448514, "uuid": "2b49993d-6c9b-4c25-aad0-f0ce87be6c20", "value": "T195D3B021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448514, "uuid": "d8dd7677-f1df-42af-bb53-e9947bdfcec7", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/x9:PiySSGp+PMmT7zMplP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448514, "uuid": "50045f9a-81ca-436d-bd6a-f5e4f503e883", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448514, "uuid": "499deecc-b1b0-4d9d-9be7-0d3cdee531c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448514, "uuid": "0202ce14-133a-4758-a7da-92211ddb70af", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cbb4c1-e010-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766502287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502287, "uuid": "0a4455df-7da2-4017-9904-0ca1f2999535", "comment": "Malware payload (Stealc)", "value": "7fdd5cd187158d5e471eeaee8918cb47", "object_relation": "md5", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502287, "uuid": "f9635bc3-3677-4538-aea8-889ad09493d4", "comment": "Malware payload (Stealc)", "value": "59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203", "object_relation": "sha256", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502287, "uuid": "7c8684e4-51b1-4f63-9239-fa771e33c2c5", "comment": "Malware payload (Stealc)", "value": "99fe57f3c8ed2efab58b3e42993dd513e79bad16", "object_relation": "sha1", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502287, "uuid": "7276d9d6-b5a6-45c6-90aa-78f973e60a5b", "comment": "Malware payload (Stealc)", "value": "ef2e3be39dbc86ac672714358ebb019210c6144abd0b07ca42c44fc417344bee5c5997bdb617e4b8b43a15f71bf02680", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-104-211", "colour": "#85D045", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502287, "uuid": "3f841013-c174-4c86-a0f9-c08f804c3715", "value": "T119B66B14A4D82607FD7EDFBC999E76540F7AB2952501BB288F5209D92BD2B58CC038F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502287, "uuid": "f4ef0b3d-dfd2-49be-baed-07052c90ba00", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502287, "uuid": "b07f9ff9-e222-4d48-88a9-922e89f29c47", "value": "196608:TMBqZR7laXRRQeNw7dADHGwI8veYeekr5OGN:9b7cBnNadAxI3ICOGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502287, "uuid": "6f97f573-1a04-4b01-9f45-699fed132c88", "value": 10691584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502287, "uuid": "6f78d1ff-eb4d-48f8-a41f-e17e9f945eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502287, "uuid": "7cf513df-3dfa-4412-a84d-fbee601d15d8", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61146b20-dfd6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766477229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477229, "uuid": "ef8daec1-0dc4-4b4c-8b77-91e488622b81", "comment": "Malware payload", "value": "6aed3f54678e704e8fe3e1550cb93200", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477229, "uuid": "ac95518a-c864-4cbc-ba95-73adc90117e7", "comment": "Malware payload", "value": "5a5d6c685b773df74deb9d8ddb9842c1c5249016d1260cd179284c4998752ca7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477229, "uuid": "05b83375-d707-4ce7-9107-94488b192f8f", "comment": "Malware payload", "value": "6016e9055f36c23bb8675f3af8ac44253bc4a780", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477229, "uuid": "8aa6371f-0834-4e4a-a925-71886daf6633", "comment": "Malware payload", "value": "ec937110ed7849b4f2a97719f7655acea63b54dc01d07c9b1f5f3515daf70e371cde7c56c0ed10f303b74ec754bee353", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477229, "uuid": "240b4103-bb6b-4746-87e6-085692847490", "value": "T1A7457C13FD41C0D1E4DA02F293FA1BF65C28522A37A944D795A42CE499608E3B73FB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477229, "uuid": "63b8768d-e13c-48ba-9e3c-0cf08fe623ef", "value": "3c733b5675643aad72c3f03ebfb1a5b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477229, "uuid": "5d65352c-30f3-4922-b326-1bd6064ccab7", "value": "24576:RZrS8ftqbYzaTG7p5SX6BrR/uNQHBfvELjdf960rsJGgbNG:RZr8KR9TANit8lsJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766477229, "uuid": "60b1da9a-a7f3-4e20-b9fe-a32090be27ea", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766477229, "uuid": "0fa18e9d-e8fe-471a-82bc-57956741a842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477229, "uuid": "4f98f6af-d973-4667-a16f-edadb0e8fe00", "value": "5a5d6c685b773df74deb9d8ddb9842c1c5249016d1260cd179284c4998752ca7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd49b197-dfe2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766482564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482564, "uuid": "0e16ee9a-a5af-456d-8e73-798deee250bf", "comment": "Malware payload (Formbook)", "value": "f31cb277c670f9afe7458699724eb870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482564, "uuid": "3b179f55-8433-4ea6-bf8a-3c4628d3f5fa", "comment": "Malware payload (Formbook)", "value": "5aa4328001eb57a54a716ba3c7f0fa7f6b8c390828ea8b33a3c85dfb2838a512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482564, "uuid": "f57373dd-d4e7-4d53-9847-98af81d7f5d9", "comment": "Malware payload (Formbook)", "value": "01b7ff030b7dd9b780674a9a87d1ecbe8c35c00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482564, "uuid": "204d29bf-d364-445f-bd8d-c41cf09d8dc2", "comment": "Malware payload (Formbook)", "value": "3ae187540e611b1d02a134de7d97cb6a7995437d6f4ba2b8a2583b8fbf3a96dd3869bf87b2a1f135d20e6d73b12bba08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482564, "uuid": "6645d1df-e8f9-4ea8-9367-5b02403d087b", "value": "T1A775BE16E3D802A8E537DA74CB656232D6B178064F71A9CF0699D7192F33ED0AB3B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482564, "uuid": "ead47453-4e0b-4430-b220-a8a5059ef803", "value": "51573b5e350d818866d94a5d6dc9477b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482564, "uuid": "66b56d55-245d-42b6-882c-997bb55fea1f", "value": "24576:BDrdBZDSJuq5CtQibDuIJBKH1s1OnGjqVdU4iIVrmGWOtQ2KcF1fMz7D+H:B3dBZDjfuuKHiOnCIVrj/KcF1fC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766482564, "uuid": "3e98cfb4-164e-4f3b-800b-f2d9a1fab338", "value": 1549824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766482564, "uuid": "16f8f557-ce6e-46d4-8c18-e24db72e7f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482564, "uuid": "528f9914-bc5d-4c29-86a6-c036b82e4919", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb658a9-e056-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766532197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532197, "uuid": "250bec08-0648-4cb5-92f6-ce662f9ddf25", "comment": "Malware payload", "value": "fabd48afaaef4cae33c2049b1dc1c3d5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532197, "uuid": "efbe2144-ee38-4063-83bb-2db405f83ad5", "comment": "Malware payload", "value": "5ac973b70e83c6652f5b0b3cd0a3dc9b02f676aeeb7cdf3b1bb70a165bc76daa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532197, "uuid": "4b15c206-9ac4-43cf-b25d-44c426dd0600", "comment": "Malware payload", "value": "0d7a2733f33690476f1fbb07e8dbe10c67107c33", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532197, "uuid": "4d75508a-a425-4200-839b-0b056853e1e5", "comment": "Malware payload", "value": "03139ef3551deb25ac551a92e69e9a3ab405e8881dab79cb53050f5077e054eb2c02c98740611952c8f2991b0b1bfa43", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532197, "uuid": "03883d33-dff5-4581-8a28-a68407318b42", "value": "T1C95623326152303BE6F529B3F454C2302D6DA2282B5CC5AECAD0DD5C79686D1AFFB346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532197, "uuid": "2ec1b8f8-6c73-4875-ae89-f0ab39b7d27d", "value": "657e40fb09b2c5e277b865a7cf2b8089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532197, "uuid": "5899ac05-e563-4c2d-9293-ab8ff9121f76", "value": "98304:cKaAh0t/+lHgPgIlvZWfE3wV3uWOjdzck8Ir9IFL+oLJCkcAPMN:vlatGuIkwfEvRjdzck8+IFLfLJp5PMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532197, "uuid": "dcae4c9a-6f59-40a8-8a76-6c7679bf36fb", "value": 6355970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532197, "uuid": "62942307-ddd5-4646-9b59-d117450fdffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532197, "uuid": "0caf46d7-f724-4446-93e4-6add950bf83b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b1b40e-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525129, "uuid": "22bf7a37-bf31-429d-93d5-740193f475ba", "comment": "Malware payload (Mirai)", "value": "438bbd86ec7a465dd43c59ecfb5fd676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525129, "uuid": "907a9a73-0abb-403c-9619-05c7c3aa5eaf", "comment": "Malware payload (Mirai)", "value": "5bb9ac8eef34f99caf47b43d6df38a1051035a67893dc7e7b6443b90eac94de9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525129, "uuid": "c354ae76-f2fe-42ae-b05e-db94dc521358", "comment": "Malware payload (Mirai)", "value": "5451b113272efd1c2cece7ad5aaecdb3659126e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525129, "uuid": "57fd50eb-b8c1-49f7-a533-d0e237a12ada", "comment": "Malware payload (Mirai)", "value": "261e346ae5137069bd54cbc3a806677ed0c5bf454f466207c8ab4b96e8788249bbedb5ed101cd53b80cf09bad81329b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525129, "uuid": "f81aa035-3366-4e4c-9709-e342b9b50496", "value": "T16D734B036A8184FCC48DC23487AB7639F4B2757D1239F1EA2BC4FE23AD49E501E6D691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525129, "uuid": "a6c5c46e-253c-44ef-9bc4-b10a76acd563", "value": "1536:YNXMcpbBLhjo/mSucXfoBTpTcQzoOlUU2+hp9cetvQd0i7KErb7KghtN9wbZn2:EcybdJo/0cXmTcsoR+hpLtvQ9KErb7Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525129, "uuid": "806f8877-e61c-4242-9bf9-b1ea9abfaefd", "value": 79768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525129, "uuid": "ae7bdb1f-623d-44f8-af7c-3349b1429d97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525129, "uuid": "6b91975d-6194-4145-98da-2407eef4e5db", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ba33d6-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478893, "uuid": "836a97c0-710b-4cdd-8201-f43f4e5ed849", "comment": "Malware payload", "value": "5ed71763cb1efacc5d48fcb000b7fa59", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478893, "uuid": "12797c60-beac-44e7-b0a4-2394c9577d38", "comment": "Malware payload", "value": "5cdff7527b18876f8baa57dfca444407f51e652df39d9c030865ac8ca3d78b28", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478893, "uuid": "1af1795d-4fa5-465e-8a52-df939d687968", "comment": "Malware payload", "value": "fa21648600f9465fe5b2dce5bdbdee4dc4fe46d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478893, "uuid": "e65fbe6c-e427-4219-8213-4815bf7ae211", "comment": "Malware payload", "value": "1772bce9adb0bc3dc3616d6d0ddfc2dd3a1b944e58bc5fab5f8781d2329151342ae4993847a52f069af5c52568bb59bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478893, "uuid": "2ccaa33c-9d29-4b4a-8d6d-0a1e8a12d90a", "value": "T1D7633A80EE5ABCE2A78361705C06841BB20CE74B7D446B72D55827B4FF05E93738B9E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478893, "uuid": "a02ba382-07f5-42ec-8719-41910d092ce0", "value": "768:I8w/h62/jWs6oS+xISN0vr7ULVBNJdkfScBYrwz2y8kTAlGB:I9l/AoSSMcfusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478893, "uuid": "60f1bf4d-2c42-48a6-ab41-adad3016d506", "value": 71554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478893, "uuid": "5b82bcbd-fe13-46aa-8b97-7230d4fc88ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478893, "uuid": "f62041dd-00fb-4061-a5fb-6636ff8a50ad", "value": "invoice-1645080830.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83098539-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478574, "uuid": "f915aade-ef94-482c-9ab6-445eaef048a6", "comment": "Malware payload", "value": "5379c2e9560758008344dda6981465fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478574, "uuid": "7fd4a1ae-62ce-45a8-af08-1d8e00e729ef", "comment": "Malware payload", "value": "5d70538660c535cf47c4614d8d4a8cc313223d8d2e1fe7259a173d08f6473ffa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478574, "uuid": "e2c1c7bb-4b36-4217-8846-3493a7a4ece6", "comment": "Malware payload", "value": "805da103c6a622ef9afd45500f171754cabaa20d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478574, "uuid": "8f6e1f8f-d8e5-453c-97e8-491b86144507", "comment": "Malware payload", "value": "b883d34a0ce3a7cb051167a070511cf49f2a7929f754f16600ede42f808166a5092aefe0b8ef55638dfcfc859c73b1b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478574, "uuid": "e8dbf462-c776-40cd-ae36-789127d9b266", "value": "T1F4636C453E710BDA866BCB10EC7FCA45A153DB0994476FE960F3DCA86E0EE8D6866103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478574, "uuid": "9b15c944-4acb-4423-bf2e-d255243aceee", "value": "1536:I9l/AoSSMaaFsL0qnl2wzJR2yI+MObygXSkq+szAsvtUMhBMYBcen7jJIQwusrd4:I9l/5MaaFsL0qnl2wzJR2yI+MObygXSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478574, "uuid": "342c8992-a221-4294-9fc7-094186bf7523", "value": 67711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478574, "uuid": "0ee863c2-74cd-44b1-9f9f-46bfec564cf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478574, "uuid": "69d6bb8d-40f1-4a8f-a15e-4062172971e1", "value": "invoice-1645080830.pdf (113).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1be8c7-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468872, "uuid": "82265d9e-c820-4499-9f76-40bbbcc76610", "comment": "Malware payload (Mirai)", "value": "025eb2644572105568dd691f7c84fa76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468872, "uuid": "1a98664c-2046-4bb3-bf45-46d3537895e3", "comment": "Malware payload (Mirai)", "value": "5dd2dd08bfdb028500496ba1702738347e747814ee6d4f724598d940a8e76bf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468872, "uuid": "5a55915a-359b-4470-8ade-7d335c59d3b4", "comment": "Malware payload (Mirai)", "value": "7796e7c8505083231672a9c0eb633147af7ae139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468872, "uuid": "d3004f27-fbbb-440c-a23b-df8d129df0f1", "comment": "Malware payload (Mirai)", "value": "17914af8c352c98f1f806fd14a0f3c01176beea99763cbbbf32e755729d49e698520c1abf74b5bb013fd2168065493fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468872, "uuid": "d98352aa-0467-45ff-ae33-6e35b98ffa49", "value": "T1D9A3BF46A241BEAEF058AD3FC4038E1AFB10DF601A832B65A17AF5505FB93C47693F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468872, "uuid": "be178d70-cce4-4bbf-bda5-54b43eecd530", "value": "1536:2wZc6MMZAeXDffYwPiwTc9MGaroErB6HEf1xffHsN4D3fOBmDqu4458rS0:2wZNffVPiwTc9Mbr/os3HsNmD1US0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468872, "uuid": "962d2e98-6a44-4288-91d2-4d97549dda93", "value": 106968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468872, "uuid": "ebd9344a-4793-4bab-8882-3dcae04ea6b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468872, "uuid": "2f527fc5-88ef-4064-8dc7-d065d1029523", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd61ff0-dff9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766492281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492281, "uuid": "797fcc7c-9df2-423d-a5bc-4ee983b967e3", "comment": "Malware payload (Mirai)", "value": "baee5cf8ca3bf71f6a66a1c594c1c5b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492281, "uuid": "aa53a15f-da4b-4d61-991f-271048f8a8ca", "comment": "Malware payload (Mirai)", "value": "5ee3a4aec9a92a62c5d308a2ec541372ab4bacf3fa05e833d880935cf46d0721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492281, "uuid": "80a98404-91c4-4b96-bd7a-0815d681631b", "comment": "Malware payload (Mirai)", "value": "6266538dfeb3e8f08d706a31e972bf7dd4b8222b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492281, "uuid": "72c98488-82d7-4c1d-879c-ce4074d13590", "comment": "Malware payload (Mirai)", "value": "6e970cd1c9ecab3e7279ecbf8d2b1ac511f73bd04f4a9f7b7ee4ca4062086698b23a02cb5d76be2207827ffdee59ec88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492281, "uuid": "b71e9502-1a6c-4945-93ab-8432ec96ed5e", "value": "T195D47D98FE5E3D42D2C7E27CDF8A07A1612BB1E4D72781F23941525DE8C9AEDC7A1201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492281, "uuid": "c550ebac-c5e3-4a9f-b0eb-cc17f3ad2171", "value": "12288:6aLuOO5Dm519NTPovuRJM+E8yW+sAyOw5VYA6:PAa7TPdkWTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492281, "uuid": "e04e25a4-a214-46ee-88f0-3a8394955d80", "value": 597584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492281, "uuid": "539c50a5-9ef9-4da2-b3a3-4840c0631eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492281, "uuid": "08646336-7881-4e67-b70f-761c1e309d41", "value": "shadow.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b599f5a0-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524186, "uuid": "1c665dab-bc19-4a57-a20b-a41c0c7462d6", "comment": "Malware payload (Mirai)", "value": "e21a67f6262ed75235a76f41c05f320f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524186, "uuid": "2d8822f1-2362-4278-ae60-45d8cbaf9bb1", "comment": "Malware payload (Mirai)", "value": "5f76e4b54aeee591df54f4a1b5f4f257013e3685fd9c9501652c2cd8df8a147c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524186, "uuid": "54a1f876-2114-439a-8122-f645d57ef9a2", "comment": "Malware payload (Mirai)", "value": "bf1f3592c811f0d0555fd43182d176adae288c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524186, "uuid": "a1f69e9b-863b-45f8-b681-e7d18a40ae62", "comment": "Malware payload (Mirai)", "value": "497137b2b46c3445144cb6f5d8ecd3fb6405c4872f58b781405f7e2dc5d38395b5c514130736ea40e5971197988efa9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524186, "uuid": "863c013d-f0bc-4921-8927-ed3d7a8305bc", "value": "T15C242A027B0D0F03D1432DF4267B0BE14B9BAD6138FAE681750AFEC957B1DB1654AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524186, "uuid": "5e28b43d-45fc-4258-a5d2-506d0b15bc69", "value": "3072:FPHhqVbmVjairxVqNWZsxthh9C51D8JrEhgXpj1snGKg:F2mJaUxJZsx/h9CbD81Ehcjgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524186, "uuid": "f89c418f-81f8-4eb5-9fdb-0dd90b5ab00e", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524186, "uuid": "33fb7764-2c31-4295-a0fa-84da1fb87ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524186, "uuid": "6f16296d-d09f-491f-912c-5f2941f5f7c1", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f299ca37-dffb-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766493364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493364, "uuid": "b0a774e2-aa10-4482-996d-cdc6339d3983", "comment": "Malware payload (QuasarRAT)", "value": "1ddf5ccb516c07a05ae2bdcec190b1f4", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493364, "uuid": "5fb018ac-46f8-4fad-afa8-598d0b8f2588", "comment": "Malware payload (QuasarRAT)", "value": "5fc91760e012d3883537ab8656f4ed240c350357fb7999476b072cf5d937a417", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493364, "uuid": "61f013fa-b5c9-492f-8f9f-35ab0b91ac06", "comment": "Malware payload (QuasarRAT)", "value": "bb71457b5f03e65a17a0cab03cee02fc83d25e1c", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493364, "uuid": "36a63c99-7fcb-4790-a106-28d6b57dba7a", "comment": "Malware payload (QuasarRAT)", "value": "f3e1543887b68318c576129990bbb43992ea889975878260dcc94268ad371b13efbdcf9b623681b1cecb5c9bb57ec246", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493364, "uuid": "f52f869f-9aa8-4ec4-8545-e4de1406c5a8", "value": "T15F3122B768084DAB5702A4C6D1DA246CDD72E367BA21ECB47640CC2C8F14635E6D2CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493364, "uuid": "5e3113e4-1f94-4cd8-9cbc-d86b631dbb57", "value": "24:9AMfoXnrQMG1KRHvMGEQ8TGdSXcF2MSoMRD2aMblg7dhYXXF3ppj0qkv:eMfoXnHoKRH0YpYx2evYXXNg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493364, "uuid": "e8a508ac-675f-41cc-81e8-4a91a1ae2164", "value": 1836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493364, "uuid": "94535f2f-efe2-4d0b-9bad-a059475ed141", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493364, "uuid": "ad8bf0ef-f06c-47a1-9926-64bf1c1bbd69", "value": "Cheat Mod 2025 install.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56da1fe9-e021-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766509424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509424, "uuid": "2888a014-9895-4c6e-a0a6-8deeefd99486", "comment": "Malware payload", "value": "265ce063dac51635faa44b83c891cadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509424, "uuid": "dd050bf5-a038-4431-98c0-f30ecf0fe35e", "comment": "Malware payload", "value": "5fffec1f48089b4a8d4110f27b7bdcddf2b72d9e66acbdfe97b10ae47b2c7006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509424, "uuid": "fd5c752d-e677-40d9-be7a-ecf7ced986fa", "comment": "Malware payload", "value": "2f30678095614d82ee31ddf955db1b8ac2015ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509424, "uuid": "3e0ef54e-9ab5-4553-8ec6-8aa8bbc6c4b8", "comment": "Malware payload", "value": "5d1c78f079ffde691ce29b217ae894912d01bf7b5032c79b0c7cbe21c18b6959b10b54fba31d6984d96276d94718ebba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509424, "uuid": "562bad61-aad4-4066-9293-fdd7334364d6", "value": "T1E307330D6B91D813DFDEF3B4B262DD719AD406111F51A819AA6B1F7E3C3318382E2E91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509424, "uuid": "5d537f10-d478-46af-83e7-5dd30a6b0447", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509424, "uuid": "ae46f6e6-d074-4dc2-a022-d96227a601f4", "value": "393216:DvJGJ08UGClIvBqbCS6p/+CBTnEOdMrqatTHNB2mNlW2wT:DvgFClIIt2TTn9daq3QlXwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766509424, "uuid": "1e9665f7-26d8-453a-b937-5fad4bd8039f", "value": 16867047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766509424, "uuid": "ba4da428-d7aa-4c61-9bd1-0f88d645bcb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509424, "uuid": "660af99b-83f5-4aaa-8c93-d47e624156f4", "value": "Internet Download Manager (IDM) v9.43 Build 25 + Patch (Lifetime Activation).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843826e7-e057-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766532693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532693, "uuid": "83367980-4887-446e-83cd-5555de673a75", "comment": "Malware payload (Mirai)", "value": "f65d31d57bd49a267e452eb2cfbfa385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532693, "uuid": "366b6be1-d65a-4a28-8eb7-e24cbb02c55d", "comment": "Malware payload (Mirai)", "value": "608206076c605668e5530ce06f636cc0495a4501309f0333b5aa6f7bad5a7b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532693, "uuid": "401f79fd-9208-42f0-8806-6dd3dc522079", "comment": "Malware payload (Mirai)", "value": "52b6639d47b83f585da4bfec7008ebebf3e690ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532693, "uuid": "75385feb-e867-4b82-9377-9a07f6f70faf", "comment": "Malware payload (Mirai)", "value": "0e7ef5f84e9d558ca5f7873886015043ea94d8138e156ef05ffd5ecadd2f4ea1020c79db97303494c1bf9a4027046a61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532693, "uuid": "9b03ce87-7d9e-4cc4-b0d7-86207eafd9fc", "value": "T1B0F3F80ABF601EFBD86FDD3701E90B0A25DC650722982B753634D928F65A64F4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532693, "uuid": "0c4bb489-bdc1-40b6-9c42-924ca60ed29f", "value": "3072:aRxFv9HFB1vIRi0UEkSrfKy793sSEHWnz082:aRxFzB1vyU3YKyFsS860", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532693, "uuid": "fbcf2035-b40c-41e6-98ff-f85161f17e73", "value": 169184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532693, "uuid": "17a1219f-189a-472d-b68b-721373039b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532693, "uuid": "02752334-13f6-4393-aeb9-eb4b8bdad1f6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d5a9c4-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478502, "uuid": "567cb515-e600-4036-9faa-1e3de3e91646", "comment": "Malware payload", "value": "0497937045529eb9d15f674918b6ace0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478502, "uuid": "ca425cf2-175a-4431-88aa-472668bc3f8d", "comment": "Malware payload", "value": "60f3d3f09cdfc4b1a45ec30f7611056c8440aaa879bf8cb0a5a122b25eae85b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478502, "uuid": "74d0292e-331b-4880-a301-0521ff2b91cb", "comment": "Malware payload", "value": "1a761809f6b0028bbffb687f4fcd98dabc293568", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478502, "uuid": "2d14acef-90c9-4ff5-a4f0-15f475736c37", "comment": "Malware payload", "value": "484d0788e5337455d46537096412fcaf24e1ae2ab0aebcbc215aa2c18d6e885e27cfc51cdc5e2fd35a74abea642587ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478502, "uuid": "91a1790e-bcdf-42da-bc37-54b6dc6fc160", "value": "T1CD733B9FB7A8058F59B91F51EA4E5F815F1E12949AF803001A9F9E1C83063CDE6E790F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478502, "uuid": "2c2455f1-3093-4340-abe8-2b6e0f356d19", "value": "768:I8w/h62/jWs6oS+xISN0vLpABJvqdkfScBYrwz2y8kTAlGB:I9l/AoSSMt5usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478502, "uuid": "7cc5b5c5-403a-4fa6-8df8-a458d3b1cab4", "value": 74394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478502, "uuid": "9d6f93f5-6370-417e-9992-671eb7dd0ecf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478502, "uuid": "5d4cb9ab-1359-48a4-9506-34451a589e77", "value": "invoice-1645080830.pdf (124).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86e144e-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479067, "uuid": "e850ef7b-d2d8-4e8d-b4bb-aaa7655e5907", "comment": "Malware payload", "value": "4d0e6db9c1b3d218967a1fd69d29162e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479067, "uuid": "96d8998d-16fa-4bb7-8069-b7e0f15ca2f9", "comment": "Malware payload", "value": "614ce7fb8a4a9214f3c185458394866350ce76cb99ce2012f06dbe9ecaaffa31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479067, "uuid": "df06a6e3-4325-478e-b813-790710b260ba", "comment": "Malware payload", "value": "a7392bb96dd260a322e369545030fc44659b7a0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479067, "uuid": "871970de-92e9-4519-a1ff-818b28accd4b", "comment": "Malware payload", "value": "438e31249a8c4f60c2ae68655d53fe6c0ec24190686a6d6c06ea1d44c3f7f5c86b567c4be9f9094967223308cba45c7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479067, "uuid": "9ff0b8c8-fb86-46c2-8030-90966d257bdd", "value": "T1AE730A8CEB9A7FCC7AFDBBE94A0035587A179074438F21F9894AAD719F3D3885458C24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479067, "uuid": "7142a3b9-a8e1-4b02-9f0d-357548c9d8d0", "value": "1536:I9l/AoSSM59YxSvvqVS1VqH92mWg+06txAVx1KDzhidAuSqVgtV/ZrFyvrFXuLox:I9l/5MzpusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479067, "uuid": "24674115-67ce-40f7-a35d-44b76803e835", "value": 73453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479067, "uuid": "3947f6f0-d7ef-459d-a68b-4d1db9fc90cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479067, "uuid": "014e6a45-dc7a-40fd-8c7b-9f7860f4d9ca", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e95c4d-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478690, "uuid": "931da51a-c00d-480f-aa20-d656f71655c7", "comment": "Malware payload", "value": "274854f079deef4ad295dd16d7d9d1d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478690, "uuid": "97f77dd1-faed-4f1a-b4ee-5d5bb97141bc", "comment": "Malware payload", "value": "6321d18f8395bfb07d42cbaaaf6abd5753778894d10bbafb815900dd9884813e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478690, "uuid": "eee38f47-fee5-498d-8fe6-0ea6a970b093", "comment": "Malware payload", "value": "16d5eb4a35febbedc6638eacfae7816234659edf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478690, "uuid": "5e62fe75-5bf9-40e1-91fd-3e4ca6a1fa05", "comment": "Malware payload", "value": "e3fcd7c449639ef0b73ee2627b64855668f7377f1e2374844d78702115c47f10436ea8c0f149c144c2a0416496f3504e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478690, "uuid": "6cb75bd8-5837-43a4-932c-5013015fcd16", "value": "T16D633CF66E24A90D969D7212DECC0934982004A64F8CF3F615C2F7FE0F956493B5AF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478690, "uuid": "24bb4c43-7170-4158-ba11-1f45334937f7", "value": "768:I8w/h62/jWs6oS+xISN0vsaoaca2a/axaEaHaBaWaY1aOaHaFa31an1aOafaZaTq:I9l/AoSSM1dsurA6ezREusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478690, "uuid": "717c33c1-998b-4c8b-a5cc-6f26d96de6a1", "value": 69712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478690, "uuid": "bd62daf0-6961-4c18-b84d-4e8303845208", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478690, "uuid": "f0647d8d-abc6-4838-9f07-bc355dd5f867", "value": "invoice-1645080830.pdf (91).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4954040c-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478477, "uuid": "9c4f95bd-9f12-4e69-8ef2-5b85a56fed1f", "comment": "Malware payload", "value": "e36d48a8a131c9bb48d7a3f5854a82ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478477, "uuid": "21fec435-7d99-4a8c-b54d-8f71644e59e6", "comment": "Malware payload", "value": "639ca74798e27093c997e009a577130014a0f2539cb54f0031219ca13e8e8765", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478477, "uuid": "10c343b5-d43e-4aa7-958d-41afeb32116f", "comment": "Malware payload", "value": "9603158ec8cd2dd2c27e279106409c5c49be8dd2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478477, "uuid": "a75ff228-e72f-4605-9837-b635086ae10d", "comment": "Malware payload", "value": "15c200694e29ae0f5d165a327cb51617b0c849598bc59940034ecef325c3044bf5738dcc34d98450dd7be231fc673be3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478477, "uuid": "15c99330-8c51-4532-8ddc-c1cd5e016f72", "value": "T1FA6338EB1E94FD5289AA8795BCD853CCE488D92A5C3FB0702145F1C53E067CAB47B9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478477, "uuid": "bc465c57-ec92-48ed-ab8c-0095078b5b85", "value": "1536:I9l/AoSSMdBuhcbo/Yyn3OEm5pAJBQdHTPZjJR8aR9dLKl3BEh62YhCR73DkRRux:I9l/5M78usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478477, "uuid": "ab86e5e4-4c7c-4aaa-9681-8a26182df79c", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478477, "uuid": "27873995-fe6d-4c37-bc3d-a0e7e1e899d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478477, "uuid": "6d019475-2c26-4e24-b967-6e472631d347", "value": "invoice-1645080830.pdf (130).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00738ba-dfab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766458947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458947, "uuid": "d6a46b13-c6ee-4968-b7f4-b0a5ec3a8ff8", "comment": "Malware payload (Mirai)", "value": "aef4cc5d4571ec7f0beeb59fea216eab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458947, "uuid": "94b4bdf9-932c-4e48-9ca5-910a17cf0256", "comment": "Malware payload (Mirai)", "value": "63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458947, "uuid": "615323ac-38a7-45b6-908d-6df1a045098c", "comment": "Malware payload (Mirai)", "value": "8ca7e6e2324e79b68053245c66c08d5a36db8d78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458947, "uuid": "89bc79c2-e9a5-4587-b538-508378194b13", "comment": "Malware payload (Mirai)", "value": "9c9fe2a16b3b068798edbb62f982beedefa4ba706fbeaa60f9e6461e407198a54c625f025db694e6df519709339fb312", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458947, "uuid": "cca1eac8-9896-418b-981e-6f9b4466ccec", "value": "T1A20125CF105DA52161CC8F603197C55818A0DDE21A160EACDFDC48B386E8E10B77AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458947, "uuid": "c26d1f7d-f04b-49dd-a0c8-d7aef7e58baf", "value": "24:cf8UR5iNIx2GRKSoaYOXK0iNckRoFpfD0Gge1JPsn:YTxLRwahX2+kRoHfD6SPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766458947, "uuid": "90c1887e-83eb-4b72-857a-b882933a6f6d", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766458947, "uuid": "58cb5935-4ee8-42a5-a84a-ef54ef762cbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458947, "uuid": "0647394a-007b-4a83-a95b-48ecd0f0eed4", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a9abc4-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479164, "uuid": "fe116210-039a-4e1e-ae6c-0622bc5ea9f8", "comment": "Malware payload", "value": "4d3be3080f0b6832689d861149ea6aa8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479164, "uuid": "264e47a3-c538-411b-848d-8bc37ecf2fb0", "comment": "Malware payload", "value": "63d381b59beeb0b4e4f6304f158755fdfc66be7ce7926dc34eb49f2b2612bf1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479164, "uuid": "b081da58-d735-4a6f-a734-af9c333df1a3", "comment": "Malware payload", "value": "0883a45af53e2af8964e7d7f04e5c8cfb052cd13", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479164, "uuid": "33037d43-d5e9-4ddd-a9e5-09317f5aa9f7", "comment": "Malware payload", "value": "3e21ee1575094256b117f00522cb23eacf0425c9b272737992ca0363a0ecb34ff6f37024e89e75b5b716ab05c64479b5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479164, "uuid": "133dd441-af4d-442b-8610-99e797edea4e", "value": "T1C1731BC789367D59C5FF60705B2F025A9386E1F46D8A37E2B8A1F428700F4879FAD294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479164, "uuid": "de695d69-eaf7-4e36-9b56-d5306a54f54b", "value": "768:I8w/h62/jWs6oS+xISN0vC11Z8o4BGKFdG4y1UPhfBmv07pIiCcVJ5Uuv8Ph8w3a:I9l/AoSSM+xusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479164, "uuid": "9db56453-b317-402e-b417-42df757c0570", "value": 73498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479164, "uuid": "0046482b-ef0d-4422-86ed-dd1285959e80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479164, "uuid": "09e9876b-13a9-4bdf-b6c1-364000ccb4e7", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0b6bd5-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451429, "uuid": "c8925502-845c-4f30-aceb-178e92dd93b3", "comment": "Malware payload (Mirai)", "value": "6bcb8150e7aac836f986d130edfd7a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451429, "uuid": "47d06169-e18c-4890-8b65-0029f4172a55", "comment": "Malware payload (Mirai)", "value": "63d89ed21361129e21135159abee02298cc1b12e3e3bf20818244630d4257378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451429, "uuid": "48966962-d45d-4db4-b6d8-431559baf51f", "comment": "Malware payload (Mirai)", "value": "cd89c821e6f0f882771cdbd15daf91d7a8db722c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451429, "uuid": "aa370d43-6395-4836-afa4-8634c78f178e", "comment": "Malware payload (Mirai)", "value": "d3408f16d8cda3a241fc33e04dd9666d08be0b0cd721fd8f92d03ffea3e270c6a44c9173c46a3f2b925a24ff7b58bc51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451429, "uuid": "a0e2eb02-8f20-4551-b5ec-3018e9a29340", "value": "T18C531983E500EDBDFA4DD63784570E00B564BB654F520B63B377F9ABAD35088482ED8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451429, "uuid": "51fe72b6-3df4-4ef1-b287-d37b2c3596ef", "value": "1536:Fs0qEaXkedDpt6toOBu038QLgxtB8AxXPHd6Y3fDETPYH:20qEVCtthO87eAVPHd6MLXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451429, "uuid": "b5e1f170-e611-4fff-b1f6-50f13ecaaea4", "value": 64924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451429, "uuid": "9b00d2b1-1007-46ca-bccd-17d9330c9db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451429, "uuid": "34ba34b9-d500-41ba-a420-fe56d2b24db2", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470c4e8-dfe0-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766481395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481395, "uuid": "009df510-106f-47e1-8a9a-a4a4cf2cf677", "comment": "Malware payload (AsyncRAT)", "value": "80b0af2d74c70f3993a0ad42b2e65d41", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481395, "uuid": "7951365a-206c-4f33-ad5f-45597b347a68", "comment": "Malware payload (AsyncRAT)", "value": "64c3efdf3e833d6391c2810ec9c9a334f6400a40a816741a1f87318b81e8e468", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481395, "uuid": "55e2cc37-8f59-4e3f-a885-e441c67db36e", "comment": "Malware payload (AsyncRAT)", "value": "0d0b848f07a86a163b47847d3eb6be0821b49280", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481395, "uuid": "2e8a4674-a087-4417-a189-f386233110e7", "comment": "Malware payload (AsyncRAT)", "value": "85c839d8ee43c603e4d8820761db3eb3a7e14c6c09491d5ea3b637120635f8753e8e07a6e5fd96c092b3a200b4de2ccf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481395, "uuid": "549b1aaa-5050-4bfd-88c6-3359b78a1dab", "value": "T153C22A0473F48262D1EC4BBE4833A600D375E58B5D53DB9F6EC494AD2A23BCD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481395, "uuid": "8ac87c3d-477b-45b0-803c-7891ded16548", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481395, "uuid": "8f005a58-93fa-455e-b2b7-c5c111c615cd", "value": "384:8QaA9XyfjjzgeRSQkeKMMymrJhxUHqqbuUsJQxnCJf+BWfXWf/vu+:8QzMjjE9QkeDMyCJhxaFbHBFBju+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766481395, "uuid": "729028fa-68f9-400e-aeb6-09323c529674", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766481395, "uuid": "d61d0d0e-1369-4f28-8bef-8b2339d7b981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481395, "uuid": "d5498910-7547-4cac-b25f-89ebddbd7897", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e680f686-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510094, "uuid": "4b1d9540-f4ee-490d-bbc5-42bab675977a", "comment": "Malware payload", "value": "ad0647adb2449c2addf5badc45a2c94d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510094, "uuid": "592ae9a6-7fdb-4738-90de-0789872d90d7", "comment": "Malware payload", "value": "653b90d033d7e977f2161f77f4e70d30eab30840fd1d238eb051e3ea7bc13520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510094, "uuid": "8108b144-da56-41d5-ab15-d4a0e38574ea", "comment": "Malware payload", "value": "0ef99044a0f418f621f7e8c227274d02b4a41cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510094, "uuid": "9fa6d4ee-cd50-4f42-92cb-248aad064abe", "comment": "Malware payload", "value": "f7ed91dcc76b4e4ed54a49ce3fe2a7ceca513ad272afa12173a7321098951cbf77c2ea1750f5a34dcbea6fd0b6a5e51f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510094, "uuid": "b6824608-c2b8-44d0-b209-6705492d2599", "value": "T194F2E0A233B6071EF0D74533A679C62A277A591D9F23DF1D0709636C3C90EA09B605AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510094, "uuid": "b1cb84f5-f540-45c7-bcd1-dfdd8dd3a265", "value": "f3293c789533ed7182a2471ee6ec63ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510094, "uuid": "0dea4070-5007-49ec-b56e-d21db35ca4f9", "value": "768:oneDtKKlDTH6/i8D/4QbGFpENFo2Be5G6TLdl5NaT0Evkb:EAK0Djt8D/4aY2jtBmNKjvkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510094, "uuid": "ce5e8b29-85db-47f1-be43-d06e666c38e6", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510094, "uuid": "dbd246ae-66b7-4b25-a00b-cda4ba367022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510094, "uuid": "d15fdd2b-ec88-4d09-8c6e-6480f039855e", "value": "cbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ac5341-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510143, "uuid": "106b302a-9282-4c27-a3f6-fa4a27707092", "comment": "Malware payload", "value": "90170f739a785dcb3f863030bc4fd64a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510143, "uuid": "80d9685e-127b-4c81-b74b-d3edacc1a6c9", "comment": "Malware payload", "value": "65fdfb2fe35b497f7daf12505ca9ed686342b615b6d9b0b4b13af4ea390eb808", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510143, "uuid": "e813c772-0c86-41af-b3e7-4bd3ee292192", "comment": "Malware payload", "value": "900bf7a2829a8b477fca1ec37513aa6979037ba5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510143, "uuid": "1e6b2d7a-710e-4faa-8c7f-64419ad25c20", "comment": "Malware payload", "value": "da1e947caf3eda1c4e63b8dc743fa30760e6af9953f8e5a9393b1ded7af27222cf2f70e65c4f542118d1fc95bebe06f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510143, "uuid": "cb59d565-9fe9-4dcf-8b36-83e766ed7917", "value": "T1D336DA5D820F8C12D5367AAAFFC925C7F085EE1E66870CF4BE4C03D997A935182A4F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510143, "uuid": "074de9de-789b-4ad5-9361-2d4d3437438e", "value": "192:TZXSPOVnyRfTbagwTgEDzI9GIE19KXOUUl7aG+1qRB7Na6J6b8bJ6W0nH9ZgBGp1:qk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510143, "uuid": "069fd63b-499c-4046-b340-deb8bf509fbd", "value": 4907663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510143, "uuid": "d45dc5e8-a952-4c63-805a-f40f2b6b7dea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510143, "uuid": "53e51aa7-e468-4192-abd0-2ea01d8ed6a8", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc6b454-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766532011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532011, "uuid": "57f11c01-e3c3-4b3e-aa57-c069c505d6f3", "comment": "Malware payload (SheetRAT)", "value": "8f2e0530bd077ebabdd89c340fbf1742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532011, "uuid": "abd09f97-39d7-4032-80cd-c93ddcea43f4", "comment": "Malware payload (SheetRAT)", "value": "66fffde4c64999b2f9a620f3c8707e1c9116a8e71aec2ee3838897b20027c8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532011, "uuid": "dc3c038f-7024-4595-aee2-8b9e9f0c221c", "comment": "Malware payload (SheetRAT)", "value": "82613f642a5d28ef4191ee4d9556cbb118301277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532011, "uuid": "a59113e8-b1ef-4318-95ba-2f31c0380e1d", "comment": "Malware payload (SheetRAT)", "value": "18821b18be32316fb25be77545f4c456633d820ec9c7ceebccc8e3a7aeb83700975fd0da5c4f3fe8ddeff6f4f46db566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532011, "uuid": "fadd707c-82ab-4147-9a81-a48c02aef636", "value": "T10094B20CFE92E845DE2E3D77CBEA10104B7129C12E2192563159BFFE8B6537658E21BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532011, "uuid": "90ef2d2e-afa5-4588-b9ad-59e97b8e0b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532011, "uuid": "d95db8d3-49e0-4495-ab35-6ce3b33ff6f3", "value": "6144:aB/hgh3nu1kmFa6Xv4uDuxe6VlWT8b9lbsELEfesP2NbpyYbzDFTr:aBZ4Xskya1PVle8r9heir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532011, "uuid": "addb99da-da68-4b6a-a786-307b085b2ca9", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532011, "uuid": "48af8c61-230b-4ee7-b328-e61823671206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532011, "uuid": "9fe6d5c1-3ead-4555-bd60-68dd418fa107", "value": "ybgzqkjzvkjd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183a5ebd-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468517, "uuid": "8e1a78c8-3da2-4092-ae32-bb2714974d35", "comment": "Malware payload (Mirai)", "value": "c4802b2b16c2fc0c7e10525aa4bb8e57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468517, "uuid": "4a367063-9d59-4edd-85ef-d4589e4c0976", "comment": "Malware payload (Mirai)", "value": "67a3d0165a41e9404c786e6036a23831706207265e3d3e184cf4f4bfe8910b49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468517, "uuid": "6dcaab75-f687-4010-870c-c12bcb4b001d", "comment": "Malware payload (Mirai)", "value": "e017edbc62fbefd136a126fdb74b22a57a530d72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468517, "uuid": "8a8a2638-13e5-427f-9596-c67b74ac39f2", "comment": "Malware payload (Mirai)", "value": "5f009fa605051eebdf040bc20ddba4129d77e2aca426e54ce4788e2f4e024a70fe6c37f8200fe5fde53380ab279f76dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468517, "uuid": "2a37104f-aa2f-4749-b9e2-972e024b8429", "value": "T164D30885F881AF10D5C626BBFE4F418A33135BACE3EA7213DD145B2427CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468517, "uuid": "cff54ad2-3639-4b73-a272-3b2d0f74b705", "value": "3072:CTVrtZlkCUsEHSUYnhW2rV5oeh7glCZW/SoE+UqWa+Ynu67a6ynzr:CBrtZlkCUs6SUYnw2nvh7WCZW/SoE7qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468517, "uuid": "cdef4c0b-4541-48d9-a011-54cecf31662a", "value": 140548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468517, "uuid": "315fde8c-7e8d-4581-bc97-fa5a8ab74afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468517, "uuid": "36a6bd4f-465c-49eb-b5ab-010e3cc46563", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ced615-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457809, "uuid": "2ee8566a-42c7-481b-9f25-ddba3dbc64a4", "comment": "Malware payload (Mirai)", "value": "e602a169973bd820da6355c28854e51a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457809, "uuid": "98734be7-4b0b-4b37-9c69-50ed791911b9", "comment": "Malware payload (Mirai)", "value": "67d445a8aafcd3e7c47746cfcda4ad4a92f00fe2b67fb4f4564d9a5b6f219491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457809, "uuid": "f6e9c92b-714e-4ed6-b609-c9ef8ad9d3b9", "comment": "Malware payload (Mirai)", "value": "a518eebc7855f460f783cfcda8fa860971535b12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457809, "uuid": "0aa2e01d-b99a-46c0-a0d9-a9cc27a3c2a8", "comment": "Malware payload (Mirai)", "value": "f58817b8365a11bc9eaafea05575716251a49df8d3a848bd233e4cb4e92e0db156f9b593b0f1acdc2f8afd121d517ac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457809, "uuid": "7783e4ab-c1d0-47b7-bc4c-9230a3d61fea", "value": "T1EEF2F19C6929C0A5CD9EC0BD63D80BB039D90FD25C31EC45B66A74B7EDC98AC781ACD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457809, "uuid": "15427dce-a962-49a3-81c1-9baef5b15fb7", "value": "768:q28cQt5+O/NFhG+xFyFrjdJ5TGoWpXkJCJgGlzDpbuR1Jm:v8RFhGgmdJFGoWpXFVJuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457809, "uuid": "3dc2839a-31fe-4142-8cf1-0078116ed3d8", "value": 36720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457809, "uuid": "074d4cb3-14f3-47f0-8f3a-b9e921c0d5a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457809, "uuid": "bdd40d36-c2c6-402b-8b6d-2c4df37553bd", "value": "ntmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693ea073-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478531, "uuid": "99165a98-9c8e-4051-ad26-f811afb70e66", "comment": "Malware payload", "value": "2551e48ef9eb70fd867cd7eb49c44d30", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478531, "uuid": "b4fa7aec-5ae6-41f8-8744-98ad78f0dfce", "comment": "Malware payload", "value": "69085a062ab13f288251af19181757ce4f78a98ea26873550c5b340cf0d72363", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478531, "uuid": "58955602-ec20-48d5-8b7d-f0ce5c8b8831", "comment": "Malware payload", "value": "0fbf6f429d66458754c507c1601cd23235dd4087", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478531, "uuid": "157ccb60-7160-4e92-a0ee-e54e88bd9b79", "comment": "Malware payload", "value": "60a27f73cab0c929d8cb68db77fe28ac19531f7da10f315ed3ce501ae4c9280f869cc2f79fb626ac49d865aab64d7e94", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478531, "uuid": "d7df203a-39c6-4883-84b3-627023beac65", "value": "T1F6631A6ABDE65CFEC066B74435131C90BC26F2EFE49FAE881687F80D982D24426057D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478531, "uuid": "7cef6e81-db55-4854-86d3-36758e7213a2", "value": "768:I8w/h62/jWs6oS+xISN0vKS+nN+dkfScBYrwz2y8kTAlGB:I9l/AoSSMEcusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478531, "uuid": "5b86b713-c5bf-45df-9b31-d81c2b7e24ee", "value": 72539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478531, "uuid": "dd399655-7123-4b89-8c68-e3b6c2f814ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478531, "uuid": "06d85814-899a-4fb0-9939-929ba667a831", "value": "invoice-1645080830.pdf (115).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce0f6ce-dfe7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766484792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484792, "uuid": "2a8bac3a-fad1-44b6-99ad-01d6a412729f", "comment": "Malware payload", "value": "3fcdcd5988fec5f6e9c5b6fba81c808f", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484792, "uuid": "dab7e3a9-84a5-430c-aecb-76e19202607b", "comment": "Malware payload", "value": "6910fcba9c90a7e8f5983be3cf6908f09a245a4bd3193650a4ce6a04b2bf03b7", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484792, "uuid": "ee1b9487-e690-4825-87d4-e95a644638fb", "comment": "Malware payload", "value": "a8193a4904e4a0c005dcedd09b8b00ce1cf2f1d2", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484792, "uuid": "94612fc6-e339-48e1-b424-14ce332d6e40", "comment": "Malware payload", "value": "9b86d8e0ea86e70b73ddca6ac93ffe842f117e12626ba90d9e6957b910c95df434a465f66abea70a477a678eeddf439f", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484792, "uuid": "d3a5d133-261f-48fc-9ac2-2f0533153698", "value": "T136031990637EBC263BA9C3658EDC5CEEDE21CB50B1A8D45DF24035DC2E4FA9B19581C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484792, "uuid": "7f770d9e-8a11-4509-9bee-ed506ec0a42d", "value": "768:kmQpcc3chJV6cu4sNidozfcg86yLFLPc0S3nObR3zCmZIqwQll8gPSTq2q:QpcwchJ69idoz0h7L1Pc0SebbwQlWgPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484792, "uuid": "6feecf7a-1e07-49ae-85ed-36783ee9cb12", "value": 38996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484792, "uuid": "0bd8786b-c090-4b40-a1c5-e78da3b7c569", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484792, "uuid": "e8f33ee3-4455-4a3c-9713-fc7afa0ca4e1", "value": "6910fcba9c90a7e8f5983be3cf6908f09a245a4bd3193650a4ce6a04b2bf03b7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f46f90-dfab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766458948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458948, "uuid": "588576cd-7574-40e0-9346-09263e3520b3", "comment": "Malware payload (Mirai)", "value": "0c86801efbcdf70f0a6049f236372873", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458948, "uuid": "d584e0b7-e6ca-44c4-890c-3a0c5725fee4", "comment": "Malware payload (Mirai)", "value": "6916678a4add3da849ed52074dda91f54e51843e1883ea3a239480a712bbd0bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458948, "uuid": "f63b3a86-bd99-484d-a2b2-3bf6436462e8", "comment": "Malware payload (Mirai)", "value": "799b244ab4fbbe26736588a46e8e56cb1dd545d3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458948, "uuid": "a2745966-5f50-42d1-b8d5-f72ddf98eda9", "comment": "Malware payload (Mirai)", "value": "5fd0b28c9fae76e3c05e5761b1f62942dad53ba31b217d7a34f7642a2e6013782bbeb8aaf1a0c6ba8d8325498a0e1938", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458948, "uuid": "8370517a-7819-4d34-a598-526c436d47df", "value": "T1820184CD109DF513738C8F64B197D15859A0D8E22A774961EFB48872C4E820177BC3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458948, "uuid": "93e16799-983e-4b63-a5d1-17f39f1770f6", "value": "12:3J3nx9JnxiWmonxQNIxBhnxhaa+lLKYAnxnJPpnxKicsrJnxYMxnx2kdHozgnx81:3J3nfpURMiNIxTGRK/1JPJoa1iwckRob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766458948, "uuid": "2e60c167-dd47-4ed1-ae4a-258f438c9769", "value": 728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766458948, "uuid": "b0d0c79d-529b-42eb-be8e-b5ae8ba5d662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458948, "uuid": "eea89ac3-f987-4be8-afc2-0cf9df4cfa22", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852190c7-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479007, "uuid": "b43701ed-1944-493a-ae80-db83741aba13", "comment": "Malware payload", "value": "2605abf0c8c3b70504cae3c70e27f130", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479007, "uuid": "92b6e383-a3ba-45c3-b167-bb96bcbf293c", "comment": "Malware payload", "value": "69ec98a7ef3206696ea41a913964e8d77da9c36c99ca8e6e8d23027dda22d9bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479007, "uuid": "a6427b6e-297c-40fe-b0af-bc26be6bfa10", "comment": "Malware payload", "value": "882df34e80b34e258ade2a4b088947ca6c09b0c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479007, "uuid": "06fa3b1a-8f4a-4061-804c-59cec11fb561", "comment": "Malware payload", "value": "a8549f663bff1da20b39753bb31beb0afcc1803af38706681af64ec231c9b3abb4fbfcb844161aedd7cae01d31942708", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479007, "uuid": "322b8329-2da7-4665-8bcf-c781c92b6c3f", "value": "T183630A99F231EE0D3A270C86C5F1AA8CB3A93C92729CD1068D6477B54563D8F97CE253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479007, "uuid": "908c52ea-5487-49b2-98b8-969b7f8c6724", "value": "768:I8w/h62/jWs6oS+xISN0vQAuwdNYidkfScBYrwz2y8kTAlGB:I9l/AoSSMvlusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479007, "uuid": "1329576e-911f-4ecf-b370-a43dbee800f3", "value": 72556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479007, "uuid": "4751a95a-fa9b-4d8e-8cc4-e679b5372dee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479007, "uuid": "bbe70ebf-111d-40ea-90d7-cf3cbb520427", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fef7536-e03a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766520123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520123, "uuid": "43884330-0d57-4d13-b958-186c5c5ed63c", "comment": "Malware payload", "value": "0f4cb4cff086416597f9e3b75026569a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520123, "uuid": "fe696ab6-0dc6-447a-bf70-167b104296c8", "comment": "Malware payload", "value": "6a12e911bc3aa8d0596bdcf042aa40fd9bc7f425d1207b382194c3fda3cc8fe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520123, "uuid": "22416cf6-a766-4695-9248-9390a4cf4712", "comment": "Malware payload", "value": "c4bf40ca7901747e3f8734534039a7ba6d562686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520123, "uuid": "b66d6ac6-578c-4fe1-9061-8cf6fe979040", "comment": "Malware payload", "value": "4967160da1738e1c384ec7b4acfc7b864fb33158c9fe22c189a64c4d4b18cb50d3d54fcb2f19da3ef08a3d78405ffb4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520123, "uuid": "7b4633e0-dea2-4735-80d2-9dae0f91d02c", "value": "T19642C005BE52424FDD642DBA5686E400FBD6039428BBAE5803FA8346CBF665E577011F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520123, "uuid": "c2d60aad-6fb3-4611-9125-f4d5c5efdbad", "value": "384:TeV0foxTKXtuvwdtTX9KSyaBSBjeYTfo9V:TDoQtBTX941eYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766520123, "uuid": "c220ac32-4a85-40fc-8ccf-9df9d5717aa2", "value": 12852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766520123, "uuid": "fd1de855-b396-4910-a754-43260d63beff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520123, "uuid": "97c6b223-70d9-4328-b569-a8e37b7d34db", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117b1486-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524340, "uuid": "1df416fd-b222-474c-a876-2ae48345f0c7", "comment": "Malware payload (Mirai)", "value": "9362ed7f98c8fa5eec560704c2086bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524340, "uuid": "013e4e09-3f04-4139-a055-e974c582cc41", "comment": "Malware payload (Mirai)", "value": "6b45751ff27d97931db848be431d4ee20722957099b37530b8fbbed06686452e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524340, "uuid": "11291f44-cfcc-4d35-af73-c23ef99ccca0", "comment": "Malware payload (Mirai)", "value": "0480af32751a274616e82acc5d62bb984e76adae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524340, "uuid": "388eda14-85e9-4f9d-a046-4300e4de4cff", "comment": "Malware payload (Mirai)", "value": "8b777dfaa345909db16c81dc3282b4891a5c04686e52550d016473c0f5ba28a7ecaafa89015299908c4401849c78d45f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524340, "uuid": "b46bfa3f-ff5e-464e-bdf3-6845b922b7c7", "value": "T199043C21643D2F16D4D0B97E127B8B90B1E23A4D2BA8C58DBDB30D4FEF3565068135BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524340, "uuid": "fab9543d-ff0c-47e5-a234-ce2edee13d59", "value": "3072:0qD16vE7iba9VmYgj0vVC/10xl/Pic+GpcY2yv/7+Fu:FD16vE7iba9VmYFpxlXic+Gpp+Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524340, "uuid": "3406577b-5e94-4471-868a-ae1d26549e61", "value": 184888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524340, "uuid": "e7ca7376-fc79-4228-9e42-4c891e775aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524340, "uuid": "db14ef5e-06aa-4248-87d2-e61ca5002eb5", "value": "pandora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112a39a8-e007-11f0-a129-42010a9c0007", "comment": "Malware payload (Guildma)", "timestamp": 1766498140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498140, "uuid": "39f1465c-ef6c-4913-be0b-7c785600e4cc", "comment": "Malware payload (Guildma)", "value": "4699bac8d4d80144724c31a64f9e0c91", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498140, "uuid": "9bcea0c7-c3a9-4eb8-95d1-37c3d935c716", "comment": "Malware payload (Guildma)", "value": "6b75c7c526059a86576fc9573d8f5588bb367a66ffbdaf831628b9855d7e3af1", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498140, "uuid": "1b134d58-6a8b-4e7e-83e4-e9532ed6ba0c", "comment": "Malware payload (Guildma)", "value": "5197b8399301ec27feb1e6ae5a37168201b528e0", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498140, "uuid": "e77aecab-d316-4c96-9438-1261004df0c7", "comment": "Malware payload (Guildma)", "value": "9149326a408db9d8e1cc0f9c18b91db7c34e61c791a84a2fb8604e3ece48cfbf0dc9c1ab7dc802a1925f0462a4f3a0fd", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498140, "uuid": "7cb9e7e5-a521-41c6-9408-0d69fe2fa3ae", "value": "T12A524C1D1B072B9DB2614C929458307DAFE084D414329F6DA461E7E14CF8A8AF35BAFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498140, "uuid": "d9c8ee6a-74e2-4bba-89a5-8e26642512fa", "value": "384:wlVgRGGo+40DBhZdex8M8+a4g3gfTURheS/BhRt/nxU9uksvDVoP:TDBJex8MlaCS/PXe9uksvRoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766498140, "uuid": "abd5bd06-5ba9-49e2-811a-47ebb8421627", "value": 14297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766498140, "uuid": "6b0ec191-ab5a-4dea-b4b5-622c2c704bb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498140, "uuid": "0ddeced5-00ac-48bb-b446-1b817bbf7c1c", "value": "fk8a03.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c54541e-e054-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766531418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531418, "uuid": "27b651da-59f7-4797-aa63-1df7606eac95", "comment": "Malware payload", "value": "c213f6d768593a6a46798b4e339389a9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531418, "uuid": "8adb6561-8145-4d68-85f8-06d26afb36c4", "comment": "Malware payload", "value": "6b9c2dedd3cd061b10e31afe6c68824f5723e4a169a9bbe5432eb47207a5aab1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531418, "uuid": "2421dcd0-f587-4789-8344-b6e7880cf259", "comment": "Malware payload", "value": "d8dce8f93f8679dec68bcb97f86f6a052eb0bf21", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531418, "uuid": "88c4ace7-0157-4ca1-a9da-770d68876d91", "comment": "Malware payload", "value": "879cf52e7e34155135e3d1bd3415eacf51d61a7de4238dafd5231fc34b6367ac29fcf7153815b6bb13b00c7128044ee4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531418, "uuid": "aaf17101-8d63-46da-b2b9-5cb50ccb88e2", "value": "T19C47D9BB8E384D89C6C7F1F69381D6700DE59EA6E8E6E0FA51E109401F433506F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531418, "uuid": "2944d4b6-f49e-4cc4-bb16-9b689c381887", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531418, "uuid": "58b11ad0-5fcf-4e55-87ba-cb0afb55362f", "value": "98304:1q4/9P/8p718mUNsuoAPjfJoXelYVSuixIPETt7GKdIfRd8xw:139PA71zUNsQ7fRGGxIiNGLRd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531418, "uuid": "ca785302-cf35-42b4-83c7-ea80e212c4e3", "value": 26299392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531418, "uuid": "7ce7bfbb-8606-44e6-aa84-9029d51acf87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531418, "uuid": "594818a4-d486-4aae-9cc2-bc04070658a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cf0cf2-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468546, "uuid": "79fb920c-eead-44c5-af2f-876031aa046e", "comment": "Malware payload (Mirai)", "value": "1267a33035a53e00ea04a1450bf96819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468546, "uuid": "6d9966bf-25d0-4c5c-ad2d-464cc8417c85", "comment": "Malware payload (Mirai)", "value": "6bbfa0ddee2012390bc1c7199df8d1f2434da098649f3cbe6267f2160456dd7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468546, "uuid": "9d0d3007-3968-4e71-b435-2c1bd2ac7f81", "comment": "Malware payload (Mirai)", "value": "b391607ffb76a1dee23bfe41f5795de12f5685d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468546, "uuid": "fe6291b2-4f22-4bef-a1af-adcaf5bc54d8", "comment": "Malware payload (Mirai)", "value": "0ca255fe1ac75daa755dc4b1777f074bdfd138d375b6cac5b4d1b8b280c001715e04ee2673aa7eaa5e30dc95f232089c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468546, "uuid": "23363342-bd63-44fb-8498-80d1116e78b5", "value": "T1C3C35C0A79D230FCC28BD131526EDF21A936749C41187DBBA383AE711D36EE12E15E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468546, "uuid": "b7a8dc68-820c-4103-96c2-9999a2912fff", "value": "3072:bHK1KzxNygvvXRG4LPIZfNfb9k1oVqSQ:bqEzjhVyfNfb9IUql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468546, "uuid": "8475c898-a482-4dad-9a85-7c288906d8e4", "value": 127968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468546, "uuid": "68e9efb6-2f22-4e6f-8cda-7c199bff51fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468546, "uuid": "68600a3f-ae7f-4ef6-99b3-5b58c87038a2", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf19430-e052-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530639, "uuid": "9129c5d8-93ce-459a-b473-a50fc2146546", "comment": "Malware payload (Mirai)", "value": "fda598aef75b92613a6e4b360e694e54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530639, "uuid": "cf4c18fd-816d-46bd-a902-79632372063a", "comment": "Malware payload (Mirai)", "value": "6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530639, "uuid": "52691515-77e7-4fd9-9907-0264396eda07", "comment": "Malware payload (Mirai)", "value": "18e006a1221442420dcc82eb5b19f77c5f033786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530639, "uuid": "00db6d06-b780-4f29-9ccc-1cdf21c6ba2b", "comment": "Malware payload (Mirai)", "value": "afeabf0df56f913aae89fb311d3b094fc69788231d6359024c9860a477bc5e14374cf1c5b4ce9a187bae96c476df59e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530639, "uuid": "e2ff48b7-529a-4b11-849c-b99f109b4ed5", "value": "T1C2432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530639, "uuid": "41099d6e-cc10-4fe9-8785-e271bcf445d0", "value": "768:TXon00+q9wp3C+vactfa1sDHQYAzsv6WswWSHoXdss63B/9JO+zC3b:TXw00+SY3CaactfI6Qvzsv6vwcGJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530639, "uuid": "d9e79268-36bc-4d4c-b453-ce0819dbc484", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530639, "uuid": "2b8192c5-0e04-44de-84eb-0c0f651ca029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530639, "uuid": "4a2d48f2-0220-4e6b-9ffd-511c9b412919", "value": "Josho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221c27f3-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478841, "uuid": "1f8329e9-d883-4d93-a52c-2481f7e6adf0", "comment": "Malware payload", "value": "d484d642544432baf001a997a9117fc5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478841, "uuid": "9408bd8b-a5bc-479f-a469-471b4e31eb36", "comment": "Malware payload", "value": "6c344bb4f905ca7010188e874a98191a189e32fd7f58a1aebd89ce8f36fbd25a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478841, "uuid": "c74dba39-f0a4-4af2-89c5-5dae78bd5de2", "comment": "Malware payload", "value": "6c132269e510e0056c02780f416cedf351bdb66c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478841, "uuid": "d8be3e3c-0e42-45c3-b10e-62501185b29c", "comment": "Malware payload", "value": "2dd295d3ce35e86c3b51087ecf8d86941e04ac2553452526bb2cb400bfbd01ab021c93fad3b725339dc8c75a22cc7866", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478841, "uuid": "6acc31f1-fbe9-448b-98cf-88053e8dc5ef", "value": "T1D8632A8A0F9257DE8164AC943C0BE553A287EC34226CEF75D9CA357EDD6A60E493034F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478841, "uuid": "e053a311-05ce-466d-a35e-6a1fd2c711ff", "value": "768:I8w/h62/jWs6oS+xISN0vsTpLhmJvdkfScBYrwz2y8kTAlGB:I9l/AoSSMQhmNusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478841, "uuid": "8df8e0e5-c496-435c-9e2e-0ea214eb5a94", "value": 70614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478841, "uuid": "35173157-0690-495d-b742-d4a1d04b19a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478841, "uuid": "e3957cb6-a40e-4ee3-935d-b0d320784c2c", "value": "invoice-1645080830.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d15bd8-dfee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487572, "uuid": "59f90dec-f636-411e-a7ab-58e7bfd7508b", "comment": "Malware payload", "value": "e37adf49e9186ff900ac5ded3f4d0890", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487572, "uuid": "5e4cdc42-29b8-48ca-9fec-17792c895dbc", "comment": "Malware payload", "value": "6c8bcd3e3d0ff6ff8d63aaa5476da66294d27a21ecb701a0189d6432a73a7b05", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487572, "uuid": "99b76e11-73a5-40af-839c-ba276adebbfb", "comment": "Malware payload", "value": "0f5318c7980220287f4fcc0f779324b6d45a206b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487572, "uuid": "c2fd478f-61d0-4ea4-85d1-4ae30113bd2d", "comment": "Malware payload", "value": "2cd1ff8b1cfb93e9e26f83e865118964993ca849104ccd2eb05652ca6217b904c5a60b5cde3f172622a8e46221e7fa4e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487572, "uuid": "aa9b44ac-7860-48b1-a85e-efda5be55f5c", "value": "T1A0923D0F770FD57583738B909F396C4696BDE336D9910284BCAE0385BB301686ED4A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487572, "uuid": "7aebfd41-dbfa-4a27-a7ca-8b20d83eeb41", "value": "96:9Qu3DzdEL+zabd2mlUyFXNlDC7EWMMJTVuqvLH6Pd/G+NC6fc9euokMWJQ9XYi3B:vtu+zPm7FXNIbJT1oG+NCfeuDM/dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487572, "uuid": "c22092f9-244f-47f0-bb5a-d1445741270f", "value": 19361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487572, "uuid": "0cdfa828-32d3-4afa-972d-6dfa4600c9a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487572, "uuid": "d99aea19-06f0-46e6-8333-78db6c025c3a", "value": "RealtekAudioService.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18e67ac-e057-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766532849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532849, "uuid": "b5ac42c2-897a-45f1-9f12-c04a490ad0ec", "comment": "Malware payload (Mirai)", "value": "9d3df6cd19dffaa43308d5f5ea155a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532849, "uuid": "005e2d33-4219-41a2-93d0-9e61adc92389", "comment": "Malware payload (Mirai)", "value": "6d9fc3a037f9e3dbbc6d1d368e44513fa1b9916326df456a8ada9db6035824e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532849, "uuid": "b0e89e09-310b-4e78-b5db-2b65c19abd63", "comment": "Malware payload (Mirai)", "value": "86f454a555e09a8d937cbd7959226b0ddd214aa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532849, "uuid": "7cfcbb8f-63fb-4dd5-a7da-3ee2b55bba27", "comment": "Malware payload (Mirai)", "value": "3320a0a662c679b856636c0b085e54244f545e34ce1f55d335ea86be6e9ec26af9726cba72728793832df893e13b5936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532849, "uuid": "f0c0d8fc-b8ed-4133-896f-d250ecb280e5", "value": "T15614EA46BD518F23C6C311FAFB9F429C772667A8D6EB3102DD157FA437864DA093A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532849, "uuid": "37698918-12b5-4b46-8c41-2446dfab7685", "value": "3072:pimS/z//o55nnTAHfWfib62OKTEADIN6kPLUrF6ZkgwJJgjjL7nG6gPL:fMzXInk+6e27TdDIN6ILDkxzgjjMPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532849, "uuid": "08f0f01a-8ee9-44ba-886e-12049b93d426", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532849, "uuid": "05e70357-2971-4ab1-b096-24919cea6c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532849, "uuid": "32bd848e-b7c5-4ac0-9f96-6b67e784ea4b", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c965be8-e007-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766498374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498374, "uuid": "d986b4fb-8dab-4714-9164-76991e9f09f5", "comment": "Malware payload", "value": "abbbeab63844ea9c4aa34e6dc8b69aef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498374, "uuid": "20f093aa-bf3b-4089-a821-509cf5adddc8", "comment": "Malware payload", "value": "6dc44a4ce4af3be8fc438b10a4efa979c2481d41947c6306e4f7873206744d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498374, "uuid": "883a73ad-4ba8-4d3a-a2a2-85a49903a663", "comment": "Malware payload", "value": "e2a892b922b3055d75c4ab0b7e7952d7d7b27a71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498374, "uuid": "b984738f-e581-47f0-810f-d890a8a8042d", "comment": "Malware payload", "value": "f2f2fa148905d68ba9202fff007ba911e70ba0e5090848a07f3a13696f04c7a818b5595d01e61ca1cfd607d12a3d130e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498374, "uuid": "99fdab22-e826-41b5-9817-e06360d50e20", "value": "T1BB45332B2522DA3A9BDC54E2A7DCD27E1065FF8B884CDBA521A0C041FB5722D610D7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498374, "uuid": "6ca04de0-5b7b-4c11-8b3f-8da5aa767880", "value": "24576:RzOnel5KDZdILKFKxcKJ1ayxqFz3bhAGc0iYdUTdH9NydY46jxhny0:R9XKNdI+FKTxqd3bhg0iYIddNydYk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766498374, "uuid": "4eade351-82f7-4579-a355-50ba7e1f94e0", "value": 1194811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766498374, "uuid": "f4987970-f908-4a92-ae0d-65147b0ffb20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498374, "uuid": "c083a525-88a8-4b44-9906-10da1b9d7d96", "value": "bizy.mipss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5bd533-e007-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766498182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498182, "uuid": "fb2edcec-ae71-4c53-85be-84a0b6758ad0", "comment": "Malware payload (Mirai)", "value": "b90d74e0a6e9a5a8c1df61aa91929942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498182, "uuid": "990e5112-f98b-4595-b5a0-985a697b4030", "comment": "Malware payload (Mirai)", "value": "6e01176ce19a409441cadb631f5f0c9b51705a99ebeac50cfae65de383b2e4d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498182, "uuid": "f27c8aac-c632-409a-8243-8ef1b7f122c2", "comment": "Malware payload (Mirai)", "value": "eea47a732653cff60484012d9bdcb20aab6c2824", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498182, "uuid": "1659402c-7acd-4687-b12c-a0720adb16a6", "comment": "Malware payload (Mirai)", "value": "1f1c1e4d84fd2001efd4a2ad9236a6301365d30331ecd965d1c5e2b2f952ea922639bbfd23fe57d88ed53205b566689c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498182, "uuid": "2c677d0b-b3b5-4b66-bba1-dfd4ee1ad1ae", "value": "T108532BC86902DAF1DC255171E0BFEB7A47BAF67F4029DE9FC3949472D453A02A24239C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498182, "uuid": "5f46ab9a-9561-4dfb-ab44-d8e5394c7c10", "value": "1536:9oMwUYuBeqcBzgAyVtDG/BmjPNl7/FvA5:WRUYuBeqcBsAyVtDikVlrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766498182, "uuid": "69d4c812-f939-4270-9c2d-f6ab52fbc13e", "value": 62112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766498182, "uuid": "ffc5db2d-a21d-4d70-8cda-f7b919c349bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498182, "uuid": "318ebd23-7527-4d32-90a2-60f26736af22", "value": "shadow.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e4e3f3-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479002, "uuid": "ad575f81-00de-4604-8fa5-a9c013608926", "comment": "Malware payload", "value": "ab5d3ebb053e41e45e58f559514235b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479002, "uuid": "646e2db1-0e86-41c7-ab8e-c33d7198f3b0", "comment": "Malware payload", "value": "6e2ed24dcd87230df8186dfee7297d3b3c095033dc9817cdb75a2160f5889f27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479002, "uuid": "b208ae14-01f4-4996-bde2-16368dbdb085", "comment": "Malware payload", "value": "af7deaa65fcbd39ba0cdd7f484480f244a7a38f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479002, "uuid": "fc07361e-4b49-4d33-93be-d2017959bea9", "comment": "Malware payload", "value": "b8be1f35a798698141e2a48c47b42d3600bece38a788555377a88b781e6575381bc440263832d786bfe798b1c347e866", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479002, "uuid": "1e9d96b9-fbab-47e2-a567-135965edaf04", "value": "T1E5635C52DF4D31677D0AC0B0D93628E6CAA0A588CA8B4DD43F5E73C97B57FA821D618C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479002, "uuid": "86bffed7-73a0-47e2-b81c-c4825a8fd6dd", "value": "1536:I9l/AoSSM7e/eDe7eUeiexede/eHe1e/epeOeoeaeHeTeJeUeJeae9exeJeJeZe9:I9l/5MIjusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479002, "uuid": "53a7c573-9fb7-426b-b720-71275a7b16ee", "value": 69626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479002, "uuid": "a2c6e499-4491-4216-928c-b6aca9c60f7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479002, "uuid": "afa704c7-622b-4284-9552-7f21cbd6acb8", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cefc82c-e025-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766511206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511206, "uuid": "1212246b-f489-49ac-9ba7-4133473d5012", "comment": "Malware payload", "value": "9544c5afa265ad95573dbc648ed06b41", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511206, "uuid": "d3575de3-3009-42b9-a0ab-ee134afe2c60", "comment": "Malware payload", "value": "6e2fc0c835dd7030d0b0f8e0d90a5e2e90ba9bdb584beaec4a9e00fb3b3c026d", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511206, "uuid": "e99d209d-2664-4779-b555-03ea6cc26ba3", "comment": "Malware payload", "value": "feb06f47bd8781dfca3df8b3b904a4030c12303c", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511206, "uuid": "9852a214-1cee-481e-9616-53f979b71cda", "comment": "Malware payload", "value": "5ae63a3a234f28536bdb8e6a9b7471b05b9a2ceb13861758c816bb8e466f777b466dc1fc55bbb9176448212a3c48c418", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511206, "uuid": "4836a486-57f4-40f1-bae4-d0747d24c4f7", "value": "T12186E00FF3EA1478E4AAC77645769155E9F338206721AEDB45A0C478EF239E42E3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511206, "uuid": "d1fa8827-e729-4d07-8c05-2d580f078e33", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511206, "uuid": "44588fc5-6d3d-41cd-9e19-d1fa3765c847", "value": "98304:9wREqmHzsTZCoKMScL8aYobfNKwbOwxAqcN45F7hbHWnY:3qmHzsV72aYoDpbOw2qq+NB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511206, "uuid": "c0b2e6fb-3b31-44a1-8159-4320c65cd976", "value": 7904544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511206, "uuid": "7bfffd22-0418-4318-955b-2ac2df26fe6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511206, "uuid": "7fb4d777-454e-43e0-9c49-d8bd25d5bd74", "value": "IDMan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c05208-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478768, "uuid": "52a47467-76cb-432d-ab12-ce47bcfe2236", "comment": "Malware payload", "value": "0836a67db5dcd3205bff1f842f8da7cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478768, "uuid": "f71e829d-319d-47d8-93bf-585611d40fd3", "comment": "Malware payload", "value": "6e3ef19a2ab907d7dfa04b3c0fdf87737eb8a4995989b7ddc711ac9f9217c2c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478768, "uuid": "e805e564-12fc-431d-9ff5-64a6b29dda71", "comment": "Malware payload", "value": "490639e06a779595f35c45b38b67844ffea38008", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478768, "uuid": "e8bd47eb-34a5-4258-ac64-8d6a3cd11653", "comment": "Malware payload", "value": "40bd9581c5491040350c299a93470bcc0259b3aa068d15221ac828209ea84cef46b709bd3ad93bafd33802b30a4d3fe1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478768, "uuid": "6c8b8b0c-0948-4f0a-9b9c-23f2a9e97955", "value": "T17D633CD5DD31F98D155434ECA22A25BA6000C534EBCA7DCC9683B406A3F3FF1A27A9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478768, "uuid": "19b806f1-5b14-44c6-b59b-833c8f489032", "value": "1536:I9l/AoSSM6k4NOPEPJFPeEWN5IjSAjV1wEnqtuejKgoqI+1oX15oWYeIaEyaozux:I9l/5M6k4NOPEPJFPeEWN5IjSAjV1wEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478768, "uuid": "da69cf75-3c4e-4b2e-83ca-7f2aaeb23cd5", "value": 70568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478768, "uuid": "55e154c0-a41f-4dea-9a45-39e4beb6c69b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478768, "uuid": "46fc7947-e49f-414e-9f31-00117d2f3a63", "value": "invoice-1645080830.pdf (77).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd87793-dfe8-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766484817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484817, "uuid": "bd86eb25-1778-4ca0-a18a-fbe6834e6b9b", "comment": "Malware payload (QuasarRAT)", "value": "d48eb7579da09ee2fc9838c1cac3a201", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484817, "uuid": "01c433c5-9aca-402f-956e-57293977a98c", "comment": "Malware payload (QuasarRAT)", "value": "6e988df18cbb4e02d7013395b1b90915f1125366ea2688ab4c5efcd66c83c495", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484817, "uuid": "9187b623-42b1-4a4b-95c1-466d6acd4bdd", "comment": "Malware payload (QuasarRAT)", "value": "458d191d14e98bfe28db377b3b7d9f1e589c9037", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484817, "uuid": "944a115c-89b8-4aa7-b5a9-a18f64ab1ed7", "comment": "Malware payload (QuasarRAT)", "value": "5db1bf5d70746ace85d3db29218e313f5864e11496f31287aa0d0213646166cb5718707aa1e06c423b6eafbc39e8446e", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484817, "uuid": "043802bd-0734-4f52-b018-8cf7d06af811", "value": "T1BA4512A360481DE838D0EE9535CC2D0A2B55F61B3F277B4EEB6EBC58C56B60724E5C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484817, "uuid": "95ca2dad-c0b2-4f15-b72e-b3d38b2f9fe0", "value": "24576:ZQM8TxwH0VgDYLUwxtlPfuZ8MDdstTFDIa5WrqmVTzA3Cg:z8TxwHoLTPf8ds/IaUqmVTzA3Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484817, "uuid": "3e7a36cf-2fe1-4fec-b0f2-5713bebec4e6", "value": 1234206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484817, "uuid": "968d285a-cef3-49ef-b7e8-92ecb12e1b58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484817, "uuid": "38383453-2120-4c68-b2f6-c8e9cd39c4ad", "value": "6e988df18cbb4e02d7013395b1b90915f1125366ea2688ab4c5efcd66c83c495.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e522c07-e036-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766518429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518429, "uuid": "5baa3f30-7c88-43f1-b2ae-c259619004e0", "comment": "Malware payload (OffLoader)", "value": "4d5b377f15943bfd4ad2eae525abc5b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518429, "uuid": "6c35ff80-a5d3-4353-9aee-d4a181dfd286", "comment": "Malware payload (OffLoader)", "value": "6f10858bf67f3416c3b35f872e2afbaacc82ae77946a5e468fcc2ff720687ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518429, "uuid": "5804b8bc-9fc6-4bdf-8ce8-a0f09a2c6575", "comment": "Malware payload (OffLoader)", "value": "48a229857433a2c740d2715ff61bfd21fdf4af0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518429, "uuid": "9bd116d5-5e55-45fa-ba95-1edeb0a2ef90", "comment": "Malware payload (OffLoader)", "value": "8e9ff2316cfa7fe290636fc66b582270b40ad19c0fa3ee22fbe3411337d44786d4972f86139cade2a38da0f0c91c780d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518429, "uuid": "b5120831-4844-43ec-8a26-09ba14028c57", "value": "T13DC733E7CE69DE04F3B2D874611247B4D35C78229F9B6EDBB4C055EB400C18AC9798EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518429, "uuid": "271708f6-1ecb-43ef-94a1-79b2174dc095", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518429, "uuid": "d4cd788d-3c71-4144-8019-21eb5a4f9641", "value": "1572864:uB68uPyH/ypOLbKp80UqNRN827wPMFe8lkHpzGX/:uU9K/AiKp/Ugx7w0Fe8lXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766518429, "uuid": "a957706d-f8fb-4b65-8779-e8dc1d56840f", "value": 57671679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766518429, "uuid": "76a17025-aafd-44cb-a35a-667965186552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518429, "uuid": "ffca3d9c-2866-4338-88ce-c58debdac971", "value": "DiskGenius Professional.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424b84d9-df9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766452266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766452266, "uuid": "d77e12a8-0dbe-4392-afbd-7587aae44a5c", "comment": "Malware payload (Gafgyt)", "value": "8d7689835029c6018fec3439bd40c961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766452266, "uuid": "75c5b2c4-14b5-4c80-ae7c-90059e31deda", "comment": "Malware payload (Gafgyt)", "value": "6f48819fc74917209d9442b78f92ef63c16c2ad4285f10fdfd16396b40eb462c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766452266, "uuid": "c819434a-c9f0-4688-beb3-8d267d225633", "comment": "Malware payload (Gafgyt)", "value": "53b758b0ebdb940b5dd1e5df13984fa2656380c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766452266, "uuid": "80af3da3-d037-4b8f-8f10-2ce74d7b321e", "comment": "Malware payload (Gafgyt)", "value": "02239cbb7ec75df9bdf0dfe6c06b8378aacc22e69100b337c2b5360394ce5dfbafaf295eef46147bfe324424142a7816", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766452266, "uuid": "2f58c8b8-1b2f-401a-8fc4-0d2a55cb353a", "value": "T12AA38D4AD693D8B1D4230039122BD362CE32E5317432DD8BE7A93F35E86A750DB563AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766452266, "uuid": "1e571a56-26a5-41aa-8cc5-9f567a5d2484", "value": "1536:JC7XRsML1BlwTRUOj5QrAOGRy7DYm6GygI+8AcIaJdWnH6flvijiZO9styFul7S+:J5MR4RyrcY8Z+nPaflvijQOQyCzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766452266, "uuid": "f21ab793-cbc2-410e-b208-62278b1e6615", "value": 99596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766452266, "uuid": "e9ce4f00-6abf-4db2-b1e7-d60734a1c2e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766452266, "uuid": "868be824-664b-4cc3-8114-a618af426f3e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c5db43-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524327, "uuid": "cf67130a-6f72-4c29-9a57-8f8fa8c73c3c", "comment": "Malware payload (Mirai)", "value": "75e0d25052a762dc6b83cbb26c473178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524327, "uuid": "791a0519-e989-4a0a-90a0-213b68a30d26", "comment": "Malware payload (Mirai)", "value": "6f716434431b42aea2fb6f4dbb0623d93f7e85ab402d4c58d7f58c2b7d5aeeb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524327, "uuid": "95c05a01-64b3-4715-87af-743d803adc77", "comment": "Malware payload (Mirai)", "value": "823ec370f5eb5503f9dffad2a77c877eb4cac122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524327, "uuid": "348aeab0-db90-4c55-b8a5-0b6e68f0b4a2", "comment": "Malware payload (Mirai)", "value": "e5c6cf0400e25672b26934e8d32b841bcf48a33063806d00a6b37ade627126b4431ff0ab4a128680c0ab7a9c70320da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524327, "uuid": "0138f7dd-c21c-487f-9e50-4524f96cede5", "value": "T1ABF33B8CA4025E6CFA87A8FE94254F1ADD516351B1930B1F959FFEC37C2226F8E42D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524327, "uuid": "518bef35-b1d4-4305-997f-0fdfed951f58", "value": "3072:pW57+OlKgf1bPBsm4+CrbOZ40pExQanDp6:w7Bsm4+eU40pVant6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524327, "uuid": "b7f5ca9b-50c6-4691-8e45-269e7b4c5ac9", "value": 170316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524327, "uuid": "98f45b5e-b6c7-4757-a8c5-5737660880eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524327, "uuid": "702cee62-1de9-49c4-877f-3d3105850461", "value": "pandora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beab0063-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479104, "uuid": "ffcc9be4-ae41-411e-bd6a-3bad1e60031c", "comment": "Malware payload", "value": "13d6508c48061a7bed015ce0f70d78ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479104, "uuid": "5655b338-c64f-47a7-84c5-cee1be9f34e8", "comment": "Malware payload", "value": "6fccc0f6a22cea4387475e04d7cdbc6e3893586382ea74a07316e044f521a661", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479104, "uuid": "bfb11e97-fb09-47fc-8f1a-a8ad5e1b1157", "comment": "Malware payload", "value": "4514642fa17446065db3d3bec2a48ad87461d369", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479104, "uuid": "bf534184-55ff-4a91-b12d-9dd75fa52538", "comment": "Malware payload", "value": "19ae4ea06141bcf52753dd850039ccfecb224fe6bb9c4ca5bafb9eb9393f762c668d4d396f7665ac204764778eb4acdb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479104, "uuid": "a0bb4c04-0b80-4193-9674-47c9cbd0a5d5", "value": "T138631B924611C4E9121FBCC4FE98CA07B71CAAD50F5F732B5714FEEA521B1E263A3069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479104, "uuid": "07122778-f37d-475f-aad8-23ddd5c8e681", "value": "768:I8w/h62/jWs6oS+xISN0vCQLnB1dkfScBYrwz2y8kTAlGB:I9l/AoSSM5/usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479104, "uuid": "11fd522e-337d-4f7e-b326-3f1c01c5d60b", "value": 70511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479104, "uuid": "8094a12b-6b4c-48b5-aff7-c0205e8ca3bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479104, "uuid": "29cde4ea-3f63-4d6f-8d51-b1c6db33cd9c", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9b956a-dfd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766478325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478325, "uuid": "c2cd89d7-bbd3-4ba0-9a4d-00b1bd1d677c", "comment": "Malware payload (Mirai)", "value": "1c897c7e02fa38fe6d75696c3820b947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478325, "uuid": "64b5a3fe-b387-4e3f-abe9-4e1ee9346fd3", "comment": "Malware payload (Mirai)", "value": "7087175432107de054a317a77a5d902f19a19b2ef18d80433057dcd1f29a456c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478325, "uuid": "d9bd95a2-8d42-4c11-8ee2-1868443755cc", "comment": "Malware payload (Mirai)", "value": "60870a724b72ef3a2caca7ba1c56b10de0825cc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478325, "uuid": "753cde77-1fc4-4122-9d1e-ab3a35e50d36", "comment": "Malware payload (Mirai)", "value": "13e86555319eacd6bbf0a8a6d8eebcf0478fe5a3109fe048c99dd94ed0678f1f941dfc538b3e84ac819eec1e95f93bea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478325, "uuid": "31601be6-4687-43fe-900c-e531439879b5", "value": "T1C6D37C69FE8F6CC1C3C7E37DED4A0FA2751778749666C0B10A00969FD6DAED88890613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478325, "uuid": "760d4b93-2230-41d8-8ee0-f4826697a8a7", "value": "3072:xGekZ0ZrDdG0+TVXaK2dRXqqAY4xxrK7KtNPzPxq:xGdyZrDd6aK2dRXSvKIbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478325, "uuid": "59318883-f9d0-4272-ad5e-7a766d2b0d96", "value": 132048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478325, "uuid": "d353475f-ba96-4cd7-aaff-a6aeb2d86993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478325, "uuid": "6eeabd14-da39-4021-8a32-0a5644fbd6b6", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099a77ac-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530769, "uuid": "38fc6e7e-ee11-4d6d-a601-e51cec1f75e7", "comment": "Malware payload (Mirai)", "value": "49b158cc55bd44062726a013c0461d91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530769, "uuid": "15fa5f75-e9d1-4d85-b474-7722693bbe6b", "comment": "Malware payload (Mirai)", "value": "708f064aefc524d3a5c2814625615ff5eb13693d578eb5990ff99a2903dce03b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530769, "uuid": "3d7724e8-6758-4588-aace-28366c5638a3", "comment": "Malware payload (Mirai)", "value": "3449627f30b06d1ec04ead33a7483e0ad4951865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530769, "uuid": "c2fbc55b-50ef-42ed-91bd-ff1abf5a4368", "comment": "Malware payload (Mirai)", "value": "46facedc3591c57c0b4663b0a121b4c6e0b5398b6ef777096364404bb85fe14adeaf339a53faa311ab09c81c69064183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530769, "uuid": "2457e0ab-ab94-4b45-8d0e-5f8197619175", "value": "T181338DA6D5BDEDA8C1544AB87D258F389B73E00086533EFAD644C65A8047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530769, "uuid": "1f04c63b-2e69-49f4-830a-38bab7b939fb", "value": "1536:5aR5ewtQZ0t8GdcPs3q/aKlMLEm0DOFCn:5k5eDy2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530769, "uuid": "d4f24b06-3713-4764-819b-66a862ee65f5", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530769, "uuid": "87d3849e-5a9f-4435-9884-4f9647db9df8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530769, "uuid": "db6692e9-f5e3-4968-8fee-6dd48a7c8a9b", "value": "Josho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744ee10f-dfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766474684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474684, "uuid": "8213c69c-e300-4040-88c9-e13215876718", "comment": "Malware payload (NetSupport)", "value": "bc1ff0c690adba9e88a2a126f08260d5", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474684, "uuid": "e4931791-ffa8-4ffc-a2da-ba2c94f02938", "comment": "Malware payload (NetSupport)", "value": "712b356dc0f2e2737ff23955c25dd50b9d2511ba258c064798f4f118d6746dc9", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474684, "uuid": "1c93b96c-c0dd-46a3-8c89-67668f30d1cc", "comment": "Malware payload (NetSupport)", "value": "04c89d38e7211338d791ba1f3dfe3a2d3f1d224f", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474684, "uuid": "5c386d74-b5a5-410f-82af-d060ce0f7a8c", "comment": "Malware payload (NetSupport)", "value": "8c7b0c58d06414111331690f87ea0bef4e025f3583f506bd47c834217153f2081cc2d01231b69c49fdc178e6bd0d295f", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474684, "uuid": "b57c7258-0ef4-4e43-96f2-92469f0f0e0a", "value": "T16E900260145066695A19863AD16455202412198A877818B7A11951850846969C210E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474684, "uuid": "60c6dafb-60a7-4083-b910-f8d6afafb882", "value": "3:VSJJFIShhwdF65IFeVnykmn:s8SnSFUcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474684, "uuid": "994a53d2-9f77-477e-9d2e-963cc94d8cb8", "value": 55, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474684, "uuid": "91c3ef33-2d2d-45f3-afeb-8d06c9852419", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474684, "uuid": "d2e9e26f-d2d3-488f-afa9-c0acf08bf97c", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369aea38-df94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448811, "uuid": "2bea2210-0343-41e4-84e9-9a30acdc9437", "comment": "Malware payload (Mirai)", "value": "f59d4e9bc0c6275563119d7ce014db2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448811, "uuid": "6bdcfb3a-ba38-4d73-911f-277d3ed62f7d", "comment": "Malware payload (Mirai)", "value": "71e294a3990696c9e492150d11169fa867a180eac3312619426d6a0f2bd449da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448811, "uuid": "a3517986-e934-4f42-9c20-080b2ccb288d", "comment": "Malware payload (Mirai)", "value": "e59f9a5694d6a7cc06ab460b787871175b4bcca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448811, "uuid": "a8e1b9ca-7b89-4f79-87dc-c898533aa936", "comment": "Malware payload (Mirai)", "value": "0ce52b32fff7d91756bfd19dc8a3d50c9266a75e744a36a94c243de3d527d1ad8e3f24f8695627c42ccadf0c70beaf84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448811, "uuid": "afd74b58-b753-43d3-a0f2-ae3112aae6e9", "value": "T1D963E896F981DB21C6C5A2BAFE0E51DD33130778E2EE73139E146B24678B46B0E7E405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448811, "uuid": "149e852e-63b6-4e3e-b9c1-85e41fb5f867", "value": "1536:7hnR59qbUW/SoF+o9QQFU7x7D19a5S3qMoi4Zecuz0wm7fxYZT2bVR:b5sAzoF+EQQFGlD+Zecuz0wmrxST2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448811, "uuid": "b747e452-2fb1-4fcc-b370-75dd6466b402", "value": 70824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448811, "uuid": "757fde2a-2138-4a40-8bf0-4945bb311038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448811, "uuid": "3e233c4f-c6b6-40cb-9c14-830f678a4305", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9d2f4b-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478857, "uuid": "4578d344-9b6a-47e6-b3d3-f03940307ffc", "comment": "Malware payload", "value": "89268beaaa0f6c0a5b824f8251cfef7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478857, "uuid": "785f78b9-6fda-4a02-ae35-24287a6873f2", "comment": "Malware payload", "value": "71e7439200ee490e5558bdd03f43e08ce44e74038ccc62cbb32efe66181d0ece", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478857, "uuid": "9ec72c43-55a6-49d4-9922-620fb5ae3ae9", "comment": "Malware payload", "value": "95bf9eb16b334d75d7066dc853fb8659637a7c89", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478857, "uuid": "16dddbd3-43f4-4178-883f-aaf39de20432", "comment": "Malware payload", "value": "5bd808e399d255a35234d7470f9b38f6063ee397b29c67ec649b1b1b7f88fd5383d30fb53f13bfcb66d9bb75dae134da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478857, "uuid": "278c97bd-e591-4acf-ae44-9c93f46c5f39", "value": "T1FB731983AC786A84C4BC634FD39B129D59CFE7E0F4F1733C8966B4805F0B8556A21AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478857, "uuid": "06db83a4-be84-4d6c-8e8d-0db8207ecadf", "value": "768:I8w/h62/jWs6oS+xISN0vp090m0J0v0dh0Uh0r0I0V0v050Z08000i0P0H0Z0A0x:I9l/AoSSM05IusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478857, "uuid": "150704b0-b787-4508-90ad-84a27b213889", "value": 75395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478857, "uuid": "88c728d9-3833-435f-8dd0-5125c0015c68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478857, "uuid": "9ce0dfac-ae6c-4ea7-92e1-9ef94554cb24", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ec81ef-dfe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766485282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485282, "uuid": "02f46658-c453-45cf-ad15-e627a145c062", "comment": "Malware payload", "value": "c9bebf0b8688ccef820e4c25113489f2", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485282, "uuid": "51a6cdbc-cef1-4357-8622-17f6408358b1", "comment": "Malware payload", "value": "72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485282, "uuid": "5edc792f-29c7-454d-b69b-26e9e08e7886", "comment": "Malware payload", "value": "accea060436d2dd24ce121d3cd07dbf9876e9e0f", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485282, "uuid": "1e39e9a8-fa3e-4f3d-932e-bd36419af18c", "comment": "Malware payload", "value": "74759eb06e31a8beb886cb42c8cb83c9d65fbfc37a84e43575f13e253e432b3308c4c35dd7bad1d8a51752a84749d530", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485282, "uuid": "90602e2c-63eb-4aa8-b9ac-83bcb738f229", "value": "T153510E17A3E8466BE8A703316DF387577774FC50AF72A32D1880422C9C657681E32BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485282, "uuid": "02b254b4-f019-400d-98aa-023fbd6cb46c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485282, "uuid": "705e35c1-d4c4-4c7a-906e-3e90dfafe9de", "value": "24:etGSUWJOJ9a8tMcin5dU+atkZfe9/hzWI+ycuZhNwakScPNnqI:6UlvBtMcs5++NJe9pK1ulwa3MqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766485282, "uuid": "c3ebcc04-d37c-46db-a1ff-0e55e9a0ca2b", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766485282, "uuid": "d02643da-4328-4f60-a86f-f7947995e8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485282, "uuid": "18441156-3d27-4293-b4d7-763bea865da2", "value": "nhhgpnb5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e89d8a-e02b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766513820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513820, "uuid": "aec73747-116e-4044-aad5-96470a327115", "comment": "Malware payload (Mirai)", "value": "553e336baf64f8fd23931e483a8160f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513820, "uuid": "39da3668-fc8d-45d1-8ad7-65b894287016", "comment": "Malware payload (Mirai)", "value": "72f8dcac376fa2861c1a6591953d2c4ad3eed9c634938b3a04388603121ac424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513820, "uuid": "9af671ec-d4fd-4ea4-80df-ec5c5ef519ac", "comment": "Malware payload (Mirai)", "value": "5e6e3edbc3d16a32fa56d99915228a45b1a07f50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513820, "uuid": "2e1acefa-8900-47a7-a577-151e584d6d4d", "comment": "Malware payload (Mirai)", "value": "298979b0adbbdcc7883b49e8c2e235fa78ee78f3ed18d51ee306b0d685596adb4eff8453415d92a6ff9dc2393a5ab20f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513820, "uuid": "021b9145-bfd8-4f21-9629-368bf7437144", "value": "T1445318023A494A5FDEA26770082F03F087BEE6B055F4B9C6151F2A964371F761487F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513820, "uuid": "3c2bd00e-198b-49b2-9caa-9b61a30cad84", "value": "1536:+TYecjfHDy9G1YjfQR3DeMryKoyps/qNNJic:+cLTDEQR3Deay1yO/qNNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766513820, "uuid": "407071ed-e545-43fd-a627-63e7ae3f3cb0", "value": 66476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766513820, "uuid": "c8ec931e-1ab2-4d2e-a12f-a9efa2c24157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513820, "uuid": "56075e75-b4e3-4d74-b0b5-e7393e5fff43", "value": "shadow.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab2e348-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457864, "uuid": "f91e7e65-8f80-45d7-ae21-673e42dfb505", "comment": "Malware payload (Mirai)", "value": "878a1511a969cc7c8aa1867cf6b4638e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457864, "uuid": "d643ecf8-ff9c-4f22-8019-6aea2381c4d8", "comment": "Malware payload (Mirai)", "value": "736b91415a42419dac177545396d00f66ee73c801601800ebe28ea97f463e4ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457864, "uuid": "2490b355-95ce-4bb7-bb16-d9a35d0a89ff", "comment": "Malware payload (Mirai)", "value": "72523e36d5d533990c36db5ecc1766a7ccbc9846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457864, "uuid": "17b14b67-56b8-4ce5-9c94-0f24e68dcfd6", "comment": "Malware payload (Mirai)", "value": "4d5b0ddd08a6650788821fb13ad0c8c5b79dbb66e9285c1ce67547c3bc2e5a2acdde8eb16f999c207862eb8f957ef785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457864, "uuid": "9f96c751-e8e4-4028-9045-74bad3886f3e", "value": "T1BE93B91E6E218FBDF768873047B78A21A75833D627E1D685E25CD6006F6038D641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457864, "uuid": "f96ff48f-d6f9-4315-ad35-360173e16723", "value": "1536:pbk3IJ73TfwvDPeoagqybQXo1hcd6e8Vgykgs/Fd:lfJ7D4vDea1b/1h0mkDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457864, "uuid": "2cd96779-26bb-413c-a780-969e2576f161", "value": 93496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457864, "uuid": "86795e0e-972e-45eb-bfc0-a820c0fc8486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457864, "uuid": "3edbb9a3-8ba7-480d-b088-916f836dce70", "value": "ntmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf80e127-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522914, "uuid": "2aec83ab-0079-4afa-bbca-42e2b72d1386", "comment": "Malware payload (Mirai)", "value": "6ce6172cc32c2721ead5397330eb63f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522914, "uuid": "fb67e3f8-1e3c-4f2a-b168-91aa60bc780e", "comment": "Malware payload (Mirai)", "value": "7394ebfd28d0a9b080c6890215745fd14fe124f33ef3e333bab611210daa2739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522914, "uuid": "d8eaa6d2-a42e-4599-b313-a205a0837604", "comment": "Malware payload (Mirai)", "value": "8772c9394d74213ea0510863a5b667eb81be93a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522914, "uuid": "f2e56ec9-ac93-4fc8-895a-bf01e759eff4", "comment": "Malware payload (Mirai)", "value": "ccb93d45b8790d77774c923bff7761137ebee8c1ae9b85ef4a89f9bd43e0e2479d6164946b06e1b93444732211bd109d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522914, "uuid": "451a676a-f5a1-4fba-b925-1b86fff55faa", "value": "T15233C705BB654EF7DCABCC3746A8270024CC691E21FA7B76B534C91CF44B51B26E39A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522914, "uuid": "ed3902bf-4e4f-4034-b044-d28d277f0900", "value": "768:8uR8mMB/lkQ2w+ge0eMAe5ZPFt0ZI/qXiLohafr:8uR8//HpFFRAcZt+ZI/Mhor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522914, "uuid": "d86da3a8-f7aa-4b4c-94ba-edfa713f4cac", "value": 52664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522914, "uuid": "4bd806ad-4ef7-4faf-a905-80500b2d3dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522914, "uuid": "0c55e710-4a76-4fea-b00a-0603fded6187", "value": "87sbhas6as.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8ea828-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531979, "uuid": "646439b5-0f93-4c89-b924-be1fdf2505c7", "comment": "Malware payload (SheetRAT)", "value": "9d782ae04998ed3a4fc5ef28d821f1b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531979, "uuid": "76b553b8-def1-4faa-a175-74959f69f210", "comment": "Malware payload (SheetRAT)", "value": "73a583bfa6362e599d5519acf4dcab793b126a697356d32861a6e7ffe5f9e0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531979, "uuid": "47c2b36c-b720-44e2-b655-9efdb818dca7", "comment": "Malware payload (SheetRAT)", "value": "ec579730423729eb50f5512fe4126449a8b1b695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531979, "uuid": "c604755c-c4b4-4d80-bbfd-b1f13f46e24c", "comment": "Malware payload (SheetRAT)", "value": "e9a5a1a6ffc69cb34574046757b847432bb810d45b08cc08157670970d9787718ba061240c6132a097fe2bdecfd99665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531979, "uuid": "736d934c-43bf-4890-8e4e-c8df87ebe10a", "value": "T17994A30CFE92E805DE1E3D77CBE610104B7129C12E1296923259BFFE8F6537658A267C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531979, "uuid": "e1d028e6-fa4d-423f-b498-699212e18db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531979, "uuid": "4f16c269-d645-4ba1-8f25-dfe0024b7924", "value": "6144:Umx8YILbzHEB9MegbHs9e6VlWT8b98EW94IZGrLFbOlpJtXYP:9869Es9PVle83WXGrklGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531979, "uuid": "d931f38d-957f-46c9-8354-54242655fd62", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531979, "uuid": "db430b9b-af1f-4bb5-bdd3-12cbc344d520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531979, "uuid": "30cec153-833f-43b1-bfac-bfcd26873afd", "value": "rookqpshtgdi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cade49b8-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478695, "uuid": "cd1bb50d-5bd7-4af8-bf8e-bb580cab7d16", "comment": "Malware payload", "value": "f3028e091099b00eeabbc54ed7d539ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478695, "uuid": "84dd04df-6385-4e03-874a-55fcb9efa74c", "comment": "Malware payload", "value": "73a9fb1265cbf4a8d21b8e22c3b0f3e7c332bafaad8ac443de3a99a50dd8a7e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478695, "uuid": "d7bdd708-fb71-47d8-982a-836e599fdde4", "comment": "Malware payload", "value": "f8e8c5fdc889765485e990832b56da1032eaf483", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478695, "uuid": "4c9e019f-fb7e-4400-97aa-7867133fe979", "comment": "Malware payload", "value": "7804eba9be40313a6cb8f3ca0c77bb14c10772751cf6f8b33f9d1dd95d3afb5c172a201577529c6ee85a5f9e7a232c0c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478695, "uuid": "42ea9c3b-a429-417f-b449-0a0ba73eee49", "value": "T146633C5F0E5A5DB812E8F865CE403D05BCE59C24A3E51A4C319ADEB1EAB179385F2FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478695, "uuid": "a4ee6eec-15f0-453f-b660-2598b637eab0", "value": "768:I8w/h62/jWs6oS+xISN0v/c+pEHpBe2oGD3+1WcnZ2ZA5sH5F5ABz7sZGPrA9/3V:I9l/AoSSM5dusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478695, "uuid": "9433a053-fcae-4ca2-ac70-6f633203eea3", "value": 71530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478695, "uuid": "5431236b-2294-446d-9957-08b61ff308d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478695, "uuid": "2a6b3966-31b2-4dca-a171-13b9e1c5afd5", "value": "invoice-1645080830.pdf (88).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b3193b-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478898, "uuid": "437b2760-1de9-4a62-a4d4-958cb6cd84b6", "comment": "Malware payload", "value": "7f40e233e39c8e15de218282fcb12907", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478898, "uuid": "2b529d4e-93ec-4017-a04c-e9eefc5bd58e", "comment": "Malware payload", "value": "741c447f2de33b47e1c5509e7a407b0724076764d4c0b3380118c60889847bd0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478898, "uuid": "2f5a17ef-8186-457b-aaa3-acde25f6275c", "comment": "Malware payload", "value": "be9b09bb55cd87f1c5f967a1504a59286b88917a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478898, "uuid": "f2eef3c2-679e-4584-b392-38cc968c54b7", "comment": "Malware payload", "value": "4a3381a7469cbe247f6204c428ff5d1cd21785ecea97905fabb4d22ae481bc6374303ca3e33d76abdd95fc92bbffb9db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478898, "uuid": "4221c6f4-0455-4cf9-a7ea-12138cdc36b0", "value": "T198633BB22E3C2F6F34E5F579CFA90263291CA9D69CCB47401A247F25194C6E2097B4F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478898, "uuid": "d686a273-9340-447d-a0a4-db405b7962c6", "value": "1536:I9l/AoSSM4gY+TNNiD4Dt/jg8BCVNNUv8hUMwZQ7gZpog8KbOJbnzqH034Ni4Gux:I9l/5M3AusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478898, "uuid": "6c74e25a-2784-4755-8e9e-956d500a5c06", "value": 70617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478898, "uuid": "9caed6bc-e869-4df3-aca9-85df55546b81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478898, "uuid": "76e2bf01-0e77-4e92-b6b7-340ffa8595f2", "value": "invoice-1645080830.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423b9b5d-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488344, "uuid": "788d1e38-57b9-49d9-89f0-bc34882585fc", "comment": "Malware payload", "value": "d0f5194badae35acb23f209a4a42277d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488344, "uuid": "da8b616e-c5bd-481f-9eea-56e28e75a717", "comment": "Malware payload", "value": "745c51f2e28a853a5ccb07825d54b794bc11a64aa579d41bc28ab19713bfc334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488344, "uuid": "ef3e0073-ebf8-4e59-bc79-8c9d4db25a8f", "comment": "Malware payload", "value": "ea91ee15ef1c177875756978f9451966f9bd0ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488344, "uuid": "baecdb24-2a41-4021-97c8-7fd8539b7668", "comment": "Malware payload", "value": "a6207a6a7635177d3c6b0c45df8513017bbc33bef26aad2e6920289f89590f7af4f6b8102116bcaf3c12e6083442a0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488344, "uuid": "1eb957d4-2d3b-45a1-93e5-f6fbc5faa194", "value": "T1FBF41250B0C1D436F47B11B646F658ACDE3CEA20179816DBB7D828B74F359E0A936C2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488344, "uuid": "c2b1c095-8ade-4801-ac71-fde480bfa5c7", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488344, "uuid": "555eabf2-2440-4753-8c23-3126b283c6c4", "value": "12288:NHztGhqRH93dc6qRsb+nn86iVtXCDtxq2zKzI1c0nPMnDLpLN5pf3ie7CZWUzRt:zuKd326ysb+nHirS3q1zI7MnDLpx5FSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488344, "uuid": "f15bed71-3b48-436c-a2ca-b161ed57b2d9", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488344, "uuid": "a16259ba-d58e-4071-9196-0f93272fb6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488344, "uuid": "29143827-175a-4c53-89a4-e4c82ac15afb", "value": "745c51f2e28a853a5ccb07825d54b794bc11a64aa579d41bc28ab19713bfc334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6a3da6-e043-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766523952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766523952, "uuid": "d48db15c-57ab-4e8a-b22d-820cec9aee22", "comment": "Malware payload", "value": "118f503cb23b50c5d5755d2f930e31b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766523952, "uuid": "9d3b683e-930a-48f3-8189-18d8e524879c", "comment": "Malware payload", "value": "7593b2e5b0fc25c232b65b799cdef88c9a02fd80c53384fa6e08f1fda975436a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766523952, "uuid": "5fb9ab3a-419f-4e36-b439-d15fe272bc24", "comment": "Malware payload", "value": "43b56465dd5b22fb2493e684a418d0dd0fcfde10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766523952, "uuid": "c7ba74df-bd7e-4efb-8f10-33a6cc5d65f5", "comment": "Malware payload", "value": "d05d5cc1f52fb98a94f9a4ef24fddf0d824bad53587ed02f7783d62d0e7948cfd3074f8069650b4d80096ceb87c91474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766523952, "uuid": "2e87289d-a955-45aa-bdad-dabef95c85ba", "value": "T130B408253FE98E00D584257ECA7E3609CB26E0F215026347370AF6A25D459EEEE2D3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766523952, "uuid": "1313cb36-7523-4ce1-a3a3-16e482b825d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766523952, "uuid": "b0ffa85a-fe32-4a2c-b688-77b57902bae7", "value": "12288:sSAVPOr5OooESIwAVPSQ7uDkETxQfJT5E2CO:BOZBAVPSQ7UlP2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766523952, "uuid": "56980971-bf0d-458d-b7bf-e463ee1f8caf", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766523952, "uuid": "e3c504c4-c696-4ea3-b92b-e9b003c75a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766523952, "uuid": "5fbcde10-df2d-4b6f-9256-aadffc20f6e8", "value": "dotadlc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfbef33-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479047, "uuid": "8823cb57-ffd4-4374-b2ad-de369e39b0c5", "comment": "Malware payload", "value": "853a4be19f06569acb15335fd35aa27a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479047, "uuid": "60ac6f1c-1b04-4fd3-a7fb-22074a991068", "comment": "Malware payload", "value": "7626a17a11bb5832ec26a97d49ed635bd62b575a6c8c43be8e727a9b6f23aa6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479047, "uuid": "20aff476-2904-4782-a82c-be57d8feb77d", "comment": "Malware payload", "value": "7ee8776f0edf37d3b78a9837b83c423bb2383857", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479047, "uuid": "bce5e5d1-5123-40e8-928a-adff6fb00f54", "comment": "Malware payload", "value": "0f093beba410d2b943bc16317c2d5203a5d625ce3c3c30b5146ac56df94309dcadf196848a531cc883a9792459c4bb4e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479047, "uuid": "7a8fea06-7018-4ec3-8bfb-1643f691fcd6", "value": "T13A631CB27D60B82F45369B4C9928136DEF3766004FF3359DE632D704383E9A66A8179C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479047, "uuid": "9bda1c67-703e-44e1-b4c6-5e5fb1076597", "value": "768:I8w/h62/jWs6oS+xISN0vsmyJDN5dkfScBYrwz2y8kTAlGB:I9l/AoSSMTW7usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479047, "uuid": "92ea72c7-b44a-4199-8b1e-8df8c150687c", "value": 69684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479047, "uuid": "8d3f83a8-13ef-4e8f-92a4-c0a9fbb11df0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479047, "uuid": "c5e52711-5345-4ea3-83af-3cbbdefc8994", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7451f30-df94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449107, "uuid": "ca81b287-1f86-48f7-a736-fddaa5fe5bc4", "comment": "Malware payload (Mirai)", "value": "00603d48c152414e9b3497b02b958432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449107, "uuid": "72a00607-214d-491d-be70-e85505a7e463", "comment": "Malware payload (Mirai)", "value": "765d9ac8e51ba62c5d9bf313b0c2cad28983ce623c098503c36830bacad10a75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449107, "uuid": "2664aece-5f07-420d-ab2a-d3f3fb850b22", "comment": "Malware payload (Mirai)", "value": "eb6417f102f24fd937539c1205cd469798eeb194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449107, "uuid": "356ca570-955e-4d15-8548-c6258f768731", "comment": "Malware payload (Mirai)", "value": "bc3f3dccb91aadb5ce7f8cea6b75b0db38a5d00db0d6878ea3fc51e38c2a7324164691571c410af8c5834a7902951733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449107, "uuid": "5d5c076c-d172-49e1-ad90-68be00cd8725", "value": "T1D9938E22CC793E58C6665AB5F0B0CFB9AB13A505C0871F6A84AAC37E5447D8CF4867F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449107, "uuid": "a2bd5567-3add-4f72-b7c4-d61a9c709a8d", "value": "1536:yBwsb6leNYm0axmVG2OVrgvqJnskKvKM+rArPCbCO7ovFkfnzi:23se30Ab2uYqhsLv8ArP/W2knzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449107, "uuid": "298fbc4c-2187-4dd4-a2a8-fa00f219a9ba", "value": 92624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449107, "uuid": "64c3fcdd-9f9b-4a69-b257-bdc82e9d6559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449107, "uuid": "eb0a2e63-e345-4c2e-8ba8-e10eff19f3c5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b224350-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524329, "uuid": "f79ec2c2-4abe-40d2-a979-ff48c9658ecf", "comment": "Malware payload (Mirai)", "value": "cb26628a2de70052fddc1391b77a7ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524329, "uuid": "7c442e2c-09b8-486e-a513-a3b4eb60657b", "comment": "Malware payload (Mirai)", "value": "7695a0b23b4c4c0e84c4ffdc302c11a16e58a327cee539cb10727d972d7461d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524329, "uuid": "ef7bc507-9239-4332-aa59-1ea992d9c6b2", "comment": "Malware payload (Mirai)", "value": "936edf1b383193e1418ae64b3721dca7ddc93eca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524329, "uuid": "690793b8-f0ed-4f99-aeb0-4557a44b3128", "comment": "Malware payload (Mirai)", "value": "da25ffaaf28f5901673c95d69bc3072e8beb4719691b4b3e6e36dd90ec439e9ef0fea46bfcd6378a6becb91d20f85768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524329, "uuid": "6561a925-f2ab-4079-8b28-a6502a70de61", "value": "T1D414F781A8828926C6E813BFF57E00CE331567F9E1CFB162CC511B1477CA95F0DA7A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524329, "uuid": "8349ad44-8866-42af-b228-6843af30b2a7", "value": "6144:3WIy/w6uK6Vp63xvAj+Y9mrsplDKZUXQBKXAVan5X+F8JyvYYuH3E6F:3WIy/w6uK94d9mrsplDKZqQBKXAVan5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524329, "uuid": "53e2a909-3a6e-4df6-bda0-904dc74c4a6a", "value": 202032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524329, "uuid": "5854563c-4278-43b3-8ca7-0e4214403567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524329, "uuid": "1887d6cb-2582-402d-ba31-b1eba91d5ddd", "value": "pandora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637acce2-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478521, "uuid": "005ae13f-4a0d-4f88-bcbd-b9dfa46d4372", "comment": "Malware payload", "value": "a9dc5ad70755b5ac753b0cb6a737da9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478521, "uuid": "60786f0f-338b-4f17-be18-b1ccf3b91ccc", "comment": "Malware payload", "value": "76f7bac18305e7b89b168ff183cbaa7b4e2cc168e549fe09edc6830fbfae4fb0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478521, "uuid": "af696701-409d-44b1-a873-b0ac876fd401", "comment": "Malware payload", "value": "e4451ba6b33d529e06ac7b151d9e97db636b50ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478521, "uuid": "0bc5d9cd-1787-4ecc-bbd5-92f4146af64d", "comment": "Malware payload", "value": "9042f7ce9c80c6e9ee685aba650e7df7f24e700aff04b2e8169d35f9ccba54724ce08f1517db44c02bae14d364b68031", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478521, "uuid": "394e72bf-b88a-4d65-8639-e653c29218f8", "value": "T1A5631A1C1D4BE1D0AD68DC48C63ADFC8D526E829C7E45D5C68C261D0739ABBE3275E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478521, "uuid": "37778f1c-6bf6-4845-8c0a-17b3d013af20", "value": "768:I8w/h62/jWs6oS+xISN0v+RikZbgdkfScBYrwz2y8kTAlGB:I9l/AoSSMEJ0usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478521, "uuid": "cfa68403-ecce-43b2-80cc-eb435b83a589", "value": 72477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478521, "uuid": "a5d4618c-dd08-4a32-abf3-1881e649475c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478521, "uuid": "2b209d87-5bd2-4f31-9774-94d9385af370", "value": "invoice-1645080830.pdf (122).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3b2b75-dfc9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766471607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471607, "uuid": "f8e97958-fcda-4ed0-8065-3b0213dd1acb", "comment": "Malware payload (Mirai)", "value": "40ad2facc252a89f8bc85cd60534bc7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471607, "uuid": "e9e77e16-891a-426c-9d5b-18abc808ee97", "comment": "Malware payload (Mirai)", "value": "7704edaa1fbb2c2e9d4e346b77aa6ee667d7f2adabff0bc85714790fa6807529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471607, "uuid": "c452dd09-efe3-486d-86e5-e5460eb0ae2a", "comment": "Malware payload (Mirai)", "value": "930ba0075cfc7060694c12d7d8518d92f56e8aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471607, "uuid": "2aceec8d-89ab-4330-95cc-dfa15366f542", "comment": "Malware payload (Mirai)", "value": "e13455f379602db3d190140fa0bc989f47bdb6973116b87d605f9fed64521c9d68b89597cf8b5c4d6ee90069e7604e45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471607, "uuid": "a1a28b2b-96b7-48c0-81a9-f80c10dce830", "value": "T1F5D3AEDB738B1911C46106F01BD79F8E2F6322118E1BD9FB2E1DA67E2D762CB1906781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471607, "uuid": "a8a34c17-6f76-49ba-88e0-4d77289244ee", "value": "1536:KjWWxoYWsYS2mGQuvnXfvQuyHobolz1pSxPM3gnqkZgGnG/LWZ:HWCuYDQ6PBqo8/pRgnqqgGnGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766471607, "uuid": "2cdebd69-3a19-41c5-b66a-d24f63189b2b", "value": 132484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766471607, "uuid": "c28c8c84-9994-430c-9a24-a7e05727c8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471607, "uuid": "fb1f988b-7d0a-44d4-a9b6-753ffd7320eb", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa12eb9c-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478640, "uuid": "bf40b6ea-fcb7-434d-98fa-3aad2e839bf0", "comment": "Malware payload", "value": "7101f6eab090601f31b80636f7bd578a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478640, "uuid": "3c37ece2-bf2c-4f95-9721-4a1b25104fb9", "comment": "Malware payload", "value": "7763da12ed56edfba23ef34af0323e370b4ce265c5d7669ab5305ab16cadc897", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478640, "uuid": "26c5d0ee-36f7-4fc2-a3d8-f8279204a433", "comment": "Malware payload", "value": "e67da65f4a1b4b2e946e74d640369c36bc70e1d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478640, "uuid": "e003211c-a555-4037-b4c5-1dd59b451871", "comment": "Malware payload", "value": "832a5ef9a789304821444964b286fcfefb5f07aec1bcde3cb7dd2a101cabb1597a302450fc8fb8d1fdf617ae51ceb322", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478640, "uuid": "84776358-d781-4080-aae8-43aa281fcb0c", "value": "T15C73D993BD3976753592FFEFF9CA146DD6C23D41D3E2B53AD4A85324806AAC4080CA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478640, "uuid": "71cc8ec4-0cbd-4543-9ff0-8fa5c6ee0af9", "value": "768:I8w/h62/jWs6oS+xISN0vU50RVzhznDIrl8QzstrsrF1AqVMhPONLaQAKfrEpEpw:I9l/AoSSMGrusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478640, "uuid": "a8efea12-605c-4f65-b734-4e2379651a3e", "value": 74448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478640, "uuid": "3fba038a-ce35-4bda-85d7-4ba5d14403bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478640, "uuid": "76488609-e3be-4c1b-a63c-258681397fb8", "value": "invoice-1645080830.pdf (101).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea371b33-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468869, "uuid": "8d5fceaa-904c-46d4-818c-b2c0fd251540", "comment": "Malware payload (Mirai)", "value": "fac176a76bcdb23133ed8653897309e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468869, "uuid": "e7702dc5-eafb-46b3-a368-7510e6b7ca1a", "comment": "Malware payload (Mirai)", "value": "77827796721932598e298749a44bb8d532f42ef1156170d560618173b4bedbaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468869, "uuid": "468d5e6c-1be8-49f8-b410-8032ea9b2df3", "comment": "Malware payload (Mirai)", "value": "e207ae80b8966cc4f482fe1241e47b13510422e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468869, "uuid": "ced76e1c-a516-49bf-9345-7270bcdf2bcc", "comment": "Malware payload (Mirai)", "value": "acf77a122a7526cd240df86ce223fa9e3874efd0e6ae3762dd739328d2ef6a4135dfd7ab0e66b55dd708bbbdbb569db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468869, "uuid": "faeeb163-674f-4c31-b43b-4d3adb7f9a4b", "value": "T17A63027CE26CECADACB04D3232701090B1296E61A0CFD538BE3B551652578AF95DF86F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468869, "uuid": "1fe22df6-e0d4-4213-84a3-0c0183eac6e7", "value": "1536:MK8py3Q25PwU4Ekp1p4xOmIx1AtZgM0Eb3+y85Pq4rI3j28UiXrPo:s2IEkZ4sctZgM085ofdiXrPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468869, "uuid": "0aaa9d55-66b3-4cc6-b900-658e014f9cd7", "value": 67168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468869, "uuid": "1cd8a9b3-cf73-43a0-9f74-7cc2201cfe17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468869, "uuid": "e1472d54-dc3d-4be7-9d7a-68ed2d889a06", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a30b52a-e036-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766518476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518476, "uuid": "5b9d2350-857d-4842-9209-3dc245a9fc4f", "comment": "Malware payload (OffLoader)", "value": "a6dc9ecd7fd81a464a1ab3368c77634a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518476, "uuid": "b6073c72-1e1f-40e9-b2ac-4097d9182ebb", "comment": "Malware payload (OffLoader)", "value": "77a3da4cedb91ae9c3a83e4dade09e05caa76acb1db7c5b20c257f1ec0951303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518476, "uuid": "830c249d-9a9b-4ae3-9b9e-1b35c491a31f", "comment": "Malware payload (OffLoader)", "value": "933d4d0b3332dbc8985ac0c855f5767de06a84c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766518476, "uuid": "9a2e6237-fda4-4ace-aef2-13d03e09f13c", "comment": "Malware payload (OffLoader)", "value": "4be3b863450b65a57537058c2399f1556928e145cd611c15bbe4ec3c130e9ad61e39e39a200781005b4093c980851d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518476, "uuid": "a78951ca-a320-4095-b9f4-f29fbef6166d", "value": "T152A533839B40767BEE7B07FA06768B2269ADD45640B85F43178022CCFD1D442DCBA9E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518476, "uuid": "dbd34cae-d6e5-468a-9cd5-d21607b51816", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518476, "uuid": "25e970bc-d1c9-47bb-8631-8c2367aea146", "value": "49152:u+Z3yWklaOI6ndkqG0rJhQInBdJZVba7M2GB4CQaF:uhQO7nVGEJhhBaIndF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766518476, "uuid": "867ed082-f9af-4360-a901-7bfdb59d6a49", "value": 2097150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766518476, "uuid": "4c9b8a31-1389-4388-a44b-a31c88687582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766518476, "uuid": "0e06c204-e95e-40c7-af3e-cfd363e47bca", "value": "crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14c02ae-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478625, "uuid": "8cb79fd5-f3b3-4157-9de9-9b41936b98d5", "comment": "Malware payload", "value": "3b0df9eb280d16ccb5cabfeb97851301", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478625, "uuid": "6a69e74f-c8ed-4396-82e6-0afa8b88e858", "comment": "Malware payload", "value": "78631adcb39d6cf20cfe162248b93e0a9fe99ef456bd173a0a6f85ce5bcc9221", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478625, "uuid": "8b320564-680f-41c2-9602-49eb7835e457", "comment": "Malware payload", "value": "092b18d9c3c894fd1ee1470d0dbb7210069f0126", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478625, "uuid": "3dff7ff8-fb84-4a2c-bdfd-64632d3ea4c4", "comment": "Malware payload", "value": "7b125b80bc4de933761fe04f7ba6934b64265048bf2a2bc6b976033c103953092fca8133f17254ff6cbc0addb833fa86", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478625, "uuid": "c01a8659-f904-416a-8cde-76a193da783a", "value": "T13A631B435F55E9C52E7B1EC496A119512B0FFEAF2C83BECCF036226C4405E61C2A779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478625, "uuid": "61b06faa-b67a-4d4a-a6fa-1dc256be26d2", "value": "1536:I9l/AoSSMK5UnK3Q4Z5cw5x2CP+/gl/XU2kVmCSLTosIRBBIlY5wo5taZMw4l3ux:I9l/5MK5UnK3Q4Z5cw5x2CP+/gl/XU2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478625, "uuid": "7b8dcb9b-3c5d-406d-9be1-5bd3c33af1aa", "value": 68761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478625, "uuid": "e3072ac7-6c37-4aa0-aca5-162bcdf6b32b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478625, "uuid": "73a3fb03-997d-486e-aaac-d6bb89daf163", "value": "invoice-1645080830.pdf (107).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53ceec6-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478685, "uuid": "38ccd4e4-f078-4839-8406-1ce04db177ad", "comment": "Malware payload", "value": "d20c04593952382bbc8714cbe3be1a34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478685, "uuid": "81c49769-fa19-4e35-a29f-82f1ba8b416f", "comment": "Malware payload", "value": "7925aea8fdd372084d270a382309a4faa68a01d6021b3e25f3fc55e05d221888", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478685, "uuid": "7edb091e-6abe-47ac-b058-3934de2a6930", "comment": "Malware payload", "value": "a20a49f80a6b6c3827de3370585c84457dc8e3be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478685, "uuid": "6e4dd19f-eab4-443b-ba5b-ca992b380ad1", "comment": "Malware payload", "value": "9304fc959c57f5f6a9055c6687d11a73e16268aaf709cd5a047a0c5cb6f3ecf3be5fafa535ed9f88423b9f2bf33bd0ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478685, "uuid": "7f6574cb-8395-4b33-b121-a0a5126a5936", "value": "T1EA630A07DE3444F1451705E5DF1D41DC9D0C8F8AABB6BA34A29EA007CC4E6ABBDE84AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478685, "uuid": "6d28e297-2a36-4a4c-9031-a882aabe226e", "value": "768:I8w/h62/jWs6oS+xISN0vJIiksCdkfScBYrwz2y8kTAlGB:I9l/AoSSMBYusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478685, "uuid": "93a8689d-a5be-4a3a-9a50-b05b1c9c164a", "value": 71541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478685, "uuid": "ca0791e0-c503-4213-a14f-76c6f1e10ef8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478685, "uuid": "6bddcb31-c6b3-4dcf-a383-97561bc0ccf6", "value": "invoice-1645080830.pdf (93).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7043dde-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524188, "uuid": "432e0817-bc72-4733-a29d-bdc087977744", "comment": "Malware payload (Mirai)", "value": "c1ac512f508be0745b8077bdc7dfbf39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524188, "uuid": "c4e63b68-1e0c-4f35-80fd-77e497709b0d", "comment": "Malware payload (Mirai)", "value": "794e00636e37af811924c961963bf5c6b96f7f4bd070670296a1ab21aba3df3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524188, "uuid": "8190255c-f5b8-4786-8452-e867b4eb0e86", "comment": "Malware payload (Mirai)", "value": "cab14b52d50c1f3ddb53173d1cb474d76709bf3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524188, "uuid": "6d24d7c7-edea-421c-b37d-a0c85683dedc", "comment": "Malware payload (Mirai)", "value": "8cdc98e512f9a0986044bf4c4658fcaf50f01a68e9504038d740f848d1c9f4f426185667f61f863aff7aad1f1468b92f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524188, "uuid": "0dc99af9-8fb9-4984-a70d-13386b00cf30", "value": "T1E1242B037A81C9FEC496D1F04BEBA5319978F82D0635714B3794FFB12B49EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524188, "uuid": "90c27b98-afde-4c3d-9980-c78e12a1968c", "value": "6144:KBbbTJgbFZIeT6XlrPG2er/+PlNzO/4X9:KgJT6Xl62er/3/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524188, "uuid": "786c947e-56e0-4109-b0c6-7c53b082c72c", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524188, "uuid": "57cb8e98-5111-471c-ab3e-b7769a75e2da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524188, "uuid": "3af6d9f2-cf0d-4bde-88ea-f7f3ae3b421e", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be5d06c-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510157, "uuid": "1533c4d6-b4d6-4d58-bf7f-8a0fcb02654e", "comment": "Malware payload", "value": "5563d0758bd272a8797a41e25a6f8009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510157, "uuid": "c4ec3182-f5d7-4fdd-98bb-f63eb065edb8", "comment": "Malware payload", "value": "79c537fedb15657948e8175545a22ff2c48ca7ac678b3168925f78fe68753d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510157, "uuid": "7c2f58a6-5ddc-4416-9421-ccb42ab500ad", "comment": "Malware payload", "value": "3448a63c636c2284f580d678c4b16c00553d37ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510157, "uuid": "8d841427-6f0f-4464-b42c-de3d99554bfe", "comment": "Malware payload", "value": "1801385cc5b019fedf6b562e4c69eebd2951fa00fd0c2983063d18cf6d87028fd9989c0046bd572ba451465665523e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510157, "uuid": "d871cf97-7e70-47e9-b15b-bd1faa6568e4", "value": "T18573396AF3A398BCC217C1789A865632A978BC4A0A70F73E53DCE5753F16E404F39611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510157, "uuid": "d6c2965e-73a1-46a5-9131-a64b73a2f591", "value": "3a2d0dde76dcbe70053e2bf54bc13e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510157, "uuid": "93e7d581-ae8d-49ef-8002-5011c5d5dd31", "value": "1536:HyjojeipULtZVcxIXDoP3yrIcAVogkvluoZV50232t:HOu187zoPizAKhluKV5DGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510157, "uuid": "d2ac670e-c135-4f9f-9ade-0432f91c80d4", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510157, "uuid": "0e464482-82a4-4b35-bbc6-33b6457ade7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510157, "uuid": "ba6e08c5-5fb8-4a15-ae84-80a36f7a880c", "value": "cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800adbe0-dfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (CastleRAT)", "timestamp": 1766476851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476851, "uuid": "d6c24533-9324-428a-ba66-73c230f30d46", "comment": "Malware payload (CastleRAT)", "value": "eae14fe94896706ec490a2425886229a", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476851, "uuid": "664a7a54-0de7-496d-ac75-68a73a318342", "comment": "Malware payload (CastleRAT)", "value": "7a183d113322a729e73344460bac8e87a2d72f83d30980566c8d2f99eb576d01", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476851, "uuid": "43f4fd21-f928-4bc3-a402-8515beb2f36f", "comment": "Malware payload (CastleRAT)", "value": "2362aff4f61c8a7c6b0fd92940fc80a47d667f86", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476851, "uuid": "34abf39d-3159-4208-aeb6-b5ad4f56fe36", "comment": "Malware payload (CastleRAT)", "value": "09ec7cf70a860bfc73d024f69cf7a3759c381f7ca9a806143444846f853b10cc1c2857bc26ec4d22f282a4909fe15fb5", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476851, "uuid": "da6af550-9ce9-4e46-9457-621ca8373077", "value": "T1EB75D547EBB650E4D8FAC1399656722BBC71385983389BD797408A474B62FF0E93E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476851, "uuid": "92b9bb54-7efc-4a26-8ea9-16b6992fdf78", "value": "9feb5ee1d88fdc8540a2bfc1574641fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476851, "uuid": "55c52d07-4528-463a-a972-517e22b91818", "value": "24576:XRdjAqa0AdhgXz2IjAexbIV6KpBX7LKzswnexq7tyQA1a9turLVxd4DSXI:j7z2kLtCvrLt4D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476851, "uuid": "1b5d3876-d5a2-48fc-b747-9fc95ed6341d", "value": 1639424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476851, "uuid": "18ecd745-3b3a-43e2-96e6-997b2a85fba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476851, "uuid": "fbf744ad-0ea1-4168-b219-60c44341495c", "value": "7a183d113322a729e73344460bac8e87a2d72f83d30980566c8d2f99eb576d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee156b85-dfff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766495075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495075, "uuid": "af8f932b-36de-4fc6-9ee7-986b98777bf8", "comment": "Malware payload (Mirai)", "value": "a251ebddf5c37f707095e81ad20808f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495075, "uuid": "93830eaa-5e01-47f9-b368-54f26bb4694b", "comment": "Malware payload (Mirai)", "value": "7a1849017c0684337d85b2aa8a730c4fee62486f444c675e8414b97c50cfb5a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495075, "uuid": "041c0049-9c97-4921-99b2-4646b9f5912b", "comment": "Malware payload (Mirai)", "value": "3867fc1a40c5307c94b96387f9ad6502f1d2be50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495075, "uuid": "58f32ce3-8342-4cb5-ab4a-b47bdac61184", "comment": "Malware payload (Mirai)", "value": "db5af9f535ab423d33caec90c0ba549a1cb6ef17c576c91501e0411e1de34e4d355c73c3d81bf61269a95dd7b4c80dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495075, "uuid": "06c2bfcf-4af5-4206-a492-7ad8c77dd789", "value": "T16F93A7197FB25FE7E82ECC3705E81B4524CD17062159BB3AB938D464FA4A64F1AD38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495075, "uuid": "e0c1c4a6-1af6-4f4a-a5ea-fc95c486599d", "value": "1536:72X4wWJThHe5A07xsx9JyDjqcfgWzW4ngy6V7r:72X4wUVX0FsfJy/Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766495075, "uuid": "16d18499-974a-4182-a609-fe2a1aa939bd", "value": 96204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766495075, "uuid": "b03dbd89-6b41-49b3-939e-e912356ce6c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495075, "uuid": "98dd1b7a-3d9e-48d4-92b5-79eb8ba63787", "value": "shadow.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5202f2f7-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478492, "uuid": "a7da2aa8-407a-40f8-9355-9e816d67f5f9", "comment": "Malware payload", "value": "21ede78f7899789fbb5c946ab2bbea8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478492, "uuid": "7ab4caf9-7413-407c-a6f2-db8d89fa1cca", "comment": "Malware payload", "value": "7a4448fb696029bd07af3a16d54b4b30b701283b3d7bb6d8c802b7ef85aa707d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478492, "uuid": "cd70783d-5e8a-4411-8ce2-aec6c93d64bf", "comment": "Malware payload", "value": "10c253a21b57f3ba76ee6dba8d62f55c24f3b155", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478492, "uuid": "15e43a71-68e5-431b-81e4-b694352870e7", "comment": "Malware payload", "value": "e40ca4bf3d16af14e7cbefd9053fa67a91101c86600b312effa3538bcb580d47b9f9cd0bd80bc274c66da76c98532d71", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478492, "uuid": "98f744e0-4f61-4b68-8f78-c9ba9d06b952", "value": "T142531BFB627384933F77B6123DCA484811930FE10C72A6F8A4C22DFDB918BE51A557A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478492, "uuid": "3a094318-2bbb-466a-940d-11006ec47fef", "value": "1536:I9l/AoSSM0ktiA9szWatie2cssuVtShlSGBzbXKqgJY2d8EtSb4ECJKHwusrdkT1:I9l/5M8kusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478492, "uuid": "09d47c92-5663-4f8c-9311-1ee5c7a379d1", "value": 64905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478492, "uuid": "32b1dd4e-e8c7-4ce5-b171-f61fe995eaee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478492, "uuid": "99c378cf-0651-4f5f-86a6-7f75ce81b1ee", "value": "invoice-1645080830.pdf (128).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdc388b-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511533, "uuid": "ef862cf8-ac0c-4a6e-8544-c34c4c7ffe2a", "comment": "Malware payload (SpyNote)", "value": "bb9a56271c22d2090914f6a5b2917a01", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511533, "uuid": "23bc8f7d-0aff-46c7-b44b-c3e2ef621f1a", "comment": "Malware payload (SpyNote)", "value": "7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511533, "uuid": "dbc4dd0e-5e2a-4794-bec3-045166a1eded", "comment": "Malware payload (SpyNote)", "value": "5279fd993849c4fbbdaa77a8c47141435bc926b5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511533, "uuid": "f9f2f93c-87fd-4a83-9db1-9afb9af68c34", "comment": "Malware payload (SpyNote)", "value": "cb45f120f7d1d40a8a617f15ae60af4a84d78ebda753f8ba1b56256f936db766ed48431c74d8d043d4bd60a36140439e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511533, "uuid": "6b816967-f0ee-49f9-8212-8ced5055f4ab", "value": "T1A2F45C86FB5AF867C9F3C7364275C6AA96064C544B43E7431A85763C0DBBAC08B49FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511533, "uuid": "b7e1dc04-ff39-47c8-9334-b6849e65c9c4", "value": "12288:40YZa1a8LdefjbLLP7SU+5WmpYshXZPbGwidNpge:Ga1a6efTLTSU+5WmD9idNpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511533, "uuid": "b32871ff-b566-4caf-9915-0e139c82011f", "value": 778721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511533, "uuid": "65298a53-d889-4cb6-abe5-68410cdc3955", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511533, "uuid": "f262b66a-0a90-44d0-82c0-0ed21202340c", "value": "client.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c84227-e026-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766511737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511737, "uuid": "fe1fd55d-d5bd-4f03-a5e5-ba94cb82b85b", "comment": "Malware payload", "value": "9f23884ac4706943480126132947eff2", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511737, "uuid": "654034e3-61fb-4dd2-84bb-e0b67d58d627", "comment": "Malware payload", "value": "7a7856ad1fbd7092d4503b5a2dabed236731b0b6dbc5394a96e3c5120b5046ee", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511737, "uuid": "ecf12169-4782-4c4f-a0c5-13cb5b79ba39", "comment": "Malware payload", "value": "4a3b93f199dd4c63009148817326c5b4bdcfd9a5", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511737, "uuid": "28bd5a0f-7ac5-40b2-9ab2-05c2fcb9544d", "comment": "Malware payload", "value": "d53f3c7c6ca3fe2559d6dd1837c07cd02ccd4ac35eddf0bf7c4023153ed971e57abe2710e6593aa4aa7d42c5fa2729fc", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511737, "uuid": "0b722ae7-d284-44f0-8dd5-99f87445c6c3", "value": "T1B3850123B642E0BED49F02B1A01DD73C5EBBA91417518DEB03D45DB88DB8BD15A3872E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511737, "uuid": "804fbb09-0b38-4c8f-aaff-3109d914dd18", "value": "c37e77d466a62b13f872fa8f274453f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511737, "uuid": "447da948-df26-4eef-a392-3879a258a5e6", "value": "24576:vuhTw+ipdgNouHEUsRktcw++17XnyqNCnxV8bpQhOT4R0rhcRdiz70T6aS:o+fg2mzTtcS7XnsvV7Rg6Piz70T6aS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511737, "uuid": "5d82f3ca-ca5d-4457-9af0-1fbb867b5c1a", "value": 1723904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511737, "uuid": "e154d83c-f604-4c3b-90cb-e849162e7825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511737, "uuid": "bdfb27e7-10a1-44de-9d70-e35b613cff21", "value": "CornflowerBlue1.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf48b58-dffc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766493756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493756, "uuid": "7a1082fb-0408-4d1b-ab01-f19e88b82741", "comment": "Malware payload (Mirai)", "value": "8965420f337667642c78b324fe9bc653", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493756, "uuid": "b4ddfda3-ab31-4f70-b37a-830f81ddb984", "comment": "Malware payload (Mirai)", "value": "7a84fe422301a21cbbb8dd3cdc0e643ee0b9c1aadffa8c57398fd62ea4b58c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493756, "uuid": "8d19c485-b856-4449-9c8b-2a637e77ca33", "comment": "Malware payload (Mirai)", "value": "e4e72a37fa822adab6129e847da17dc3324ee1d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493756, "uuid": "3553534a-796e-42a5-827c-4af412e00e7f", "comment": "Malware payload (Mirai)", "value": "075dc009b567dce880ea6835775e3be5ecfda2103e9643bda22e964b9e21fd355669a59b8834334e0b79276a7b8e1419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493756, "uuid": "10dfdece-b13f-4ea8-a2dc-ddd7bfeb3031", "value": "T12793C45E6A274FBDFBAC463687B7DE209249339227D1E244D09DE9019EB034E384F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493756, "uuid": "3c8b14fc-0d83-44b3-b853-540bbd27db4e", "value": "1536:YTLv1rp0xCd509Bv8hVxzOVYDsixjEU+yFgr81WiofV2vKOoJINnYrQjW7yUdUJQ:YTLdWx809BvaVxzFD31ncXMWv6ucy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493756, "uuid": "b2c10735-a446-44d9-8c78-fbfe26389bba", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493756, "uuid": "064a46fe-4959-4cbd-a426-ede01941a522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493756, "uuid": "aab41230-02b1-4304-abc7-aba0c87368be", "value": "shadow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d485ad-dfd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766478312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478312, "uuid": "a6f79961-f339-4b41-83d2-1e34a75ce6d5", "comment": "Malware payload (Mirai)", "value": "0e90de8ce441e3571652bfcce5f0b650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478312, "uuid": "f49809d1-2dab-4a28-ba2d-48c4b8a58ca6", "comment": "Malware payload (Mirai)", "value": "7a896488e30cbcfe61af83f138383aeb288eb984f2981d2ba252655f0a6ed1ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478312, "uuid": "9928ec4a-f9c1-4b75-a1d4-83a4f0e26de1", "comment": "Malware payload (Mirai)", "value": "01b2e0f04575e6034ca3df61e5ebe0d7dea6971c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478312, "uuid": "79f69366-287a-48f8-b334-1f6811bc82f6", "comment": "Malware payload (Mirai)", "value": "5da47d139f3a1002a4f63f01901911bcc8fcceabbb73ef28f8a5b2f25c28d5de8d952d0e235a2977718d84ec51dea666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478312, "uuid": "22015c08-1bd3-4623-b70c-b2134715ef00", "value": "T1EB6302072EE66FCEE7D59A3261A0AE5F8338896EE012F3D442B2CD9563E0116481F18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478312, "uuid": "7a8dd66a-0cf6-4bcf-ae17-23c3abef72aa", "value": "1536:BOkqaykM2zaDqEX7YEYOqaZ94y7iQeEQNgJ5RlnnvNm+:goBIqEXHYOq894y7iQ0ERBnvNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478312, "uuid": "2f317eb1-c592-4345-a3ee-15dd50642fa1", "value": 68076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478312, "uuid": "341a83da-567d-4c1c-a119-4cdcd3225bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478312, "uuid": "edf98451-0f82-40ce-9d3a-de43f3966b37", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47ee03c-dfe1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766482147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482147, "uuid": "f8024a19-3fc0-4955-8102-0f409d00c994", "comment": "Malware payload", "value": "e021fdc52c3edaabff0b70011e8f27d1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482147, "uuid": "b0b198df-c7ed-486a-aeea-cf360d0f9119", "comment": "Malware payload", "value": "7a9b933b41e8c345c374073636345b050a0f86321129b5f68d04695fe8a5751c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482147, "uuid": "29f61d4e-57f4-4035-acaa-fd6755a6cfda", "comment": "Malware payload", "value": "deaf06c6bf140b4317a617265e078d5e3ab19935", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482147, "uuid": "c34709eb-4a69-4256-86b8-d4dd319d8e1c", "comment": "Malware payload", "value": "55f522ca4810957f69e1abb4d0d17cf40c9da65590ee4575cf1cbaa474a9b1c379277ff35932f7d77ab6a69e416b8660", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482147, "uuid": "3a6e819c-69cd-437b-8dfd-1065c0dd464f", "value": "T1CC473322B6DBC132C56E017BE958FE1D09B9BE73073001E7B3A57D9A94B48C29379742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482147, "uuid": "1f58be28-e0a6-4736-8d48-1ab1c78a00ef", "value": "393216:bz2+LqVJEN61cUDf4hL8IXpE7xyxHWuW4nEKg/RfIJoGyGQ6n2I0:bLgJdFDe8w+GdEKgKWGyGQtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766482147, "uuid": "161cb968-b534-4132-ab35-a63ec055f060", "value": 25484800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766482147, "uuid": "87b889a5-265f-40bb-a0c9-1db135007fa9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482147, "uuid": "7b3621dd-e3fa-4550-bf61-40cfdda6371a", "value": "ChromeSetupA-5440.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7ec711-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457869, "uuid": "9812f757-1838-4e26-97e2-738fdaed9cca", "comment": "Malware payload (Mirai)", "value": "fc71c3ec3ea3e04f15bce38a7117bd3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457869, "uuid": "89a12c31-06da-4996-8290-a711c2201ff1", "comment": "Malware payload (Mirai)", "value": "7ac5f59e82588567a1f4724b203416ea1098813e9b4192ca3e9d6e8ef045a3be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457869, "uuid": "68e03335-0c84-4f6b-b81f-bc431088ad37", "comment": "Malware payload (Mirai)", "value": "b26f573db68d2fa68a8f2de87472768ab9e0abb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457869, "uuid": "30c9b3a9-d7f9-4490-abd1-a09c5b4c8f1b", "comment": "Malware payload (Mirai)", "value": "e12ba7951a34a9183657506dcda0770a080fd39437b88adc80c39d105e6ecc1fb838e1563f23471c85be778c1fe400f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457869, "uuid": "1c78b1d5-5a0f-46cd-a348-6c0f32c9feee", "value": "T1F0E33B46E6408B13C0D6177AB6DF42453323AB64D3EB73059928BFB43F8679E4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457869, "uuid": "d5602ca1-2093-4283-a701-723de9191a7e", "value": "3072:8huZ+W4OgdaSj3/pMfYSCnWa79niZuzLNJmM/96NS:8huM3aSj3/pMfXCt7ZiszLNMM/9GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457869, "uuid": "dcd89d0f-9c02-4e5e-b689-1abfd9f7e82a", "value": 155471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457869, "uuid": "775f0647-19c1-426c-b0a2-ad51ee3a6f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457869, "uuid": "91a75204-c6e2-4455-a6d1-3e22941f8558", "value": "ntarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e356015-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451427, "uuid": "797761e2-4a21-4ce5-8c01-81b0330b17d3", "comment": "Malware payload (Mirai)", "value": "3d2970a56513c40fc92159ef7e6c3c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451427, "uuid": "9885e019-76cf-46b0-ba8d-ffea5845acb9", "comment": "Malware payload (Mirai)", "value": "7acbab1fa1aa1ea342e5594a41423a529d656fd3aaf933fdaf8d687d1099146b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451427, "uuid": "77c9e9e0-3608-4ba3-842a-43391e5ba60a", "comment": "Malware payload (Mirai)", "value": "194cc236ccb759409349c597dc0b27e76886f5c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451427, "uuid": "9a8a5d29-55c5-4db6-8626-6c6e20b038d9", "comment": "Malware payload (Mirai)", "value": "fdff24a492a35783cf98f5fdaade39e8dd2498d95a8e83582c6cbf5f271d6b892be554a8c875ee9410c3266d6adf0fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451427, "uuid": "ce94282f-65c2-45ae-9c9d-36f5387512af", "value": "T13193F996B8918B12C6D452BEFA1E51CD331317B8E2EF72539D146F247B8B42B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451427, "uuid": "0d4155a7-f93a-43c9-bcf4-f472770744d5", "value": "1536:dtn/eWRtjiXGOgtxJOCFmIKh3qqR69LAPB9y7bStEYeSoRv2o3IMyiOcRJuBTxh8:V+Gzk3ftI7etEjS8qcRJuBTxhr1rT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451427, "uuid": "1cdabcd4-3838-4cc2-92f4-5bdb0435335b", "value": 91708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451427, "uuid": "3f95d734-3e4b-4698-8943-7504be6c5fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451427, "uuid": "ffe286e0-31b2-4284-8d6c-b38a3091d45d", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7ffac9-dfc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766470542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470542, "uuid": "91c38d2c-a4b4-4833-a4aa-a7888d7986e2", "comment": "Malware payload (Mirai)", "value": "6fa6fb4bfc09129de3cfe45f894a4ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470542, "uuid": "2da7862c-8494-4ad9-9394-93ad04cc1ffe", "comment": "Malware payload (Mirai)", "value": "7c1ce6058dd3e5c26b74c027c353ca2f02dcf2b05faca4f07e4dc5530a874ef5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470542, "uuid": "653a005c-0f74-45d5-b505-ceece3f0da8a", "comment": "Malware payload (Mirai)", "value": "5a5c34c2c3b88c530a3e45a7e7fe957d80a1510e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470542, "uuid": "39d5da8d-6807-4752-a3fd-a06070a6ab40", "comment": "Malware payload (Mirai)", "value": "d7eabf1aeaa047bec4b630e836e2516ed0c8e496452372d9e06860064b4693d7cf680a77548c3310fbb64216d7ad7a92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766470542, "uuid": "29e5a3b6-be8f-4e74-89b9-2160d1b34fd5", "value": "T134D3F6327A601D1BC8CC533961F78320F6B2776A61B9C71ABE931EA96F383947117760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766470542, "uuid": "baaa67a4-4a6f-418f-ac4b-a95a1a5bc0ba", "value": "1536:asFAzXkS+zzXEucf+dO8y9d3Hw1JTEtMomq7nHBm7W6WgtoSjoHwcLC1/hrzbu:NEkNv+3QnT3vMhm7WkSSjOwb1/hrzbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766470542, "uuid": "87ac9638-8fa1-4f5f-8cf5-8a9671aca86f", "value": 132568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766470542, "uuid": "51a6963d-47a4-4361-ba67-ef0b430a6bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766470542, "uuid": "8cd92a3b-dce5-4582-9109-34b9f46699c0", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaf0ae2-e001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766495955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495955, "uuid": "d9c39917-104c-4392-ab85-becde03f025f", "comment": "Malware payload (Mirai)", "value": "3ad384f69616916fbfed642e4047cfd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495955, "uuid": "0440a780-3060-4cd0-ba01-f327c98ee29d", "comment": "Malware payload (Mirai)", "value": "7c4d404b0e75f2e8a13e6d396544a04667a28b0d73f2baf2ee11d715d09c52e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495955, "uuid": "c81188de-2983-4441-9669-119d406c001a", "comment": "Malware payload (Mirai)", "value": "e96f82565b0aae7b3fd83623985237551a353432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766495955, "uuid": "34813044-3764-4784-99b0-ffc6d4fe59f6", "comment": "Malware payload (Mirai)", "value": "c8459643cab581765d1a1b58ba04b7a4e8bbb13f86e714d9d8a89b58bddfcdb86aef3602b340ee8c1a9b1c16b85791ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495955, "uuid": "659928d7-f403-4618-aaf2-2be1792fe282", "value": "T13563294B744846FDC449C23C0769B07ED466B4BE52BDB2FA27D8FB067E86E106E6C418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495955, "uuid": "2e71cbb3-451f-4bd7-a90f-a380055dd274", "value": "1536:k8xUadgoSsbstYu+IerdzVVzkJO23kcFuVDkY8kFgrwPg57cAeXPWN84ug23hLRu:8adgoXbstYpIerdzVVzkO23kcFuVDkYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766495955, "uuid": "bc4427c3-ba2c-4aad-9d29-a4f693c551c2", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766495955, "uuid": "a18f108c-594b-4150-a2b4-53bea5176070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766495955, "uuid": "42a21dc0-34f5-4459-bd75-429757285429", "value": "shadow.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9640f2fb-dfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (CastleRAT)", "timestamp": 1766476889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476889, "uuid": "16891eae-f620-480a-bba4-519e40f35f34", "comment": "Malware payload (CastleRAT)", "value": "5e112bf39e380e74bd820db22820a19b", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476889, "uuid": "40e6ac4b-f8f2-4d35-b235-91bd18a775e0", "comment": "Malware payload (CastleRAT)", "value": "7ce399ae92c3e79a25e9013b2c81fe0add119bda0a65336d1e5c231654db01a5", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476889, "uuid": "384bfd99-9798-4c40-b60b-8286afc11f44", "comment": "Malware payload (CastleRAT)", "value": "9fd21b8defe7b9ebbebc422caf6fcab3df7f547c", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476889, "uuid": "946dd686-3893-401e-869e-d534d1151586", "comment": "Malware payload (CastleRAT)", "value": "42afccd55575d91afc7dde8fab54c415300082afe94ba908d1fa2116fee04311126ea34347ef98a78977a6e4f4d3691d", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss-com", "colour": "#D04E06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476889, "uuid": "33836616-6846-4560-944d-13bfe958c8ec", "value": "T1F7573363E5D81993F47E2BB041BF1FE5CBF965982D02A09383874985B8B06713FA7D84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476889, "uuid": "0111e1e6-363f-4ad2-aff4-1a9d2967a2cf", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476889, "uuid": "87bcc5c3-bc9e-483a-b2f7-8286cff8b6a9", "value": "393216:CDQBb0vfMEeYC263y8US6z+WHlVDmOx/iD/0Fich2WPuaKxSms6c0Wd7tEOs9tl8:CDQY2YmCVdFVDMCcBx1hct7ar9nXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476889, "uuid": "89c5ae23-fd05-447d-a72e-c6293b8c0453", "value": 28578528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476889, "uuid": "dc19efde-8ab1-46f5-af67-a96b85256896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476889, "uuid": "dd87d90f-3246-418d-9cc3-881ef405ddf0", "value": "7ce399ae92c3e79a25e9013b2c81fe0add119bda0a65336d1e5c231654db01a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0aac30-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522911, "uuid": "06b99779-325a-4efe-b7d2-b60265010a2e", "comment": "Malware payload (Mirai)", "value": "1d19aba796d018effa6804f2d8191613", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522911, "uuid": "c8191429-db79-4cd5-b88b-56e64265e8d5", "comment": "Malware payload (Mirai)", "value": "7d772b21d9be3f9e5f585eb6f8b4c97c07488b31daf891092c7d853f679cf8b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522911, "uuid": "3e020b09-a2b3-42fc-91d9-35168cf3a189", "comment": "Malware payload (Mirai)", "value": "3403afde859ce6c5bd26d1516781de3bbfa7046d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522911, "uuid": "00f607fa-7897-46f2-bbfb-35462bb5231d", "comment": "Malware payload (Mirai)", "value": "55f83d6cb35dab1877371540a316423267426099403952b83264dd44bba9df7883967dfbdc7640b08594d6c5660868f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522911, "uuid": "38f2662d-56e8-4531-8d83-fdfa4df06d2f", "value": "T1E9331985B8818E22C5D4137EF92D018E3317276CE3DFB3229D116F24778A96B0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522911, "uuid": "840ba9bb-df30-4bd3-818f-c416179a8301", "value": "768:mwn5I8aNLpSagm2d+NeieWDyZ/zkSB9cDbUrfimkisdvIv5MTirAfQNHY/6V:mwn5aPUvWDI5BeDbuzt2IWirAINHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522911, "uuid": "d320ca27-4c9a-4b7a-8785-9255e3f7712a", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522911, "uuid": "9f36102a-96ca-40bb-911b-1bdb81582711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522911, "uuid": "77ea1014-a10f-4ea5-984e-c31f4ddc2546", "value": "87sbhas6as.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f4161c-e035-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766517876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517876, "uuid": "586c1f98-d2ba-4074-a10f-0f5bd0270336", "comment": "Malware payload", "value": "5e0fbeea5d86d269b371666d76fe76a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517876, "uuid": "1c16c497-c72b-4bce-9fad-f45d4837d4a6", "comment": "Malware payload", "value": "7d8667c7bdda378d6379af70212f67f6d7c5b0169fa8a6a624b653d77850a774", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517876, "uuid": "a734a59d-fcd8-45da-9849-762f8b95649f", "comment": "Malware payload", "value": "cd308ea74acd19b7c5ffaffbfac944af5be18346", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517876, "uuid": "35588180-7100-4022-9f40-719cd34bae12", "comment": "Malware payload", "value": "98ea6b5e08b79c72f7c90f58531fb306446b1ab5dcb94d33d7817cf3d55c3cd03fa81acd8ae02a57079c997badd81a93", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517876, "uuid": "dec97d3c-55dd-4542-a5d7-1cafa304b62c", "value": "T19746D60D94C70053C452BEFD2E2E76918C067E232ADB3C56717FB49B347E989E662E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517876, "uuid": "ff28a99c-1224-4490-b03c-731b56b54c14", "value": "49152:9G/tI8Ualt8aoemNc/AvDjfRRItSK1aAuoGZav+PZRoYSqq2CDi0T2R7VNGTtuRf:AVFUCiaoeqc/AvHRRItSKnSpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766517876, "uuid": "81c183a4-ea33-4b1b-9c2d-81ffbc926514", "value": 5757812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766517876, "uuid": "e47e41f0-5440-4a82-855c-8daea17fc902", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517876, "uuid": "5fddc9ad-9049-4f50-94af-c5d14a33c7a2", "value": "Technical specification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0e6cbc-e059-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766533402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533402, "uuid": "7212e9a6-d54a-41e5-bb58-4f80a18d795c", "comment": "Malware payload (Mirai)", "value": "1cead56377f3a452c1414d9b9354168f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533402, "uuid": "f1e5dc66-6985-4d88-825d-c6e61b8bddd3", "comment": "Malware payload (Mirai)", "value": "7e3ba88133976eaee1d09f6166c60c87c6cceb7bd9771bff02a05139f182290f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533402, "uuid": "22f053e6-1aa2-47e2-9359-9ff5a4993f98", "comment": "Malware payload (Mirai)", "value": "3ea3127fc0e3c0602a1e279d38fc728b6b834db5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533402, "uuid": "3fb8420b-d1b5-46b7-9879-5fa1bc965b58", "comment": "Malware payload (Mirai)", "value": "8f9f5cbd81aed20088f32e2a76a45931701ec9902167ddb5e43e5a5a4113feb41fa032891f43956e5f9c81c1c0fad60b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533402, "uuid": "d96f55c6-6d4d-4fec-ade5-58afc8765e81", "value": "T1D8C36C02A31C5807E6E70FF027BB53E1A36B664116F5E2863609D7495276F32DA06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533402, "uuid": "959cc81f-09bb-4eb1-b19f-51214a7dc57e", "value": "1536:Glh4K8NrkcB5DDP4vYPoNG3t1OxP11MjR8tZuj3mH0Rcx1qZxOrxi9KplEMoJowg:GZsr1V0vYg+TOxxhx1YnHprcyFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766533402, "uuid": "50956942-954e-4ffa-b337-42d7741c6436", "value": 124476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766533402, "uuid": "2ab79885-900a-4d1a-acb7-04575fb2fccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533402, "uuid": "b4855f48-d612-4fba-8834-d9173657abd8", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fc1e1c-e028-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766512615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512615, "uuid": "c7dd9193-1b0c-4fd7-af4a-524abbc00cf6", "comment": "Malware payload", "value": "908b9078fe9273474b7d5a3705548d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512615, "uuid": "13e74714-fff6-4576-9eba-d2d53dbf52fd", "comment": "Malware payload", "value": "7e5a92ae0cf39750a4c3b538a133ada3b13cbd8034837960f6414e1ffb40dcbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512615, "uuid": "d0e4e52e-faeb-448e-b07a-db553b99e8d4", "comment": "Malware payload", "value": "ab20085dfe51a75e56ec7907ace130f3f28aa994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512615, "uuid": "e765c211-88bd-4011-9ff3-a4d96ab0784d", "comment": "Malware payload", "value": "c80953dfbacc456d7316209a75475ce151988dd648304e2e8fa5ed1b0ecf935f4b4ab8f112d886c61e074f2e38deaadf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512615, "uuid": "2ebf3ae0-8184-4279-bf4f-8465331c6ac4", "value": "T1E1A633CBA75F82E6C4162C3844840AA972F5ABEDC5E68B7F3349C60F7F236160547369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512615, "uuid": "7f20af5d-dca6-4803-a605-b59810f17df2", "value": "19c9786bc4f79ab473b50e90c44237e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512615, "uuid": "036a359d-f464-4bd4-b613-c279adf3457c", "value": "196608:73dtMwMZF3d58HOqdQAIbKCaDj/sIo3ipXnYJPY:77MJk/QD9Ojzo3iFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766512615, "uuid": "f4e91b31-6333-426f-814a-14e02420bb14", "value": 10416640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766512615, "uuid": "25ecdf7e-e41d-4f0f-93cc-9f5d2b8d4cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512615, "uuid": "2706823d-ad42-4497-b728-030883ee7fb4", "value": "rbx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356b23a5-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510227, "uuid": "88d8502d-5267-401c-8e9a-bc160a5b40bf", "comment": "Malware payload", "value": "ef5840f2543d5b8a68ba0ce3916767a5", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510227, "uuid": "645ce44b-632b-45c4-80d2-a1e49ea74991", "comment": "Malware payload", "value": "7f54636439c9e2a50214b0b8bcdaf46d746ebdc26d4e06828dc91960ac6a0902", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510227, "uuid": "6aede04f-721e-4da1-8419-aaedd2225890", "comment": "Malware payload", "value": "33492e600f95e508d2714cec3ed4abacb5ba34e9", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510227, "uuid": "00c40356-1c46-4844-9b22-11937851d42e", "comment": "Malware payload", "value": "0f4746166b69d1fa250b67174cba6003807b885f48065a0191a67db1cf1ea59b2bec556d9c28e6addd16569f0cdeff90", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510227, "uuid": "356453bc-5ed0-458c-a71d-56b9c91a907b", "value": "T120341225D792BC40CA9F90BC531984E3E8609526D305763B12CAE5DF1BA7CC386DE39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510227, "uuid": "ecc75438-e0dc-4b31-9b34-4083ce825c75", "value": "6144:gddI/gD4CY8+czMufiqsw3a0Xw802PB6dhtXU:gd+YkB8Hgufsw3aU0b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510227, "uuid": "33e66d19-ceed-4257-b998-dafb327d2fb3", "value": 246031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510227, "uuid": "54f67380-539e-4b8e-911c-4417772fdf31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510227, "uuid": "c7ba9e11-628b-400d-b08b-9c782876ac77", "value": "Acompanhamento Nfs Pendentes.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ffe773-df94-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766449108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449108, "uuid": "b0216fe5-591e-4e95-b2e0-014efefd2d05", "comment": "Malware payload (Gafgyt)", "value": "abcb1e8b7a1bb036addf1048c374047b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449108, "uuid": "9a690a31-8bbb-4506-a243-238375ef4da8", "comment": "Malware payload (Gafgyt)", "value": "7f721fcbad2a84f1bcce60ac405ca81142f7b79df10e44b98452e5957544db63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449108, "uuid": "35cdfdd6-1db3-4b07-ad72-fa0bc5753987", "comment": "Malware payload (Gafgyt)", "value": "9547e3b393198ceb5fdce8cc637504a87e98fb32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449108, "uuid": "ef1d5e18-5b02-42f0-98c7-17959e608543", "comment": "Malware payload (Gafgyt)", "value": "824bf7d6ef1dfb71582519267254fd663c66dc0ca403198e071bae9fcebbb760e5fa378371c6c352c7e8a2f5b25bf3dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449108, "uuid": "a1bf2e97-cef8-4ba7-80ac-7b1d646f94e5", "value": "T1A2B35B02A58084FDC8D6C2780FAEA216D932F66D3272B65F27C47F157E5DE202B5E225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449108, "uuid": "d1df1791-e5ee-4ead-8baf-33e4a6899e6a", "value": "3072:MbGYmxTYjl1xMGgF+3e1SNCxNGC/oF+zc:MAqmDOe1Cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449108, "uuid": "df427c5f-ff26-4fec-911b-b77330fe898f", "value": 108648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449108, "uuid": "142e5509-e8f2-4981-9ca3-fb7dcdcb1d8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449108, "uuid": "cc3d6ed0-a8f6-4768-9328-16e208db544b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d365bf17-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479139, "uuid": "ebcc9969-5a8c-49bc-a2d5-1d4252744a65", "comment": "Malware payload", "value": "1bda31d0743e9015630b34f3feef930b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479139, "uuid": "d05d68ca-3f34-420a-820a-aec4ac84b701", "comment": "Malware payload", "value": "811cbfddc31b2f79d3d8c93df2a6ff941c4a3baa5f8e3c59fea78964bbe1fd46", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479139, "uuid": "1f261086-4572-45cf-b264-9af37d250abc", "comment": "Malware payload", "value": "4c998d90aa006c0cf70936e28f7b5ac8b4892e8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479139, "uuid": "b5c6a073-adfc-455d-96f6-93e549b24e16", "comment": "Malware payload", "value": "68d7f9dc526435ed85a94773c80f62aca8081cb91ee84ac5236aeba21c9b5c742968d698a5b03156254535977815f207", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479139, "uuid": "197d85cf-56d6-4b90-9f73-1cd8cfe5fed6", "value": "T1AA632C22EFB31E6D1A53501D280B0601627644FA8C317762AEF53ECE39557B7A9A4FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479139, "uuid": "7e5ebed9-77b9-442d-8862-ecac86158e6a", "value": "768:I8w/h62/jWs6oS+xISN0vhbWiN1tydkfScBYrwz2y8kTAlGB:I9l/AoSSMh6msusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479139, "uuid": "97eb6fc5-970a-4ba6-bf1b-effed1f780b0", "value": 72487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479139, "uuid": "7969f8db-33c5-4f5e-95cb-7b05c27a48b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479139, "uuid": "60690a00-a42a-47b8-98f1-696aa40f1603", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104d05f6-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766522620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522620, "uuid": "de00b396-9c95-4079-8925-d24d3901b10b", "comment": "Malware payload (AsyncRAT)", "value": "3664e511926f1907b734267381d13c29", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522620, "uuid": "fd5c8fff-37c0-4a3b-a04f-0ab93233fc74", "comment": "Malware payload (AsyncRAT)", "value": "81348201e988a78363fb01989d22cb16da786a20157dbf089662532d91bbd95a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522620, "uuid": "cc7ca992-d184-4528-84fa-94c989b72316", "comment": "Malware payload (AsyncRAT)", "value": "0bc731a4b70d50ead3d2da1f2d43e8149209fa76", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522620, "uuid": "30a5b333-c26d-48fb-b44c-2b594af87303", "comment": "Malware payload (AsyncRAT)", "value": "e4d0af8ea812f2be4dbeda6762c1c6df7ef76d061fa484917f7231861942ab26c5d1f593ba9bb85d66750ef8725b63d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522620, "uuid": "7f280165-67f4-49a8-85be-31b32e12831d", "value": "T123D3E6033367C15EE63E4F30659A5DA019745EFFE401CA9E38DC738A69F1720285A7AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522620, "uuid": "da6aad36-28e0-4fa0-95a5-0e8303c6f67d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522620, "uuid": "867737aa-9310-4d1d-bd32-cd44e6cb588c", "value": "3072:Ouk4ThE22OP3C+3b0VEO9ZAbYwCHmDQnv7IR:OukjDB+3bUE+AbYwCHmDQnv7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522620, "uuid": "d00942e8-42a9-47bd-a633-b225c06e475c", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522620, "uuid": "27ed669a-857b-49b0-8f5d-b15741486d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522620, "uuid": "207c78bb-3a24-4886-a232-b37b802b6223", "value": "unikey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acc33ec-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457810, "uuid": "d3972275-c979-4278-9d85-3cefd66c7ad7", "comment": "Malware payload (Mirai)", "value": "df04bbfdb663bb58429f8f5d66e97121", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457810, "uuid": "9e40c15e-f5c2-47cb-9f3e-8d05477b9ea6", "comment": "Malware payload (Mirai)", "value": "8198e09fd8d9e79cd05d5b00f01c4199706fc156a45ac0bf74f251c8f36d385e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457810, "uuid": "363ba54c-3352-4d89-9bd4-3a6078855996", "comment": "Malware payload (Mirai)", "value": "03a0b89c8506d4c5466abe92bf6218bf88c29704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457810, "uuid": "82754dd4-e1a6-4cc9-a524-b570f9e7832a", "comment": "Malware payload (Mirai)", "value": "b8f15fa1902901e4f54615b0cb584eee9bad5040cb5e854e9b32f9f7cd6686e7f23afbc8f357a753ef2142e0b6edec8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457810, "uuid": "27d54abd-fadb-4ff3-bf42-469a4147f674", "value": "T1E8E2E11816AC8077DE0DD37F5A2AB80CBB26F04D666E11C30E9DC9569927E6C2372C27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457810, "uuid": "138ea53c-f568-47f4-8efd-fda517a20bbf", "value": "768:KsuvM2s5D/heXFPkZbSFTR7Jk7KLECXgETq:HuvM2s5D/gFPkstJ4KoCXg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457810, "uuid": "201a8478-d438-4dbc-9069-eba9a645f408", "value": 33100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457810, "uuid": "6ac16b53-fb93-4e78-80a3-197d7d52aa08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457810, "uuid": "7e671e4c-8056-4e49-9451-7a260ab1adcc", "value": "ntx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb96697-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457812, "uuid": "a078f5e6-38cd-4b0e-94be-847ccf0c1b08", "comment": "Malware payload (Mirai)", "value": "6bd3493b7d0433f0cb4dc3d83132bef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457812, "uuid": "409a2cf8-a5ea-4325-b652-5fb372674ad2", "comment": "Malware payload (Mirai)", "value": "81aad7c6c7e13e69d0759539801b14a00e44d1363adf39ba5ecddb1874709e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457812, "uuid": "59fb17f0-8c96-49e5-bf9d-17cb3543b6eb", "comment": "Malware payload (Mirai)", "value": "f046c095a025e5fcf7a3361eb6c737f814f65870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457812, "uuid": "5aa4d30f-6b5f-42e4-81c3-4fb6c3d28fee", "comment": "Malware payload (Mirai)", "value": "1ad28fb91c92bd38ade277f09f0bcb28efc8a4c05d32dc9c234495cebc8b624039dd98bdcfd135add32d37e8863a9bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457812, "uuid": "dd29b8e0-ba4c-44b8-b09a-161a71608295", "value": "T1E74301B506C78492C5123CB9E5B90E9D2C240EBD9BFD35636D868BA4DC6C5E0D7CEC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457812, "uuid": "77140926-0b7d-47be-822f-c8bb44c0c80a", "value": "1536:C/0sDlsr1+g7+82gObxqblYOnfSDLRUMU9ypBhdl1:C8sDlsrkg7AdqblYOILRg9ypZl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457812, "uuid": "02f5729d-f84c-4dad-bd0f-f93a3c802c08", "value": 59660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457812, "uuid": "3cc831ef-b1a7-4c1b-9978-145efec90fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457812, "uuid": "9f154cf9-b11f-4b22-beb9-72fca2619dbd", "value": "ntarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceb0e42-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468873, "uuid": "60c83e1c-4ff8-4f17-ad84-defba1d212c3", "comment": "Malware payload (Mirai)", "value": "1d6dc1c434cc18edb4f0a2864248e5a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468873, "uuid": "146348a4-8072-449a-99e3-be40a2f47034", "comment": "Malware payload (Mirai)", "value": "821f3e123512cb605f7da540cfc7cc646d8e2ddfe3253496133131157d653a03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468873, "uuid": "0aa7c6ef-173a-42a3-a72b-f7d5b4609db7", "comment": "Malware payload (Mirai)", "value": "2ead97b6478054169b12f51bd8a54a044dd8491f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468873, "uuid": "b6ec5efd-87ad-4cd0-85b2-006bfbc463f5", "comment": "Malware payload (Mirai)", "value": "135c891efb5e6a582df3bf764eb3bfbc34bee6951a14044285247f83573cb5276fc46886ebdb0eee7ee8210ef85deb2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468873, "uuid": "a79f9aca-1401-4840-9872-cc2de4fd91e9", "value": "T1CF146C2BB3C3ACEAC11063319C312362771FD7051558EFFB9E1A3794A997B225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468873, "uuid": "350939cc-e5de-4458-90ec-5cf3426bca4b", "value": "3072:p9ZOm515qVlSmMkLB5Zj1rBbiJMkXHSOXq9eDgvNv8T0tUKXa7IKZ5tN:p9ZOm515qVlSmMGkXHChvxUKK7IKTtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468873, "uuid": "281da0dc-f88c-4363-a995-ad9bc5ee9e02", "value": 197448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468873, "uuid": "731ae5e0-9f03-40ef-bebe-95fa611e1c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468873, "uuid": "17ac1674-e6ed-4546-bc82-5ea3fbd18947", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef0fc02-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488338, "uuid": "ffc2c555-fb01-4b0b-87d4-91e0e947c41d", "comment": "Malware payload", "value": "e19d4eae961b0b3c2f3f4a1404639ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488338, "uuid": "307316f4-8df3-4079-849d-4f67991d51e1", "comment": "Malware payload", "value": "828b4b28b9208235a55a20a9180bfbe88c8ac3f4f12f656e0a8ebf85f050e456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488338, "uuid": "860f6dab-cbb7-48eb-8359-9f3e3267ccaa", "comment": "Malware payload", "value": "b6db66ad1e1db3edc54ecbde6422720527248373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488338, "uuid": "8fa1cabd-9488-4786-b6c6-4a907410067b", "comment": "Malware payload", "value": "3bfc0a081844af96e444decd4554c855c62e04a07d45be71efcd7dcce6bc00a0e212e8a2d54de9d3d6a4a1c279fbeb25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488338, "uuid": "9c36c1b6-b518-43fc-b91e-1d874bec124d", "value": "T1CEE41210B6C2C831F5B319B66EB89CADC67EF8700B5459EB77CC25664B318C06A35C6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488338, "uuid": "ca4b3469-fc25-4a6e-a60a-f4ecffa62a97", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488338, "uuid": "17bdc9fd-c4aa-4ba4-9473-6bdee8620911", "value": "12288:SHztGhqRHHs5qj8k3hfNkA2fVe1JVRjVhSgQUbpSxowDLkJBNXPk6MlE:2uKkqJRY9eXVtSgv4xowDLkJBtPk6MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488338, "uuid": "48d223e2-e74b-4ae8-88fd-553341332ac8", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488338, "uuid": "c49da410-f4bc-4e9b-93f0-72bbc28ee8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488338, "uuid": "1dd6c265-dc5d-45b7-934d-5e1421d8fc05", "value": "828b4b28b9208235a55a20a9180bfbe88c8ac3f4f12f656e0a8ebf85f050e456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71632125-e011-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766502596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502596, "uuid": "2b33ed60-f1c1-46a9-a3d8-440ff93ce513", "comment": "Malware payload", "value": "83ff6f9a615e00c039aaa02675a09a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502596, "uuid": "c848c3dc-cf2c-4ac8-8cac-6f59e78ffcac", "comment": "Malware payload", "value": "829c4334f8a4effeade1679773057d643e06a7ff87b2510b6bfb305f6b64e7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502596, "uuid": "66248a99-cbd1-47db-b59b-fea177125f46", "comment": "Malware payload", "value": "b13347cfff4e7684ac1793a08d44abdd06345935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502596, "uuid": "b5a55da6-1c88-42d1-a3a2-162ff34311ad", "comment": "Malware payload", "value": "bea87d8d8edbbdeea0120d000ade74fc689d896856ed79aa5a69bb4a772b46018b66bf2d5b6c5017ffde916658448d3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502596, "uuid": "d42d3509-2a85-46ae-b830-cf350db563fa", "value": "T1C243DFAA77CA008BE426823CC8A21E61D576FD655322A6CF436290AF0D237F5763D746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502596, "uuid": "8255e4df-3551-4dfd-b0e9-c7d4b79ec8eb", "value": "6d63c10eb30192d2903e92a7d33fb130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502596, "uuid": "f8c02138-4d26-4b3e-9185-23a9bd21715f", "value": "768:FMnha8VM+JEt0kUO8/3IzI59e/Pa495Fpnf/gQX+rMGnmOUWNSCn8m68HiLoVLO3:5Cx/3x9eXRxvXKJrUWNSU8mPzdOHxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502596, "uuid": "56923071-9f4b-4039-a1f8-2ae1da36f5c4", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502596, "uuid": "62183d8f-7843-4645-8a4f-5b1e06ffb26f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502596, "uuid": "be1c3398-ffb9-499a-ace7-bdd3861d638e", "value": "829c4334f8a4effeade1679773057d643e06a7ff87b2510b6bfb305f6b64e7c7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aadb56e-dfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (For)", "timestamp": 1766455233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455233, "uuid": "b008a392-0a26-41c2-ac82-576cf131a08f", "comment": "Malware payload (For)", "value": "b0e9b1aecb228fbfa609bf9715169aba", "object_relation": "md5", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455233, "uuid": "f0276cb9-8840-47cb-80e1-c068eafa88ed", "comment": "Malware payload (For)", "value": "82ab90c6dbc6dcac6f50feefe5803427b0ca00ac117deff29fd1ac4ecff58572", "object_relation": "sha256", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455233, "uuid": "e393fa53-c2f7-4145-94dd-4ff2a034d142", "comment": "Malware payload (For)", "value": "6db0772001318bcfe761805a27b5df471187b485", "object_relation": "sha1", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455233, "uuid": "30fe3376-9fe7-4d73-8a10-f3fd6045b5a3", "comment": "Malware payload (For)", "value": "8ceb3604813745c175aed8af19f6ee641f50652c025c537238b4b4a51e323b9eb287cef96bb13d6150d74d85627b5686", "object_relation": "sha3-384", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455233, "uuid": "9f0ca49a-9535-49b4-8be0-3b57c54bbff7", "value": "T1E3E42305531AA64FB4CC95F7798BB57298B7514FAB318138F18CF21AF216A5E4A328D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455233, "uuid": "922bead8-2201-47cb-819e-79ea85a099aa", "value": "12288:o92qLgI3y6USQNM8siYkeTxCYJDJEMnZJ6/oZqpwKdhGgdypZL6muWIHC3HE1s:AEwGNM8nYkeTxCYnhJ6QBSGbnWmn3Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766455233, "uuid": "571db53f-d0ce-465e-b348-6a15cd80f8ed", "value": 700591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766455233, "uuid": "089b344e-2aea-4314-806a-e1c93070b981", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455233, "uuid": "95004969-b9dc-498e-90a5-da4e4c793100", "value": "nOutstanding_Invs_DHL122025-0976.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aa07b8-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478981, "uuid": "5ab9071d-64b1-442a-8967-ed4250343de0", "comment": "Malware payload", "value": "1fcc334adb4c6c7ddd0f315d1d59de3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478981, "uuid": "c288db09-d386-493b-89b0-916d7a58caf4", "comment": "Malware payload", "value": "8334c7fef8be871a5eb090eb7eb5ff837fe9a5e770b3da8abc8057fef1b1469a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478981, "uuid": "8216634e-9902-43aa-a81a-4768aad643fb", "comment": "Malware payload", "value": "4beebd77acbbdfd9cb544d4434a6078c42fa30c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478981, "uuid": "8dd28f78-5745-4658-bc79-bb9691e234c2", "comment": "Malware payload", "value": "86353d76a072a9e5d8d763a34f55e30ef6d9a41832b626b3d7686cba7892b8ebb0a33215a80e5c57015fd9d313afc5ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478981, "uuid": "08bd8b77-0e6c-4414-ac67-a69dc3ed15d4", "value": "T1E1732BB560E2B43C69EA483F227F5344688F26F0E8BFDC4BDA45B028F4010DED5979A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478981, "uuid": "3334226f-db2c-4f32-8654-096793ef3905", "value": "768:I8w/h62/jWs6oS+xISN0viiJrE3V1jdkfScBYrwz2y8kTAlGB:I9l/AoSSMdJrIjusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478981, "uuid": "3c124491-42c0-4f6a-9a3b-f89bfbf06ecf", "value": 73505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478981, "uuid": "c9384e03-eb79-4be6-ad09-cccb122edb60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478981, "uuid": "027c356b-3540-4282-b528-894a720ae391", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df296719-dffb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766493332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493332, "uuid": "02cfae00-1eb3-45d1-bfda-e53852cd2824", "comment": "Malware payload (Mirai)", "value": "1b31f9c2ac85b8dde20a4193111626a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493332, "uuid": "f2b2f345-921f-4db0-9d6f-4d062e4bee9c", "comment": "Malware payload (Mirai)", "value": "837d1ff6922f7db42f674c7b1d53913256a825b14277f0ac0b1c1d506857d9fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493332, "uuid": "804d52e9-0ad0-4230-a0cd-4afc1f1a6fe4", "comment": "Malware payload (Mirai)", "value": "63a384564dec8a41f9e132fb8f7ebd02a1b2f004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493332, "uuid": "e165e5de-894a-487c-aa78-6dcf7d431d10", "comment": "Malware payload (Mirai)", "value": "e8739c38f3fdec54818f95a1aee7851bbab92ffcf05a4881abb81cf1368012fb23b516a9d9c894e188fbc9c20b402bae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493332, "uuid": "bc22e083-ee84-4cc9-bb1d-8a5684bef2c2", "value": "T1BD736B77AA16AF56C04B94F069F28E780B53BD158D671FF9A1A9E9D60003DECF5083B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493332, "uuid": "08036a30-6aec-4554-9290-dba88d7c57c8", "value": "1536:qPI7IUernBN//qGo4KMLhL5afCZGoW68Mul61d6tX3:qPeeNNhWMrafoD5u4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493332, "uuid": "c893bcf4-8e9e-4567-8a8a-09f3ab6078e1", "value": 80128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493332, "uuid": "9cf7afb0-3665-45a8-9a27-aed74fdc895c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493332, "uuid": "41e5d3da-3c81-4712-bd0e-cdab537e28bb", "value": "nova.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b2475d-dffc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766493557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493557, "uuid": "6a1f6a75-9155-4546-8ab5-0acfcaace1e8", "comment": "Malware payload (Mirai)", "value": "c62c3c74bf11e61096fd25c40d9c31d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493557, "uuid": "fce6f8ed-1100-4c07-9c7d-fe3db9281b4f", "comment": "Malware payload (Mirai)", "value": "83a982130622abdd2730a117ac83e5f8e4f892a00a7e8577600ce9eeebe2e033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493557, "uuid": "117f2f32-6e1c-421d-84ab-3cb16c39aaf4", "comment": "Malware payload (Mirai)", "value": "4d9fb29af768fddbf8f38800dbcefc52e0b3c99c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493557, "uuid": "df0ad793-a5b3-4906-8b2b-bb8cf1371a41", "comment": "Malware payload (Mirai)", "value": "b157ccdb4d31db57c16888faff9abf5928fc430d31c1285a0047f1013623ac209a6c274c1008c3c7902e42099ff27061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493557, "uuid": "5097b6f2-bbb2-40b2-b5e2-2a0ca625d409", "value": "T1FA932C56B9918F12C5D211BAFE6E018D33136BB8D3EE7212CD206F5037865EB0E77626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493557, "uuid": "7cdab2b8-65a6-492c-832b-e402c1f4c9fe", "value": "1536:D3nuH4wE+h8C2bVppYCO6zKoGkOk4tTggWDyXu+9taxnF93XMKiL2yaATY76U5PH:ozh8CiOxwKgotDGV+9taxs2yaATYeUZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493557, "uuid": "27f68ab1-c2a9-4671-9591-cad2b5c9d644", "value": 96136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493557, "uuid": "6320c1da-9b7f-4330-a885-725eea461fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493557, "uuid": "c0adce7e-2bcd-4601-8e58-81d23da04052", "value": "nova.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d8ffc-dfc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766469861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469861, "uuid": "f0023315-6164-474e-b13c-b1a40640fb7f", "comment": "Malware payload (Mirai)", "value": "9b560d937c51a9eb31edd8ec104a231c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469861, "uuid": "9acbbc2e-e4b5-4ced-b4bf-e8453de3efcc", "comment": "Malware payload (Mirai)", "value": "83ad4995c1a99c870c70838bbb10bbb153564f85afda8f3716db191eab969775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469861, "uuid": "e7114feb-b5c0-4e4b-9b31-6c246ea4063d", "comment": "Malware payload (Mirai)", "value": "59f4799126796b6eb295c3dd4b8f91b54131bd6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469861, "uuid": "0907cd80-7b48-45f0-92a5-6c3a0d2b4b5f", "comment": "Malware payload (Mirai)", "value": "f9ba087c2ef3c4f215fbc8f83dbac4856e335a65b02f446007fcf8ca1022d3c7d384fd89736f3b1111a62430bdd43402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469861, "uuid": "2cc4f307-5dc3-4d7e-b2b1-791996bb57b7", "value": "T178B3F785BC41AA12C6C256B7FF4F428D771A5798E3EE3203CD285F64378B95B0E3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469861, "uuid": "2df1f431-2ce4-4a18-8082-854b81ca927c", "value": "3072:aU4PEWWZlGin3TRzWMSDwuXVRgglPvPFnzR:arPEW8lTn3TRqMSDwMVRgglnhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766469861, "uuid": "fc9a7a82-0abb-4482-a41b-57f04ecbf105", "value": 112716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766469861, "uuid": "2cceea88-c0cb-4855-98c6-2beeeb3d03e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469861, "uuid": "314f0cc0-e67b-47db-9635-ec62181b2975", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe98be7-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510218, "uuid": "f57ed353-9e71-49da-b438-054defe56588", "comment": "Malware payload", "value": "1ff2f0d690dad2d54f1fb3a129506e4f", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510218, "uuid": "c66ead66-7e46-4497-9da4-9a14e7c0de02", "comment": "Malware payload", "value": "83f63e10b56a7d1bd3b28f7fe9e8d6c9cf917509e4521f8ec1aaabf424767d6e", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510218, "uuid": "131cbd17-dc56-4839-b505-1cd490f123d8", "comment": "Malware payload", "value": "047e876736a415573f2fa0e4e21f1009dd1cd5ac", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510218, "uuid": "51b50497-51f3-4cde-8aac-5422f89ef37f", "comment": "Malware payload", "value": "02cd1221971583c241c05f05a971a65daf4aa94968be209a8025210747eda5f42b8c02c43c0c17f491f094ff4565d497", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510218, "uuid": "9311ddce-9aba-4903-bfaf-1302f040ac1b", "value": "T123747C1677E525F8E177C639C8624A02EB727C225760DBAF0760458A5F237D0EE3DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510218, "uuid": "0f52f3d5-0a4a-4bd6-bcdf-6579e31a8e25", "value": "0da62d5f519ce5d13fc7eaa002978cb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510218, "uuid": "e6614585-e3b2-4304-b5e8-869644c8cbf5", "value": "6144:VJRj793i4Jm2LfxmqtFseUvzYb/MC3agajVoLhDibm:Bpu2LsqEr8jMCQoLym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510218, "uuid": "76821be7-a1ce-4fde-99bf-6961c0541bbd", "value": 354928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510218, "uuid": "fb09cc90-a483-4a77-bda7-971020a749f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510218, "uuid": "09803d71-c860-444e-ae0b-1f5d85c2c284", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3928a334-e03d-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766521400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521400, "uuid": "b0da61bf-0372-439e-b999-d7593f8a6248", "comment": "Malware payload (ValleyRAT)", "value": "73fd518b93ece0f61f193fcc3d708ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521400, "uuid": "11c7cd8f-cfc3-41e5-b4a5-50dca9820d42", "comment": "Malware payload (ValleyRAT)", "value": "84363809a16939c41a6766373a033c9ddb257c719b9ca59abe79e68dcfe80ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521400, "uuid": "590087de-6db0-490c-b588-ae3c93f25f6e", "comment": "Malware payload (ValleyRAT)", "value": "d6a184f5628e36abf9cbb0ddce29be6226669122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521400, "uuid": "8e3ac840-15c4-40a9-9b7a-8b043225ad29", "comment": "Malware payload (ValleyRAT)", "value": "f2e49481b3fa690d8cfc57758aa2855dd3f23417c97a0fd85869b76d309feeb2343bed79a90524106d45d6d644b5bc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521400, "uuid": "ac5249c5-80a4-470c-944c-f8095a8ad1f2", "value": "T161073356C40F40C6E460247C905B44D9909BBD9F3C71E7A2FA85FFEAB23B91646BB10E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521400, "uuid": "38a17ccc-88e4-42bc-917f-6bffdf759d9f", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521400, "uuid": "4d3aa169-e736-4a3b-9f8a-376d5dc47ab5", "value": "393216:OkEolWL3HsarmfSkxl02YWYuybJ+ELBAe1s63j6r21c+uXtf5H4XfeZ94WXo:OkEolWL3BrPkx+mYkE9Ae12yK+uXZ5H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766521400, "uuid": "dee97376-393d-4d69-9291-3af57b545686", "value": 17905456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766521400, "uuid": "31a14a16-7b4c-447d-ac30-17a28d897097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521400, "uuid": "dcde6e62-e49e-4cd2-b0c4-bcf6641cdde7", "value": "LetsVPN.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0560d7a-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478650, "uuid": "a942a623-77c0-4ded-8ae4-a5965651b5b7", "comment": "Malware payload", "value": "b6e93c2cfef79f274c5d41c71e0de4d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478650, "uuid": "79a8a4a2-1a94-4feb-b84f-8b416b135330", "comment": "Malware payload", "value": "84835034a7bbcbb6c2ebbb05282f8d845cfa49fba36405f028013ef5948e1510", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478650, "uuid": "451f65c0-4fdd-43b2-9069-f9d0ff697f29", "comment": "Malware payload", "value": "c3e17fe4bf4d0a4dcf506254dad7b3b061e3d332", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478650, "uuid": "4448b14a-878c-414f-94b3-523eae6b74f2", "comment": "Malware payload", "value": "59630a41217aaee124da980203858e483c6dca7e9d181a878c65c207e74d1ffe0bf93da53e295b473055869b16c1bf1c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478650, "uuid": "220825ac-9a52-40ba-a141-0f9895e97d61", "value": "T19363F8D6CFB6E9FC3BAC4B08BEB007052BA7B5060501D14D678C9A0A642C7BE7D55BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478650, "uuid": "0b53f2fe-cc2d-40be-854a-e0b04ebc343e", "value": "768:I8w/h62/jWs6oS+xISN0vvHZ1HZAHZWHZ3HZdHZtHZcHZKHZWHZyHZhHZdHZiHZ3:I9l/AoSSMKkusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478650, "uuid": "46821c0b-847a-45b3-a825-7d3cdc26a067", "value": 71623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478650, "uuid": "6c0059b5-5a7b-4cba-a492-dd2276ae6c5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478650, "uuid": "f97c5640-190d-4c5e-b370-7ecfa8c95962", "value": "invoice-1645080830.pdf (99).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375f4dde-df94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448812, "uuid": "9bd2cd9c-d9b5-4628-8724-0cf4ce55723a", "comment": "Malware payload (Mirai)", "value": "adeb7d6e5d5c89f6a55a5ac569b5e83c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448812, "uuid": "fa8a2532-f4c6-476a-9fa2-83071cf0bf95", "comment": "Malware payload (Mirai)", "value": "85510dfe1a9fcfbad7a0ec22542cef21bd29a288f04951ab8c514c444f6b492a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448812, "uuid": "ad31f764-6fef-483a-8d9b-f3ddd573aded", "comment": "Malware payload (Mirai)", "value": "be6371e872a04e808665030bb0b7d5ba97617a31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448812, "uuid": "755336df-45b2-43c8-94b3-5a87f9f6cfee", "comment": "Malware payload (Mirai)", "value": "570531e3c13855c1c7288b9f4e94fb8785249d9733f015ce628762157163be9d29984711ac851855e85f06f7b40fa1ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448812, "uuid": "b847e181-cd69-4005-8842-b974f74ea1a8", "value": "T172936C43A992E4F2F8621036172BD3618B33F6352025DD4BE7A92B71ECA5B10DF0679D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448812, "uuid": "553e98d8-613f-4162-8a12-9c096523579d", "value": "1536:BYzCZvnxKBK7l4zXwjvsm09ksBrEGlROktfEYCBL47F+iDxOaDcxcJm6RnzSg4u+:9t9jEV9kyrVVtt4itOOMcH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448812, "uuid": "e9a43cc8-06e3-4d17-b404-dadc65925b7f", "value": 91536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448812, "uuid": "0a31040c-4dd1-48d2-9a27-d78dda6669b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448812, "uuid": "caf0a683-a131-44d5-9b90-88a8713f3235", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af9466d-dfc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766471232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471232, "uuid": "13e46c3d-bbac-470a-9765-a3c8724aca4b", "comment": "Malware payload (Mirai)", "value": "a5c2126d070c5193ed30b138f031f2ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471232, "uuid": "1e674c19-320b-40d4-967b-3df10e87bb13", "comment": "Malware payload (Mirai)", "value": "8554425793c9b1ce2dd634486e778e97f515fc9fdd4709482143b540080eab8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471232, "uuid": "91b2cd78-5f12-40d4-a2c7-389cadbcbe6c", "comment": "Malware payload (Mirai)", "value": "3048060b600484527f3fdc37dcb11360b871bdf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471232, "uuid": "6e69139d-3342-47d7-8536-7b9b325ad896", "comment": "Malware payload (Mirai)", "value": "496b71e8eb4b67983338da42139ef21a4894370074e275f5e363aa709ce88def9094284b542ea0058d324d5cd2aaf83f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471232, "uuid": "3d31bcd3-a699-4c82-b4e6-94469a0f12b6", "value": "T1BCD47D98FE1E3D42D2C7E27CDF8A47A1212BB1F4D72681F27941125DE8C5AEEC7A1201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471232, "uuid": "bfefc3c4-7905-4b95-88bf-2fd336059bd5", "value": "12288:W4T6Da7+abhbPYov9el8uorkj8AfLw5VYjw:F2QPYHukhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766471232, "uuid": "316467ce-1237-40fc-9f59-6e549caebf40", "value": 597584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766471232, "uuid": "624bfebb-7a83-4312-a207-7f4c9840bba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471232, "uuid": "939d804e-e882-4b56-ba66-ebadf2d61113", "value": "shadow.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba98056-e02d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766514828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514828, "uuid": "d9bedcba-0c3d-4297-a928-159e40946aef", "comment": "Malware payload", "value": "da9923d054fd3bef328767ee6ea1d359", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514828, "uuid": "6adeb4c1-576d-4b48-86d4-b3b6af525b59", "comment": "Malware payload", "value": "85691a45e067c754c28e5800a19ee8beb28d6529bb77712d9fef0e2dba1f6944", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514828, "uuid": "4d295ef3-796e-455f-bc85-2754a4495abe", "comment": "Malware payload", "value": "65d15ff0b4a6112b03605767db3869d8a04a8aa9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766514828, "uuid": "39d4d8f2-503e-4b88-ab08-95de92f007a2", "comment": "Malware payload", "value": "85ff95b8941136957e79c3d73577d0eb8789b65892f0cac7b1db10c0662f24c575a1379d5c1dc9181f29dedba77f0a87", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514828, "uuid": "eb0799c4-4cd3-4949-a314-3ec1bd0d8fd1", "value": "T134E5AE16FF8244F2E9E2017A11E7AB7F4D399914973099C3DBE029ADC8212D1663F39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514828, "uuid": "4058c27e-200b-4287-a6cf-e4be4cb91a86", "value": "58f817df1b937278543407d4acb93df2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514828, "uuid": "0d8c8df2-ee0b-4075-8969-47ed6a617d55", "value": "49152:mOpVwBQJWXi+2waWg877LWmadnzMR4Pn2kPavz0lcvYFdSol:mOpp+2VSJy2En2L0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766514828, "uuid": "01a8f813-54b5-4cf6-a156-3d15b90715a0", "value": 3048952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766514828, "uuid": "e6ee94d3-06d6-4dc2-877f-ac69b1cc8b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766514828, "uuid": "f6bfeacf-85ac-4b6d-9c47-087cc380512b", "value": "getdirectapps-update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b430cd3f-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524183, "uuid": "28e18a41-d7b5-4f69-b858-cc1eb37fbe66", "comment": "Malware payload (Mirai)", "value": "35ae0e1432720a57c38d4543b49f9968", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524183, "uuid": "91c6603a-e0ac-497b-afca-58b1e6b8f7b6", "comment": "Malware payload (Mirai)", "value": "85a68d8ccdeaf78c7d7f2b0977cf10ddf001f50f1bca595bdb57f2116c4e1535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524183, "uuid": "39531b24-46f6-4f4d-8cbf-099e294a8199", "comment": "Malware payload (Mirai)", "value": "64faad9ed875d7306060b7c4863fbc29780eeee6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524183, "uuid": "84d4f1c8-42a7-45e9-92dc-755a3b956391", "comment": "Malware payload (Mirai)", "value": "b87c8694998cdbfb67e0f3e8b77318748ee3f735d0b019c8ccaaa44fc4e651ecf7fc06b653576b4875de0237dc67e305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524183, "uuid": "a60c2db0-73d9-47b3-a43d-bb13164b6fdb", "value": "T10E24F947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524183, "uuid": "16777816-3272-4d1a-99ce-cc4ecadb2285", "value": "6144:Iv4nw6IdA1Twfl4ds0aVGGp8CwZ9YNJmh0jlP2:IEwi1Talz0aVEHZ9gmujl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524183, "uuid": "0f04650e-a804-4d1b-a507-d2ad037e353a", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524183, "uuid": "022596f1-52de-4d83-bb41-9cb90555bc99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524183, "uuid": "16b33a5d-1920-4660-835d-669cf2a57a70", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d443c01-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478967, "uuid": "ea248751-3fac-4625-957e-e40c903c707c", "comment": "Malware payload", "value": "45249fc088b40df5d2f7faad568a4c8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478967, "uuid": "4712b39e-bf86-4848-9db3-704ee013e0b5", "comment": "Malware payload", "value": "87321691a1154efd81a666d47ad054d60ac19b6fd4e00d59e303eefb3d5be382", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478967, "uuid": "8b956bad-04e0-4ec9-a368-89707c80e2b1", "comment": "Malware payload", "value": "fec61a65f94c585b1f68ae29ced1fc5509573be1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478967, "uuid": "7c0c913c-3ece-4d44-974e-a42831a192ef", "comment": "Malware payload", "value": "641591b43fbe0938e4ae1b4d35a9a48587cf64a27698bb8043dc55cc081418447c6b01f4400437913c262671b0698219", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478967, "uuid": "a21c919d-d624-435f-ba29-b2144e221ca0", "value": "T13E632BC7FA397C1F2DD22D89FEE2033879B0891F865287C73BB9720860B944B949B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478967, "uuid": "897e567a-098c-441c-a180-ec6c87b8e5c4", "value": "768:I8w/h62/jWs6oS+xISN0vV8Nypg+LmnE6zoAbePhY+COw79wUDOdN1JiJSnigClS:I9l/AoSSMbXmusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478967, "uuid": "ec7b6100-5c40-4216-b923-b7c2c91878ab", "value": 70639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478967, "uuid": "d7d2b3c3-8ce4-4aaa-aa0e-5a50c29b3a82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478967, "uuid": "ba2c486e-a4d0-47b6-a489-9c7387df363b", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ab635f-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478773, "uuid": "6000ea8e-d758-4190-8b1c-3774fd0fd60c", "comment": "Malware payload", "value": "9ed4258c455038b54a980aead7de4d50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478773, "uuid": "861f3a18-1959-46ef-9b71-27a4939a6e2f", "comment": "Malware payload", "value": "874c624ed95fb64c4e6b0886ab8c7185ace644b634d8f1eaa42932b3f5ae0811", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478773, "uuid": "8e6dfceb-3c53-4101-80df-86c7dbe44682", "comment": "Malware payload", "value": "c904e0dc603f6caef561909be3a2d0caf88496b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478773, "uuid": "b3bb1a93-4339-4351-89da-e8b0ee6d6cec", "comment": "Malware payload", "value": "bfe5bf559c86ca47ecd55e99407ad27eadef63c0ca6261d3deb394d0fdee988c426b3694e78cdf529392b4516b015e87", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478773, "uuid": "4b17ca2c-347e-47f2-b410-3c139aa79ce2", "value": "T1EC632B16101F66ED09F41263867B23AB017F8DA0DC23B9C46ECDEE924B9D497CB19277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478773, "uuid": "6cd8b538-44d4-4471-a5b9-6dc977f7c5fa", "value": "768:I8w/h62/jWs6oS+xISN0vJiNOwbLN950i9lh069cucZ3IAJfcLMo/OLE0LPhQyNI:I9l/AoSSMxlPusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478773, "uuid": "0b15e573-28bb-432b-972e-994fa092f0ff", "value": 71463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478773, "uuid": "fccb6c5c-ec3c-47b0-adfd-3b283181192f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478773, "uuid": "625c4327-727d-46aa-a187-6d2f3e4e9984", "value": "invoice-1645080830.pdf (78).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e915ef-e013-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766503651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503651, "uuid": "c7c445fc-a290-43a6-8183-c4ac3a37eddf", "comment": "Malware payload (Vidar)", "value": "fab2a648c0b0aa4e4a75d1de7bc49ed5", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503651, "uuid": "1c9eca5a-1246-404b-9152-8e78be84b224", "comment": "Malware payload (Vidar)", "value": "87ab4bb2afbe5ae4588263edcc9aad2ea8687da31272f51a22ff70228715950f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503651, "uuid": "0e8e501b-f6ab-4036-a4c9-c300d5283a6d", "comment": "Malware payload (Vidar)", "value": "3851c94ad18373fb5f2adf1c4d991f74599fed39", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503651, "uuid": "76aaa8ce-d4b6-47df-ba8c-dd17ec515e8d", "comment": "Malware payload (Vidar)", "value": "610d6ede55baf8db03611893c229ce35d5ca703d001a00cf87e2bf465c091bdc611af32d48eb79d5ef327d5f02a38958", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503651, "uuid": "6ffb0b72-5a2e-4ea1-8f85-75286ccb72cd", "value": "T15A1512E02F69B712DDB91FB049A0CD3493B50E6A7006FAC759E96FCB37987028558B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503651, "uuid": "4189fdcb-e9ff-47ea-a86b-3b714f6f6c8f", "value": "24576:f0gpGcmXaS8mMksfK2r+iyFLp1v/jt8PLJLoGt:PGVf8mO1+iQb6TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766503651, "uuid": "3f8ad519-641c-4b90-88db-298b9a633d29", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766503651, "uuid": "06f684a1-dca6-40dd-ae62-59cd9229d42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503651, "uuid": "9b3842b8-89a8-47b9-919f-0f1eff82b856", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e403bd4e-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525123, "uuid": "e7c9440a-ed96-4a3e-9089-392a43ffd5bc", "comment": "Malware payload (Mirai)", "value": "7a37f64fbd53565268067dce062a9c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525123, "uuid": "f39f37ae-0e4a-407f-b1ab-140dcf564011", "comment": "Malware payload (Mirai)", "value": "882863a89762c7f571889b5c8eb9382e9287fefcfedc163ba03a8f64209a2ea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525123, "uuid": "84871454-8664-4892-8ec0-5b7531f67fb8", "comment": "Malware payload (Mirai)", "value": "5a588c62a38e878e5ee7ea8fb066a0b82b06e282", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525123, "uuid": "08ab41ad-ccab-436f-9284-3a6e3fbb880c", "comment": "Malware payload (Mirai)", "value": "4f89e412ac308dc9b9875297d0ea6f479a8b86165f32c236ec0d1db32fddb688384bfee5e83e7f3f00ff2b543fe1e945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525123, "uuid": "0b045887-2c4e-463d-8a38-8ed3a16b58dc", "value": "T164A3B50AAB611FF7E86FCD3745E91B0535CC591A22B87B367934D828F64B24B09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525123, "uuid": "1d43d8ef-3b37-43b9-bcb9-b941a9d10da0", "value": "3072:wAhnKZGGCpcA2qUReuqD/B75MBIwbZnKFT:wAhnKZGOLrRe7DB9wRKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525123, "uuid": "b7421d95-500e-48b6-bcef-3b658113963a", "value": 105636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525123, "uuid": "cb9a5aa0-6531-424b-a0fd-01ca573d8b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525123, "uuid": "a06e9c79-b928-4a45-8b2b-fe17e59bf32a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dd5f9a-df92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448190, "uuid": "ef9f86d4-7ae2-48bb-bf5f-36fd4b133eb0", "comment": "Malware payload (Mirai)", "value": "096c176a953f7159496542ffcb874842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448190, "uuid": "e76f33cf-5d27-4747-8cf3-80ecfcc8e162", "comment": "Malware payload (Mirai)", "value": "88559bf79531cf7ab2fd6db57337bf1999b387538bc9335ed02a8cea4e0503c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448190, "uuid": "c84ca2b1-9740-42e0-a48f-bb21787226fb", "comment": "Malware payload (Mirai)", "value": "4fa2f1d6af5d329e1c5b0b7299129b39b65a14d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448190, "uuid": "954489ec-804b-4c4e-8aab-695faa3835c1", "comment": "Malware payload (Mirai)", "value": "bfcf2bb892f0deda26e95fb23619cd78585b995132f8a9d3ce6f8ed601302db0d7c4c67f7a594545dfc3621a5316a378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448190, "uuid": "3720d8bb-6ddf-43f6-83d4-7e0ec1d1ecd5", "value": "T129D3CF32E0086DA0DD2117B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448190, "uuid": "754516d5-0022-4b3f-84f1-7756ecc8df27", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZZ6:xOFgpOEoVv3MXL5NhGOZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448190, "uuid": "e64ac779-b67e-4eb6-baef-4ff1f43cb214", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448190, "uuid": "cbe0e3bd-8aa7-46d3-a3cb-09389147232b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448190, "uuid": "fc98b0b5-624a-4416-85e7-1265e21450f4", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52506b17-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511564, "uuid": "0c3766c5-8b36-40dd-a23b-cb5c0c714e2b", "comment": "Malware payload (SpyNote)", "value": "9d84459d7647443097232be0cc00d7e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511564, "uuid": "6e5a3b88-902b-4690-962f-fc176940d385", "comment": "Malware payload (SpyNote)", "value": "888d3156f5cc5ae3de8861eb097197b4939b4f5b2e7f1ff88c558fd64dcdeecb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511564, "uuid": "80750396-0f5f-44c8-87e2-0d79fc626283", "comment": "Malware payload (SpyNote)", "value": "5b48f1247abfc2e7b729bcc2dc9a94a1b23a447d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511564, "uuid": "1181d0a8-dd1d-4ac0-aa28-83aa15f36f79", "comment": "Malware payload (SpyNote)", "value": "6638faf2621fdecc4832643bf39698749d14be98251909e375bbe2c4cde2c248f2193fd739370525f40735625eaab4e2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511564, "uuid": "ac3c901f-8d9d-4adf-b9ca-930baf83ae54", "value": "T111E41243F746CC54DAA2113A8BAD41D9503B2F796D06D3932A67B3ADC1737C1EB88D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511564, "uuid": "fe4f2200-cd87-427f-a4ce-91e082f7fbd5", "value": "12288:c+CAB78RtsPxsr4n+2ouiz6m9WSMbKx/rYh/usT3cgtN0Fome6Rq21egNltWDvk2:fB78AP+jh9WZeNrYHT3SFomeGNbAvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511564, "uuid": "3dbcfe3a-d0e3-47a5-95f7-7eb7135903af", "value": 700731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511564, "uuid": "d89dd3ac-746f-45bd-9fad-c29c1e715db2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511564, "uuid": "8c428820-bd55-4112-bb45-9c57e2b0244c", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a371de37-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522867, "uuid": "25b85b8a-3d3e-4c00-a091-1d00a0c63e48", "comment": "Malware payload (Mirai)", "value": "0e79a9d9310cfbed40f69b0253c3bab1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522867, "uuid": "22581a42-d025-4f85-96bb-b2e6cd3bc7b4", "comment": "Malware payload (Mirai)", "value": "89396773d9bf3eca690892f8036e71ae0964b6427775db0e0dfd4281e4ce160c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522867, "uuid": "53da9625-62e1-43c9-8bed-e5858e49d444", "comment": "Malware payload (Mirai)", "value": "26425c181c9db4176f91e00953d0a1d6f483bb03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522867, "uuid": "782a984c-1a1c-4af2-b13b-581399b8a759", "comment": "Malware payload (Mirai)", "value": "695bbeb30f0d184bdd4f36bac43851efa4cbb74bbf29f40028728a5ecb60cae21c485e63c7b08365810973bc48787831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522867, "uuid": "362b6737-8f43-49eb-91a1-593fddb254b7", "value": "T1C7F26C76C829AFD4C48886B4E8714E742B13F408D2571FFB0B4A85664047EBCFA2A7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522867, "uuid": "68a2650b-56a7-4103-850a-2e45f9fbb653", "value": "384:M/jGsrQni7w2CmPsO+zh4yq3sO+H2LgLmUY4SZSNCEsH/jrSH3kLxVVcoZ7M+/7d:cj67m0FZq8FWLgLCFaCiolMG72g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522867, "uuid": "701b1c58-a657-4745-ae1a-1f703ad8a850", "value": 34736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522867, "uuid": "83426b01-4cfc-440a-a49c-bd39fb92e0d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522867, "uuid": "1605ca39-5a7c-42dd-b9fa-cd0c8caaf373", "value": "87sbhas6as.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5bd896-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478645, "uuid": "d40646d3-1f64-4233-94e5-e8a4a7d0aa2d", "comment": "Malware payload", "value": "497e56f69c8aa87df6712b2c72f3a673", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478645, "uuid": "2ec47879-490f-4b20-bfd0-21f15f8a79ef", "comment": "Malware payload", "value": "896c977f22f46b6bbd36ee7e129d529f9c7d5122fb834f0dbea33a82dfe32dd7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478645, "uuid": "63c2148b-543f-47db-bd3b-58cb34a267d4", "comment": "Malware payload", "value": "f37d1926b7d55e9fc435a8b3365fdb0d2e282f25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478645, "uuid": "1441f48a-bc9d-4c1b-9587-92a2a9c3d52d", "comment": "Malware payload", "value": "f594b647ab50b6fb3a55bef1f8b08dda3e5949e15d76ac76db8ab08594ab80e53bd8d018a900353b8ed06cd3106a8b7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478645, "uuid": "9dad4ae2-2bed-49da-bb40-65767446312a", "value": "T1F7634C71E71D99BD11BEE3625C1823C0E272E47950567718608B7AB0F24D1838DEABFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478645, "uuid": "c2f6dcf8-d2f2-4e67-91db-79deff4f1772", "value": "768:I8w/h62/jWs6oS+xISN0vvyJypfCRKxZWpcNVd7RdkfScBYrwz2y8kTAlGB:I9l/AoSSMZ/usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478645, "uuid": "291ff43c-7dd0-4c58-8695-5647d33c6491", "value": 71594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478645, "uuid": "3c6071f9-6881-4009-8c78-2d28bdf269c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478645, "uuid": "47c3b4ac-e519-42a0-a303-434ffeb657de", "value": "invoice-1645080830.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062691eb-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524321, "uuid": "1395493c-5b88-4a26-88bd-59f97b22d1c1", "comment": "Malware payload (Mirai)", "value": "69b5fc30909d71d1490579deeace8c00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524321, "uuid": "0a70450f-52b7-44dd-ba2f-458ddb36fc85", "comment": "Malware payload (Mirai)", "value": "897e512b856bd2dc9152c6760fd42b7b679792739d5a401c9eef74a95f2be56f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524321, "uuid": "1fd170de-7945-4b0d-a46a-049fb76a2071", "comment": "Malware payload (Mirai)", "value": "6d1f616bb519e215dc2d0b527594bceb278484be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524321, "uuid": "09f7b6d1-0a77-461f-a0d1-4cddc9d86eb7", "comment": "Malware payload (Mirai)", "value": "a88ad36d527979c6cf6084faa120b509f9596243544d5fc3fc74ab6e307a47ff9f1dde93a8f6a7a0bbcf3166bbf767a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524321, "uuid": "87a6f8f3-6794-4dad-982c-b308130cc0ce", "value": "T15B413DFA264114F62EE5DD3371A80404E0C155E5AEC96EC8E4EC24BBB58EDC87188E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524321, "uuid": "b7b75905-e0bc-4410-a5c6-b35b93c8f20a", "value": "48:v4XiXe4X1XPo4XadX+4XhMXhVZ0h4XhFXheH4XhqXhpG4XhDXhAV4XXXO4XWX24l:v4XiXe4X1XQ4X6X+4XaX+h4XzXw4X8Xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524321, "uuid": "c99b5911-f53e-41e7-abbb-4bad6cb9d9d3", "value": 2063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524321, "uuid": "a1c448d1-05e0-4ebc-b7bc-953a186f77fd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524321, "uuid": "7a2c0835-513b-4334-96fd-5f16eab61232", "value": "Pandora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844fb616-dfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766455384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455384, "uuid": "91111eb9-9ef5-442d-a2b7-314a02fb5b58", "comment": "Malware payload (Mirai)", "value": "6553b83521f6722bbb4ea0e4c69c1383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455384, "uuid": "2df67332-6352-4a42-83dc-da34cfd513ba", "comment": "Malware payload (Mirai)", "value": "89e5e3bf6ac64b76dbb5aedede40c48945fe53668fcd8598b30d61e4e1e52678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455384, "uuid": "da62def8-5378-4f4e-8740-fdfdaed13959", "comment": "Malware payload (Mirai)", "value": "c5636b2772f7664678ed846cd14d70a4fe4a9687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455384, "uuid": "fa073f06-b29f-4967-a664-1c089f1c477a", "comment": "Malware payload (Mirai)", "value": "af205ae935e9ce272e4bd48df75186cd3c97926892092acfccab9b517dcc06b654c564f29218a8bc22b3490632b3b5fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455384, "uuid": "622ef8fc-b416-4ca0-b47a-f9a39c074600", "value": "T13AC33B6AFD828552CAC31677FA1E4299775713DCD3EF310B8E294F60279B92B0A7B041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455384, "uuid": "b6c31e55-24da-4e48-99aa-0b210f151d0b", "value": "3072:a/tqdYHdsrlllQl/lKlXSl2Hlaul/lilA+l1lFl/il0lKlMlMlFlyil9lIlNlMlJ:a/tqdqSr72p8NSAH0u50W+TTtiaIyune", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766455384, "uuid": "49c35657-59cd-4071-b04d-b91875bff9ea", "value": 121612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766455384, "uuid": "4275a423-4801-4c0d-88be-1f1ddf90dc84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455384, "uuid": "ccb85190-7233-4fef-bf8c-e3b14c20baaa", "value": "rondo.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5c741c-dfab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766458996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458996, "uuid": "310d07c7-d5a9-4a0d-b1b1-add399a62932", "comment": "Malware payload (Mirai)", "value": "439dc58ee99ad097cf8158c4bc2836c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458996, "uuid": "d499cdde-0567-4cc6-80b8-4d0058acd8b7", "comment": "Malware payload (Mirai)", "value": "8ade9d5ea51acc0861daec8b9a1444f06d93938fc3aa816e6ba3a83b19f6b7ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458996, "uuid": "5aee5933-c548-4b71-bc99-5aa69f6fe648", "comment": "Malware payload (Mirai)", "value": "82268daea56861db9db0df665c98ff1943f96669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458996, "uuid": "ea3df3d5-fa82-46e1-bedb-7d5857720e7d", "comment": "Malware payload (Mirai)", "value": "19e9ad461044067bdf21fea9ac7109b19b81dbcab5322f917f0a2a58d2cb75261a950889c987137c89f381bb13a56e99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458996, "uuid": "15a43891-4f6e-4c91-87d8-5c8595dc8a3a", "value": "T1C9633A02731C0A47D5A35DB0263F27E193FFA99121E8FA85651EDB8692B1E331186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458996, "uuid": "2d19b4ec-9415-4963-b17d-12a9c87a6a42", "value": "1536:bRKs6oEpZR9X6A01wvVfATaN4Idfa+4aQWlOC3sus/BO:b1icJyWT64IM+9paO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766458996, "uuid": "14f48e86-2aa8-4d74-a71a-a9b8bcec1215", "value": 71780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766458996, "uuid": "0fc6ea86-06af-467b-8e4e-679eff5ebdfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458996, "uuid": "258bc0d2-2aed-4b44-b97e-f59b0d49ab8a", "value": "ntppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b9d6bc-dfe7-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766484781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484781, "uuid": "0b541490-02d2-40f0-a8a6-e399d2bd5561", "comment": "Malware payload (QuasarRAT)", "value": "7ec0bbdada8f71d6192e512d553b0bc4", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484781, "uuid": "089fe3f6-477f-4bb7-80ad-0e5f3459abce", "comment": "Malware payload (QuasarRAT)", "value": "8b0a9b414d895ced0a4bb3ba586b94463043a6ec5d884e5e0815a740ccf9ac96", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484781, "uuid": "cf013fcc-931e-4566-b56f-42d0f47ae430", "comment": "Malware payload (QuasarRAT)", "value": "a6e94554a61abe104d129118f2519226b8f745e4", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484781, "uuid": "a60969ff-28b5-40ac-973a-2c315ade823a", "comment": "Malware payload (QuasarRAT)", "value": "09a8a40998ec5162b559d06baacf11a4db276ff4c548e01099b529b7ed0fee5b5d80e73e4dc7960c019f2abfc0172720", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484781, "uuid": "38c27283-8eef-47c6-88fe-6c435c4d5c0e", "value": "T16E11141DEF30F9C84B3C728890AA2E1B1154612997336DE4C5085CB11D297A6CF5A6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484781, "uuid": "dac66533-ed4e-4441-a8da-7e9477eef5f4", "value": "24:x0e9zTe8VbahAFVkGArxl2eQxUaqw6kgQoM95Y:Lli8la+Vk9xgekgwIQowq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484781, "uuid": "a45e41e9-5269-4a62-b4d1-20fd28f94f10", "value": 930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484781, "uuid": "033162f7-24df-49ad-ac1c-14e337158d5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484781, "uuid": "10bd4b3d-1649-49d3-a08b-b7683f31aa5e", "value": "8b0a9b414d895ced0a4bb3ba586b94463043a6ec5d884e5e0815a740ccf9ac96.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b990356f-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478666, "uuid": "e5acb3f1-2663-4c6d-a998-460543e42ec3", "comment": "Malware payload", "value": "9b3dff1441ea6f756791d32d9ba13f20", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478666, "uuid": "065e5c7f-eaa0-4775-9ab5-960812cd8384", "comment": "Malware payload", "value": "8b4b5e1b2e0d6edc1bd692ae387bfd388f2b2349925909172f3063d82822b068", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478666, "uuid": "7edb6890-437a-4f52-b7d3-202cce53e413", "comment": "Malware payload", "value": "766b96a2b732b77b1121c3ed0f1f15aa3f6705e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478666, "uuid": "8db2efcb-0859-4c9d-a1b2-3fcd1e847a23", "comment": "Malware payload", "value": "e9080c20a031a2467843a575cef1ccebe7ba8655387edc907c0851c86588b9a99c3288303260470a35f98ce63a9cfda4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478666, "uuid": "39507371-ce48-485e-8453-c3d9f18a15c0", "value": "T190631AA2DFC34CAD0381515DC6BDA9B3C242A041CFAF5E68A35121E4D4593EB7F219BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478666, "uuid": "063c50b3-4730-49a8-b89a-8f85973bebd8", "value": "768:I8w/h62/jWs6oS+xISN0vBAwAvcdkfScBYrwz2y8kTAlGB:I9l/AoSSMOKusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478666, "uuid": "ad8be289-f690-4132-9e85-0ff347bde5c3", "value": 70543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478666, "uuid": "e883e4c6-23b6-47ff-9109-744832983e15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478666, "uuid": "1080e8fb-95d8-48bb-a283-eb1ece1b6f0a", "value": "invoice-1645080830.pdf (98).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a44ef2-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478825, "uuid": "c077affb-e102-427b-a6ce-17620678f9e0", "comment": "Malware payload", "value": "417ee902b84ebe0a4acbdaadcc7dff26", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478825, "uuid": "81f4d25d-3e04-4c96-aa8e-a307f6524698", "comment": "Malware payload", "value": "8b70ae21bec063c3d989e129c00d71a0b1182e9bf557c0662093ea6ec7ba9e32", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478825, "uuid": "03503faa-3b02-4828-bd98-211af2c19d12", "comment": "Malware payload", "value": "4a86523e80cc914d7cefd10f1cb53b19042f0f87", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478825, "uuid": "d1fabf78-5e99-4ea3-8de0-8f4000bdd19c", "comment": "Malware payload", "value": "d080f973b65e5eb67a029e2d21a3f776febed5dc03bf6270e8148a4fadb767a44d3343ab0c1af6f71357a37b5ee005be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478825, "uuid": "8cf1981c-ebd8-4268-9e69-3f3f02ad994a", "value": "T12073E90F9D2458B0979BFE6F876971404CAB8E90CC6E338E8AC32571A58D5F37B0856D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478825, "uuid": "774972b1-cd92-41e6-b0f5-3b8f779860bf", "value": "1536:I9l/AoSSMsIEIzI6I5IBIEIoIOIWI/IEIlIrInIrIFIWIuIhIUIJIkIeI7IUIhIn:I9l/5M5xusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478825, "uuid": "11af0d88-9017-4869-bd9b-d60aa6c44a38", "value": 74439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478825, "uuid": "e583e58e-df93-4d48-b160-c2460fb806e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478825, "uuid": "d849ccf7-061f-48c4-a545-c27812670301", "value": "invoice-1645080830.pdf (68).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f21116c-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457871, "uuid": "c7b01d22-a196-4c03-a0c8-040be5f336a2", "comment": "Malware payload (Mirai)", "value": "3ffeb07a5493e724769d98c4fb802430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457871, "uuid": "59b6d3bd-34c7-4ff5-b34a-d2e42f89b255", "comment": "Malware payload (Mirai)", "value": "8bb6df5f2c61a955dcbc98b25150d0ae232bc52bb2a0ebc748b87b39778eb5ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457871, "uuid": "bdc398b9-d588-410b-a29a-cb4f3303ad2b", "comment": "Malware payload (Mirai)", "value": "8867bfe2b5cbfb2b3d3bf6560af1ff8a590d1957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457871, "uuid": "b50de231-b4b9-46e7-b81c-d12001a6e7c1", "comment": "Malware payload (Mirai)", "value": "658315f4c8a3a7b34baaeb9861c46f4e6e19e2432012b2521bcede4d99a7311e44371755d5a27477bd2a4a4df1dad274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457871, "uuid": "4a9de623-bc6c-4533-837e-58a4a857baa4", "value": "T1E503F891B8824A6BC1E013BAAA7F518E332173A8D2CF7757D8255B047BCA91F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457871, "uuid": "32f37197-46af-4608-b087-ef35adf75b67", "value": "768:CRYK5xzX/4ulq3GjKWKK34o2TFspjqlYNWEMb6Mjks/1bkU:UXVlmGh2TiyKMb2s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457871, "uuid": "503272d1-32e7-4a88-b6cf-a4a7261046de", "value": 38560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457871, "uuid": "29021cc4-530f-4dfd-a316-5009caca4b67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457871, "uuid": "af17f113-fbd3-4962-a50a-a235ea78987d", "value": "ntarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c5c937-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510199, "uuid": "c43aff3e-5036-4c16-92de-db1582e425ea", "comment": "Malware payload", "value": "1eede4635c7ad6ebaa3d31d4b79ee02e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510199, "uuid": "aafa37af-5664-4ec8-94b6-b78694d3116e", "comment": "Malware payload", "value": "8bb812aa65ca3a3351fde193cbe0e0f07258f14d0ad62820c3615d2fe94d2228", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510199, "uuid": "f5ec263f-7697-45c2-9f49-da80826daec6", "comment": "Malware payload", "value": "3317832305bde7b29094aa23d8f42e57e8938595", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510199, "uuid": "5aa667b7-6ff5-4804-9d21-ba5c130f2d73", "comment": "Malware payload", "value": "3ed815834b7e51bccfb2e37be0ef73c4d2132343fe05879a8a4ff19d6bb7e1aad1f4530205bdaebe851d81e714c59d38", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510199, "uuid": "2d0fe3e6-f579-4528-852c-3d2f8ec09e8b", "value": "T155E502BB58B269576E904663EB0F2C1A335B19D53B24D342EA01919C7F3B1D38E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510199, "uuid": "f8a6a986-8aee-46c9-946d-75f882cd89b2", "value": "49152:AOc2yD4lTPvCB40s6yC/KabxlUFF6ZYS7C4sJIc/tcCVrslBgyqN38jR:AoyEFPvMPTCk7rc/tXVfx8jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510199, "uuid": "c2348583-e43a-4432-81b7-e70da3a98e91", "value": 3020663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510199, "uuid": "75b2471d-e791-433e-81fd-360133a73450", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510199, "uuid": "11ffd498-393a-423a-bc0c-ba1feb081968", "value": "PSINV3000887576.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c522695-e025-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766511097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511097, "uuid": "2134383e-168e-4852-b2ba-89ad4e118689", "comment": "Malware payload", "value": "c42fb1ef578ced7b1fcf6c781d7b3b87", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511097, "uuid": "598c66a3-b5c1-49b1-9f5b-68a4e819b5f4", "comment": "Malware payload", "value": "8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511097, "uuid": "78e791c3-663a-4d3b-a009-982b71f58894", "comment": "Malware payload", "value": "fbbf365fa534198553e71691ea69ed4752090c5f", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511097, "uuid": "8c296aea-d55d-4d07-96df-5d7ce120b25e", "comment": "Malware payload", "value": "f757180259952d2e0e8ae6b5a52c378cc91ea9d6d5dcec4250995ca0205d415d66224e4f6e1ee19e6d120003cc32f219", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511097, "uuid": "258c6d8c-79c9-4dc7-b2bf-fa3bb8d9f94d", "value": "T13757D04FF3EA1478E4AAC37645769155E9F338206721AEDB45A0C478EF239E42E3E701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511097, "uuid": "90caeb33-a3e4-4cfe-b399-36226f379017", "value": "393216:gqmHCw8pbOwJqpIqmHCw8PbOwkhqqmHS7w8PbOwY:9FRU1FRmrPR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511097, "uuid": "1c15d1de-7606-46e5-a915-9f39dd8f0d0a", "value": 28114944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511097, "uuid": "64f29ec4-f3d1-4c2b-9b66-aa29ac1ab2f2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511097, "uuid": "dfc4cc54-61eb-4f63-8c94-3ff4151e27da", "value": "Internet Download Manager IDM 6.48 Build 45.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01434e17-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524313, "uuid": "95b8836a-96dc-4b37-982d-c194526da6f8", "comment": "Malware payload (Mirai)", "value": "f8332a2eab848f0d30630cc308e3901f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524313, "uuid": "86fb7679-ba0e-4b9c-b5ad-a4234e8cadb0", "comment": "Malware payload (Mirai)", "value": "8c869e687c4338dec621d3a3e980fdd12aed349a786882cc97be151b62b81ca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524313, "uuid": "0d74072a-0809-4b14-b486-aa4e4e0ca30d", "comment": "Malware payload (Mirai)", "value": "23da341042ed5ac15b682969e3bae0e3b520935b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524313, "uuid": "c038e7b2-a607-4233-a5ec-9155fd8ea860", "comment": "Malware payload (Mirai)", "value": "802630e8f43ab1d89d442aed95137b580c52fb01614c06e5ba0246840d40e0ce3b3eb93c814eccadf2f8f95d51b7dd66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524313, "uuid": "e9d335a0-e1c4-46ab-bb87-c43e6496eda7", "value": "T11124F947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524313, "uuid": "83c6769d-2907-4095-9c49-0bbe2d4a88fb", "value": "6144:Ip4nw6IdA1Twfl4ds0aVGGp8CwZ9YNJmh0jHP2:IKwi1Talz0aVEHZ9gmujH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524313, "uuid": "326d624b-bfd7-4b02-a8e4-75ae861ecde4", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524313, "uuid": "220fcaea-67c3-439f-89c7-88f64bff811a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524313, "uuid": "c774251c-9b82-4c2b-a197-bdf920f4a2c6", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c136f8-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525124, "uuid": "dde6499c-f16d-408a-8273-a83a5498c77a", "comment": "Malware payload (Mirai)", "value": "feead61c987b4260b63cc82ed8553a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525124, "uuid": "8d6b7620-884a-4d06-861a-4cbb9a59690c", "comment": "Malware payload (Mirai)", "value": "8cfbf248a9a30770d86bec38ca3f7a74a021c673893e4ac6785b35a858d5068b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525124, "uuid": "1572a900-a0c6-4cf9-afd9-1422d11cadef", "comment": "Malware payload (Mirai)", "value": "27c05e3ef9b4a1ff7219829a1d6e4be2c56b17bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525124, "uuid": "a1cbca1c-77d7-47a7-9e4d-e5ef184cf1cc", "comment": "Malware payload (Mirai)", "value": "c9e275271d838378a8a1d5c61604619891e8869a3016b3c9149598fcec7f3b9593fa26873ccfdc176cb405f3746ba842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525124, "uuid": "4220a63e-1065-473f-9842-d4e32273a4e6", "value": "T12F933A46BC818E11C9C503BAFE1E118D331357BCE2EE72229D106F25B7CA96B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525124, "uuid": "bb511ca7-c14a-4238-8625-aeaba8701dbf", "value": "1536:KBnlTjhg41FGT8SnLspcp1bDRHn8nqaIM7QxMuiChiaZ9FDl/C7ka5AY5UwbZnZ:ojhgMFrSLocplxn8qaehpZ9FDl/Cgaqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525124, "uuid": "e210864b-e22c-4ece-b499-177767e03b3a", "value": 91424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525124, "uuid": "322c4971-e3d6-4de1-980f-efff926109ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525124, "uuid": "b1cfe04b-1cd8-441d-8824-4846b8ab628b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff97cf6b-e021-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766509707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509707, "uuid": "fa7a429c-0f71-4d82-a525-ebcd8eaf382a", "comment": "Malware payload", "value": "86b67d6afd9e7736a9761002e63952d8", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509707, "uuid": "be051edc-88e5-4337-b0a1-36971ceab2ef", "comment": "Malware payload", "value": "8e4a2ec56ea451c863939ccb9d16d8498dec989c5e8f0bc313f7f76f82d6c9b7", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509707, "uuid": "96a3e1c6-7162-44b1-aa65-24423f278833", "comment": "Malware payload", "value": "d3605f70bae784717c9a0de36e92c00190ef374a", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766509707, "uuid": "0e24fff8-0167-445e-8a7d-ac3027fc18cb", "comment": "Malware payload", "value": "a9fc6e86c9dd55bbc75a6e95389d877e0317e325050218568fb8c492fdd05ab53f8be30cb0354da1cd4e7535978b84cf", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509707, "uuid": "4d788714-a07d-4136-b34a-3efca0a9ea23", "value": "T1FB83B889899F49EE9BDB2064B91FBC17C9AE8607021CE150B74EE9C63F24CF071997D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509707, "uuid": "6d447adb-3f8d-435f-8c71-3f1742e8848a", "value": "768:rt4KuFhiH7HSdQNOIvyzuwiwwAdebB/OAdW//ox7EFx2TSi3+bNR87eKzBkpCRrm:rjvQYcFx2TSi4Ne7ehC2AcrDKgFcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766509707, "uuid": "13860723-ed31-40dd-99e9-a1cb658ac08e", "value": 81436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766509707, "uuid": "a6542129-6f62-4c52-bedf-17450a80efe0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766509707, "uuid": "730d438a-745c-4159-b042-2caa43974755", "value": "file.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6225e2-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510208, "uuid": "88cd6793-8d1b-4e66-a6d8-9a85dfd92c9a", "comment": "Malware payload", "value": "b572151155cdb30aa3c5096071720dbf", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510208, "uuid": "275031b1-6753-43f6-b779-28822daab16d", "comment": "Malware payload", "value": "8ef4f92eeff604c0dbd125cf358350141d9e3c1ef400775365b202c5d95b920e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510208, "uuid": "28afff94-3211-4f0b-9ebb-878f414f16d8", "comment": "Malware payload", "value": "cb22695d92994cd2cdee3aadd8304262f18495ea", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510208, "uuid": "7ab604d3-09e7-46d7-a50d-e7e6278fd6dd", "comment": "Malware payload", "value": "664f3768b817f6d3357c4c284aa0d9a4f81272038502e9d7791280f8414b2ce23f33b8557769bbfa1cf723653986e22c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510208, "uuid": "85c27641-871d-4fed-a4be-4d5017b5db7c", "value": "T125C41219C627721ED91FD039F3A447E26446B72AD083E1AE6D50B84C33272E767CE64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510208, "uuid": "77aa445b-45cc-492d-be6d-58495dac6d72", "value": "12288:zu/ue0pjbVj+nKDiEQeDhmgpWwXU6uAh0Uso0jqKC:+u/pSnBngpWD6uLUJ0jRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510208, "uuid": "6e0682f2-3309-4689-b2b7-c588de6e65dd", "value": 592065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510208, "uuid": "6f6c6074-92bf-44d7-b8a0-23b3b1dcea47", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510208, "uuid": "36770b8e-8de8-43d3-a7ee-670bdd324b6a", "value": "GSTR 9C_Offline_Utility (2)_23-24.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c69c69a-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766451424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451424, "uuid": "233b37c3-e58d-4c89-9f58-882ba85e8e41", "comment": "Malware payload (Mirai)", "value": "d308e846c7e76d8fdea16d34b74ba366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451424, "uuid": "3e3d205f-2344-4c44-9a6d-1c218db671a1", "comment": "Malware payload (Mirai)", "value": "8f4fb9b2ffb80e0e4e9c1650f254ebe87e8fc1ab0c6b8bcdae398de681288c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451424, "uuid": "15fed548-7ff1-4e08-b3b2-4ffd229f7019", "comment": "Malware payload (Mirai)", "value": "78757bb3fe6424551ae053f410383acaf7f5464f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451424, "uuid": "661efa75-ee68-4c0a-b662-3f7ea398f8b7", "comment": "Malware payload (Mirai)", "value": "e3216e661cfb9f53a49899909adbeca30ce16c03cb5c635080324f7b5f19330a634911eb6e47d8e12ca04ae92d65b55e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451424, "uuid": "fc07a22e-785a-414b-b9ec-95f9693f9be9", "value": "T1D6B36D02A71C490BE9E71FF023FB53E19367664126B5E2C2360897495676F329E06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451424, "uuid": "8f409dc3-341e-4ebb-9106-72b98d053a28", "value": "1536:hHvHwgFDtQn43DvaavYPQlcX3j3E4rEJ2yDnu58ZL0oBjeIo7ILNICngVFyFM89:hY0W0LvYYmnTxk+8ZooBjKIIVFyFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451424, "uuid": "a66b8101-12a6-4689-b624-c6faf3f21232", "value": 116260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451424, "uuid": "d6139307-fd7a-44af-9a4e-f9653389ba1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451424, "uuid": "f27ff7de-7de9-4e22-a260-0895cd53c5da", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9fa692-dfd2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766475557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475557, "uuid": "262e39a3-9e4b-437c-92d6-6243f59ba935", "comment": "Malware payload (Mirai)", "value": "f4ca46dc8820e94bd666d0664422df62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475557, "uuid": "66258292-fab6-4707-ab8f-beb3f0290d74", "comment": "Malware payload (Mirai)", "value": "9099219662c7dbafc89dad97edd4a6b652471c844bca044c1d1903d4cc1da083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475557, "uuid": "e7462dcd-9def-43c4-a632-12825f7ab272", "comment": "Malware payload (Mirai)", "value": "8646cac168fcfdbcf219d71a1f5ed8460a5e9f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475557, "uuid": "1e481a8f-ba05-4768-82bb-fa6221529f98", "comment": "Malware payload (Mirai)", "value": "67617ccec5fdc3579730a37c07e9f47f8c8a98fc74bc4603b7cd6b4b33495adf94d6938210018e052c8791d4fa7bc368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475557, "uuid": "043506bc-33b4-4506-9cba-4f618b23c592", "value": "T1EED3CF31F019ACB1DC110AF934B685780342AFF406E51683EEBEE56E14B7D45BAEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475557, "uuid": "45872e7e-83cc-4236-97b0-5ad869a2b602", "value": "1536:SOyLS+mbf5tLebTyNUzPqjbQoHIHbdZGP22M2MGJLv0zBeebtShQF+Gh0rr:Sc+mbBtLGqgHHbdouv1GJLWIecC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766475557, "uuid": "22453c1e-6fbb-4629-a5c2-bd642bff8f1f", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766475557, "uuid": "270020a4-3ddb-4c4e-9f50-87a9a90e40d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475557, "uuid": "443cda2e-dcde-4b57-b4d1-69c782eef8de", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da51e65-df97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766450272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450272, "uuid": "e99a3573-26f9-47da-9faf-74bb04fe91fe", "comment": "Malware payload (Mirai)", "value": "eb5e1c7d45890b6d8139c8b761b3403e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450272, "uuid": "93a39207-8944-4e19-9c1a-5a561856785a", "comment": "Malware payload (Mirai)", "value": "90aafd9b5c1c902bd354f153479fc70c3a212505209a6a8b59cb9e34464559f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450272, "uuid": "d1ae1152-1dbf-463c-be9e-8c7138087b85", "comment": "Malware payload (Mirai)", "value": "4035ed9ff092cc8b1f9e4afc8c840aaa860b58f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766450272, "uuid": "8654195c-7f9d-4756-9fd1-deb7789c6698", "comment": "Malware payload (Mirai)", "value": "d89beba0926a825fedab24b12fc5e0a34c1b4507d685a99bf7a7c66e3847813256cb24faca726c4efc34403e1803134f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766450272, "uuid": "2ef630dc-5bb7-4f59-b56e-71b0d306a17c", "value": "T15CB34D02B32C480BD5F71FF027AB53E1A36BA64156B1E2C6360993494576F329B46FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766450272, "uuid": "87e84b67-d7cf-45ee-9fd5-3fcaea5eeb57", "value": "1536:HN2b6BEaOOCQBQBMSp+Iib2G7V2H5o2D9x8Ubn8LBJeJ+J07CngVFyVMU:cKDfliMSpze2G4JHbnzi0FVFyVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766450272, "uuid": "98ab443e-0f69-477f-9b7b-8f488c12fb58", "value": 116260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766450272, "uuid": "05910acf-c074-423a-b340-1f43dc7df187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766450272, "uuid": "40f7d12c-c260-45ac-8578-8d79d3527b33", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0580300c-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524320, "uuid": "d58de445-60ce-442c-bc79-6b956c060e8a", "comment": "Malware payload (Mirai)", "value": "b7b0c560e65a4921db74fbbcfbaeb141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524320, "uuid": "dc609414-6821-42fa-85a0-bee430a11d66", "comment": "Malware payload (Mirai)", "value": "9166a6afa5d5bb71a70c307d76bf8f4efaf6acf3ca0cc4e4fe1b456b7222dc26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524320, "uuid": "2ba551dc-f2a9-45a7-b50f-bfdb0a30b635", "comment": "Malware payload (Mirai)", "value": "46a03bed668c44ce75405ee9281b0e3e8f5cec04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524320, "uuid": "72aa3fa3-f61b-46bb-b0f5-78ccceb93882", "comment": "Malware payload (Mirai)", "value": "fd104fe0b3c9d84580aef4e729f729bfad9e946165e2d3b6e06391c96b98aeafb260b9e9265e6c710f071c3ed2ba104c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524320, "uuid": "2559131d-69d9-4a4c-a212-302e76944e9d", "value": "T130F33B8CA4025E6CFA87A8FE94214F1ADD516351B1930B1F959FFEC37C2226F8E42D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524320, "uuid": "d299f509-b7b3-4c4b-be8b-3bbc8e3dd805", "value": "3072:pW57+OlKgf1bPBsm4+CGbOZ40pExQanDp9:w7Bsm4+RU40pVant9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524320, "uuid": "0178a1d6-812c-44e2-9f40-a94e52f84010", "value": 170316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524320, "uuid": "192f7c16-6943-4af1-8024-780f51676c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524320, "uuid": "e5ce26cb-4423-4f84-b8a5-7663e70fafd2", "value": "pandora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb464987-e052-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530638, "uuid": "a7ee4fb6-7fcb-4787-bd43-52c4a4f523b3", "comment": "Malware payload (Mirai)", "value": "56529cffe4a41723495e246ac7edf325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530638, "uuid": "63fc6afa-e2de-40db-a441-ddbf0d8b75ff", "comment": "Malware payload (Mirai)", "value": "92218b5fc2f91d1082d4eb23d1789ea254e6181b97b4d25e359157d08a47ecee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530638, "uuid": "8e29fb8b-ae95-4c0e-a0fe-9363c2793f5e", "comment": "Malware payload (Mirai)", "value": "ca9c20900403a6f486372d38bc90154a7defa58c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530638, "uuid": "d947c3e9-4d74-424e-8c75-1b5d496f447c", "comment": "Malware payload (Mirai)", "value": "94d61c2ca2f65ea118ce6450063caf10c78b1b86f47488d89fe28db4712e6cb2fbcff0ce248e94414b587daa3afd0d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530638, "uuid": "d6674c18-79b1-40a4-9706-06a767a95825", "value": "T105530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F647BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530638, "uuid": "25d279d9-065d-4329-bd13-33cb8783f176", "value": "1536:wdnIYoZXnYkTAcASlquAS/AFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlq4uhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530638, "uuid": "85f7c8af-93f1-44d0-a1af-7b89d51c2db6", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530638, "uuid": "54f47861-a530-452e-bb22-df1e1ba32e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530638, "uuid": "fbb3d06c-1b37-4b5f-aad6-98622a6c5483", "value": "Josho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebeff0b0-dfa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766456846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456846, "uuid": "4b2ab274-ed28-46f3-be6b-61a90ffcdd22", "comment": "Malware payload (Mirai)", "value": "58273cccac1fbf00d103e871de1428c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456846, "uuid": "1c4be591-104b-498e-8661-6256991c9fa0", "comment": "Malware payload (Mirai)", "value": "9252366beba13d11e688a11f70f56851e49ca08678168de48301c13c266c3c86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456846, "uuid": "0a5e55b8-a424-4bea-9730-0fbc8540610e", "comment": "Malware payload (Mirai)", "value": "5c3f0c19e6b3f53ddcbe9519cc18bb93ff121762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766456846, "uuid": "17fc2a49-e403-42ef-b5e1-b7408188154d", "comment": "Malware payload (Mirai)", "value": "d5a0dce70ebd20eb07b8866c192fe49d02b0e9aea53f25bf7f3b7fd028f41573b8d1c7f8a561f69da62ccd064c27bf62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456846, "uuid": "cbb57aab-8d61-4269-9db6-0c8f50edbcad", "value": "T1F4B35B46E643F4B0D81A0475224FA37A8A35D9316022CD5FFBE47F71ECB2B119A1A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456846, "uuid": "e155c67a-ada9-4e36-a660-a0c73dc959e1", "value": "3072:t2l12As9vL/ovwHyUYBU8gdwBQ7erQ+QIODx9hn:cH+9L/o4HyUYBUle4j3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766456846, "uuid": "6fb38bb5-66e3-4994-a7ad-1d3bb7b14eec", "value": 115108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766456846, "uuid": "72980069-089f-4692-bdc8-e16b8f049b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766456846, "uuid": "6973a742-d887-4972-8abe-7cf0ba506b7b", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adae2d80-dfca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766472203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472203, "uuid": "b15e84b2-75ce-4f44-8c49-19df963535a1", "comment": "Malware payload (Mirai)", "value": "b1d4305ae59a92405740346dff8f2ad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472203, "uuid": "2589468d-2ab2-4db8-a546-ca4f71e59bff", "comment": "Malware payload (Mirai)", "value": "927d5ac1289b95e77e24f168bae4f535f8329828b0489e09f89f1e63ed0b5a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472203, "uuid": "b81de6d2-7df5-4299-b057-04309375ed67", "comment": "Malware payload (Mirai)", "value": "7649107fc61b240d44c4874f146f14c333ca8581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472203, "uuid": "1f989e71-e855-4f5f-9df4-af5726093011", "comment": "Malware payload (Mirai)", "value": "644e5ecf20f9f7383699762520541800b878606589e42ab18d36544b60be52fa779e582d55d0eb3a20773205fa6a9c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472203, "uuid": "c682483f-b63d-423f-980a-2a7116f2b428", "value": "T107146C2BB3C3ACE6D51063309C312362771FC7091958EFFB9A1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472203, "uuid": "664a917a-4cfd-40b3-92cd-d95537da7cf1", "value": "3072:I5pOm515UQYwmD1CFVV1rBbiyxW1VSOXq90mOT0vWNwVsKXa7IKZ5tz:I5pOm515UQYwmD2W1VCAT+sKK7IKTtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766472203, "uuid": "76ddff42-63b3-4b37-9a01-f2c181abed25", "value": 197448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766472203, "uuid": "7db8786a-4812-442e-aeab-c3a7041766d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472203, "uuid": "1fa02139-13a3-4b2c-b1a5-c171ebdf7b16", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091b2ccc-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524326, "uuid": "77523d07-3118-4d16-a1a7-6492f4c4d461", "comment": "Malware payload (Mirai)", "value": "8f03affc8deedb777b0ec1ea6c2e6f70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524326, "uuid": "ee2aab0a-d4d9-4c73-ac47-4e22619a2384", "comment": "Malware payload (Mirai)", "value": "930e8d2f6a2633590899f77a3665043b1a2dd0e262fabc2412a65e47f4827d1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524326, "uuid": "b509e8ea-6ae3-4dda-bab9-da4c5c7e5b71", "comment": "Malware payload (Mirai)", "value": "f9e8d37e64cbbcbf48fd5ab716b94883134d68f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524326, "uuid": "bce3a84b-fc77-4920-b5cc-6f81dcdd7309", "comment": "Malware payload (Mirai)", "value": "ac48ad4bd4ac846c1b51798d8d5935b380432872fc99f8f20878a6bdfeba75c6ed0e4e565ff590c216907b86fcc0272c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524326, "uuid": "eea686ea-ab2d-484c-bdbe-74e5af9b683a", "value": "T198F33AC5B163F8F0DD1506742137FB332E72B47A6239E997D3E82A63AD85B42C4061B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524326, "uuid": "d1728f4e-6748-49cb-994d-fdc897fb68da", "value": "3072:xZ0OWLLnSt2tGbn5y3nDkUGJMC6m9vs60bVmwGKHgaCMz4LqO1Hr3e4GnaB5ug/4:xqOW/n/tGb5y3nDkUGJv5BDesbgTCyKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524326, "uuid": "f99e8dbb-b99d-431f-b41e-fe7e4bf03033", "value": 164848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524326, "uuid": "6c5f80a4-e456-4c73-9dbf-56f67fc65318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524326, "uuid": "d10b973a-77d8-4341-bdfa-1555eb593182", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e5225c-dfab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766458950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458950, "uuid": "ef31c26f-4051-4287-ae8b-0acd58c86f6f", "comment": "Malware payload (Mirai)", "value": "b46df8ce95b7bc41ada536c4a85b5821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458950, "uuid": "7756f705-89fc-4717-89cb-f67f941c352e", "comment": "Malware payload (Mirai)", "value": "93b5e35d52129a8f694081b56cd71ca7bd3f53481c32b80e4d653a6039a90af6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458950, "uuid": "42bbce16-c55a-4e0b-a89a-f2be96af39d5", "comment": "Malware payload (Mirai)", "value": "b87ac3b15d5b67181be3b7106aae297df3633058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458950, "uuid": "114f11a7-333d-4f3c-bc5e-3095c24e7c96", "comment": "Malware payload (Mirai)", "value": "fcc28bdf7ba134cc776a194929028b2225f034dcbb104b40498fddb8567dcfba4df14f5209479dea85603870e7de2a43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458950, "uuid": "32c7119c-2bb2-44e1-b0bb-66873a2b3cb9", "value": "T177833ADBF800EDBDF80ED77B44530A0AB231E39149931B366757B967ED321E54826E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458950, "uuid": "63cf8530-e54b-4434-9312-c1867b3656a2", "value": "1536:LWOLMPybZRAqGIZW2d+Pw81y1jFRt5FZah2szX6NLLMdgKVgLskbXyn:LWOLIybZbc2d+Pjy1jFRGhrzXKIVgL/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766458950, "uuid": "4469e852-9cfd-46fc-a7d1-f9d30ce2f145", "value": 81476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766458950, "uuid": "eaa4d6c1-91fb-41d5-83d8-3d8d192db74e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458950, "uuid": "a32e1684-0cce-42e6-a009-ac39af2d1802", "value": "ntm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9184bfbe-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478599, "uuid": "90579bfd-8942-43fc-b5b6-7ed9ef6cae0f", "comment": "Malware payload", "value": "713f710a802bf83fc28781a8908fcf56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478599, "uuid": "7e2295a4-b9e4-4738-9a50-354b4237cb2a", "comment": "Malware payload", "value": "93e943627f095e98466eeda27113a0dc80c9e70b7721928427bceb1a471c2e95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478599, "uuid": "4813b0e1-232d-4dd0-93a6-479b8ab9362d", "comment": "Malware payload", "value": "214d0eb244c7dfea9b55006498c271db3581b01e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478599, "uuid": "e3117cf7-385e-4fc5-941c-5d5ecedeaaab", "comment": "Malware payload", "value": "56ae5a9ee7b0dd94d6d5540c22daed3d27ee64866058a27e96704badba84dd56b1a31ab01afe8aa813b503d66d0b6106", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478599, "uuid": "6dd39809-c131-41a4-ab9b-3a117fbd4964", "value": "T114630BA55FBB95E0FCFD625C7998C80A35C9911C268340D9B943F280414BFEE7E63C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478599, "uuid": "3a2ba950-236b-4d29-ad88-868bc09282ff", "value": "768:I8w/h62/jWs6oS+xISN0vi3l3WL3EZ3L3NGdkfScBYrwz2y8kTAlGB:I9l/AoSSMi3l3WL3w30usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478599, "uuid": "a54db17d-404c-420e-bdf3-4dc152aa3e1e", "value": 72509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478599, "uuid": "899d59ef-0dc5-4052-9066-d17aad59c4c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478599, "uuid": "5bb70509-00e8-450d-bb94-bc9bf7b11069", "value": "invoice-1645080830.pdf (111).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1dd9f8-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479100, "uuid": "6bf5ec22-ec5c-4430-885a-46483a68facd", "comment": "Malware payload", "value": "7710c39cbf990359286c3740720eb0cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479100, "uuid": "a3495abe-a20c-4c0f-b40d-664ec9d64b20", "comment": "Malware payload", "value": "943512f16274359e617b7dae2c56b6658fb5b253adc751a23ebc685dea10f4f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479100, "uuid": "1cb5d716-3232-455b-9498-8741dd11a4cb", "comment": "Malware payload", "value": "32a3b2b91c0244ff2d25af02a40e70ad60e2d414", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479100, "uuid": "42e84139-3a06-47b5-8843-b12b0eed4146", "comment": "Malware payload", "value": "e8074f01e28e19a3222945128b49cf95878b43950478fb494f5c4694e764520b836b378a1624d56feca76c2891ebaf95", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479100, "uuid": "5c0179bd-2ed8-4bb5-9028-b3cacc1678cb", "value": "T14D633BD1F0B96CE423932763F8F85198CC7EA244089D71D4F96A723D0969B497AF83D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479100, "uuid": "2f43e534-e9c9-4f42-b0d1-e3a60cd780d3", "value": "1536:I9l/AoSSM3uX1WuX1buX1suX1huX1DuX1guX1uuX1/uX1wuX1CuX1PuX1juX1nuL:I9l/5M3uFWuFbuFsuFhuFDuFguFuuF/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479100, "uuid": "e87ff334-e612-4f6a-be8d-50a5dc94052b", "value": 71601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479100, "uuid": "696f7d77-0055-4c6d-a076-cbee6099f749", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479100, "uuid": "674bc401-4024-478c-a4c2-138c48f96880", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80af9b9-e043-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766524217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524217, "uuid": "4fa7aa3d-4cbe-4e6c-9ac3-019bfae6ab4a", "comment": "Malware payload", "value": "66bbe503c2ca41c394db12686038c969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524217, "uuid": "3067f0be-ad97-4efe-b996-f02c71abfe85", "comment": "Malware payload", "value": "94e9e20dca74991bcc903283d0e487d83ad021351d52d6db30cc658128ce3ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524217, "uuid": "256ab1f2-1720-4c60-aed5-1940aae7580b", "comment": "Malware payload", "value": "d6a20ad6657f31dca3e4ca41feacde119145438f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524217, "uuid": "f70ad228-7558-4b47-8ae6-9c0b6f13f992", "comment": "Malware payload", "value": "55dc28dd25e3180f6f50b6248eed7c43f195d9973376f87973bd1e01b4cd81455c466952748c60375bf942d546231872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524217, "uuid": "f89ec3b7-ca50-4749-be25-57f53b850e33", "value": "T1B7C4C20CFE91F805DE1E3DBBCFEA11004B7160C1AE1296562119AFFE8B6537259E267C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524217, "uuid": "2be478ae-3a0e-4800-84d0-910f448173c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524217, "uuid": "52bac21a-2d6f-4c04-a2b9-8889c0a8c034", "value": "6144:05pINLLbGmymuc/OWwldAEXe6VlWT8b9L154tt4d8bFEEoxA+s9qb9f6eh5nGN:05yNLemSxLPVle8dufuEoxIA5nGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524217, "uuid": "28d74617-5ddd-448a-811d-2a0171ab9a9e", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524217, "uuid": "2cce37e2-8757-45e1-a07c-231a2a01118a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524217, "uuid": "f298b543-4e20-40b7-9f5d-9cd006c3d35b", "value": "AntiEac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d37e605-dfff-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766494939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494939, "uuid": "c6a76202-eceb-4e55-8778-42526600fb6b", "comment": "Malware payload (Vidar)", "value": "5b5d24aa7c2e9dc81c2a4553f1232ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494939, "uuid": "43a17341-53b4-4a6b-8abd-a5cf75c9ffc6", "comment": "Malware payload (Vidar)", "value": "9562441c582d50f6a7e68905cb849081f4226e73687ef98f2ff6e8108eabccd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494939, "uuid": "a95c4e7e-9f31-4074-b82e-499122221a31", "comment": "Malware payload (Vidar)", "value": "42b3f4a90bd863b94c9e64e22b21d42c0b91b0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494939, "uuid": "246f8950-f291-428d-8a24-fc28f950fed8", "comment": "Malware payload (Vidar)", "value": "7a0b277330753da0f8b07bb4f345469ee0362f03fc59167755f9090ced0ba2730acf762f6ac1668b0c66f901f7a3df8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494939, "uuid": "b0383964-2830-4084-b5db-91c9d962b456", "value": "T1FB665A63FE904666C09FD139DCB2514576703C48077122E76BA12BB51EBBBC4263BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494939, "uuid": "f39e0f75-8263-4ec9-88b9-606d8717f6e5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494939, "uuid": "29301bf1-cc1c-4556-b84b-43a1b96448d6", "value": "49152:mT/s98fzKIa3Ck8En1a/ks3O3ciebKpYPeNMlTi/GI9OfH3A1LeOh0Pya8IzWJ00:m4gnaqVXF0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766494939, "uuid": "5b5b437f-f9d6-4bea-94b9-eac6017607c8", "value": 7111304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766494939, "uuid": "d0cebb08-065c-45cc-aa29-a3bb9fc6227a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494939, "uuid": "158c104f-60ca-4233-aa94-94538ad79cce", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e977151-e02b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766513598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513598, "uuid": "b2daac3b-3ddd-4be6-994c-52e46e8add41", "comment": "Malware payload", "value": "167100db0d172822b3db978853e47d5d", "object_relation": "md5", "Tag": [ { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513598, "uuid": "64d8922b-b976-407c-a4d5-7dc4340f44f0", "comment": "Malware payload", "value": "969d32afca0623f627cdff73d547934b5237b0a3c513bc058600899beccc5a14", "object_relation": "sha256", "Tag": [ { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513598, "uuid": "4d4ac0b4-b066-46b4-b0c1-70d6594ec21e", "comment": "Malware payload", "value": "19bd29c8a56aa1d62904e8259004221c1b29925f", "object_relation": "sha1", "Tag": [ { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513598, "uuid": "029ce7cf-24db-411e-94cd-04216a45ddbf", "comment": "Malware payload", "value": "2aaa8a2c40bfbe45a6602491e2d7ed53e40f2fa80f7e990a1a4984c5a84c09fded571f2c9b61a5abbc92590115ce47eb", "object_relation": "sha3-384", "Tag": [ { "name": "lastmin1917-dynuddns-com", "colour": "#A28050", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513598, "uuid": "1894e717-a699-4f64-95e4-2282876d90ff", "value": "T1A74200BCC5E0FCC0CB5F31F175DAFAD2129ADB13BD6A1968E98844940B80714EBE9548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513598, "uuid": "88e86508-6a1e-4258-bcde-b46da5754ad1", "value": "192:VzdDqyJLxR61rxTAPzNVw9XSafBtkUHD41tcY+OferUIVfrtXcyQcT1vDh:Vp3xR2tTAPJmhSaptkUHAtcYPluf5TQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766513598, "uuid": "164c8af8-70b3-480c-b3b0-78bc2e60644a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766513598, "uuid": "4a4ce239-367e-4a55-a586-6db5bf6c43ef", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513598, "uuid": "45a96ea0-dfd0-4ae1-8a1b-36c2737b4a18", "value": "ScreenShot.png.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46812e95-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457857, "uuid": "e8f4dfcc-a063-42a5-ad4c-b7575b0aa30b", "comment": "Malware payload (Mirai)", "value": "6057349ec9fe7204bc00d5286c63824d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457857, "uuid": "58aa710f-65d2-4941-a292-5b33e490cfc1", "comment": "Malware payload (Mirai)", "value": "96f5da5bc3c1188307f801c5d9d747998e11b62cff42666589b920d22dd90a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457857, "uuid": "553ba29a-164e-47c0-bf6b-ee692ed53aa5", "comment": "Malware payload (Mirai)", "value": "028106524255fe19f4d8f46c48534d1e99d6da33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457857, "uuid": "38efef63-00c3-46ee-98f9-2b19bd090f7c", "comment": "Malware payload (Mirai)", "value": "d209bbfec5b29d3d44068bfd090482245c24b56e7d618b24cfdd2b3c8bda73d31d2b2a3c0e5f91159ceca10523dfb1a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457857, "uuid": "5ae7e307-22e2-4dfb-82da-0a406f717d44", "value": "T1A0731995B8814B22C9D512BEFA1E118E3313177CE3DE73129D20AF24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457857, "uuid": "b43e30d1-ed82-4eb2-988a-2904285d785e", "value": "1536:FnnAqDQCyz8NhrHH5wRAaSu/GWQcgMuivGjcTE20670L5HYUs/g3o:d8C7vZwRAaSSqjcTE206gLh93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457857, "uuid": "a2ee27fd-8008-4480-88ab-3246060bf742", "value": 80412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457857, "uuid": "883083ee-060a-4c53-a375-5ef838948ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457857, "uuid": "4c442eb9-837b-4d19-9412-6fe70cd62d13", "value": "ntarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06a049a-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479134, "uuid": "d4122e27-9d5f-4276-9aab-54195cafdec3", "comment": "Malware payload", "value": "3de6e196046497c729225bad3ad7d94a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479134, "uuid": "b03f058e-26e4-412b-ab48-e6dd304bcc24", "comment": "Malware payload", "value": "971ac9a14d067b45001ffce58d61b6d4e0a871ef1c0e9e6c688baa2ff3a9f04a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479134, "uuid": "70b12b7a-fbbb-4f42-b6e3-3bdc97f030c4", "comment": "Malware payload", "value": "7388b7ec659c012cb7aea7aa85080ba47be1fd53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479134, "uuid": "2c590da6-c5a4-4fc0-ac7b-9792f8689d9e", "comment": "Malware payload", "value": "f31045af897a8460c254c8c7264bac28c2c86549325d1f0ab2d2b028357424813c95cccc88645aa7fc844f715054dcf6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479134, "uuid": "0666b7a9-61af-462b-916f-7c3021db0163", "value": "T126634D1C37A70BC69771D4F8BE179EBA12AF8045D14B92890B5DD4278D6BF621E230CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479134, "uuid": "95f275de-546e-4ff5-8526-45b4373a799a", "value": "1536:I9l/AoSSMRYyau/1EGoPrU5sfw5RdHuZHLVh/Z6di+/ABK+l4rj6tsvfzQbWusrm:I9l/5MiuusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479134, "uuid": "907c10eb-f9e4-4dd3-8939-c82f20dae071", "value": 68668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479134, "uuid": "61acb1fd-300b-4a43-a388-0523c0aaa599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479134, "uuid": "4d18aab5-9575-4ef1-aa7f-686a109f1e28", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de93c3d-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524334, "uuid": "bea3e92b-6a4f-45ad-856f-5550d7188eca", "comment": "Malware payload (Mirai)", "value": "251fe4feb0db751215e1ca7aceab79f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524334, "uuid": "66aba095-127a-4661-b86e-31ed9cff1d2e", "comment": "Malware payload (Mirai)", "value": "977631cbac5039b98c9c04505c5f31cec566244b22fd7e5d44af4f53fb568e96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524334, "uuid": "834ca51c-5819-4ed7-a421-cbc438828dac", "comment": "Malware payload (Mirai)", "value": "6060aa50d02024eb71ef18dc1bad5b138ccea63a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524334, "uuid": "43a45459-3e0c-4eef-af87-72842bbfc636", "comment": "Malware payload (Mirai)", "value": "f49d6961bff999ff3a1419c9831b383b8d214f51419c8f75b04bda7e9461f5e53ea4a79f64a8068374dfb4f57f0feeca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524334, "uuid": "1289d7f3-5894-4b7a-92ce-2684cc1c1afc", "value": "T1F6F38E35D05EE5D4C0220238E9E58C3A9F117048527B2DFA9FE78492149BDB8FB297E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524334, "uuid": "56d1eaa7-de98-45e5-8b20-b6384255a41b", "value": "3072:A1anqnNqSaIqTMwA6flyyP9tq5dqdCdq9uy8BKFGSuR7WDcvpDf+A2fA/7xRaJvL:A1aAraLMwA4P9tq5dqdCdq9L8BKASuwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524334, "uuid": "e0df4016-c88b-4bbe-b2ee-b411d22221b9", "value": 171072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524334, "uuid": "b43d603f-17e8-4566-83b2-b0d2f874261e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524334, "uuid": "67e9bb88-c64d-434e-87e4-78d5a531221d", "value": "pandora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff3c8ae-dfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766476878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476878, "uuid": "f21ff1ed-7079-4d3a-a590-7157b1855d2a", "comment": "Malware payload (Mirai)", "value": "e7831780520aeb052dd1af8cdf267923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476878, "uuid": "0a0a209a-ba02-4ec8-b268-a6f3083ad169", "comment": "Malware payload (Mirai)", "value": "979e1b2756de30af1cc6cdb75e9ee48c04da91ce3c4e2d7204d65b56dad66abc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476878, "uuid": "0d4beca9-9193-4ffa-8a3e-4ffc9cb7fd4d", "comment": "Malware payload (Mirai)", "value": "3b015ce9a7b46a030904c0203258639736efddab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476878, "uuid": "764771b8-b02f-4e69-b00d-71f87cd35f99", "comment": "Malware payload (Mirai)", "value": "235215b2a5109a0d3063d2b12537757ad2719a012505ec83b7e04cdfedc468c7702ab4ccb69d17008140c95948223ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476878, "uuid": "62c9325b-6c11-4397-97db-9f0812cc5fae", "value": "T1BCC30785B8829B20C6C216BBFE4F528A331357ACE3DE73139D185F6027CB55B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476878, "uuid": "1c3936a9-3be0-42f6-b4c2-83b33bf017ae", "value": "3072:r5xbtGDPW0io23zTopAhe/rVPi+eTGvlJCVam743cCPX8bhnz2:r3btGbWHo23nopA0/5i+eslJ6am7GDcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476878, "uuid": "2e081bb2-8f53-4d92-bb32-3716ab067e31", "value": 128140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476878, "uuid": "a09d89d1-5b3e-4eff-9cc6-a0be694e8099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476878, "uuid": "36ad7fe6-6352-4531-b3df-105758b85e7b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5c1506-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468525, "uuid": "52fa5463-af22-4d52-a8b9-7b2aad53d31a", "comment": "Malware payload (Mirai)", "value": "b1f2ed562a59476eba6df6e6ae1ac7f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468525, "uuid": "2d3ebb59-f58b-4a71-ad82-f639c801122c", "comment": "Malware payload (Mirai)", "value": "984b8573b2166107bb227500874a33cb9c7a7a8aaf28f369367d7e03038ea690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468525, "uuid": "86948de0-485f-4023-9f9f-0937f026b5c1", "comment": "Malware payload (Mirai)", "value": "892a20aff3cb2c2870f736877545c617b8e7cb74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468525, "uuid": "7182e6e9-7792-4d12-a119-9d672ef0e050", "comment": "Malware payload (Mirai)", "value": "77bfe851dd2ed2b7473bb1564fbbb093ef3d03e1661b9daa5254fbf8d33d505159c0e2db5bd029a478799b58883eebd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468525, "uuid": "3d46158f-ae15-439c-99ea-85a4faac4b4f", "value": "T1E3F3292F358591F0F6811B746BCBD3A76C290BBF1199A0DF6B416329B6E0B77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468525, "uuid": "ae28208a-1060-45b9-9c83-ab990458eacd", "value": "3072:Ads3Hz6Jt2A/ladCGs1Gl8gdswuj6zYx64sOGNf0gtYZp55gQUXu:A209u9mPxrYMZp5Cx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468525, "uuid": "138199bd-11a8-4d51-88dc-c2ecffd994c2", "value": 172660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468525, "uuid": "c3e3dfe5-d7b6-4e12-b783-e52218576efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468525, "uuid": "46a76535-1365-4cfc-9479-d428ed14915f", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217c73d0-df96-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766449634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449634, "uuid": "07a110f3-954e-4094-af91-82d21bfb5375", "comment": "Malware payload (HijackLoader)", "value": "ce1a1eda83dbd3d98b3b425b7fc48714", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449634, "uuid": "adbb3dc3-46dc-450f-80e0-cd7165536f8a", "comment": "Malware payload (HijackLoader)", "value": "987765aa8da3a5f4ed465cca83080bbe1213f3c5bd4db631edc5db635fb2085b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449634, "uuid": "77d68826-b8ef-41dd-9d5b-2f1736cef575", "comment": "Malware payload (HijackLoader)", "value": "11f6285660d15f7d37e5fa36f07c21b1a3f8d075", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449634, "uuid": "2a073d88-68e0-4321-b266-8a39bd0ddfc4", "comment": "Malware payload (HijackLoader)", "value": "d997eaab3c50f980cac05986d13e3b0e00ea34742e2ee921f3556b5f14874274ce03fa882152b4cc612a130053cf07f6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449634, "uuid": "1b382f4a-d00b-49da-88c9-90fdc5d89325", "value": "T14A86233291945036E6F20673BC98A2306E7CF2181B54CD69E6ECDD5E2EA908277F7347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449634, "uuid": "67039004-ba4e-485e-aeec-1b8435a84f55", "value": "f71c71e4b409d2cc3e7e8b0ac4b8385a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449634, "uuid": "9e9cff7e-1d36-4616-b74f-3a93f9cbfadb", "value": "196608:6iBk73PvDvExmmqBJ1rMsmOO4DJCphGv3OwiN/+OpW06rOpR:6iBknmCJ1r5u41C8eN/Jpf6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449634, "uuid": "ea7118bb-fdf2-4504-bd5e-acbba268a9f3", "value": 7981998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449634, "uuid": "9fe79606-276b-4502-ac6a-b36e99567004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449634, "uuid": "f93e1905-e0b7-4dea-8c90-666d4e00b0bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abcf261-dfee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487526, "uuid": "b957f219-078f-40f9-a3cb-9e5dd9e939a7", "comment": "Malware payload", "value": "a283c482233fff9144484fdc07eb68f0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487526, "uuid": "4d42fcb1-cd39-40b5-a9e9-cc1b6491499b", "comment": "Malware payload", "value": "997176a7d2a65627a3c4f5f3ba4ce1d7db456342a8a213b830c862f1284b00a1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487526, "uuid": "9c392b5b-5ad2-4604-9193-30aadb550012", "comment": "Malware payload", "value": "9e657102dc9cd75c6595c4a8739266af032d6db6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487526, "uuid": "d873c2c5-f56c-4211-91b5-0c6310222d7e", "comment": "Malware payload", "value": "04822186b9dfcfa2a3556cea51239045804caa3117429a9e5714e6ac4b8c6b73d27f9b26c6dd961ea7eb6c6641d80cad", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487526, "uuid": "4247f3c0-6ad0-4b13-9f50-56e388e8cf25", "value": "T116D0A7D06510386E0D97CE5142BEEF6C1C6B483D13256B49377C816528D7456C11F091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487526, "uuid": "091af716-a23d-498f-aae0-ed5270c3655b", "value": "6:hbmRI98SktxsEwetmfj3mjMefhO/8SktxsEZ:NsI981vwomqjMD/81vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487526, "uuid": "79de16f2-002c-463c-b059-fd1714e2d2f7", "value": 226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487526, "uuid": "a693a629-68d0-4410-945a-ec1d117de9f5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487526, "uuid": "ebd95275-f73a-4a0b-a50b-3127395847c7", "value": "RealtekAudioSyncHelper.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda3b00f-e04e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766529031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529031, "uuid": "11ac34ac-61fe-411c-ad4f-24a867404976", "comment": "Malware payload", "value": "69d4806f75f739ac7c5d778b9000e97b", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529031, "uuid": "075b7103-08bc-4995-bbc6-6e3707fb4f68", "comment": "Malware payload", "value": "9a13e42373f5320119df955894ee62956869b94ba502a3dee4ad9f6a342a6da6", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529031, "uuid": "f1473936-a0df-446a-8407-705275f907b4", "comment": "Malware payload", "value": "24f4d6dd16886125c6a39c198b058fe1a515d571", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529031, "uuid": "b843a38c-0155-4921-b6ba-165e6715dd41", "comment": "Malware payload", "value": "079c9f6c62664d89abed2126061c5ed9e22b35984977c7f587db7a19d138ab3ef2504960327ecf522200a99104997402", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529031, "uuid": "adbb3ba6-2dea-4c8a-a8ed-169e6f1a8ea9", "value": "T128E712022339C8D7E1FD097368ADB05BA1FDA8CA378E352205584E5E73D79CC68606DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529031, "uuid": "cb3ebad8-42fd-4366-9870-7d12b300ce3b", "value": "786432:TJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJf:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766529031, "uuid": "e242dfb9-5d0b-4749-a343-e14f54d9b3e0", "value": 67129600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766529031, "uuid": "9f2c04d0-35ee-4efc-a25a-f477e3bef1ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529031, "uuid": "d7b28039-3516-447d-b656-5dca10981738", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce7398d-e016-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766504763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504763, "uuid": "191ec9cb-0a17-40c8-955f-0c047fa657cf", "comment": "Malware payload (AsyncRAT)", "value": "6b15e3aeade276291d73b09e9c37dcc2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504763, "uuid": "60a37500-d922-4a94-9447-be5cb5274a62", "comment": "Malware payload (AsyncRAT)", "value": "9add4b744ba1937057ff7b5a0e2b1e86e4a4cfff53faa012bd0f49d22dfdff7b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504763, "uuid": "1b3e17af-0269-4672-80cc-0ad8557d854d", "comment": "Malware payload (AsyncRAT)", "value": "554b47e6504255157ebf909caa935fdf0c3e51ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504763, "uuid": "105d67f5-d0ed-4a35-a59e-61a6f418fc3e", "comment": "Malware payload (AsyncRAT)", "value": "e253787a8d51b464d24ebf3a29a28874d4f3c93833ee7393230c9f1affc4367432f9b39fc4b4f0ec69cdfc2e5f3a0f57", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504763, "uuid": "8d768051-54b5-4f10-9f19-e7ce29e194cd", "value": "T1E5E3E8033317C459E63D4F706D9A4D6019B44EBF9404CA9E3CCC76DBAAF9760281A3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504763, "uuid": "402ee4b3-7557-4173-b762-14d5717cfba8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504763, "uuid": "5a2c6415-9fd8-4c2c-980d-9b193cc58b08", "value": "1536:D+C5Xzpd7DM2RGbb1wQj/71GBAbYw1L0HmDQnv7IUVclN:DfzL7gCGbb1F/oAbYwCHmDQnv7IGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766504763, "uuid": "a1e4fd70-3f36-4042-a90b-1df9319d4a13", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766504763, "uuid": "0ed2c92a-8602-49bf-ba1e-ee11647c7d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504763, "uuid": "3f6d89b1-8e6a-44ef-a74e-dac6bb4ec3ed", "value": "unikay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debad907-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478728, "uuid": "3d141caf-5690-4659-8c96-d855a4ff2698", "comment": "Malware payload", "value": "8f129a425aeed55336b1a410528c203b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478728, "uuid": "c6641758-66ad-45f7-9a2e-464a50e95271", "comment": "Malware payload", "value": "9b2fab5ecaba54abe8d4742b511a69df8bfdd949c2e1eb241b102015c9a87ffd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478728, "uuid": "9cae169b-381f-4db1-b221-de3a9fd3e587", "comment": "Malware payload", "value": "1b99165b262367330072293ff51122012fa74a93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478728, "uuid": "0f27925b-2063-4548-b447-3c349c027a52", "comment": "Malware payload", "value": "6620e153e6816397997859cc60e62bd8637d80f63a4e24ab727a0fbcd81bed0ebc0194eae45c5019df188d05d62a5dd0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478728, "uuid": "26d3f914-5939-41d8-ad7a-4330f4500ecb", "value": "T1F7631A1D34C8601E11DFD0B7E588103F4A8F3A4BCA543E6C9025E9077379B5AD9EB759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478728, "uuid": "33aa3494-49cf-48de-83c8-bbd29bc98658", "value": "1536:I9l/AoSSMUIvRIveIvMIvBIvdIvlIvSIvgIvTIvYIvgIvzIvIIv/IvJIv5IvtIvB:I9l/5MVqLd62OfBApBg5MSimX4jeNGRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478728, "uuid": "f613952b-82b5-4bb5-9d22-34e61871a62b", "value": 71613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478728, "uuid": "b6356c42-5906-4c50-8502-71a321ff7942", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478728, "uuid": "5d5d97a3-2220-435b-8721-8fd074a4d868", "value": "invoice-1645080830.pdf (84).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02aefcbc-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524315, "uuid": "51fdcf0c-d335-4d65-a959-e84d0ffc3976", "comment": "Malware payload (Mirai)", "value": "62e39c5bcc8cfc7ced7901b4cda08dd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524315, "uuid": "c79e99da-07a1-489c-a5f4-e8f9b942cb0d", "comment": "Malware payload (Mirai)", "value": "9b33472b208e73866442847d62d4e6d66b2c2a8e67c09590c77091a25b33f13a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524315, "uuid": "d28dc45f-bbf3-4e80-8200-1f9802a65a5a", "comment": "Malware payload (Mirai)", "value": "60922d9010d49e42b3e6d1ac4e8102e8902c2dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524315, "uuid": "60c5cb99-153f-4765-bea9-a7c01cecc11c", "comment": "Malware payload (Mirai)", "value": "13c003f92f7fe129483f7a5ea044384f7727afb1bfcc1505fe444650134250ec1e01f1a6a0107ad1319b3652da4933e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524315, "uuid": "a573018b-7be2-4349-8afb-198d6011addd", "value": "T15E74F8113B47EC6FFD6A43B40AF78A7477DC65A22561889AE26EBF4D1F310D10D08AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524315, "uuid": "185d9d82-e6e8-4346-b5ca-9c6639621668", "value": "3072:C9Q3Rf4V+JKBLCwvanDIryZTl/BDftnpj1PR2bm47Y7+4T/sgqT9AtYPVpRHyGEQ:H4V+JKBLcnDImiSfhe5VpHEex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524315, "uuid": "9d3f9105-4ac8-49ad-94af-461bcbeb7415", "value": 342256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524315, "uuid": "2aa222b7-1b61-4e16-9377-b929c276d335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524315, "uuid": "83fd29f6-cc41-4ccc-a568-705f0f9b84d9", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e52665b-e03c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766521087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521087, "uuid": "5dd96510-9c53-4bc4-b6f7-1042a5847b79", "comment": "Malware payload", "value": "33f482a4c816ea4833c18bf6f8f7495b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521087, "uuid": "3fa7e380-8f5a-42fa-be79-350972b7e67c", "comment": "Malware payload", "value": "9c4d4a05173b627d2e5ed987d5a00684a5b8b74707e078eb3b9e5b4cdeae4148", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521087, "uuid": "8a51b6d0-0497-467e-ba13-d2ec2d0b1f55", "comment": "Malware payload", "value": "11322a4c2c2a8a61222f1bff48e2be546de2dcbe", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521087, "uuid": "dbd73da7-727a-439e-ab50-8ddebb578135", "comment": "Malware payload", "value": "4f1841daacf9b5455a49bc5d1025d99581e2cc01bf2c2d1bf8f2c1c253c744fee3c511623662f74c9c86cfd1907a465f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521087, "uuid": "97d62e2a-14ee-42b6-8bb0-a4d700aa93d3", "value": "T14E751246BBD82523E8B9577018B207CF6631BC652F2206AF47A5F25DEC532C9BE70349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521087, "uuid": "48a39d02-5f38-4d10-9a1e-38b37884b97a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521087, "uuid": "6de60ab6-53e0-4bc2-a5eb-0c25511d0f0f", "value": "49152:ysEuB4FpsnlLpYfDCSU7MxeM1CbVpite1IBvkzm:ECLlKyBMkbz4eIBim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766521087, "uuid": "2b6c71c9-b73f-4e93-bb43-99e50e0d5ed3", "value": 1670184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766521087, "uuid": "5b7d6d01-f955-43d2-bdc9-71486fd24012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521087, "uuid": "b9a4a05f-5846-4fb9-b9d4-ea8a98e42500", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c31807-dfed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487348, "uuid": "0c91306a-598f-4308-ab69-44925ad51624", "comment": "Malware payload", "value": "65f2a72ea0489f8bd230c65538343f40", "object_relation": "md5", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487348, "uuid": "0f2d5d87-1426-43c2-9264-3c80a3c6a26e", "comment": "Malware payload", "value": "9c5c779cf6458216f4ef3ba9ca082b1482b9f1b04ec803123de1e79b30fb3e9d", "object_relation": "sha256", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487348, "uuid": "5abfa176-ab78-4869-80f4-656f12a29b6c", "comment": "Malware payload", "value": "51dd70a085e3c5362124562b9b0c7c0a075f1b95", "object_relation": "sha1", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487348, "uuid": "8dbed7f8-3ef9-4c04-be96-5d0f9fff1e2a", "comment": "Malware payload", "value": "30926d646a8fc0aebf8e7e4a5ad088efa8e893ca93fa2c0532606237e2de8361cb0066603c8c9f980e58fba533a7ecda", "object_relation": "sha3-384", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487348, "uuid": "38c326ae-e040-4ee5-b42a-7e6c8de2799e", "value": "T1253533A36B832B60D6FCCBF6CDDF28C526D060875AF579493FAC218A5CA6410977D348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487348, "uuid": "41358075-5bd7-44be-821d-44fad118b00c", "value": "12288:75f+oMfespqRq27sXC4SNhNjdCSBUPn2Y9mH1kStBW2H6vWB92N4+YjOR38GPUE2:7LKpmq2pM2tVkiEuxU++LN2oJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487348, "uuid": "08d96265-d3f8-4604-a048-9f5872c6c9f1", "value": 1128204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487348, "uuid": "51d3023b-4603-4d72-aeb3-1cb568df8a21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487348, "uuid": "7029dadd-3570-4721-8983-7830d73c5ab3", "value": "Cover.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf49945-dff9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766492279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492279, "uuid": "fafd0130-0b9e-4682-bd23-03bda8f8244c", "comment": "Malware payload (Mirai)", "value": "a374981857ffa15cf7668e387f3e7043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492279, "uuid": "21d542f5-b67c-45ea-9cc0-3e9d9cf958f3", "comment": "Malware payload (Mirai)", "value": "9db2cdc377de44600f2bd4ea70114ef56ca00c876e0577899288782fd8b11fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492279, "uuid": "0d1788a0-42b0-4e75-9d72-6ebad013518b", "comment": "Malware payload (Mirai)", "value": "5a0549ee831cccb6298e15b57bbc1f3bf2a89da9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492279, "uuid": "0dfc1fdf-9ad4-43da-91d2-c97b5eed16ec", "comment": "Malware payload (Mirai)", "value": "f5390cbc3c4a2a3f2a5626455c0c0506f4b38d1fa2736f412df459875b412bf1780517718a5ab9a7f4b4bf53a07e36b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492279, "uuid": "3f30ae69-ee37-459b-b8a7-d5944b455fff", "value": "T14D435B77D11F8880C35846B47816CFFA6753B34859662FFEAA998A188003ED8F9457FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492279, "uuid": "46878eb2-ec58-4dfd-bde5-b908ef79255b", "value": "1536:2bfmecCQsZAWUb+yVxIQoM9IEHH4NpCZs:neS+LUbvv91HYNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492279, "uuid": "3ccb2942-cb57-4dc3-9b35-a86c50f95519", "value": 59868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492279, "uuid": "89ff2af2-d6ef-44e8-b626-18bf39a8154d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492279, "uuid": "ce1d2678-c07f-40ba-9c1a-90bb2ac2951d", "value": "shadow.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fe7bc3-e02b-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766513722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513722, "uuid": "50ae0093-1544-44ba-8e8e-120fe2dcf318", "comment": "Malware payload (ValleyRAT)", "value": "14fdaebcdca24aa7140ddf66e0fcb67c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513722, "uuid": "507eed6e-aacc-4821-83f2-bcb8c556c84e", "comment": "Malware payload (ValleyRAT)", "value": "9ed07094af649eb6fc760be4ebb05cf5fbaf8b36762a6bd85c10ccb03ef9a1b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513722, "uuid": "bf3a4d84-3a78-466a-a95c-c7cb7d885885", "comment": "Malware payload (ValleyRAT)", "value": "a419c841c71c07518b8fd767b144d8b0fc7eb9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513722, "uuid": "abb69a67-cc62-43e2-9095-244227b9a4d7", "comment": "Malware payload (ValleyRAT)", "value": "1757902d69842932c1a3947b08a8b93875082eee5f24d7462eedf5fe80cb5333d1ac52bf24c984ba6d83a3a876218497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513722, "uuid": "757ed9e2-04fb-4ac5-b60f-5c6a59d80006", "value": "T10405AD1335C9BCB1E4B211356B7A4BE5CB2DEC200B22C9CF53D4259A9A386C37A317D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513722, "uuid": "3909c976-2371-40a3-9160-d71b3446cada", "value": "21e92f5a5c455f5b897bdcf7710f239f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513722, "uuid": "552659bb-a992-42e4-82a5-fdd70dc5cc87", "value": "24576:pNfwHXWNNOJiHDVjh1JOfldcw8B9RO7zn:A3WNEJo/Oflx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766513722, "uuid": "2855a6a8-6d7e-4b0a-8a92-fd2d7991dcdf", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766513722, "uuid": "f9cbdf2b-f0e0-4d26-bc1b-7754df641452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513722, "uuid": "dfa0a5fa-79e8-4cdf-b971-de5f7a46e40d", "value": "14fdaebcdca24aa7140ddf66e0fcb67c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2cc9a9-e016-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766504948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504948, "uuid": "a19c81fb-e9dd-4894-8708-eb08a5e70c4f", "comment": "Malware payload", "value": "5e902ea6bb94e03c5cb5553f8dc26b8a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504948, "uuid": "8d0ccf2d-545e-4f7a-9410-def7a1c3a80b", "comment": "Malware payload", "value": "9fea08d091cd23d5c6af51fe09b1f26640aecc81c465e07e492279bf4b49b8f8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504948, "uuid": "d18d4e23-f96f-4ec4-a79f-cebfa3f51de6", "comment": "Malware payload", "value": "d774d692a7870e6ab85deac19616145d3e2b9a0d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504948, "uuid": "d7f41e6e-c8be-4530-b48d-5ab9746ca4a3", "comment": "Malware payload", "value": "ff260f983923f59dcbf73b515c1c06d1b2b1f4f1eb196fc02f566337aa76c1a7c47c4ea291874a4df5346bd741d5ac38", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504948, "uuid": "e3d3c1a0-6e44-42b3-b5cf-1f8bb239197c", "value": "T162B47B13FD80443AD9B90FBE493AB7615B3CAD245A30855B63C4751DEEF52C02A72BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504948, "uuid": "1ef91537-d675-416e-ba2c-8033e40ad5c9", "value": "6144:n/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0Vkaxih5p2rrY+M:n+8jOZy2KsGU6a4Ks41x5VkgigM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766504948, "uuid": "c20fcde6-ae5b-4d3f-b87e-15abbef0e536", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766504948, "uuid": "3a445b50-565c-4535-a7e5-7089b61d68eb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504948, "uuid": "ea115985-2ada-4642-a313-5779b01132fc", "value": "9c9934959b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcdcc12-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525116, "uuid": "6d26ac72-eae0-4ba4-bad9-ddef957979c9", "comment": "Malware payload (Mirai)", "value": "09cfc5aaf2a8aa4a4720bdd18ee439c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525116, "uuid": "8b109f1b-f7e5-4211-9afe-6916a4a62dd7", "comment": "Malware payload (Mirai)", "value": "a0033362afdd586c398da1a294760af7d9785b9e6b09cb7566e91dc76172ea34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525116, "uuid": "9326ad93-5ece-41ef-9152-dd089c6a35d2", "comment": "Malware payload (Mirai)", "value": "cf603c1d657579128697a846068b5fadee172349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525116, "uuid": "da30d7c0-9186-4e7a-a3d2-75794b845f56", "comment": "Malware payload (Mirai)", "value": "9bef073ef7c8cc478ca5584823c2bb1c810b5a18960c3dbe66c9bf3dbe5fda6ba1e15b6307c040c06ad1ce0d2a19b327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525116, "uuid": "a9356e8a-cbd4-414e-b417-5ea5e66bbe41", "value": "T169A31749FD815F11D8C922BAFA1E018D335357BCE3EE72129D116F21A3CAA2F0E76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525116, "uuid": "c86581d6-6ec7-4a5f-a948-608e98975731", "value": "3072:gOWOHCxKxYJ0q6cGazq+PZRr1JkomNZ2J7RwbZnY:gObHCxIYJ0kGazq+PZR5J+N8JVwRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525116, "uuid": "ce7154ef-e086-45f1-86d6-5adc6025961a", "value": 104252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525116, "uuid": "c4c2e024-909e-447b-8bf8-0b58e49a78e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525116, "uuid": "109db867-452d-4e6f-ad4b-e77ce247d0ff", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af76304f-dff9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766492393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492393, "uuid": "43a0e24f-8c29-4843-b626-e9f1bec6f39e", "comment": "Malware payload", "value": "9d0d3d6ba929e1697fc060e81f689058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492393, "uuid": "c626a787-9354-4e3f-8cc0-f17a08f79504", "comment": "Malware payload", "value": "a07d5fce549962948f19155a8f6f6f39a6fef36fec8137228f6550f798cad86b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492393, "uuid": "0eabc1e9-118c-414a-b537-c7b5d35db9c7", "comment": "Malware payload", "value": "01ed90ac88222a351646cbc47ffb630bd647c9d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492393, "uuid": "0e633c67-989a-4b63-8d72-825c563898a4", "comment": "Malware payload", "value": "b1da4e72aa9a8f2babd5b08bfb6fc92429c3c941b986b86eaafb448966f804615c070953384f689f0945974009ccfd87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492393, "uuid": "b4cfc30c-7024-4456-8f06-f1f1a8bebb0b", "value": "T19B6533E03BE57C30C38F38F8141ADA38214DDD69559918ED9C7EBFC0A3769E98D8815A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492393, "uuid": "ed38b04a-928f-4993-8243-d9a560c711aa", "value": "54a3f0f7b79a63b4c09ff8196194ea9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492393, "uuid": "8e5df74b-c652-4391-85f2-523c98e5ff1a", "value": "24576:Bx1QNu5vtAuOeuzx1p0ThJtoBK4HhO7nv0fcsxNv4aiIApv5iwfx+LUotT:B6O1AuLuHi+nychxNv4aiIAR5i6+Ljt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492393, "uuid": "a10e0364-2c3c-4863-8e3a-ba6a4aee6782", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492393, "uuid": "f97b1a36-fe3c-4e02-be3d-2cd7ec19ae49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492393, "uuid": "270aa0ef-f340-4d66-beb9-951810e858a7", "value": "PANEL PREMIUM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec148b5-e03b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766520685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520685, "uuid": "e87d63fe-4d87-4896-b91c-ebb80330782d", "comment": "Malware payload", "value": "254dddfe14db6d301cc8ded2287851ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520685, "uuid": "164f3b7d-d894-45ac-b3dc-2e46d6662917", "comment": "Malware payload", "value": "a10eadd55f9de9cffc409fe65645663496240d8fcc85a2acf802f0eeecc35d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520685, "uuid": "0c7cf7b4-7342-4e80-8e7d-bde3a6ffd889", "comment": "Malware payload", "value": "c21605c09f87b0e00607c15195fb5eb93ffbe5c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520685, "uuid": "b299d10d-f6f7-43e5-bf4e-2d55f15d1251", "comment": "Malware payload", "value": "643f3ee22059d1bdcfd03d4fab72fe766f7c03d3d19a3c135bd25e4a9d83f22486c989dacd785a2eaeecfcc156561b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520685, "uuid": "31155173-dc2f-41dd-8d6b-d546cc4ee666", "value": "T1298733AA7290498ACA984779C1638796DC9278325381C5CFEBFCD2967C676F4183FF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520685, "uuid": "d73a80ee-5821-4257-942d-93d01d0475f8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520685, "uuid": "d4ffb875-9154-4861-b12b-fb66479e7f15", "value": "786432:V5vzxmhlyaxsofFlUR1OOrLF1Zdlqsvb0yLLsKMMo5ovsVuRRnNsETP5hAo:V9zxmhlJREWeLFbqsvbIoeORnuETbAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766520685, "uuid": "1e919fb0-82cf-4e03-aca0-a093e0b49716", "value": 36831499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766520685, "uuid": "3100897c-11fc-46b4-b299-88adc5fc75b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520685, "uuid": "36da49ec-6a9e-4c3c-97bf-f21b932e681d", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df6ac8b-e025-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766511154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511154, "uuid": "cf4df39e-60e0-4a86-8193-1bef54e91bec", "comment": "Malware payload", "value": "f78e1e54fd83c1e2c4f1dd3c8c16b0c6", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511154, "uuid": "2f113f5c-f7ce-4714-971d-039e0570f6d8", "comment": "Malware payload", "value": "a146b14df5e049038b47a5cfa30bbc120aae3fa85da0cae414dff3eea1375e04", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511154, "uuid": "eda565ec-4ec5-44f6-acdd-9f0636b518bc", "comment": "Malware payload", "value": "f5aef6aa160c8aa833e3df369a4abc14b586b0e4", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511154, "uuid": "cb72464a-b9b0-40cb-a5f9-4cc39df70760", "comment": "Malware payload", "value": "bb230afdfb8193e78f06946fb8277699f88759ba486f54dfe692b505beb1068c86cadacde66580e491fc52fe64216ab7", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511154, "uuid": "ad44b3d2-cb4d-4f1d-891c-8fb181275fc8", "value": "T1F4C6D04FF3EA1478D4AAC27649769155E9F338206721BEDB45A0C478EF239E42E3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511154, "uuid": "a71d4880-93cf-4940-a4cf-9828eb9e5233", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511154, "uuid": "709a3840-cc23-40c3-b0da-89269ed40ccc", "value": "98304:9wzEqmHzGNZCoKMScL8aYobfNK9wbOwxA/05F7hbHWnY:dqmHzG772aYoDPbOw2CNB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511154, "uuid": "843c2a10-8c2c-4a04-9644-8187da222dda", "value": 11534336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511154, "uuid": "a6359e7e-ad73-46cc-8f0b-7aa029c6cffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511154, "uuid": "748a2960-f71e-437a-8798-125fa483ec3f", "value": "IDMAN6~1.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c992c3-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478871, "uuid": "4908f7aa-18e2-4eed-aa93-e4a150bf1238", "comment": "Malware payload", "value": "30374d2e4d462028cf83f119c47f789c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478871, "uuid": "56a38679-f02d-4baf-961f-40601537b72f", "comment": "Malware payload", "value": "a2769cdfed7e29166c43c402f3d1e85fa341e76dce8d0f5faa1399f78b00e92c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478871, "uuid": "386c97e7-fdc1-4014-9aa8-80fd2b9a38f5", "comment": "Malware payload", "value": "35f2401037d5a6d8fdcfb3e65bcfe9c2f3cd6fe2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478871, "uuid": "01d14e55-45a9-42af-92a6-f5c2373be4ce", "comment": "Malware payload", "value": "ab60a9fde22ce56e68c3fbec4041aa1eff6fe8c608546b1b1051e3eaf05b240d8394afdd6de2f1367879765b2031d948", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478871, "uuid": "a9813d1e-f1d6-4974-bc74-7f087c5558a6", "value": "T18973E77C4974B2AAEAF364CC0F1751450939A7D16106A83EC4BAAE410936F17FB8BB47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478871, "uuid": "02a3deba-8fc2-40cf-b6d4-7a65c2bf22d6", "value": "768:I8w/h62/jWs6oS+xISN0vSV2V2V0VQVDqVJqVCVJVQV1V3VAVdVrVrVoVfVZVlVW:I9l/AoSSMvyusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478871, "uuid": "60153306-3592-4994-b6a6-4cf307fe2b9c", "value": 73501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478871, "uuid": "45bffec0-3dfc-4267-9f7d-e696f82ba6d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478871, "uuid": "4c595fd1-5cfc-44d1-92d2-0c5a8c4f60ec", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad5adf5-dfc7-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1766470937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470937, "uuid": "c37b342e-2a5e-469c-89b9-a106ef92370d", "comment": "Malware payload (RondoDox)", "value": "3d949e9cf717649e45cdacbb8c980561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470937, "uuid": "bbe37ee8-7f39-49d6-ad7b-4248de43dd48", "comment": "Malware payload (RondoDox)", "value": "a2aa4c7a0e4e2b8a29882e7f49b78fdcbab259fe0483ba4c7592026a78849b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470937, "uuid": "d598ceec-c6d2-4f06-be27-35f6b0ba4324", "comment": "Malware payload (RondoDox)", "value": "81ba572385c6f3cfad018963426a2554b992de1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766470937, "uuid": "540e950b-831b-4dae-9baf-f72627d2b6ad", "comment": "Malware payload (RondoDox)", "value": "8e67a6728bcbabeab842bd5775d0a0cd30bd2fc4828ed9a5402afffe6f95e3a20af47bd3d3802ed4ef7315d54397cfb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766470937, "uuid": "56999790-e9c0-4dd2-affb-243253d55c6c", "value": "T121D32A5AEC819F61D8D526BBFA5E8189335347BCD3EF31128E240F2527CA92B0E7B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766470937, "uuid": "b7539858-220d-4119-9459-28765c37e1cf", "value": "3072:dy1E4GGsmg8ktQByROd2aGHR0jWb8mIlzN7dg3faOKk:o1E4GGsmg83Bmo2a8R0jW9Ilzjgvaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766470937, "uuid": "9482d9e8-9cdc-4f71-a74b-da81462523af", "value": 141532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766470937, "uuid": "96cbb529-54b2-48b0-86d3-dbdfdeea1310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766470937, "uuid": "5e73d10c-b183-47a4-b393-5244223833c6", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0017feae-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478784, "uuid": "ea8c8125-0fdc-4c7e-94ed-b82fa6b33478", "comment": "Malware payload", "value": "ec8e2e866d5fb87a8497382e66ab71e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478784, "uuid": "a31a6685-b8c4-4810-afff-62788460c9a8", "comment": "Malware payload", "value": "a2bf65310a8810672b5703af91a461e33bda2f9c134e50b31587b2f7c6ec287e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478784, "uuid": "286ded27-493a-4e3a-8e29-5dc5e295ba0f", "comment": "Malware payload", "value": "704389789ba1795801d967fa4c1b1aa192b788ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478784, "uuid": "53732b89-2569-4cbc-a091-cc9c32a03632", "comment": "Malware payload", "value": "bc21caa571ddff6791eb1ee087e95b0ce8deb809572ece5834be308f3483fee0b4cda1656018cbca1f493528c5b1486b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478784, "uuid": "c4833af3-ce05-4af5-86e9-71cfe390f7de", "value": "T198731A60BE4C2C3A88235F2A9D0D3793EBD75D7169829307B667E9055747FB3123B8A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478784, "uuid": "fff15faf-12a9-4d7d-92d6-7a17831cb980", "value": "768:I8w/h62/jWs6oS+xISN0vy/Llty6z6dl2rsaZSv1truXs28ULRf7mE7Hw4yntnfd:I9l/AoSSMFcusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478784, "uuid": "9cffc235-dccd-4c29-baf8-7c0decbf352f", "value": 74376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478784, "uuid": "ae5e3929-a85c-487b-b705-6c9b1984eadd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478784, "uuid": "8908fee9-48a0-496d-b962-9d6772734b41", "value": "invoice-1645080830.pdf (75).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765155f9-e05a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766533958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533958, "uuid": "615609c5-bc30-41d5-9167-52faeb5b55f4", "comment": "Malware payload", "value": "d6fa4e9b82c8a247813927fcef15cd17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533958, "uuid": "9ebec9bd-693c-4e55-9428-deae35d4ab27", "comment": "Malware payload", "value": "a2c31c27b64d295d3b2d533dac88ac40d7ba51b694fef203d0e2ae83fa81abc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533958, "uuid": "6c1bddd8-1dde-4296-a3c3-333ba1a08ea7", "comment": "Malware payload", "value": "c6cf4a110d5041e6d536787f0ccd279ef887a99c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533958, "uuid": "1c856e5e-4007-4da6-8d48-d2d200622085", "comment": "Malware payload", "value": "286c9ba41dbe300699945e9c403eb146f1827b83928eb4c692f2852251280d5918dde35183c1c7d522ed2908d6ec2a7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533958, "uuid": "ab6795f2-268f-433b-ab22-c23913ddb1c0", "value": "T1F1B36B03A58080FDC4C6D6780FAEA216D932F55C6375B64E27C47F293E5EE612F6E221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533958, "uuid": "628e3230-41e8-477d-a9aa-f91c203126ee", "value": "3072:XafIPYm0xsAjZ15KRSUtDOs3SCXaf2Y/EtkAegf:XJ7KQxDlSme7Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766533958, "uuid": "2b1eb0a5-571f-42ed-a497-07f42b374274", "value": 116872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766533958, "uuid": "59ac1177-b343-4bf6-bff9-695b12f06719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533958, "uuid": "351c8693-6618-4586-b1c8-9243042d3e1c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0eb8b6a-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479081, "uuid": "02a032b1-53ba-4abc-a6eb-d108d8e4c724", "comment": "Malware payload", "value": "089a10eb2cb9f8990488008557f9bff7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479081, "uuid": "796b6de0-3cdc-4570-b86b-1d64101ff82a", "comment": "Malware payload", "value": "a2f5a82373ace5235fb48bfb842555a0a545e146cffe4c0fc97295155c2de5cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479081, "uuid": "0313dbf7-94f5-48d4-a388-75dacc42ea28", "comment": "Malware payload", "value": "bce0faa0ceb52a8e45d0a226e4b55a724cc945cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479081, "uuid": "18babaed-ea62-49f7-8541-ec5b2b40643e", "comment": "Malware payload", "value": "fb359205d92586bb31cd73440a466ee700e13e6aa32dde7bfd32e1a0ac653a574f3698cda6ea12912c26841681709494", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479081, "uuid": "5d603593-8767-4990-a801-8f2478d0a35e", "value": "T1F76329DE5EC07DF498C828F4B75C6E74E8D87018BC920C21D9F07B784E4E6CA655A4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479081, "uuid": "6ed237a9-d64e-426f-9119-7d58ec5ac6e0", "value": "768:I8w/h62/jWs6oS+xISN0v9299N+dkfScBYrwz2y8kTAlGB:I9l/AoSSM+ousrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479081, "uuid": "6763d3d9-57cf-4651-a7c7-e538e7088c43", "value": 69664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479081, "uuid": "77570494-926d-40a1-996b-0cad46ce48bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479081, "uuid": "7bf8f0bb-1246-43fe-8d43-3b7e160855b7", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c58fe5-dff1-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766489044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489044, "uuid": "6cc04af9-fe69-4114-aaa9-a6a1d3ac6863", "comment": "Malware payload (Stealc)", "value": "907f28989957247e4cac0ab48fb9e5df", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489044, "uuid": "9935df0b-6ad2-438f-a901-706078aa0dff", "comment": "Malware payload (Stealc)", "value": "a3a0322ac654a42a0883f23b01e19a6dd6586b099d124d9421e1c81de1317cc7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489044, "uuid": "2a170f74-7eb4-4df0-988b-ddf286debc6d", "comment": "Malware payload (Stealc)", "value": "5f4eeceadb8476ba785a4b2bedfd3339af72b5ad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489044, "uuid": "cc9ee0d8-2f2d-4d71-8d95-0e06cf46ca61", "comment": "Malware payload (Stealc)", "value": "44d6e4d1588ee3cae7e62533549a5beffdb6dbcbe943419c4c55272138b625f89193a8dc2d29c7a0ac0e7cd18d163d8d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489044, "uuid": "9d0e211d-9422-422b-90f7-3386e9cee70c", "value": "T1C3F48D5AE7A502F9D0BBC178CE424553EBB2B8155770978F03E10AA61F376A06F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489044, "uuid": "401987b2-61f5-402e-a03d-c9ae2f2940a4", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489044, "uuid": "f6c6a54e-387c-4ba2-b744-f25be5079247", "value": "12288:1U8VHX4ZPBuvzkOkW7UE+YTRqwJ4xDv3YZtF15kjHKA:lVH6BuvbkW7xXVVmx73UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489044, "uuid": "ecb4551a-c7b5-4a7e-8dd7-e41c9932f5f1", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489044, "uuid": "fde36b78-eeda-4c33-bd10-02fb004740de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489044, "uuid": "ba2f7c4f-9652-42e1-8910-18680ff722e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33a1ea4-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531886, "uuid": "02e9a284-cd7b-4a81-a1a8-c0f3192eb0fa", "comment": "Malware payload (SheetRAT)", "value": "fc3e61680ecaa3329a7d24acd9e0ef89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531886, "uuid": "bf77a894-cc88-4326-9659-0b1c10b0455f", "comment": "Malware payload (SheetRAT)", "value": "a3d483f60efdf1b0fb07985c2640e69e3a30da130949ffbc0c4c8b0cc3c9f7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531886, "uuid": "8c8d4929-ec14-410d-b764-836635fbc94a", "comment": "Malware payload (SheetRAT)", "value": "b31e720a33d4a17a4b85930ee132b1747232fed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531886, "uuid": "5f7fcdf1-a9e6-40c9-86a0-2d302f1a26e6", "comment": "Malware payload (SheetRAT)", "value": "718ac19a5234ad547b1f9519c150e874460c930f10473358fb4dc1e9c1920df77f45270d6379c03c84cb48161976da27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531886, "uuid": "ae103a09-3f68-4fce-9619-609b38fb5f85", "value": "T10F94B20CFE92E805DD1E3D77CEE610144B7129C22E2192863269BFFC8B6537698E657C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531886, "uuid": "859f25e8-1594-4520-a79b-009846e2d40d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531886, "uuid": "e2b5308f-4c43-46d5-8845-df2f23ea4562", "value": "6144:1IAiXNbhTA4podxoMe6VlWT8b96j9jW6AEgs1S2H8Qba6ZTW:1bKNbhTARPoMPVle8UI6HzH8OxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531886, "uuid": "21bcc283-4fb3-4a0f-b82e-5d373c85ece3", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531886, "uuid": "3a7c3dfb-c3e2-46fd-9f70-1e4fc2dd51a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531886, "uuid": "e75f1ecd-1379-4e8f-b6d1-c5b662dec62b", "value": "msyqikwbasfl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b18f333-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478937, "uuid": "0b618e44-9fd4-474d-bacb-be7f79deb214", "comment": "Malware payload", "value": "cf4f7e666d1bc3a511d6f320efe9fb93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478937, "uuid": "1a37e944-9283-447b-ba1f-1f4fc1d165ae", "comment": "Malware payload", "value": "a41deb68201c74b1cbb5bc6746619df3486c1ca7b558073d44a47e99590cabf7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478937, "uuid": "7c6a2232-abab-4dc8-8709-ecc6df44df52", "comment": "Malware payload", "value": "03ffc5d1ae34c07318163f0efdb71fbad2436bc2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478937, "uuid": "6150b987-eca9-4635-bd02-f4c852812519", "comment": "Malware payload", "value": "f3d12779c2bd4dcd54bdfb2680407285bae11d6b0c863422996f437ea0392bac4ddc74b916dfc9786390beee0584abee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478937, "uuid": "deb49e18-f1ed-491f-b7ba-478d31d48e61", "value": "T157733C9527A33CC687E3AB51F08B04AE6DCAEADC0E1B152360649F111650B35F8F5EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478937, "uuid": "6eea3b3a-6e47-42e9-93f5-c1c4d8fed838", "value": "768:I8w/h62/jWs6oS+xISN0vZXAW0prIKZi0oTuMxBgywj7qg7Pw0V5efO+a7O+Jln0:I9l/AoSSMwvusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478937, "uuid": "5bd25d57-3e1a-477d-8f05-533bb3774c2a", "value": 73410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478937, "uuid": "7de2ccf4-a40c-47ee-9566-eede3373e315", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478937, "uuid": "e2d26b16-8855-4e9a-8656-d798deafe700", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f73e16a-dffe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766494406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494406, "uuid": "e900a5f5-42be-40a0-a309-5526940b6707", "comment": "Malware payload", "value": "5b20b7063cd86beaef9aef0bc99811ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494406, "uuid": "35a10b50-d537-4b73-b365-c4fa7ab26dbc", "comment": "Malware payload", "value": "a4505941a2503ba6dac66d3110ae0a93f278ee52fc24b77eff9e23dc6976d978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494406, "uuid": "65fa3c9c-a643-42a0-be1b-89970d876d1d", "comment": "Malware payload", "value": "48ae1dcf9306bf38b1c810b80d93a9546f4631be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494406, "uuid": "1978ef77-0747-41da-b430-78d3f09ed6bc", "comment": "Malware payload", "value": "d866a41f8b968d42ed95a06d24bb3aa5994998902c103b90d72bdf838bf8d3f02c1da75cb357c6152094fa88709d0fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494406, "uuid": "1dc27860-f7c1-40e3-b6e6-67a5293616da", "value": "T179D26D36D469D6D0C8914B749DF398790F43B149C2323DBBAFCA489A108B9B8F615BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494406, "uuid": "1b885163-0e87-4d8d-bc0f-5f2870ece2bc", "value": "768:p7xjbMagENhGs0UetJkt+LrEqsaD7HQugAyUL7t:0agENhFLMgqNw6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766494406, "uuid": "78c597b1-3657-4f28-bd59-6e0a489f2f2b", "value": 30744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766494406, "uuid": "18751e61-4d03-4418-8882-e8c12d1c0369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494406, "uuid": "d72c3d7d-c43a-451d-b8c3-f0eb7f18fb64", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ad4bc5-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479090, "uuid": "844c0c29-1df9-4b38-aa11-460e4facf46f", "comment": "Malware payload", "value": "16091ff0dbe08d9805227f4c2e77c7b1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479090, "uuid": "5b93b2c5-c625-455e-98d4-43feb12a8a82", "comment": "Malware payload", "value": "a457c94c312eca1779786c3f8b42fdf034aaf4f15c8e8f8439604c2d84f10754", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479090, "uuid": "8c32636b-b7eb-48f3-a4fd-19314dd26a0d", "comment": "Malware payload", "value": "32c071d659636d29a1adde8f203653cd973be5f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479090, "uuid": "6435d460-5531-49d7-83d5-bde4c25aada0", "comment": "Malware payload", "value": "d51b407d6b1d4281fb0258537a8509ce077c91074536195b4b5ea743c8fe2bb69d35b70d9ea28510824329c0cb9ecd59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479090, "uuid": "e0ba84a6-aac6-4aec-9165-b86f50d49395", "value": "T17B633C2066AD7DBB3C663F41494F64C0A41E163E0D8764EDA2CEF361C12E7B264936DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479090, "uuid": "86300222-f46f-476e-86a3-a58044a67217", "value": "768:I8w/h62/jWs6oS+xISN0v1FPjI1dkfScBYrwz2y8kTAlGB:I9l/AoSSMvkusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479090, "uuid": "6500481f-ef07-4444-90ee-44b664b7a271", "value": 71518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479090, "uuid": "38f32e10-9405-477e-a0d3-15b0b3d1ddc7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479090, "uuid": "85d7a1bc-543a-453d-95f2-a1ac59bb7655", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95400862-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478605, "uuid": "3d5dda88-257e-4fe9-838a-9fcaa0d9179e", "comment": "Malware payload", "value": "b3076f1e719f07d6b55f6e08e75bd8af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478605, "uuid": "217962e9-2fda-498c-8837-08b2af41d41b", "comment": "Malware payload", "value": "a594a23e8cba121c0a9b32983844c53c454ab5583a630b785352ffb35208a3e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478605, "uuid": "34d481fe-e7ab-4b32-8993-edea5aab81f7", "comment": "Malware payload", "value": "18e6ba8b2507b0252d76ffbf2ac161fb872f5fc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478605, "uuid": "85cb1b83-d7bc-4136-9693-b830e17e1517", "comment": "Malware payload", "value": "883b5f7f7bed95d4838154ddede7ca7542d0adcf46ae6d59fccb70482b281b28992c47769423460b3c2f61838dab6454", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478605, "uuid": "a7ae43a9-2f4c-47bc-a2aa-6ff8e42a4b0f", "value": "T102632B457A3A588D71F539FFE58E12ABAE858172A8792051BDFB7783DF4EC5B80010C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478605, "uuid": "d0cb2cf2-de15-482f-9841-993d01e2edf4", "value": "1536:I9l/AoSSMu+JJ+JG+JN+J5+JA+JN+JI+Jp+J3+JA+Jn+JY+Jo+JI+J8+JA+Jl+Jz:I9l/5MhaviStStOMdA5lFhleshcbqePP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478605, "uuid": "5c8a199d-9655-4ec1-beb0-7ed03cb09816", "value": 71463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478605, "uuid": "b238496d-451b-4388-ba0a-f170680fd3ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478605, "uuid": "c49d3cb8-82d3-48d0-aa9d-66c4d11535e1", "value": "invoice-1645080830.pdf (104).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aba2a4-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479062, "uuid": "f36e680f-9fa6-4f88-a780-c77f69185dca", "comment": "Malware payload", "value": "315edf1e35d40c7dece3cb0ae13c08ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479062, "uuid": "7f68e99f-5d5d-46f1-8aa8-7de6574412cb", "comment": "Malware payload", "value": "a63d754ebb35aee904dde5949f8ec361af986cda78fc2a1a8303c0704350ee68", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479062, "uuid": "acc65994-d818-4ec9-a836-747279ef6ec0", "comment": "Malware payload", "value": "48c715bd871afbe61cc1002493320ce35a0420ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479062, "uuid": "7218948e-926f-4795-96fb-4f1d420915ce", "comment": "Malware payload", "value": "02b9ea8bb67ca15a3e0e924c8814b0f6ca373e582d7d7572ff06f50e44b1480cdf5a99b836d12e4f0946c3a95a0ff67f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479062, "uuid": "2ec16cce-b78a-4434-9b98-940f7a0a76ce", "value": "T100730A86FD07B3EC0CE81B5EA66B24927C40D30D16D6A168F187B160CAD9FDE2D7D291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479062, "uuid": "781606cf-8318-4ee9-9f25-945bb5b7a19b", "value": "1536:I9l/AoSSMyzDgu5rQGNhGPmQe2EoWqjXKCeEYOcu+PCBVqG9BMsBN6Ih1v6Omb6s:I9l/5MyzDgu5rQGNhGPmQe2EoWqjXKCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479062, "uuid": "945b9ff0-5788-4ef0-9cc9-f177ca3f4602", "value": 73449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479062, "uuid": "3d21a8bf-421e-44d5-8e16-691f991307df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479062, "uuid": "625d9d8c-a249-4101-9898-1eead1f5de07", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9718607b-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479037, "uuid": "9e0261fc-032a-43d6-b0d9-68857a7c26b7", "comment": "Malware payload", "value": "b161ab308896e36deb6ded68a9aab520", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479037, "uuid": "697af8b1-733b-418d-bf7a-96c5d943eb24", "comment": "Malware payload", "value": "a6522e0b664bb99b12a4070a7e9d15e51c656c55b09549417454d7d3a686cbcf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479037, "uuid": "6b4427ab-7040-4609-9a0e-bed88edd528f", "comment": "Malware payload", "value": "93d37168348c919131f302ebfbfbaa9fed373f80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479037, "uuid": "fab76d5c-0570-4ef8-9419-d775b9b05021", "comment": "Malware payload", "value": "f74063ccc72be61a266ba66878e0af23074288811d4693478aefb5056bc1bfc41d411d10eb20aab3ff2ac423eba1a50e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479037, "uuid": "35b295ec-74fd-4972-8546-a5a82908308d", "value": "T17573F92634256C782FC9AF270EBD185D9C72CB789526027D59A76B10031EE8F4BF8C39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479037, "uuid": "a7232fd2-ab05-4695-a2f1-198652544227", "value": "1536:I9l/AoSSMBSZSLSJSRSASCS3S1SaSnS3SwSySpSlS6SVScSOSrSWSySkSqS3SMSX:I9l/5MIwOA4jJCExSCzZgURkH9u1Z/hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479037, "uuid": "40d5f481-8a82-42e8-96de-793499fe6ec0", "value": 74421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479037, "uuid": "1e19c3fe-62d6-4266-ad3d-16274254b850", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479037, "uuid": "119d31f3-01bb-4a12-873d-cecaee8989fe", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d539ba-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478931, "uuid": "68a8c4d0-1f83-4f35-b847-91647dda2367", "comment": "Malware payload", "value": "00d40756327b354d6622ab90ad13fb07", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478931, "uuid": "665d68c2-53ed-40c1-92ec-788397b58f93", "comment": "Malware payload", "value": "a6a9f3740a990e41ed8858283833e5f6a1f06da5c8417cc553d46990a2a39946", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478931, "uuid": "043b7df9-e799-4548-ad01-df5a1b3a14b5", "comment": "Malware payload", "value": "6e0aba55e100a0accd8556152298a96ba400fd83", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478931, "uuid": "901183ed-469b-4b75-8496-909f9ef19304", "comment": "Malware payload", "value": "f6499629235021facb72315129db1820a3334a80b9343364a897304f484b05cdfff49f9c6b1fdd11e2ac8b90f5a2fe74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478931, "uuid": "ff268bf9-ee61-48b9-a190-2afe23f3a9e4", "value": "T134631962BF605C2821377CAEEC6F49436854AE922907527A2E0FF7D4C5C781A67C7DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478931, "uuid": "c79f4bbb-f660-4445-9506-0baf54f6e1a8", "value": "768:I8w/h62/jWs6oS+xISN0vrpIsQywNbdkfScBYrwz2y8kTAlGB:I9l/AoSSMNIsApusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478931, "uuid": "ac09c850-6d4b-4c3a-94fa-5d2a4111ccf5", "value": 69641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478931, "uuid": "43916f6d-d1d3-44f7-ab37-b1e5ba200c4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478931, "uuid": "b3474cfb-bb4f-479a-847a-b9e187214602", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd40e61-dfd4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766476606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476606, "uuid": "eb09f9b0-b8c2-49cb-ba00-56a4aad9074d", "comment": "Malware payload", "value": "993f8ccbb93da1bd3f121c4ea24dd721", "object_relation": "md5", "Tag": [ { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476606, "uuid": "d01cbd11-60cf-4f05-80f9-c219da3fd084", "comment": "Malware payload", "value": "a79867d10cc8e2fe3f4c514905cc59f64d37273544fc45cbebf8c643968559cd", "object_relation": "sha256", "Tag": [ { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476606, "uuid": "1775defb-1ce5-4b7c-a81d-f95d49da9c41", "comment": "Malware payload", "value": "55a50cd8a4a80288bb844c4d3d7630fc72a9e3b7", "object_relation": "sha1", "Tag": [ { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476606, "uuid": "c873b5fb-af2e-4f6c-85bc-e45ffa7c2e5f", "comment": "Malware payload", "value": "7a549a28747a4268f80b67edba8aa1c7b271a7a9ce971cb557cbd2b209936238910ea05b6c592c309fdb2d71c4085cf3", "object_relation": "sha3-384", "Tag": [ { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476606, "uuid": "7698b134-ccb1-43dc-99db-9a949be06f3d", "value": "T142218B1139F025A809D3C3966A0C1ADA632D8BDE6A7C00F1E607DE2D0618091739F7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476606, "uuid": "64b6c065-6826-46fb-b7d0-fb3b6bb12b20", "value": "24:zUIV2S9ZV2KV23XQV2KV2Umh+V2kknkV2Uc5E2V2mKeV2UpmQsV2IAaV2+PMnV2c:zUIVl3VnVHVnVh0+VxPVhgVbKeVhpmQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476606, "uuid": "4090dccf-ba2c-4bf1-b164-61659ba3dcd0", "value": 1402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476606, "uuid": "b02ff704-513b-4320-aae9-71e4c60dfa6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476606, "uuid": "4063b904-25e6-4db4-95fe-37f65e7c6bfa", "value": "a79867d10cc8e2fe3f4c514905cc59f64d37273544fc45cbebf8c643968559cd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bfbc56-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478584, "uuid": "1cb2d0d6-48a0-4ec6-9cf5-ada8acc5b0bb", "comment": "Malware payload", "value": "36ce899d85059b3adfd8d83a4709d87b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478584, "uuid": "97c6b0bb-fe8b-4758-a9c9-227a5d0f60d1", "comment": "Malware payload", "value": "a88ccb0648b7227b1f4e724fab679fdee71e01d982f4e0cec38bf1ad391fd50d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478584, "uuid": "1813971e-5f9a-4836-8625-7d93338592ca", "comment": "Malware payload", "value": "9a8fa261c7c52fd631275acbaad21b9bfcfea310", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478584, "uuid": "9a529191-292d-4a58-949d-4a4692776c06", "comment": "Malware payload", "value": "8e0e7452b7082afcf234788e31014437174c7452e1c7983a6ddd7443c12dffefcb774502a5b0667b79b685c4a06adf0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478584, "uuid": "0ef851b0-ab23-4ebd-af35-4ce508138b6d", "value": "T1E4631974890AD17C992DF31D7D3B35EAB082F23C0DE51D26B1E5E5B121AEAD02BF5182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478584, "uuid": "85b72618-397d-455c-b6af-3c0abe055822", "value": "768:I8w/h62/jWs6oS+xISN0v3NeBQT2dkfScBYrwz2y8kTAlGB:I9l/AoSSM3aNusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478584, "uuid": "66546b42-e6f8-4cff-9118-eb6916f88619", "value": 72535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478584, "uuid": "b6df93cb-7790-463a-be05-360445e61767", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478584, "uuid": "fd3fe3df-8b12-49bc-9742-d045600cd064", "value": "invoice-1645080830.pdf (108).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1899693e-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1766524352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524352, "uuid": "b3b4304f-f925-46a3-b51e-136130cd9f92", "comment": "Malware payload (GoProxy)", "value": "87a2953e26aaa7346d78d950ee2e8b74", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524352, "uuid": "d55d80cc-1d17-4f42-a8e5-726796811a3c", "comment": "Malware payload (GoProxy)", "value": "a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524352, "uuid": "d728362c-23dc-4cbb-b323-f03738b9598b", "comment": "Malware payload (GoProxy)", "value": "7f6dd75ccbe45f0ed76238c47cc122cf3f1b2568", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524352, "uuid": "81acc9d4-ecd0-4bf4-92f5-a9cda3059231", "comment": "Malware payload (GoProxy)", "value": "84bb2dff9124caa0d087b68ed642cb8e173ea34549903e254fe71b8639c6d394278e66230e98194d2831a783f3479320", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524352, "uuid": "30c131e3-779c-4922-aeb4-ab5b280da82b", "value": "T1F3664A03ECA555E5C0AEE23186679152BBB17C485B3123D32BA0F7392F72BD0AE79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524352, "uuid": "a64260a5-38f5-4b23-ae8a-49b9e9b16950", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524352, "uuid": "404824d9-3738-47ba-a661-550e3b93576f", "value": "49152:KKRQ5zOAr5ltUmQCKqY8leS3WCguzUb3x5dd7k+K5mK2VyjnvVx4/9w5JxfKiK9j:KKojHpFgeUbv/jqvVxyipbDZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524352, "uuid": "cce7a14c-857f-4808-a387-6c3e729f6ad5", "value": 6588152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524352, "uuid": "90c1d4d8-9fed-47ac-b708-9466028c40a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524352, "uuid": "9a433ece-0059-4175-aeb9-281acc89136a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da30023-dfd2-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766475505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475505, "uuid": "7768ea31-e83c-41bc-96aa-630ea1b8ac93", "comment": "Malware payload (RemcosRAT)", "value": "c03dd408faf1db729a315caf22f39d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475505, "uuid": "a589a0ab-0d45-4ff5-931b-430a80681fbe", "comment": "Malware payload (RemcosRAT)", "value": "a978b6f3e70e380384597e4a52f4b7ab04af36d55c4cb95d0e354b50aa3eaf73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475505, "uuid": "4b33563b-cb41-4645-9600-55d877e20830", "comment": "Malware payload (RemcosRAT)", "value": "516ff922646667aadaa0a65d17432dbb30b0723a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766475505, "uuid": "d4c97fbe-ea2f-48fe-85b4-f80111d05b5e", "comment": "Malware payload (RemcosRAT)", "value": "daa0244244dc79a8dcff123d74c38aac28431a637fe40e51330dc12782a84c3e6eef15a016204404e1d9d2dac214364c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475505, "uuid": "ab141531-4864-452c-8d0b-6be67c25adfa", "value": "T1C195D0436F60BC6FC1226877A81EFADD0C0E3D6EBDD4964376DD6A09CB569402622DC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475505, "uuid": "5514c100-c2ea-4058-ae53-d1d3cb07f421", "value": "22e0f2a61e82a6c61d0d0a9d2d4bc338", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475505, "uuid": "b8fa683e-ff4e-4576-9794-97d0100a6541", "value": "24576:1GWkoqm9E+nw6sNdMR4fXTEJOU/XRFyfI3BURmgHGtUHqEp8ML1VZB:1EqqdM2fXTQ/XRFyfaUQ2nJhbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766475505, "uuid": "a2e0dfac-f05f-459b-9482-358a592231be", "value": 1915392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766475505, "uuid": "fe9230ee-459e-4217-be7f-355fdb1ae91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766475505, "uuid": "0dff6fc2-2479-47af-81b3-4532de65a706", "value": "REVISED PURCHASE ORDER # PEEE-AJ-GS-207-1R-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cf94b9-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457807, "uuid": "ef0b8c12-45d4-4df9-a1d7-281077421f5f", "comment": "Malware payload (Mirai)", "value": "74b01d02bc1b5a5daaedff1a9600b41e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457807, "uuid": "76a55cca-edd4-4c9e-b38b-6a8b6b180087", "comment": "Malware payload (Mirai)", "value": "a97f2be659972982b61aee906b13d8ea4e9e16a2d1284c33f8ed99d8ea41ff59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457807, "uuid": "b79bd042-32a7-4a86-8e66-6aec5f805eca", "comment": "Malware payload (Mirai)", "value": "98fe940f1dbee86bf5dd83817d0b8ebcdc095dd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457807, "uuid": "43985ca5-7cdc-4e0d-ac3f-ff641f0e4aa6", "comment": "Malware payload (Mirai)", "value": "87b5830c7292dc4f319dfe7805a486ea2358a1c35de3c9f77f33842e71ccf080c14b9e26d8b47b3789ef2851d8000e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457807, "uuid": "fdee58f9-69d4-4f38-9084-bb344f0a276b", "value": "T19C03E22ED65C6BC1C8EC26BDFD5D1B748A7CB198027F07461791C9846A7D40FBB0909A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457807, "uuid": "948e58e4-ac44-43c6-97d9-7b47de9e90e1", "value": "768:PWE/aaSMbhwtYBJaJg7aSbd6/5dNxSh6O2SVMW2F:PW96h0JgTx6/1k6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457807, "uuid": "eed9e10e-490c-4f70-9a5e-e6c55fb12389", "value": 37764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457807, "uuid": "7733aa7f-5391-43d9-9b33-ce7051de77ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457807, "uuid": "223484ef-dee5-47e8-934c-952af21772c5", "value": "ntmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c2a51d-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522866, "uuid": "23b2712f-632e-4c0e-9f76-6c5b745d8cfa", "comment": "Malware payload (Mirai)", "value": "46d03b1a153e3d97064699617ee8ebb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522866, "uuid": "0a65c7e0-c4ed-4690-8700-7de4aa165650", "comment": "Malware payload (Mirai)", "value": "a9b1f9e79de3b9f3cad71dfcde8edf81db29de8a3fe2a1789558e859b3c7c34d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522866, "uuid": "3579df9f-22f8-4c6a-ab02-fb267a32fbe4", "comment": "Malware payload (Mirai)", "value": "113c17f71bee668f5097a5435780d9b4b176ccbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522866, "uuid": "62abba5c-f25c-414c-9fd2-5055714dacdb", "comment": "Malware payload (Mirai)", "value": "68029c17e719d85cea6c05158c57f16fce3f9160749f10576af84c7f5d8ed44234076fe8a341d0dce5822ba9496806aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522866, "uuid": "d3014e70-b73d-4a4a-8479-4d14fe1b19fc", "value": "T128B2E1A151961833CB756C3FCF295089A8C297F8D54AB1730628052C3DD2EB7AAFD9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522866, "uuid": "e0bdfc8b-c2dd-4e1f-9f95-68a58230d31f", "value": "384:iKewS8Y8zBEzvdvj1cUUA6TEjcHVbng/jNqSWlYsVaJ9rbSQwLg0h7qmdGUEpiaY:88QLdCA6Y8WhUYJ9fSJLg09q3UELS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522866, "uuid": "42360e43-b070-486b-bcb9-d814f19cb738", "value": 23712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522866, "uuid": "29846f75-cd73-4122-a590-ed4639488b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522866, "uuid": "a7f195a4-7edb-402b-83cf-e74c2550af94", "value": "87sbhas6as.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcafb7d-df95-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449360, "uuid": "9a334e39-ca70-4a7d-b2f3-98c5f588e438", "comment": "Malware payload (Mirai)", "value": "ad79c014da640858319a961712f6d05a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449360, "uuid": "173d2c17-8c56-4d91-9462-6149cc4ec933", "comment": "Malware payload (Mirai)", "value": "a9de592f001cfcdee2b6c93ae52aedb5967eec5c8039acddd52c7779bfc8ec6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449360, "uuid": "d463d2de-6e1d-4118-85fb-2512280d1a47", "comment": "Malware payload (Mirai)", "value": "a32d135861e524f58b815b2d466fd30deb646fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449360, "uuid": "f75628a3-31e3-48d5-ae65-4718110dd4e7", "comment": "Malware payload (Mirai)", "value": "beaed799fa36b01a1049a79a100b021c335fce995227c8eb3d316aab41ff3dc469e313e8da762ce73aef05a99b49fd45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449360, "uuid": "0776cf1c-4449-4a6e-a1a7-1546146d36ef", "value": "T106832986B881D622C6D5667BFB5E42DC332613A8D2EF7207DD25AF14378682F0D3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449360, "uuid": "16eab7c6-b030-4f97-8a4a-76b0efbaf195", "value": "1536:6LwKjoi2P0PsX26e0G2c4AcKMSY0i6V6QgEEfMvqT2bVRw/:6LnsbOAAcKMSY+krXaqT2I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449360, "uuid": "bbfd3115-ccf5-40ba-8c0e-e9d92dd73784", "value": 84696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449360, "uuid": "be5dcf3c-97fe-48f4-8194-75c84bdde969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449360, "uuid": "9be79c21-fa79-435d-b0e4-87bc0c58e60e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc531fae-dff8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766492038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492038, "uuid": "b807af2e-f27c-437f-863c-5d852d900d52", "comment": "Malware payload (Mirai)", "value": "fce628beeb0095872824d95ec1a17326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492038, "uuid": "b2631f0d-4c2e-4eef-91d7-fb1bfaee6f02", "comment": "Malware payload (Mirai)", "value": "a9e36e6d5c7b89b86270b0ea4d1363cd83e1f8efdabd7331c76ce3e1c64a3539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492038, "uuid": "148f2101-134f-4fcf-9ea7-b8180f860994", "comment": "Malware payload (Mirai)", "value": "fe8fbcda97fc316702b66db468beab180ecadd3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492038, "uuid": "cdd7eb60-5433-4ab8-9912-891fa2a817bc", "comment": "Malware payload (Mirai)", "value": "31cf2ca8675d5bfe2240ffe5e7166db15b5e3a603d916a1f41c7eadeb45e482f8657d3a60418b200f4af7a22bad288f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492038, "uuid": "6fd0b9d3-2f0c-4166-af59-005bc53ef8fe", "value": "T1F393C559E9828A02D4D816FBBB5F119D33572768F3EE3202CD205B24778AB5B0F73A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492038, "uuid": "d9280912-1112-43bc-b3f9-d1dafc22242f", "value": "1536:aGne3Ck97cCVPv5YEuWHA17BFuwxRiX6va6gGPs5x/ZmlMyFTif8cxuo/:TkhOTWHA17B9a6gGPs5ui8sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492038, "uuid": "59d12355-2d15-442f-ba0b-4bef82800a4c", "value": 95472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492038, "uuid": "7bb8d8d4-685f-4693-8230-c59792886f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492038, "uuid": "c9216032-363d-49e2-819f-9ec5f16ca238", "value": "shadow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0861651d-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524325, "uuid": "23130606-ca06-4e0c-907c-f0f4804c9bca", "comment": "Malware payload (Mirai)", "value": "bdddf6577ba6d48f59bec18cb28be237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524325, "uuid": "d31bff5f-26a3-4640-9ac2-74acd94399bd", "comment": "Malware payload (Mirai)", "value": "aa37142589fe429705ace834827c2085903b32aa7ef7397c99d9355bbaf349c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524325, "uuid": "d708bb3d-f010-40d5-a0f3-897775de5383", "comment": "Malware payload (Mirai)", "value": "310e8c09a2d7577bc57ce75c560ef4655cbccf9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524325, "uuid": "8483eb94-ad08-4c92-a5ad-a03d62cfbef9", "comment": "Malware payload (Mirai)", "value": "526bd2fb1929d7fbfaa4b4792ceb1866748b14da3d5f9320bce1eac816d24ceb2d4a42474efb16d5757b396223fa75ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524325, "uuid": "d3566e60-ffb0-441e-833b-add72b2cbba2", "value": "T1C634C5197B280FF7E85BDD3B09E53705159C691A21AEBB35BA20D808F54B32F29E3570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524325, "uuid": "d0c305b0-8873-487e-9c10-f52099077bf7", "value": "6144:2/J8FreFNwHJii7CnlmngLH0DHL7aLZrZy/Cf:6J8FreFNwHJIM/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524325, "uuid": "2873d16e-c4f5-474f-a0c9-aba832cd3993", "value": 244620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524325, "uuid": "a539bc04-3148-46b5-879c-2efc564dd9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524325, "uuid": "8d2d68f1-b8b1-4a6a-b7fd-a48840c2cbf7", "value": "pandora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4854f41f-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511547, "uuid": "e463065b-19b5-44ee-9ea9-20d165904b53", "comment": "Malware payload (SpyNote)", "value": "dc24f07167b5e5af1d98781db25a5b68", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511547, "uuid": "f1351e90-0985-4168-8f72-91bec7dbf907", "comment": "Malware payload (SpyNote)", "value": "aa3b976475e375e92f09bf4b06db50693ad42dd7c0abfcbfd598f3e9d46f0744", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511547, "uuid": "c561a9c4-7354-47e6-b784-e8104cacc91f", "comment": "Malware payload (SpyNote)", "value": "be76888bf1a04e41e34be3ebd0233fae7323ccc9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511547, "uuid": "f493521c-8338-4732-ad99-964653cecdf7", "comment": "Malware payload (SpyNote)", "value": "22f257b715a584149ff7ef5c1294b7450c611e04094aca4be40cf8ab07d2910bd19e562d3fd8a9237ca11cb0c0d09da8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511547, "uuid": "597f4dc5-7974-4812-b684-2c67599ab612", "value": "T18FF46C86FB4AF867C9F3C6368275C66AD6064C544B47D7431985723C0ABBAD0CB89FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511547, "uuid": "eb1882ac-8cf7-4598-a290-16c8407ea32d", "value": "12288:lKpmMLa1a8LdeEzCBmBHD5WmpYshXZPbGwidNpgMnd:lKppa1a6eE6mBHD5WmD9idNpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511547, "uuid": "3b63a240-3dd8-4b28-9af3-81aab18d7c65", "value": 778643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511547, "uuid": "e7509311-09d6-41b2-93e5-0be098b02805", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511547, "uuid": "717f1a35-acfd-4dfd-9c0c-5ec8ce493560", "value": "media player.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddea00b-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510134, "uuid": "dc1bccc8-aab7-423c-966c-97af1090fa1f", "comment": "Malware payload", "value": "437818b909b8d49440b671b5ead03eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510134, "uuid": "13f2d045-f157-47e7-afbc-a1fde9d9512d", "comment": "Malware payload", "value": "aacaf35dc2a32607acd739bb040705501f4dc99f19537b9e76b8323d05b968d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510134, "uuid": "081ace02-ce33-4f72-89d4-018a3d3a967f", "comment": "Malware payload", "value": "1b84ac6889b918f38abb123989da42f31ac49f2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510134, "uuid": "1b19f424-e4c3-4fc0-bfde-f3e17d6f8365", "comment": "Malware payload", "value": "7d9608e8cd96a21664f32e675db52556d5095fa8a371d87fceebc0b87255b4822492355c789669a0dd6573ce00cf809e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510134, "uuid": "20c42afd-7c56-4dd9-b9eb-ccf7bd8b777d", "value": "T197247BE076D45D8AFA14237D85D7D222273CFAE1D7538B034A3076365A23EC23DC266A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510134, "uuid": "1313842a-70d9-4d3c-b3b1-8f7e03d2bd62", "value": "5558e9832ca091fcda6332f62a0990fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510134, "uuid": "f943efc5-68d9-4233-9d1f-2a01cc96a91f", "value": "3072:/OaatjOGaAud3mUnPZ/rq3R4nfo/833YUi9f+xxduzbVG0Fi8:maatjLaFRRrq36wMIf92FuA0Fi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510134, "uuid": "1f221af2-8d15-4df1-8be6-91375f5dada8", "value": 216062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510134, "uuid": "292a0447-2d5c-47ce-b21e-b032e409c66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510134, "uuid": "046a1027-3d02-4640-bb55-358c8f672019", "value": "raw_cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec746264-df93-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766448686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448686, "uuid": "06320767-3290-40e6-b1c7-7fe68bf300dc", "comment": "Malware payload (Formbook)", "value": "406823b0c7f54417216f7d8562d837c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448686, "uuid": "3d916bd3-d80e-456f-8456-f9eef8844a8a", "comment": "Malware payload (Formbook)", "value": "ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448686, "uuid": "221e22fa-148e-4d08-8370-057ec9b220f4", "comment": "Malware payload (Formbook)", "value": "3181195ea45b7e8ecdd7c2d7346b004220dbe72a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448686, "uuid": "ad8b1b5d-0783-44f6-a48a-89c50c282ab8", "comment": "Malware payload (Formbook)", "value": "348428b821ce9ad8aaecff078a72265fdac6d90612ce189e9c15302248038091efa2ad64c1c8fb58f96bdc4b82a453ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448686, "uuid": "e7301b98-8603-42b2-a75b-425cc668abdd", "value": "T1EE1512D12E25DB05DCBE07746924CD3863B91E68B420F5E75ED93FCB36A67419A08F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448686, "uuid": "5d88c8d9-1ed4-4ed1-bfd4-2d1dfb66de6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448686, "uuid": "97823f65-b524-4153-a00a-754b5a6f8247", "value": "24576:X1kn2F0efa03y3/tyOXCJy6kkk1GFCMkM1:XmCDiMOyJyln1GFCMkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448686, "uuid": "941c6b63-9525-4686-899a-94361c1b3807", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448686, "uuid": "4ac4caad-10fe-451a-b97f-fd05dc58a5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448686, "uuid": "6059b062-38c3-4068-908f-f218b5ea81b4", "value": "Invoice & Packing List For GC E022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584b3393-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511574, "uuid": "0c427a48-10ea-4786-b45e-88923d9389d5", "comment": "Malware payload (SpyNote)", "value": "cc0bf7a8aa834f568668060cd78240ef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511574, "uuid": "f109b9c9-6b93-4098-a555-dc3aa0be2603", "comment": "Malware payload (SpyNote)", "value": "acf2d29c8c65ee2fe57445e672fbee01fa240b0039b66ea507f110468c6c8210", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511574, "uuid": "937efaeb-4c8a-4589-a4ab-b170307dddda", "comment": "Malware payload (SpyNote)", "value": "188702b283eea0d48fc4f31cd6ff92d7f1e565b7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511574, "uuid": "429e6cc6-8df9-4f65-9270-774fd215b9c6", "comment": "Malware payload (SpyNote)", "value": "f6af9a20da1e931c4185dca46c2eb464d0477e0668a657752f345b0c39f2ff3ccc4031062d8a8102e3afb34b485744ed", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511574, "uuid": "6291c002-c97e-457c-8c0c-20c981834d93", "value": "T1BE260103FB46D69BD8AAC3F66F630D692E130F14C643AAD705253A6E2E771D10DC5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511574, "uuid": "a24da6cf-ef4f-4321-90de-2305439251bb", "value": "98304:rh3nl+39I6CP6giA6hn1P+7s1WmzVzBFT50tYXeEqYJ:rJnlUSFVG272hztWcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511574, "uuid": "23c860c2-2587-4f69-86ff-801940e55907", "value": 4754901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511574, "uuid": "b01ace23-fa33-439e-a912-ee0f855bba31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511574, "uuid": "5c00304a-0f6c-446c-a59a-be521cf756f5", "value": "Roblox Modded.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44747e5-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478630, "uuid": "656c6882-1b13-4922-a86b-69d335b21d26", "comment": "Malware payload", "value": "e0b97d8c1e116bc76457c02e734fdf22", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478630, "uuid": "16b04dad-a406-442d-b50e-9dc456085576", "comment": "Malware payload", "value": "ad28c78ea1400432d7f615affe12c87791304797f071c8f8881f2c5d32758fe7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478630, "uuid": "4f468b85-5b49-469d-b5a7-c33e7459683a", "comment": "Malware payload", "value": "4ea14322e2c76e17a7691266b4a505f273bb7457", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478630, "uuid": "c9f5edf0-7415-4483-8dc7-93b68a03731a", "comment": "Malware payload", "value": "e019a877bf76e6cc8ba6f20ea1e7c45c9afd1fd60bff0a27c0e81f6acf39a580f12a17e84aedcda2736dabe75c19854e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478630, "uuid": "ab1d69e0-6e7b-4d52-864d-09b6e5131c6e", "value": "T134630A572DC975169B7D7932E48276CF228A34ECFC6650C241F2BAC38E6BF56024BE10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478630, "uuid": "23804ed8-d1f5-402a-b100-bd074ddd05fd", "value": "768:I8w/h62/jWs6oS+xISN0v6tmCauhJdkfScBYrwz2y8kTAlGB:I9l/AoSSMoDusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478630, "uuid": "a28a8de2-fbf9-45ae-9c8d-a79dcd2c8745", "value": 71510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478630, "uuid": "b0442a22-22c6-421e-88f1-58336bde471a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478630, "uuid": "7b404938-48f8-4bcb-95c6-1976dbd6c4e9", "value": "invoice-1645080830.pdf (102).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883ad198-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479012, "uuid": "9171bb2c-96af-435d-ad59-ddaf4dd2bfc0", "comment": "Malware payload", "value": "46785be19e83d57bf1b7e1f49d67dc10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479012, "uuid": "5203fdee-9c2e-4a65-a340-6024f5702bba", "comment": "Malware payload", "value": "ad9ab20a806b7a42b0c770d9f43a05666f61d1cab70ddbf11c7ecb7bc8d98832", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479012, "uuid": "59442ea9-8870-4ee5-997b-863c01b4cb6f", "comment": "Malware payload", "value": "d38959a86a51b65125ae2dbb8ab468af4149d15b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479012, "uuid": "9497b2ec-079c-42ae-868b-ae468d649e55", "comment": "Malware payload", "value": "061a5ff45f136d95c9bea628834c22287b7d31bca38d327a7cfcf72ffe649c62ff0b8ea8a097b99b4edf64e0f801f144", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479012, "uuid": "3e6f7733-6487-4ec3-81e9-cacba28508c6", "value": "T1EA632BF76404A12304A828835ED8657698479F3D42EB767FBBE73910FF48D329C93692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479012, "uuid": "a302ee6a-78ec-4c30-8c42-1f9bcd42cb76", "value": "1536:I9l/AoSSMXbwbKbub3babdb1b9bbbIbVbob3bnbSbMb0bybDbXbfbkbFbYbYbIbY:I9l/5MLgK+raBphvIJorbi80CHLDk5Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479012, "uuid": "36e2a749-97c0-4bdd-80f9-65b86c24b3f9", "value": 72509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479012, "uuid": "74ceb14b-151e-433d-a3f1-9eb7ea7fa578", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479012, "uuid": "1cda8dc5-f05a-4992-8e42-c4abbc38bb0b", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4394cdd5-dfb5-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1766463006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766463006, "uuid": "c2165ebb-8490-4d1a-93d9-75f5adc18b50", "comment": "Malware payload (NanoCore)", "value": "0d7f9a1889b35e2c5531beb6426eda2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766463006, "uuid": "9bbcbbcb-a4d8-4a85-b12e-687728952a82", "comment": "Malware payload (NanoCore)", "value": "ae8017c92d1af149ff21027f3249302bd385e3e620c54eba99a944b07f548870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766463006, "uuid": "cebd5477-05a9-4751-b68e-cebb72557e6e", "comment": "Malware payload (NanoCore)", "value": "f9115d3be1963e05fa762222098f9d0b31607828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766463006, "uuid": "964ef87b-501d-421b-9e3c-4bce5c0faab4", "comment": "Malware payload (NanoCore)", "value": "0d14178de494eb00efd71c879dbc31ec9a7c2eb29c829aa68176196666629049339bbcb4f00d563aa61a15ab071cd4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766463006, "uuid": "894b8dad-2ed4-4c1b-8d0d-d880673c1fed", "value": "T11E14CF1537A88A2FE2DE8679712202138379C2E3E8D3F7DE68D455B75B667E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766463006, "uuid": "9b41081f-e709-4d45-831a-08df00ff4769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766463006, "uuid": "a5f4f88b-1101-48e7-9aeb-cae0aa627cac", "value": "6144:QLV6Bta6dtJmakIM5Y4Q4cpvMPFGDqMiQz5R7/3g:QLV6Btpmkb4QRFBqMv9R7vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766463006, "uuid": "daf19ea3-aed6-415d-9410-2bae7dad4d8c", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766463006, "uuid": "9e34d2d2-2885-4691-b4ab-5d76242f5147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766463006, "uuid": "465ac987-6e1f-49a2-af9a-a75ea2eca9e3", "value": "new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c482cb67-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479114, "uuid": "7338c8dc-8249-443d-bce6-63c4a9c40ccc", "comment": "Malware payload", "value": "c1ddbd368133b87f2994ca0708b3a41a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479114, "uuid": "7d973e6c-d506-466d-b57a-6ae3a2329aa6", "comment": "Malware payload", "value": "aeefa63c9b98adda7ab96f09061cdac3d997c02a669f103815748b2560f0d653", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479114, "uuid": "936230fe-7a77-4069-a62b-926b4d37548d", "comment": "Malware payload", "value": "3a288cb4014a9303268417568d8834438990af91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479114, "uuid": "de74a736-7ff4-4cb0-9a2c-f4c6487b42d0", "comment": "Malware payload", "value": "b1df8d033abe2e994ee3c250d7e6469e5048add8d0c171ae7e5377bf53f20e1c330d7cafdb00290509be9badd4aedafa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479114, "uuid": "ad81b716-77ba-429e-a123-7f34fcd434dc", "value": "T1DD633C6ADD0063FC47F5B905CBCEA0AA3683BD2415EA52A66DBF8114BC1F7BA0330D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479114, "uuid": "1f3c862d-2b99-421d-b876-33b99d5f4730", "value": "1536:I9l/AoSSMLrknv9e9t2lfPPn3NAsUigxGQH8edTcIzeR2KS5RELRlscBX0U6up6m:I9l/5MLrknv9e9t2lfPPn3NAsUigxGQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479114, "uuid": "23745d47-9933-44ce-8703-a1a350f9c9aa", "value": 71571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479114, "uuid": "b1e04ca4-8149-41be-9f7f-72fa37d0b8cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479114, "uuid": "c47bd705-05c6-430e-91a4-63c04803c3b4", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129868fa-e03a-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1766520047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520047, "uuid": "64f16faa-293f-472e-b382-86f35f98b1a0", "comment": "Malware payload (RustyStealer)", "value": "4d3f06d6e139e50a31addf5caf0891db", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520047, "uuid": "2d3cebba-e11a-48b1-9e41-0414a1351987", "comment": "Malware payload (RustyStealer)", "value": "aefa433b6943abfbed86bce0f860c85a886f9954305b9d9e8b08db65dfb16fae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520047, "uuid": "844ac97a-2ce5-479c-acb6-a5c2b361b15d", "comment": "Malware payload (RustyStealer)", "value": "c89d7dd4cf6940f4cd3d8e7af431df58d233dfd8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520047, "uuid": "2cae2980-0405-4e76-b704-c7c235804f6a", "comment": "Malware payload (RustyStealer)", "value": "7e9f100c0b15fcb1e969efcab3676cc0d8de1322be153836acde0385745deff3e29a90ece616056c17f4f44a7b1c2276", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520047, "uuid": "c1e21ef3-a53b-4852-935e-0f2379177e0e", "value": "T19F47DF15A3A904A5D46BC634CB56C233DBB07CE61B34D14F0589E2A52F77EA28F2F325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520047, "uuid": "5e4dd85a-495b-4e7a-b1db-94fa3206a0de", "value": "f64907538a90ea5dad156e3dfe527db5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520047, "uuid": "51fb873f-1fd2-429a-b0da-d7e8b43686a7", "value": "393216:2420g/zEwyrdQalM1Y/oQQaWwxRnJl+oOUZ+nJ6hwk1:2fVilvQLxwxBJl+oO+gSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766520047, "uuid": "00f47a68-27fc-4b7e-bd5e-1fc64fac6dc9", "value": 25649664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766520047, "uuid": "8c5e0881-b262-47f1-a59e-99d21b60cdfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520047, "uuid": "0e734896-e305-4bcf-9919-6b678f0703d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a305b10-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468520, "uuid": "c107b377-9310-467b-a5dc-869248b76187", "comment": "Malware payload (Mirai)", "value": "54264bb1bc8647be6b855b3c9c5fc64a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468520, "uuid": "5782f42b-399b-48d3-b994-b9a31592b51c", "comment": "Malware payload (Mirai)", "value": "af191c549114af3f6fc0a4ad88d3deedf40dcbb877eb61e6ce55f29a87bb5333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468520, "uuid": "924a6c96-e67e-4431-974e-136c7b077cc2", "comment": "Malware payload (Mirai)", "value": "0fede2847f93de7ec58c67c54d2672a3c2af7bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468520, "uuid": "2698d9b3-c272-49b8-8937-b9fc87d7daa5", "comment": "Malware payload (Mirai)", "value": "3ae20431fe08a73d5ea31226dfe44e025e2f18a4cbc8dbde5ad30e14f18447e51e2377a2fda98f634267ac023dac0227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468520, "uuid": "7e5a17d2-7050-488b-a676-5724cb92f386", "value": "T1A1836D87DE62F8F1F821107A162A93619E33F5352432ED4BEBA42B75EC55600DF463AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468520, "uuid": "040b0ca4-9a7c-4505-8516-f63e0bb8a09d", "value": "1536:NEq1152pUVTfwM02YS3MoRP04y5lQIfEYCB448TiHE6bSprPq/y3qBnT74:RDCTS8oRP3IjTcEhViM44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468520, "uuid": "36788f12-271d-40c6-8d4c-ae1ef508544d", "value": 87292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468520, "uuid": "bcedc330-1785-42dd-a9fc-5809759996f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468520, "uuid": "3186511e-3f03-45c3-b03d-f1d40e77dfb6", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5508581b-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478497, "uuid": "ac6201b6-cbc3-4b4e-b66b-0d25bd0432b4", "comment": "Malware payload", "value": "2c254a79238540c3d08092a663683b89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478497, "uuid": "abcb7b34-6de0-4af4-864b-0842e65b9a35", "comment": "Malware payload", "value": "af39f2cadb956e68e620a35884c09d254d7b31aa6062eba87f2de39f0afbe484", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478497, "uuid": "a8f8ea86-8733-43ed-bcab-75a8e819ebe4", "comment": "Malware payload", "value": "a15f6068e8dac499561d2a167426027a57d0bbe8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478497, "uuid": "a28cd453-fb89-448d-bea4-9c09100003a4", "comment": "Malware payload", "value": "97f2ff87a643b7accf0bd0e52bf8830aa74bd4feabdc0c1b66bd8651802b2078bb8042634dd2963199a3974536b9a934", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478497, "uuid": "5c78760b-7482-472f-b172-9314f55d5ead", "value": "T108631AA8EE17F1441A0FF8D44AA4198ECECD91B5CF92D2F3A7D9712306879E3431949E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478497, "uuid": "df7945cf-a4bf-4627-b26a-7a5e8e890c5a", "value": "1536:I9l/AoSSMlK3hK3AK38K3LK3FK3IK3KK3EK36K3SK3eK3pK3AK30K3tK3xK3tK3+:I9l/5MlK3hK3AK38K3LK3FK3IK3KK3EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478497, "uuid": "c5394b29-dd09-4185-8d27-bfc5518776a8", "value": 72577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478497, "uuid": "c456d11d-878b-408c-9e29-e589a0c52f27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478497, "uuid": "35b3a619-a774-4e65-bb39-07a08547cb58", "value": "invoice-1645080830.pdf (129).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cc94b7-e006-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766497858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497858, "uuid": "7f208556-7bbe-413b-b549-846f0f87826d", "comment": "Malware payload (njrat)", "value": "4898b4159d8db22f29734386332d6a66", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497858, "uuid": "dd373cb7-072d-47f8-9902-faf7ec9d25b3", "comment": "Malware payload (njrat)", "value": "afd828865444f858a18f309c0b1cd7b1018cd5a1fdcdb7477153018c2886f208", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497858, "uuid": "95bf2ae3-9205-4b3a-ad85-b83da4a9df7d", "comment": "Malware payload (njrat)", "value": "c9c6fe847b11fbd8ff7dd6a4f0d7189a9a324487", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497858, "uuid": "077536f6-66f9-4010-bcc2-7fdd7141442d", "comment": "Malware payload (njrat)", "value": "7861136c560c1a3f27d6dc6dbb87c36ca488d14594c1ec35400869a84e684e805c43484b5ebc6e813c80f867f2b75086", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497858, "uuid": "c187f8f7-92c7-4d11-9ad5-4720084f29a6", "value": "T190232A0037E8812BF2BE8FB8ADF26145457AB5673603D54E1CC4419B5623FC69A427FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497858, "uuid": "c9c0680f-c8be-4cdb-b531-1c57cfb1217e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497858, "uuid": "5decbe70-86cb-439f-b7fb-4a359b85c085", "value": "768:Iub35T0AoeiWUIwOsmo2qFdYoXyAAAA3PiPInzjb0gX3ixnxRN5MllozwBDZ4Yi:Iub35T0TV2kbWrn3bbXSf3Sd4Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497858, "uuid": "4d4d2b57-eb89-4b53-a141-8e4ee0e2cb2c", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497858, "uuid": "7f6ce9f1-5781-4c01-b879-d155acc3a355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497858, "uuid": "b2e6041b-760f-4475-b46d-d20c2dadf85c", "value": "CFArea1HorizonElite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f289b7-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478821, "uuid": "2546c973-953a-466b-b681-140e292b23fb", "comment": "Malware payload", "value": "9d984e4547b2a85370916c521d8c6848", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478821, "uuid": "55df4f9f-6f27-4ba5-b6bb-0b2ad49ecd4b", "comment": "Malware payload", "value": "b074bb6d91e1417e2b8bb81462877314b15f595d93b8f0d1c09b359cd25a4a4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478821, "uuid": "311bdc9d-e216-4ea2-8ffe-cddfd3cd754d", "comment": "Malware payload", "value": "107a74f52d3c77981dc9c91be0cfd5bf1a433230", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478821, "uuid": "82d3d718-01d6-456f-9b53-50d285a772f6", "comment": "Malware payload", "value": "16e1f859f54bda034f29939eda2d2b6522daea910d958135dd55315ea116bbfb2a2562028898996a96d3f111a747770b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478821, "uuid": "825bca46-8bb7-464c-b697-29d0b38d6230", "value": "T15473FABD0E83DABEC21C384960A4F092585664A6BDF502C1F4E668231CFB9F75B4796C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478821, "uuid": "d626ce9f-6e67-4e27-93de-fad0e02060f9", "value": "1536:I9l/AoSSMLNWDEavDchGSHJNt/LWcIyQpY1pneuXzx+LHuNxcfVcQg6MueN2GaIq:I9l/5MLNWDEavDchGSHJNt/LWcIyQpYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478821, "uuid": "a6e91291-e290-438f-97f9-f70850e0033a", "value": 75338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478821, "uuid": "e17ea673-a1ea-46e1-aa67-afff908c2c47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478821, "uuid": "b8d38eb0-78d1-416c-9909-faf75c6c238b", "value": "invoice-1645080830.pdf (67).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad9c7e1-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478507, "uuid": "8ab0637f-ee69-428b-8196-3169f44454b7", "comment": "Malware payload", "value": "6587035a107de53ec2ac683743647172", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478507, "uuid": "c1284481-5cac-4365-bfa1-d104494660a4", "comment": "Malware payload", "value": "b094605ca5beaa624f67127721e11ccb8bee45c4257cfbc71a966d5d2ca8b880", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478507, "uuid": "c1222030-4182-49ad-9122-cb41f6075f1b", "comment": "Malware payload", "value": "fc0f0090fdad7e931ab54497686cf5e92edf6781", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478507, "uuid": "754fc1f2-507e-4392-8bfe-fac9b1703e6f", "comment": "Malware payload", "value": "a22798b3d086fedf9620b2561221c847aa3d8d512b2b90b17f1f3fb2f534c57eac535177c26b0c1065b4f67772d42727", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478507, "uuid": "fec99102-20a4-4f6f-bfca-ee1d99d1973d", "value": "T169631BDB5DE11A7D073D7C5A9B2B224F2CA264CB961499561D7F20E2A3093BC6840CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478507, "uuid": "b9b183ad-d28a-4994-b71f-d39798f79bc8", "value": "768:I8w/h62/jWs6oS+xISN0vS2yUCYdkfScBYrwz2y8kTAlGB:I9l/AoSSM79usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478507, "uuid": "aa730320-7005-41cd-b743-a8d9f31b865a", "value": 69725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478507, "uuid": "df9609b1-3025-4b04-81bc-c4e53cc12c87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478507, "uuid": "c381451d-b5cd-467d-a320-34b77c63d6f9", "value": "invoice-1645080830.pdf (125).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2efca37-e00a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766499781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766499781, "uuid": "52bf5226-14e8-4f93-b074-9c7eb58192b8", "comment": "Malware payload (Mirai)", "value": "650ec7b78c32f55aa51c235b88974fc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766499781, "uuid": "f56cde81-1583-4157-8ea8-c99cb022b208", "comment": "Malware payload (Mirai)", "value": "b0c77cc6a35ab47b537ac54f24d3f9d4b83d2eced7eedbfaf9b3829ce44655a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766499781, "uuid": "562944b0-feb6-425c-8a70-ae11b2e93c02", "comment": "Malware payload (Mirai)", "value": "65f57f5ba81c23f5bd891142815787f253fa838e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766499781, "uuid": "519390b8-cbc4-426e-8290-542f5310e352", "comment": "Malware payload (Mirai)", "value": "e07df9192f04bee5d9d98aa503eb6bf4aaa4101bc8458481e0bd88ffa42f5a62ca05244e822278bc9334699d6dee03b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766499781, "uuid": "80150e6f-769c-4155-bac7-d75d331818b1", "value": "T154F33B07F4C184FDC496C1744BAEB536DD32B09E423CB1AB67D4AE222E4DE215B2DE94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766499781, "uuid": "47c8d0a0-0157-4740-a7a6-2fdced2bc66f", "value": "3072:LdH9QpkuNrDYF0oaQovNzRjl+D+f51kkEWEMN+iKZBI14Ii:LdH9QpkuNrDg0/MgbJEm5K4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766499781, "uuid": "049a7e24-c86d-4ea3-8987-13f1f5e9bfb3", "value": 164184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766499781, "uuid": "a476f34a-271a-434e-ad86-0eda08c19121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766499781, "uuid": "b9ef9a50-3dab-41cf-8f40-98f981538663", "value": "yamaha.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86ab242-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525130, "uuid": "78abc4a8-8629-4124-8f25-f306bfe248b6", "comment": "Malware payload (Mirai)", "value": "2a05530776261f64165a1d3df3257a16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525130, "uuid": "d2d2d86b-359a-46bc-b4fd-5d9e99e94859", "comment": "Malware payload (Mirai)", "value": "b19084b2f8da82df95add38c638ba0d46fb70aa8d50a2544ce741e2d2f253124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525130, "uuid": "ba10c4df-0ac8-4ec2-81ba-92ac37a54a96", "comment": "Malware payload (Mirai)", "value": "837142aa67834828dbe0da33b76cf419bbd7e785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525130, "uuid": "1ee0bb0d-2b23-4efb-8402-d6fd9885b9bd", "comment": "Malware payload (Mirai)", "value": "d7cf173c459c2e88ab7d305e8d24ed8a13c7fbb8897caefc34fbbde952ded1edc3bf0de1a760ebb76681bd5f0dbd2f00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525130, "uuid": "6ce6c466-c623-4e0d-bded-316e750adf74", "value": "T191833A41BD815A12CAC513B7FB2E02CD332613E8D2EF72179E21AF2177CA91B0D6B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525130, "uuid": "757d2aa4-556b-4eac-b9d8-12841f53ba2d", "value": "1536:VHEWbSON2eazV9Rxc8NF6Luz4tjJ7uPa6lj7lOR7BvOUwbZnU:VHEWbS9BcgMuUJJ7ub2JwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525130, "uuid": "7fafc695-a24b-43b1-bb90-d58e08bbff8c", "value": 84688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525130, "uuid": "0c25eb2a-dc99-4565-a762-0a73c7aeb133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525130, "uuid": "e2be248f-b476-4cd6-af00-5255a3033bd8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18312f2-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479109, "uuid": "def20da1-9a06-4b7b-adf1-802aaf0e4384", "comment": "Malware payload", "value": "ecbc71729d3bd51c108f829a4a3e816a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479109, "uuid": "db7d61a4-aa75-42ce-94c5-8ebcb6f2b7a9", "comment": "Malware payload", "value": "b1b5c662db4a7ebfbf29bd04678b159fb3a430fe4b381f26c326e5c3296fdb04", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479109, "uuid": "0dafc91f-89d6-4272-82d5-c950a42554ac", "comment": "Malware payload", "value": "30d4fc95ef25eb14c761b1ff5306b2f221b6cbdd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479109, "uuid": "1dfb66b2-3828-450d-a772-103a931fec44", "comment": "Malware payload", "value": "9e38d4d75715557e13606515777a263d1282d81c58a598a7c1bc6d6193ea37374d562d692a5f728e3f6ed5088fceea15", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479109, "uuid": "c7964cd9-34d6-4688-8ef1-60bd76743673", "value": "T13073D8885F9823F9A0AEF471820D746AB8CA681F3988D1E6C176787DDB74F9CD073464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479109, "uuid": "28a7c754-265a-4fc6-84fa-8c77ac1ec54e", "value": "1536:I9l/AoSSMhZzZjZ2ZCZ5ZDZAZGZJZ1ZcZNZYZNZVZBZPZ9ZBZXZPZhZGZ6Z/ZwZ6:I9l/5MhZzZjZ2ZCZ5ZDZAZGZJZ1ZcZNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479109, "uuid": "99d29dcc-b2aa-4abc-9b3a-cb233ac6e828", "value": 75409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479109, "uuid": "89f4c56f-be24-4c46-86e0-c97d264928fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479109, "uuid": "f9bacd80-00e5-4259-8e58-476b92e15995", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1591188a-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510173, "uuid": "32f91914-d9c1-4332-9bf8-6dc537751857", "comment": "Malware payload", "value": "691c3ae92362fef619ca95dc0e7885df", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510173, "uuid": "6c84112a-444c-4a42-9e6e-7a085a37a41f", "comment": "Malware payload", "value": "b2654f6c5a14892e781f3782bc13d6a823206b495aa2a76facc92bd1a910e9e8", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510173, "uuid": "4b41e59a-489f-42ff-b8df-8ecd85b92da8", "comment": "Malware payload", "value": "0bc3bdd5af66db8246dd4130f8c5535fe12dbb58", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510173, "uuid": "c5881fbe-b0a0-419a-93eb-1e9c837475e7", "comment": "Malware payload", "value": "a9e8d50f07710fd0ef65fb6f3179d4ce0cc697963ee926eed9bb1b19a4d9934b8d05b649468dff803ee1aa4c842f1cc1", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510173, "uuid": "41b2d5d4-404e-429b-9ed9-837d67c65baf", "value": "T1A576341B6AE301B5E4E9CE34A7B944FC46F16B2F5620B7BB154012F8CE6074A75236B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510173, "uuid": "d038f622-1e63-4980-bd59-215a477fb8be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510173, "uuid": "2017b542-e384-475e-bf1a-c1aa1ad8a474", "value": "98304:l0trB03LpTThUMidHSCOX32FAhpWYZxlxA+13Y:p39h9iXcDUqlH13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510173, "uuid": "30ee9730-dee1-4834-99a3-3d1cf590ba5f", "value": 7308288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510173, "uuid": "0f8477c9-be4f-44a5-8ea1-42f1417af8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510173, "uuid": "a2a4a591-fa07-4b89-9305-d709223c9220", "value": "IDMan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba743b0-e044-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766524464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524464, "uuid": "c9baedaf-9396-40c5-9f8e-7e2173865c3e", "comment": "Malware payload", "value": "a51f3772142c0c92af845382f99a4630", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524464, "uuid": "0976e2b8-866d-4070-8cf9-d21d41b8f7ee", "comment": "Malware payload", "value": "b301513e27049ca2492975a4a2e14ae4ad2ee96e6b49b39c437f3a8aff30f912", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524464, "uuid": "f66da6ec-4252-41d1-8114-03d8d7c111d3", "comment": "Malware payload", "value": "48f025de20c5de9c1ec874cc3d07fd5254b9b515", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524464, "uuid": "2328290e-9eed-4dd3-8e4e-9d99951df85d", "comment": "Malware payload", "value": "da12f7bdc9bcb0c9e65570798a7c22844d47fa0bd028340e1e9d9d1947ac16098e8e29d28f4b73f97e2374187da80cd9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524464, "uuid": "7e494728-fe65-4cd1-b2f6-961590909682", "value": "T10B2150BDCF5591761DDC8A3875098119E90DCDF0F8A8DEA0B51346B67F98300AD4CB6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524464, "uuid": "966776e1-429d-4beb-8beb-9173d7306903", "value": "24:3J3gfI8XIpDNIiIwtKKIIUs7gIs4IwXI6fIjZIm0r4I0OBn1VInMwTIJdIPR:ifI8XIp9IwtRInHIxIwXI6fIjZIm0r41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524464, "uuid": "d9a5d9f1-fb6b-43b0-bb1d-d7bf3636fd73", "value": 1333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524464, "uuid": "b57356ad-009b-4bc3-80c3-c8fdaffa2007", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524464, "uuid": "ff6e27c3-1211-4d12-8df0-70095ae17b3d", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d64aa5-dfe1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766481884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481884, "uuid": "e2c15964-eba4-41ed-856a-ef28c7718ba3", "comment": "Malware payload", "value": "eff853814ea9d2009447c42c38ccd451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481884, "uuid": "6d4961a0-d54c-419c-8afe-c7ca34c8bf97", "comment": "Malware payload", "value": "b3c2e428af48e1566f65f8cd675965db94a984ba24ab5e4156e4fd50b7c6488e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481884, "uuid": "b71c69d0-ee05-448a-a209-caea851dd050", "comment": "Malware payload", "value": "76000f0ae5d17344a9c05ceb3618635939966cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766481884, "uuid": "2b5c3f31-e643-428f-9331-2e09aec2b26b", "comment": "Malware payload", "value": "bef8cc01e47d275febc463a042e0c61b709d335ed5beb5bb015fc5699fb7a1f0ff3cc9d1f8323aeccdda6eb95d08f3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481884, "uuid": "a7bf1962-62b8-4151-96be-1aadadc93ded", "value": "T1D5C35D47B70C0A57E2A619F06B3B37D783E9D5D131E0A6882A0DBB8852B1D771189FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481884, "uuid": "b5f5d5a6-d9fc-462d-9bf7-5a8b8bb15608", "value": "1536:1E1iNdXR6yrSrSghhE7hM70uRPzilaOeqwgsNiC7lLe9ijj3Djx6Z0dM:6UNb6HSyi9MgC2l5kwC9e6RvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766481884, "uuid": "401163df-bff9-4ad2-b2ff-713dd7511ab8", "value": 122244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766481884, "uuid": "fd02a941-67c8-4011-869c-b2c73ded5a87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766481884, "uuid": "4a4a9f47-4ba1-4a6a-ad22-a88d76d3992c", "value": "rondo.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b53c07-e014-11f0-a129-42010a9c0007", "comment": "Malware payload (SkuldStealer)", "timestamp": 1766503807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503807, "uuid": "cbd21c75-4e49-4e2b-8a63-edd400135a85", "comment": "Malware payload (SkuldStealer)", "value": "0f2b19b93c031b97baea56508dc72467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503807, "uuid": "cb9d10a7-aacf-4a5e-9405-dd54962d3f54", "comment": "Malware payload (SkuldStealer)", "value": "b4b6de07a167b66c62606d30180ebaeef6df3392d2c28c2144dccae20a85915f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503807, "uuid": "8309ad65-ee5b-4454-ac8e-4ef76da7e80f", "comment": "Malware payload (SkuldStealer)", "value": "a5b653a77586165cff8feaa189585a1d23a09574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503807, "uuid": "1654b178-d3b1-4b2a-9378-5b9f8a6ea9ca", "comment": "Malware payload (SkuldStealer)", "value": "e97f2f3a33375f165d69c43c37a09a8b76fae5fbe8f8ecb04792fafd54a11df608e843d21d78b81eddbda290de8c32bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503807, "uuid": "61b12e13-bea1-438f-a7e3-11bcc85a874f", "value": "T170B62847ECA546E5C0AD9175C6269152BE717C885F3063D32FA0FA242F77BE0AEB9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503807, "uuid": "9fc90c1c-18b3-4373-a9a3-d62caca7a357", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503807, "uuid": "1f9be858-f652-4c97-a6e0-dfc040b7d460", "value": "98304:cUGV+PjU3NfstZMaAyjEm9+T6ZvY/a8liD3VcvBqEW:cg8ujT9++pmomvB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766503807, "uuid": "eb578a5a-620d-4086-b7e2-49d9b5cc0064", "value": 10570240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766503807, "uuid": "92f24cad-4ea2-42ea-bf47-96384409cd47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503807, "uuid": "d8ae80f0-24ea-4786-a132-de93e0a747be", "value": "Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6eb28b3-dfe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766485614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485614, "uuid": "f10b7d56-b0bb-44eb-b3a6-4fba062a8ee8", "comment": "Malware payload", "value": "eac0ada21e4cf4726c0ac7135eca3b0b", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485614, "uuid": "55af345f-870f-47c0-98d5-a33bcb235bc7", "comment": "Malware payload", "value": "b591bfbab57cc69ce985fbc426002ef00826605257de0547f20ebcfecc3724c2", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485614, "uuid": "4c5da86c-9f9b-4e04-bbe0-76575e0ed385", "comment": "Malware payload", "value": "d3509487442871a1c4475f1a1dd4cf0a293ffe70", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766485614, "uuid": "8de206b5-add6-4aa2-9351-9fd3a427870d", "comment": "Malware payload", "value": "9f161a419fdcade7a8b31f1936f4672a97e0d9db4275503f7f025d86aef5a7f011bd852d71834f0e607b4c4605231e2b", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485614, "uuid": "1e6698f5-8653-4186-87e1-3a5416779738", "value": "T168673337078A5C78C4C82534A8FF5313BDF89CFB51D22EADA9B365421D733AA685162C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485614, "uuid": "ea570c4a-0543-4fea-a268-ebecb165a7e8", "value": "786432:AHOEN2oFQ1CqR3B8qVkAAqmics0Aiz8SBgS:AuEN/Q1rR8LkmfsizZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766485614, "uuid": "0d29a38a-fdb8-4993-abeb-303e12a7b96c", "value": 31476506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766485614, "uuid": "779fec90-da68-49b3-825d-d733b4ab8bf4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766485614, "uuid": "6e2f2c02-0d8e-486c-be44-8ca1b1fa8d95", "value": "zk-call-messenger-installer-3.9.2-lts.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c5ec9a-dfe7-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766484786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484786, "uuid": "99cb3e1a-dc19-4d33-8b71-5e484e3a77e8", "comment": "Malware payload (QuasarRAT)", "value": "8b1e75f744c51c8464309db2527d4b7f", "object_relation": "md5", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484786, "uuid": "32fe32b3-9361-45af-a94f-d5feebf24712", "comment": "Malware payload (QuasarRAT)", "value": "b60ebd925ebe4919ab623904ca96c860260c08838390861bb7a676bc872a646e", "object_relation": "sha256", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484786, "uuid": "0e62f981-a62d-46a5-ae38-4e24637829d9", "comment": "Malware payload (QuasarRAT)", "value": "01bbc3e2edeae2c9ded699e11fcd5558a70e6b0f", "object_relation": "sha1", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484786, "uuid": "dc6f965f-d206-4b7f-9e00-4f761fa8e0f9", "comment": "Malware payload (QuasarRAT)", "value": "4fd5d6bde344d730ed810b3593ec6c04d36d20fa45e125c14af7d9bb857d87b5d9e352c6faea16b537f739b8094cb2fe", "object_relation": "sha3-384", "Tag": [ { "name": "92-118-170-185", "colour": "#521543", "exportable": true, "hide_tag": false }, { "name": "coinmarketcaps-cfd", "colour": "#B7BE3F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484786, "uuid": "6baa5424-e9f4-443d-9f44-d3d1a8539cae", "value": "T12D01FE1ACF38F9C482797185D5563D4270AA8B368F383EFCD64488E91E2C295CF5F468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484786, "uuid": "fe0e615d-38b2-4849-96d4-6ca452739973", "value": "12:xzpTfqd8VWQFl5RMhA981kVFejbqtOq7Q9bQdi4UV+O2AHcLJ5kCkJB5AHc1:xzpe8VzahAFVhaRnVd2AHyJQJPAHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484786, "uuid": "635cdd8d-0a85-4b53-b6b8-68695936e482", "value": 695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484786, "uuid": "61d61efb-5139-442f-ab92-b975e99afae3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484786, "uuid": "7006f8de-fcf7-40b2-994d-c6d6267de788", "value": "b60ebd925ebe4919ab623904ca96c860260c08838390861bb7a676bc872a646e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14e6efb-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525118, "uuid": "ac51a592-d55a-4b7a-a483-9b456d70c25f", "comment": "Malware payload (Mirai)", "value": "c8bba4f6a4322537bfd12f08436fcede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525118, "uuid": "ca033f71-0441-4b93-8e6b-faaa6f93f131", "comment": "Malware payload (Mirai)", "value": "b6602df8d96bbb48f3d1367e8aeec86a0aad51af653a1fddaa59820030f1896e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525118, "uuid": "85080161-7313-4480-a1ae-a00151326490", "comment": "Malware payload (Mirai)", "value": "b66bda7e4a7235b074c1f5de470651767633f4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525118, "uuid": "d6ce65c8-61fd-4134-823e-d38eec1dd095", "comment": "Malware payload (Mirai)", "value": "d1a34286336cb84fa9fffffbfbd301ca4956362e3abe8997c4f4a605b83922fb27512f878a666b62e9ea8d556a987f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525118, "uuid": "711612fd-0931-45e6-9821-a8a51ccbab53", "value": "T17E83398AF800DD7DF80ED77B4463090ABA70A3914A930B3A6757FD57FC361A54863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525118, "uuid": "f5fc0e2f-8366-4984-8986-59275e00acd8", "value": "1536:dSdHet9JR4r9eiY6pnsU1jmVkS8+NWD+BE62245XJjXpx7BkUtN6DBeTBnYw:dB4r9qCnsUhmVkEB/2N555kUtN6VeTBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525118, "uuid": "2847bac3-4020-409f-bd99-92eb1335e9a3", "value": 88424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525118, "uuid": "e5f2e3c9-54fc-4cb8-aa62-d0ae982cf1a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525118, "uuid": "a8bca4b0-a662-49af-bc96-775664161e7a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd2e238-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479052, "uuid": "6d5218a2-c808-4af8-968d-23479bd0d7f9", "comment": "Malware payload", "value": "bae4f097366333f352324e397ee629d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479052, "uuid": "82d4f11e-bbd4-4349-8042-b145c2e38cc8", "comment": "Malware payload", "value": "b662133fb3331ccf14113a9feaf2f50f2d46af733410f492b4be1d42b89e8595", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479052, "uuid": "7cc4276a-c933-4bf4-943e-78b97a99d24c", "comment": "Malware payload", "value": "dd0cf1841c7708239cd6431d515ae04ceb82ec3f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479052, "uuid": "3588bc02-410e-43c6-b7f4-a283e43c2dbe", "comment": "Malware payload", "value": "4f54832cac4890905e0f68536c73451a643839cdda848582d4c5c25ea518ccea8073bfcfba47d0a440d78b89c836caad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479052, "uuid": "654de334-009f-40d0-8591-e33eb9276715", "value": "T1776308C57FF3B89A17C60235CD0A8E06D5026FDE8AC94F096F1A5C0D39EB69868D502B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479052, "uuid": "a31e73a9-a344-4aa2-9e7c-430a934e5a15", "value": "1536:I9l/AoSSMhvH3SewgrnB7oNgmyMJEwK13ev3LL/vNI5cCi3Je/wAU7pkbNSvbyux:I9l/5M6eusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479052, "uuid": "a4d6c5cc-ed00-48e5-990c-0a5eb76b7ff8", "value": 70660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479052, "uuid": "330d6c9b-aa96-43b6-82d5-8549309459ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479052, "uuid": "82314423-a4fe-4716-92dc-f802b65bf7fc", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1460be2-df96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449983, "uuid": "442994e3-efa7-415b-8a56-3aa2ec819281", "comment": "Malware payload (Mirai)", "value": "f9a98767119e64bc850e2710390fe8d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449983, "uuid": "2b37ca5c-4114-484a-93e0-b0ba07891f38", "comment": "Malware payload (Mirai)", "value": "b696b4ecb614520f3e1b23b32e6e4ccc3a1c9b8eccb705d2e8745308e33eff47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449983, "uuid": "5bae781c-2587-47a2-bf7f-0b8d4f088b0c", "comment": "Malware payload (Mirai)", "value": "9f73d17ecc191bf7f1f8f9f86e38e8ecd159780d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449983, "uuid": "f990e6ee-7494-4c11-8014-95547d180f1a", "comment": "Malware payload (Mirai)", "value": "687417d36ed923c0e91612cb74526b2505da89d3a0c136d4f1867f95e4a7bb7ccf550fcf113febc58756598366ff31ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449983, "uuid": "e783b2e1-dfb0-43be-98f3-7c998d541898", "value": "T109D3E4327A601D1BC8CC533A51F78321FA727729A1A8871ABF930E9D6F393847517791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449983, "uuid": "a6ae4d04-9ab7-4025-9092-9cf437375e2e", "value": "1536:v0mFE+J7+BUJ2F2FZlC1yXRANbhiyakCX3ztYTAqzWkDZptWToP75r0buuWKUIVG:/XqB9F26NbBbCnztyDWi3t8juu+IVhbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449983, "uuid": "afa5f0e8-64d7-4f02-b2b5-b1d031a02331", "value": 132564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449983, "uuid": "f3cdb7e5-283a-45c5-b2f7-1cd81cd4e2c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449983, "uuid": "5a7984ff-1e09-4259-9fee-670621d69fb2", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99fd2ee-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510100, "uuid": "b79a762f-73d0-4095-a58a-f36abb152814", "comment": "Malware payload", "value": "3d4359e54faac6280a97d67bb9b97137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510100, "uuid": "9d302610-d30d-4e8b-956e-9103a5aad4ee", "comment": "Malware payload", "value": "b6e366fd0db4b04d765553b13579316918fe19cedad578570a9702014a2569d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510100, "uuid": "d5ae18ec-263b-4064-8b9d-243cb451f275", "comment": "Malware payload", "value": "25ba9c967846fe065f596afbb6dd46fe64c0ef06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510100, "uuid": "4c4cb2f7-d7d7-4581-b93e-d2210e701727", "comment": "Malware payload", "value": "fe5fa2fba1b97d1d767aebebbf04c95d1c5725c954d9929c5d7a1a8cbec280223e53f072f9aab276b2b5ff7a569830d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510100, "uuid": "415f2bae-4e0b-4f2c-8fa2-f9515477f788", "value": "T1FEE2E1C30622715CF05E9B39E637576AA45DF990CD36C70E87EA2BAB0C91640C7B5371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510100, "uuid": "500a93bb-32a4-4a69-ad43-f8699c51b07d", "value": "5558e9832ca091fcda6332f62a0990fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510100, "uuid": "daf9bd58-9e67-4f45-9d6d-36745537f38d", "value": "768:EmfnxnExH675ydi3+mQqpVNIx1fHv95NjxfeupjBglp6g1:EOaH675ykXGxRNlfeailkg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510100, "uuid": "876504f4-bbd9-4422-9c83-cd1076d08c43", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510100, "uuid": "63531106-8091-4575-ae0f-15ed2fb3c9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510100, "uuid": "756280d8-61f4-4378-804b-8f702dfa39c0", "value": "cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a54ade-e007-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766498198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498198, "uuid": "b3f7e982-6c0b-40bc-acd4-7f39e54d7bc6", "comment": "Malware payload", "value": "22e7f858f701f650fbb3cb5049592b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498198, "uuid": "924ebc0c-e179-4e8e-81af-b9f87f79452d", "comment": "Malware payload", "value": "b7d4566c688bf140bba68d02fa5621fa439da5a6c846343b4e9f3de20717a3c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498198, "uuid": "adec6989-cc7a-466e-a86c-0b30cc0363df", "comment": "Malware payload", "value": "1c072d43d08ad6d2099396f5df2347940877141b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766498198, "uuid": "2b843b79-e61c-4560-b2ae-aee36560f240", "comment": "Malware payload", "value": "6c84fc1b15c51e8a1546e0532e56d4fbf59972a7bc59b6a2e7f18bdb72356e7cf1a26da488b0a9870a01ef73689a29ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498198, "uuid": "0fcc4ece-0bbb-4d5d-b2a2-f8f6b498327a", "value": "T163187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498198, "uuid": "0285d875-6821-444e-95f7-7de644afd8f7", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498198, "uuid": "5f91a095-38ae-43db-8ae7-66b20d1958e5", "value": "786432:hAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:hAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766498198, "uuid": "bf42c3b5-2575-4b4c-b632-faabb0958788", "value": 90423296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766498198, "uuid": "faf71fcf-a321-4df3-ac8a-3c23da244155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766498198, "uuid": "cbc316fe-76aa-48b9-89c5-d03559de2af2", "value": "starter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f85431-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457802, "uuid": "ae9ad360-c0f0-48c3-8404-49b1102e1913", "comment": "Malware payload (Mirai)", "value": "86631f8e30978c644b87a80a948df6ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457802, "uuid": "e6bcb7bb-0957-4849-b194-037d6a51fb15", "comment": "Malware payload (Mirai)", "value": "b7f840ae5abdf8f07a1ec90a5841a7f875ccec5c064482eee8f935d12f9c8fa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457802, "uuid": "49376429-314f-4e7c-bb97-8932d0747eb8", "comment": "Malware payload (Mirai)", "value": "e2407588de922ffce0b866734cddfbd5603f4ce7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457802, "uuid": "0aa77d9f-98a9-4cb7-b69c-d8d14a56d94a", "comment": "Malware payload (Mirai)", "value": "0075a220a51f0c27f751ccf0b38d9286cee3affe9f6e82b187f1ba055863034b8c9615aca75d8e9c32a150e754b94b00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457802, "uuid": "33f49fe0-2294-43ba-8ab0-277ed9e9636f", "value": "T19D538D73D8396E84D35941B5BC748BB51B63F58481830EFE1A99C2B99047EACF6093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457802, "uuid": "12627869-5236-4d37-8bbf-e9bbd02be985", "value": "1536:maLwtrmUF1QgBVEvKVQHSKthnIC4QHiSKEs/F:mYFULQgrEyV+thnIECBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457802, "uuid": "dc54ed3b-98b5-4680-90c8-b1fd90a35a30", "value": 63628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457802, "uuid": "25c87e66-a33c-4799-8cf2-1f5c93a0ee1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457802, "uuid": "d17ac829-ba27-411c-9cfb-53ab91838db0", "value": "ntsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e0c7f4-e059-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766533534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533534, "uuid": "63bc6482-55c9-4992-b558-cd1a6a1428f8", "comment": "Malware payload", "value": "90b6eb231007e025d610bcffe506106e", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533534, "uuid": "a4402ab9-c136-4fd3-a19a-df37a496b7b8", "comment": "Malware payload", "value": "b88ea704c02627709c6f0d2c62d1171d26df8104ffab8778ffc086504160fa33", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533534, "uuid": "4d67fde4-0a70-44ab-af13-7d04e5d2e2e4", "comment": "Malware payload", "value": "ed9c4af7b80b1ba0c0659284a1ab24ec8347e69c", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533534, "uuid": "2615d98f-3ecd-46a4-8771-b0aeb75624d9", "comment": "Malware payload", "value": "b0bb52b4e9292ff37759ea6e5b03d53faffa32c7d90be39ac081a26bd84f560551ed4bd2ec9f2ea06618da2e6544e3fa", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533534, "uuid": "adea777b-167b-4d5c-b02e-6827d1119a08", "value": "T16F181369CAEE6C398A16FB5921075742E2BBDCFEE53F79025061194C0368D39FE08E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533534, "uuid": "d2bdcf2e-ddb9-44ba-b1aa-ce35b7dc0915", "value": "196608:fIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIy:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766533534, "uuid": "ecfee99c-bdd2-40fe-b187-8148e9157818", "value": 89648777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766533534, "uuid": "3f1e634e-44c8-48a4-a5f6-ad6d3b5c244c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533534, "uuid": "1b637013-7d2f-435a-8e9c-d08a82f35aa9", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193d42f7-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468518, "uuid": "7fa6733d-bcc7-4e2d-9827-8b00f72ca7ba", "comment": "Malware payload (Mirai)", "value": "db4cbe735a7cb1cad6c7ba5297809165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468518, "uuid": "5f3f4453-1cff-472a-8da0-3829ef78ee9a", "comment": "Malware payload (Mirai)", "value": "b89e008bfaaf3ca24f9a5124b31d8a43cbad8030dd6a0a09a5a71ec7ed1c0bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468518, "uuid": "cef42de8-5c4e-4cf5-91c3-69f170b98427", "comment": "Malware payload (Mirai)", "value": "8396f17fcdaf435ef3e3228d22d7cbb87d8210e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468518, "uuid": "9a834f5c-3631-4ff1-8eed-6c9e4a0516e7", "comment": "Malware payload (Mirai)", "value": "3dde92908bbe905481e31e6fa5514e38db563421a59582f188fbd7d4ab1b378c9068fb9b2c44277887684df0cc2d870c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468518, "uuid": "2ab7f1f9-ca6b-4056-b2d4-04aff4d4ca90", "value": "T10953012B8227C64CCD9DD17C4AAE879F03727D88451CFD4B9D7C2AEA56B068199AC30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468518, "uuid": "fb3c7597-262c-4138-bcc5-cbca17bc75f5", "value": "1536:2bSYzO0FG4H45xR8Bxm81sUXD9GinQAQC:2B/GdLmf1w8QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468518, "uuid": "8ec3c44b-37ec-4ac0-82e0-1f48ed09b404", "value": 60740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468518, "uuid": "1aa3aa7f-d807-4015-8f7f-7be245dd24a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468518, "uuid": "14b1a685-0e52-4f13-a953-5dd2e1d21a23", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c4f3c4-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457859, "uuid": "3d31d9e2-a69b-4f36-ad7d-d451f7788d08", "comment": "Malware payload (Mirai)", "value": "c7a31be28f15f636ec3fe576db0927db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457859, "uuid": "552c7422-e884-4288-a3fb-6eb181c4b883", "comment": "Malware payload (Mirai)", "value": "b8a732a632c0cd50dfb807cd068f4bad0c1ec3050affebb735d7032401798e2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457859, "uuid": "6ca92ff0-ca91-40e1-8c8c-38aae63d19c7", "comment": "Malware payload (Mirai)", "value": "9352409d2161fde2b7a847ebda30deb210264c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457859, "uuid": "d3b05b64-bf78-40c7-904a-68a742d00719", "comment": "Malware payload (Mirai)", "value": "cb6b21445c03228a1e97a4c0c4ae9abe0f961a184889f80a4878adbe895d6e5e81215e3e3b7c93ee2fbe61958425a2f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457859, "uuid": "2f91fc61-0032-47f0-9282-bcd47955ff33", "value": "T127733A91B9815613C6D112BBFB5E02CE372613A8E2EF7207DD22AF21378785B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457859, "uuid": "53f698d9-0809-4c33-a567-4c698fc588c3", "value": "1536:c1VzhypU0Lw5znGwHQJqFd82Ox/FwhO9NsFaZvzs/F:c1Vg8jvwJq77wb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457859, "uuid": "d5e3123a-bc9e-491e-9994-b94f063fc585", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457859, "uuid": "d9eb3ff1-49be-42e4-9e5f-8d42f3aa8f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457859, "uuid": "8d4c048d-87b6-4abe-b92b-c8529c110a14", "value": "ntarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2037a7ea-dfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (For)", "timestamp": 1766455216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455216, "uuid": "06a81067-82c7-43a8-8feb-88d941fe0d16", "comment": "Malware payload (For)", "value": "66d2c7f05474ea86f03c27e1175c5a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455216, "uuid": "3427d7ad-49e8-4b7f-bef8-4ae5fab157d4", "comment": "Malware payload (For)", "value": "b8f64422f2c39daddc4cea3b59d9a8f34114e7c865e7d9bbccddd2f3a3ae2dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455216, "uuid": "46356d6a-750b-412b-90ee-64828417d25a", "comment": "Malware payload (For)", "value": "b4823febe442d8176857c49750761104ef195603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766455216, "uuid": "573ba159-13dd-4632-a886-a4ccfe6cb23d", "comment": "Malware payload (For)", "value": "83c32c87f3fadc69e460ac19a279a8916512a0b60ab619c4e42eef4bf048c96c6805b9164a3d67b78a9615c95143627c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455216, "uuid": "e937b65c-e5ac-4dc9-9aca-04b78194a32a", "value": "T11645D01363DE8365C3725273BA257701BEBB782506B5F96B2FD4093DE920122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455216, "uuid": "4dc97c86-681c-49a9-ae22-b76a84ead35e", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455216, "uuid": "24f082c5-fcc8-420d-a84d-30d8496b4cb9", "value": "24576:Rtb20pkaCqT5TBWgNQ7aHFY51Sh0x2h/GcGyujknv6A:iVg5tQ7aHa51Six2htGlkv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766455216, "uuid": "ea7409c5-f766-48a1-87d7-8763e5a43182", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766455216, "uuid": "b86e5ab5-55c9-4aa6-8b07-9c45453be84d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766455216, "uuid": "00db8ca8-7fd4-4e91-adf8-014b34485bdf", "value": "rOutstandingInvsDHL122025-0976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941e5ad9-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479032, "uuid": "baaffe7b-e964-406a-9616-44f8c237e2c6", "comment": "Malware payload", "value": "a638b03a830329141c0b7e16c118882c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479032, "uuid": "a24ecdf2-4c61-4212-be88-39b41d942c0a", "comment": "Malware payload", "value": "b90e26d06d3fbbf7d28736ecbb410191cdb9212a5d0f0d6904ba380a78b06f58", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479032, "uuid": "859b4629-b2c0-4508-b5fd-6e799c3e1ef7", "comment": "Malware payload", "value": "a9cf2141a1e0ab0c68b5aa35b17e744112fc53e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479032, "uuid": "05bd243c-9746-4006-9862-e1b82d2a9907", "comment": "Malware payload", "value": "9cd4aa91d5eee15d404bd27e7cd362ed3312d123589ba5f27b549bf969c0fa488ed32d258d0afcc3f14672c1f8a27921", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479032, "uuid": "8625191a-1d94-4e35-a328-dcf3693e7761", "value": "T1A2735C09FE3A5BF4D8731E836B09338D9A194CADCED63147829B9117B7D59E02BC8913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479032, "uuid": "14ce483c-32c9-49a0-a176-8fa9308a59f0", "value": "1536:I9l/AoSSMjz9yurqbm9aD8rXzRI3VCJo1MvBMQzIAWyZWz+3463l3XoWVAm3umer:I9l/5Mjz9yurqbm9aD8rXzRI3VCJo1Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479032, "uuid": "8d1172ca-82b8-4329-b9a7-c65da808522b", "value": 75336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479032, "uuid": "edf195eb-4abe-46af-ba1d-2d6c24167242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479032, "uuid": "ed33c5a9-d41d-42ef-9468-79f26432f753", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712f62d0-dfd6-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766477256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477256, "uuid": "aa4e8d91-1101-42d5-b1b7-8b15813f084b", "comment": "Malware payload (HijackLoader)", "value": "109dfa0a7af457748196781ae81a32cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477256, "uuid": "7140b2fc-94db-442d-9b49-f545a81231d1", "comment": "Malware payload (HijackLoader)", "value": "b964bfa2995ffa43eb98dd6e51a354bfd9639b171f972816f03603d384f89d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477256, "uuid": "22cfb9ca-0e45-4e7f-af13-5cef325a476e", "comment": "Malware payload (HijackLoader)", "value": "05c0eca98ca51cacdea2cc95f4b048bb035c514c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477256, "uuid": "93751a25-3ee6-4d18-befb-88344831446b", "comment": "Malware payload (HijackLoader)", "value": "a8db3f50796a426773fa402ac70b05320057292c7dbc88b88d7e1e88ce413b0cc06b88c708c98f123572cd64c8f71290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477256, "uuid": "17b51857-7301-40d3-ba69-6bec9bfff726", "value": "T185D533817784B9F4DA64C672AF2DDBA99577E36552120F43D288AF522FC31E802036DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477256, "uuid": "1597e98a-879d-4dba-915d-fefb1dfca963", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477256, "uuid": "a4e2a721-b5f1-4527-aa87-ae2f0febff66", "value": "49152:+pz3ovWRXpILOjUxGlrBNW4Aopr5nVC74JFB+rbyo8jT+df6VyIbi/iS5IBjJ6M:+pSQpILOIxABNW4lr50sJFB+rzo+56gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766477256, "uuid": "a2c5f55d-c527-44c5-8e00-30966ea749d3", "value": 2749718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766477256, "uuid": "28d70894-fe99-4b34-a909-93598638afbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477256, "uuid": "3da9a931-7b18-45a4-9e0f-2698dd60dde9", "value": "b964bfa2995ffa43eb98dd6e51a354bfd9639b171f972816f03603d384f89d47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6138bb-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478670, "uuid": "29ab29e0-3b62-44d1-b4d1-f13d8ec72fe0", "comment": "Malware payload", "value": "490de7d821661fd36ca203f4a0f169ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478670, "uuid": "2bf7bb8b-c26c-4ef1-837e-e541df1e6ad2", "comment": "Malware payload", "value": "b97626ca165a2d4121ac040bf593d09e6379589a13f461e1561b3a1560881d70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478670, "uuid": "28d6ffed-ae2d-4509-9ea8-2f9a112f50b7", "comment": "Malware payload", "value": "add403555dbae3f0052b4405f32be10945c35a31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478670, "uuid": "2ec1702a-8664-4370-b89b-3a3ccd543f0c", "comment": "Malware payload", "value": "fe5979b1aa416a875f67125a710706941278a971b10f9ffecee8e89e826cd397bd1e0f26eeef25d93bd519aba6262120", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478670, "uuid": "138df870-6e0e-41a8-a6f0-c2fbd5c9a57a", "value": "T12F731A253783DEE0A9655239F4FA25F23DD4AD93D9218E28B934FBC3D0CA9C8552BD01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478670, "uuid": "97612d10-771e-4fb1-8289-b0e0bf7789b2", "value": "1536:I9l/AoSSMvYRRGxOyFQ520rA6MeDtoB4VNIANJT6u9XkyN44oCwhz4y6M4l6D7Ng:I9l/5MvYRRGxOyFQ520rA6MeDtoB4VNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478670, "uuid": "192d5373-909c-49ba-910b-859565d19535", "value": 75376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478670, "uuid": "f350de71-0eea-4982-b4e7-a42adc3bf555", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478670, "uuid": "cc61cc86-eb46-4487-a891-62b8136dd2a3", "value": "invoice-1645080830.pdf (94).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be2101a-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478562, "uuid": "eb097ae4-780a-483a-acd8-7c0ae03fe7ff", "comment": "Malware payload", "value": "f475c1efcb96267e77acb5abf9dacaf0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478562, "uuid": "d58cfaae-a9ff-4af3-822a-aa36d09f003d", "comment": "Malware payload", "value": "b9a85c7e3ff404a0273b367c25a1b9ceb778b125988fd64e100a5b7831336f3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478562, "uuid": "41e9f61e-808f-437c-ab12-18a4af9ec364", "comment": "Malware payload", "value": "564eac454c9901ba77611fda59a7808312e12b2a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478562, "uuid": "88dc1a67-4e5e-484c-b9ef-560f1d9ad781", "comment": "Malware payload", "value": "df24c6e496ac12d7c6eae4c172bd0ef9f9e0a873025ee4921dc1821c6299c81201c780c0e631b79d787fb8e2eaab16c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478562, "uuid": "5b17d0f8-d28c-4f66-97fd-51b825c82b56", "value": "T152631B49DDB3E8D51AE39E7D8D9BEEA5CB87F0FC48B5E21A8865F105919836F340104C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478562, "uuid": "4e10d1ca-2a49-488b-a02b-6f62b9914f6e", "value": "1536:I9l/AoSSMb5hzsdIafs9X64zV1ZrNA0pLsiL3MdufRdSz4nq8DWcm6k2cp1kwSWE:I9l/5Mb5hzsdIafs9X64zV1ZrNA0pLs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478562, "uuid": "da0fcc24-304f-42cf-95c7-04487e778f8f", "value": 72514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478562, "uuid": "e5148b74-7c78-4c15-a0b9-a8872d1a6268", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478562, "uuid": "3bab5db6-7cd4-4655-b3ed-f745b864889d", "value": "invoice-1645080830.pdf (119).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ccd220-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524319, "uuid": "4984cdbf-0032-4b11-85cd-173e6333aced", "comment": "Malware payload (Mirai)", "value": "e5d6cfb0c9c7586b07858a555d83f41c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524319, "uuid": "8077971d-81ab-4260-ac11-30b4e969f7c7", "comment": "Malware payload (Mirai)", "value": "bb24213ae8588e065da7957c223959d1e9bdcb994de422ec56b5f8e77a5cc16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524319, "uuid": "916ebb0b-ad8f-4de4-8236-ecd6fb93e352", "comment": "Malware payload (Mirai)", "value": "1b6384ee8c862202b50b35bd7b1078f7c4401672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524319, "uuid": "0d7dae99-4623-40f3-ac07-5d98659fa856", "comment": "Malware payload (Mirai)", "value": "75557caeeb7a53b4fd74ffda78c2721758f1c3a3f3adea4ab980ca103dd64a6310580cad2c7beb3e3008a0de42026fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524319, "uuid": "8f4cca74-0e14-4306-a096-517f11c44bc5", "value": "T1DC34A61E6E59CF3DFB99863987B78E26958833873EA1C442D05DE7015E6024F301BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524319, "uuid": "242dc422-30bb-4882-8783-fc360ceeb608", "value": "6144:AiM3puJxOjej4sRSVitP/JJwzY1xUfDaL9Y17d:E4JxAY1xod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524319, "uuid": "0ae96a9c-20d8-499f-be7d-c2577177befa", "value": 235932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524319, "uuid": "62452ae3-fed8-455c-bbe4-37e7237c8f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524319, "uuid": "0f43e9fc-41c7-4034-94cf-6db89c539084", "value": "pandora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbc6e36-dfca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766471959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471959, "uuid": "984369b5-ef5b-4005-9c76-57d49e1c93cb", "comment": "Malware payload (Mirai)", "value": "4e56d89dfb37f5a616bf1a888d45305e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471959, "uuid": "0d2c6e80-3029-4faa-9ac0-1a5b485a4a1a", "comment": "Malware payload (Mirai)", "value": "bb7c537656792e2c837231605ecd383affe2cf93486cc0968218aa0dccdd9368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471959, "uuid": "5edff50c-f3a7-46fc-8ebd-dd264e784eaf", "comment": "Malware payload (Mirai)", "value": "7b8dc72b6c3603c5653edaba06a303b1da87cfc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471959, "uuid": "db182dcc-ab35-405c-9298-bdd77de799d6", "comment": "Malware payload (Mirai)", "value": "49951bc8af81c78c6dc91efbcbbdf6dd495df8e7e36fa742c3d1c760d5c4603d5340dd49576d847f6e7c29725b4ffd58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471959, "uuid": "3b274943-c2f7-406c-8b6f-8b1b56cfdd71", "value": "T1A1145A12FB0C0463CA831CF44E3F07FAA3621A9104F5A115690D7F5A6A75D37A68BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471959, "uuid": "8d3cda18-73ac-4aa7-bab4-a61bac803c57", "value": "3072:VVj2+O9mRmxIN4rlOgaehry5VWP4KP1PdvHLcJEko6rLSpUae:V4+7Rjgao+Lg4KP7aBoyBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766471959, "uuid": "3b067912-cea5-4bc9-84b6-e095322a7f2c", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766471959, "uuid": "784dac6d-1fc8-4b17-bf87-4013ec7598c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471959, "uuid": "48dc1090-7b73-41d4-93e1-ec2d731c7a0a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a224646f-e047-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1766525871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525871, "uuid": "5bb8062e-bc80-4d6b-9863-8c150f6c27aa", "comment": "Malware payload (ACRStealer)", "value": "5484c52fa632faa9370a288f06907472", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525871, "uuid": "4afaac90-78eb-461e-9e1e-e18b56e7332f", "comment": "Malware payload (ACRStealer)", "value": "bbec376bc531a18adb2d4edc8e1bd781d7936bb9df29753e033cb2d423da2655", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525871, "uuid": "9e6fabf0-1ca1-4a7c-a516-def36af4e12b", "comment": "Malware payload (ACRStealer)", "value": "d3cd6c39370d0105a82a7681df78ae8d3ac1c512", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525871, "uuid": "6c255524-3284-410e-8631-0a9a196cb125", "comment": "Malware payload (ACRStealer)", "value": "945afa4eb97c27f094f8f60d26aad8239cd5447a5792e4e464581c3817d806caa77726f770730d9bca4bc338595e3a47", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525871, "uuid": "f77a70f2-f2da-4752-8ebb-0ee6ce128c78", "value": "T1637633091F414F92E26242F4461F5B6E8DBE8C77E295A53DE6CE38278D31EBBD1C0858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525871, "uuid": "7b5e74dd-3223-40a3-9d76-c459c6c9df10", "value": "196608:WBZmzSk90p9WygHbdNh8NAUBqSxy2p+OEB6OikKmy:Whp9hgHBN2AUnxy2Gxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525871, "uuid": "bff61436-4432-48fe-b21d-7d0c44ab4fc4", "value": 7561216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525871, "uuid": "16fe3388-50de-4ca8-a386-bc8dbb120759", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525871, "uuid": "9a7d349b-d413-4d7a-8c56-3ebedb77f757", "value": "JKBYGRII.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1603b3a7-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510174, "uuid": "610095f8-c7b6-4bf6-a5dc-2e14af181e11", "comment": "Malware payload", "value": "ea610413557126cf6d850e105f21a0da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510174, "uuid": "faf448e3-8bbe-46af-8b13-ff6b821cb7c0", "comment": "Malware payload", "value": "bc87db152f12c9dc9b42e018a52940c67e90f88640a34899792b7a0f9bf2b59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510174, "uuid": "37f1909a-4161-4115-b1db-de51926bf59d", "comment": "Malware payload", "value": "6905eaacb461e02faeddc6bef476dcff8968057a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510174, "uuid": "56f71f6e-3abc-44fe-856f-233ffbac280d", "comment": "Malware payload", "value": "2e60677e1776128d53afb804bb8f761cd1adbedc545f83667d4b3e7956664aa6e6c17dae8e94721491f9994210c21b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510174, "uuid": "f4066815-cd6c-42be-8553-2d92ded2fe98", "value": "T194868D43EC9559E9C1A9A23089A39253BB71BC441B3263D32B60F7386F77BD0AE75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510174, "uuid": "786f8a4d-2a8b-4f10-8712-fbeda7a02308", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510174, "uuid": "037e9e3f-9f0b-43bc-b6c0-cf2c78e0b7a8", "value": "98304:Y9dQGIeRtn4Bsa8UFtUNX0VVNnDEJCb/I93syhI09HXGd0T:YPQ4t4BsHemX0VVNnQzTIdST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510174, "uuid": "ea69e2f8-503b-48c8-a110-ed632f0765b7", "value": 8245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510174, "uuid": "fd79d158-0728-4cc2-9170-aed019e107d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510174, "uuid": "9f0fcde2-87fc-48b5-86f7-c8860eb4205b", "value": "pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8b8d9c-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766511849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511849, "uuid": "1bfae014-426a-40ad-b5b3-db01e2e5d9d5", "comment": "Malware payload (OffLoader)", "value": "9ae017bfc0985451b42922d812431805", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511849, "uuid": "8cff4b88-d58c-426d-879c-d9ea89b122c3", "comment": "Malware payload (OffLoader)", "value": "bcd3ea6381685f74cfea4dbbbe28e41eb7dd6435260555a234ac595d3bed8a1a", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511849, "uuid": "22ffbe68-dfe5-4c96-8645-adf0e2b4bc68", "comment": "Malware payload (OffLoader)", "value": "25caba89a367e8d415034b47a9cb7e412a0d01d1", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511849, "uuid": "6ba9accc-f899-4be4-856e-31b6a151c59f", "comment": "Malware payload (OffLoader)", "value": "fed284df25a36507a6399bd78df4758f60105e59836ba86aa4d23c99e7cb88c87d6376c6466c22333a8c34b3ee3f98e3", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511849, "uuid": "3c59b36d-e389-4ce8-b3ea-dd53a5f1e412", "value": "T11F36F123B2C592FDE06B2637CDB1B1B058776E11D85A4C5B9EE43C48FB390601D7AA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511849, "uuid": "645c2b2a-7697-46de-8e85-1b047e330ed0", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511849, "uuid": "a0f57c6d-806f-4d88-a934-7e306cea6f72", "value": "98304:0N6647iNPYVW9r4qF8LAypFu30NdRzfiVhhJGmTBfeRl2Kx2:APqg8OopW0fRz6smtfvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511849, "uuid": "7efc1834-9dee-4077-b607-202a3ef0be6a", "value": 4999776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511849, "uuid": "052237fe-fb1c-4570-adef-29c96ff483e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511849, "uuid": "8cf3cffa-7a18-4d6a-afb4-8dda14cb9e82", "value": "executive_7839.858_INSTALL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5f1dd6-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478722, "uuid": "3ea585dd-5d33-45f2-abcb-df32d0b47571", "comment": "Malware payload", "value": "6035f0ff0b26379c6bd2c1eec66be050", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478722, "uuid": "b1868345-260c-484f-aeea-470b61aefa7d", "comment": "Malware payload", "value": "bcfa7ad58bc5d06b5cd99d733543893db136942179e6459db1ff72c1ed756bf7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478722, "uuid": "20129406-b14a-4409-a9f4-558ac35411ba", "comment": "Malware payload", "value": "776327f1e6c6c2ae3b954fcf49cfa8100ae6dba1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478722, "uuid": "776a3e68-e4d2-438c-b511-33e78dfc9d5a", "comment": "Malware payload", "value": "8d068ba710606c2e3c2e0e3f4379dca0b44b08ae385ba3d8e115056f341f7f82fbd9f8157cc38a06ff06f08a4650f85b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478722, "uuid": "1086388e-b888-42a3-9b17-bf0ce4efee46", "value": "T1366319F4F51A16986931F294DE0F837809A85B894F4920C6DD01E397EECDE364AFD8E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478722, "uuid": "7ed57ae7-f3e9-4ece-b923-50c3b38fb2c7", "value": "1536:I9l/AoSSM3Wxc2UFfIZ/ykKwLW4d0ZC0C5g+A+rjCRxPq81V8IWD7MVKO0ZVLrWm:I9l/5MeWusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478722, "uuid": "70d9fb3c-a413-4485-9ab2-2e5551538288", "value": 71658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478722, "uuid": "53ad65ef-8a6c-4ef2-bf0a-8b4abdcecea7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478722, "uuid": "8a34d039-94dc-4740-99f9-c6d6e61fa745", "value": "invoice-1645080830.pdf (87).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9584cec-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479095, "uuid": "ae433304-969a-4d1e-8c68-73689807213c", "comment": "Malware payload", "value": "fa4126367e2573ee55a235457334f1bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479095, "uuid": "91d7b95a-6239-45e9-80f7-6c230091ddaa", "comment": "Malware payload", "value": "be0ff6968327e3460b5a64d8e83f94e98f52a8e0cd54d84bf513d300344cc2e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479095, "uuid": "d3dca31a-91ca-4492-afdf-f4afc7ec73cd", "comment": "Malware payload", "value": "64faa228ffc192041c4890c9a2a8b8fc60768ffc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479095, "uuid": "94c37685-2c9f-4963-9420-0a14fe32c0ee", "comment": "Malware payload", "value": "5b8f2408551476c7a08c30c675b16478eee783f1d76e17cc2b7b58f25cbb76c6abdbfeaafea3a85fcd17d01247489e4f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479095, "uuid": "3c3cf86c-e874-4a2a-9a0d-b18069bfa71b", "value": "T158633C8ECDFA684A513F6C841D21570ED528B0F18736313E1E4E2EAB2D537AEE55834D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479095, "uuid": "9df8c4d9-dfbe-4544-9535-b3839362e3f4", "value": "1536:I9l/AoSSM+N62qqHm6g23suByktLO77vSVvrG+eYx4bYJ7V8+H6ylr9x0Djy0O7j:I9l/5M+N62qqHm6g23suByktLO77vSV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479095, "uuid": "9e22d8ff-02c4-4ed6-9cce-2512bd40ad8c", "value": 72502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479095, "uuid": "8450ae9d-0e96-43f7-b0a1-fba5fbd8a235", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479095, "uuid": "3f423785-cb7f-4c27-80ad-7134b604b531", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1233b1b3-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524341, "uuid": "bf09dc2f-03be-4382-8993-148600c3019d", "comment": "Malware payload (Mirai)", "value": "3f7c65a3636c180fc7afeed644c77a90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524341, "uuid": "81206672-20f7-4c77-8538-b29915d8bcb6", "comment": "Malware payload (Mirai)", "value": "be31282f613534a766b34fcc00b6a43e81ef33d8915e7b93348f71ec01ec8d34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524341, "uuid": "695b3675-fdcc-47cd-b338-6b64afb718ff", "comment": "Malware payload (Mirai)", "value": "72e833ad03b95533e6b98b8bf91190276732060f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524341, "uuid": "9e9757ab-ef8e-439b-b331-109eebaa5136", "comment": "Malware payload (Mirai)", "value": "a1974097baae5927a103713727e279b730399b6dc321b2f486069e9c774a9a5ab8b0b5d14a961b1602dfb4491592cf7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524341, "uuid": "bb8aeef0-237e-4335-9faa-a8891496d759", "value": "T11A34C5197B280FF7E85BDD3B09E53705159C691A21AEBB35BA20D808F54B32F29E3570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524341, "uuid": "31db56c2-88cb-4786-87c4-e07062d604bb", "value": "6144:2/J8FreFNwHJii7CnlmngLH0DHL7aLZrUy/C0:6J8FreFNwHJIb/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524341, "uuid": "1b6d53a1-21f0-4fa2-9653-75df47c9853f", "value": 244620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524341, "uuid": "4b2294ec-58c5-4674-ba34-b96ab21f7b84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524341, "uuid": "4513e4d3-f6d3-4d8f-b34f-114ad67d6c02", "value": "pandora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e70ad5-e019-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766506251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506251, "uuid": "92019e90-4691-4528-90e9-fa8942a7497e", "comment": "Malware payload (QuasarRAT)", "value": "499b589acc9357b036e678699948270d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506251, "uuid": "6135569e-e3e4-4fd3-a6df-df850cd50729", "comment": "Malware payload (QuasarRAT)", "value": "be5370686c2c4b8f69d7428ec4d7f5270ef6e8d6ea45b6846e3589bc289f69e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506251, "uuid": "bdbef026-93e0-42d6-bd8c-d92acc616ebf", "comment": "Malware payload (QuasarRAT)", "value": "e78369b59597fa1bd39a765972a8ef0878a926ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506251, "uuid": "d9fe9899-e6e7-4654-bb57-bb81ccca6f6f", "comment": "Malware payload (QuasarRAT)", "value": "a5de8dad2c688a664eab7df828c3bfe4c4fd183250ad8c857bdeae1c998b34722a13100ce1b85aa225badac7c4f83fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506251, "uuid": "ddcb30c2-1e7a-4e49-862e-7c3789355afb", "value": "T18BE55B1477F85E23E1ABE277E5B0445263F1F82EB363EB0B619166BE1C93B4048417A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506251, "uuid": "6f416af2-6cb9-4e6e-bba4-75abcd9e3245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506251, "uuid": "042027a1-cc50-4c41-9f6d-008b634f71c0", "value": "49152:1vee821/aQWl8P0lSk3aKA3Z+nl1s7dpb8oGdxTbTHHB72eh2NT:1vd821/aQWl8P0lSk3DA3Z+nfsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766506251, "uuid": "5be635fd-057f-4590-bee8-c7d3fa8c073b", "value": 3270656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766506251, "uuid": "f3f12e9a-b271-42da-ba06-1ff3cc7ca3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506251, "uuid": "6ed2f113-4a09-4ba4-8bbb-1dfd51a634a9", "value": "unikey-64bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8d75ac-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478887, "uuid": "5e7dc9ea-e7ee-4ddf-a489-ae000ba25f77", "comment": "Malware payload", "value": "b3d2dfb11c620a2934b7c926bef15caa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478887, "uuid": "b9185844-47d0-4ce6-a1b0-12bcbef8c655", "comment": "Malware payload", "value": "bfaa016266a5e911d33e30a1d437bbe320729945c4b9c538eef1c50d4641652f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478887, "uuid": "822e0fa9-b7eb-4271-9cb8-f0fd3d777327", "comment": "Malware payload", "value": "81f4ebc4b324fe795711c6e10af99fd6e5fff4c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478887, "uuid": "aac51289-f2b2-4c0e-82be-00bedc2a968b", "comment": "Malware payload", "value": "3bb4db702a05f8947216ef5018ae3b03f7f030a94e9925f0b2e9f206ad9b9829176008b61faaa6fdfa388c3a0ea4c724", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478887, "uuid": "7e114c75-b35b-4d0a-8a58-6df1b7198e81", "value": "T17C635EE31FFD364E216EAB76C456041F52282C2F58507340EB9C602D82EAE7EED165BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478887, "uuid": "b3a6fc94-6e9e-48b5-a99e-6b95377c708b", "value": "768:I8w/h62/jWs6oS+xISN0vo4TO/3dkfScBYrwz2y8kTAlGB:I9l/AoSSMwfusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478887, "uuid": "c193dc62-c6f8-4251-8be9-ffd59b10fc90", "value": 69602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478887, "uuid": "58fdead9-e0a9-44e8-bc62-b6816d7c5350", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478887, "uuid": "89f5e703-00da-4758-bc7c-f63379b0feb0", "value": "invoice-1645080830.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d112681f-dfd4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766476558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476558, "uuid": "845b3327-9105-4fc3-92e7-a7a4473fc47a", "comment": "Malware payload (Mirai)", "value": "a18d394ff7dd4c6eebc7a0d3cfe66b8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476558, "uuid": "0b0c1c3c-c03b-48e3-aa47-6ba11a626450", "comment": "Malware payload (Mirai)", "value": "bfcbbb52299c89296746966a96a1c658f934f7b35eb45f6bddf1f0cfde1bb957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476558, "uuid": "7a726a5b-81a2-49c7-961d-b6c2415dca02", "comment": "Malware payload (Mirai)", "value": "16114bd4b2d8e33f6099917caf5d08391c771e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476558, "uuid": "ddcfecd2-6cb9-4cee-a074-78810c1345d1", "comment": "Malware payload (Mirai)", "value": "aa18a7d81c7c313648105c94a3adc06a29a8c48ec4ef7c3b7e2bb35f5bfda25d0190178c875b2034f90ef81566d4be32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476558, "uuid": "a511b9a0-f6bd-43c6-b12a-4c9a48ea3dda", "value": "T139A3E054B604EF05C02263BCB0C40980E7B26DF95B9795076563B9B87E7DCD82F0AEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476558, "uuid": "21fe00f0-7af1-47aa-9080-8dee63ef9042", "value": "3072:loXEC6i+i/foo4RpHJh758mqFP2Kn+wuUn:lMECblHoo8pB5E+C+wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476558, "uuid": "8d2d9ea7-11ef-4fd5-8240-932cb86190e9", "value": 103672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476558, "uuid": "a276820b-614e-4d89-a626-5263fe743e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476558, "uuid": "975ca1f9-b4ce-4bc8-93b4-0b74a5d16992", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b587e4db-e047-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766525904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525904, "uuid": "de124451-73a2-415a-86a5-ddd48c285170", "comment": "Malware payload", "value": "6d3199fa4fe168391a99939ef5f8e560", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525904, "uuid": "f53dd152-cd46-4db8-9e01-6e9ac044c623", "comment": "Malware payload", "value": "bfe06b2f18cdbc4d74b731a2fe52f66d3e4da9f9f0bbf9730b816b5418e5f12b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525904, "uuid": "8cf59c47-4683-4055-958c-9a91fcda0c79", "comment": "Malware payload", "value": "61fb134720c9b34299f4667b4f8075df5bac3dcb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525904, "uuid": "6098cb20-544e-4452-a253-69f79215fa38", "comment": "Malware payload", "value": "ca98289477476a32fec98eec8082a66d9581a0a1059ca3fd1e703bbc9a2aeb5e7e9d6e552508840d6f3f3ba258eed6ef", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525904, "uuid": "cb6f0882-9ced-459d-ab29-93f8597c16f2", "value": "T146879E41F3C382B1D58709B1203BF62B96343A019728DAF3F7907E8AD575392A97771A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525904, "uuid": "a2e1b002-19da-4c00-a925-a1480e1295de", "value": "393216:zy8rmCkJaJs2MFWEykZX8un9WoKcjUA8Y2fLQJw:J2Ku8WUAMUJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525904, "uuid": "bf8f9ea6-e4d1-4a39-a014-19287ba23adf", "value": 37784100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525904, "uuid": "b81d8b79-d685-4d86-bb47-47832679e65b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525904, "uuid": "ff961f74-db56-42de-9199-edc7120204fd", "value": "GIYACTWB.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a944c6-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479057, "uuid": "6f84e1a9-d205-44b9-8888-4a688978beeb", "comment": "Malware payload", "value": "a98d0171a46efa02ba834b3a53ef67d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479057, "uuid": "529e817e-5955-4612-b017-0c651e4021dd", "comment": "Malware payload", "value": "bfede784eb229dad15fe6cab222c8c32ad6afa1b6b7681bb967d904180539ea0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479057, "uuid": "fd899036-9ee2-4ec5-a53f-753cefe8caa1", "comment": "Malware payload", "value": "1bc1ba39b85deda6e424b363ac1d67345328765f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479057, "uuid": "649dd0c2-cfd9-4580-8664-917e6c9d358e", "comment": "Malware payload", "value": "cbf592149c636602167904ff33db299eed7ac4f95cbbf47661f4d2834a87993d2e5d20067954d35ccd28a2f2c7075d1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479057, "uuid": "b8cba88b-255e-4618-b0a0-a7f5a9eb8160", "value": "T11D731BC66A5177DC08F526E8897E8DD7881D15064BE6851EF5C3FAA78AACD780C2CC0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479057, "uuid": "5cc2b1ac-3189-4a21-ad2d-11fdb302a139", "value": "1536:I9l/AoSSMsKfFmlJQJ3ZrQZQDico9jYeqBl9jKtrPzIyB3CzgZsqZlcxyD1ur67q:I9l/5MURusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479057, "uuid": "d33fe841-e53c-4af3-af5d-5a7de5815599", "value": 73504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479057, "uuid": "d7043545-e4b4-4fbf-9809-5a83c2058fd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479057, "uuid": "67a57c6a-bc70-4260-87aa-a6a3e8172a22", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25c6a18-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510114, "uuid": "fd24c437-c83f-415a-9b20-d13d62110c69", "comment": "Malware payload", "value": "9c9cdfb6ab9f54dc9e819fa811961dee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510114, "uuid": "83aa69fd-2b7a-4a69-8de9-7b3047fb4651", "comment": "Malware payload", "value": "c132e76408487857cc300a5705dc32330baa2c2df4fb1ad4c36dbce82ec4331a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510114, "uuid": "cfdace2e-efe1-4ed2-88ff-e2aec7dd41c1", "comment": "Malware payload", "value": "00920bc4b5245c505f3e687dabd97d4b3a77429b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510114, "uuid": "c63d0c03-64ad-4983-828d-b15db73072e5", "comment": "Malware payload", "value": "417533a6d6fe3d656c6ecf3587e34c223d1af53975d03a8d5df1d3db33f9ab7661d0b2450e82e0d85ba5878e783b76d3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510114, "uuid": "99f200e8-5da2-4abf-baf4-c7db28352a6e", "value": "T19421240625228D6B0356F4F0D76B2112335AB14B28184CF9F0AB6098AE6914ACFFE7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510114, "uuid": "147bed88-ca09-44e1-8d4f-2946e2cd3c1f", "value": "24:apzHOUIzadR876gyNZ6OOvNLMjziHc4uStHEc+QWQnVzIrDkWL2:apbIza3NWujziHyMHAQVnxmkY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510114, "uuid": "20d2c68c-8f98-4911-8c31-0c8965d8d12a", "value": 1233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510114, "uuid": "3299cc5d-69bd-4e22-84d8-067d99a1e5cd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510114, "uuid": "e38f16ae-e7ba-46e1-8cf4-6822b672f5fe", "value": "install.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1758f89-e01c-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766507536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507536, "uuid": "1a9f3348-f7a0-4efa-b48e-acb37b6db5e3", "comment": "Malware payload (Stealc)", "value": "70781cbc1ba20b16a47670027d6d5b05", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507536, "uuid": "85e52bfe-14ba-489b-b1e8-7da9ad90dfec", "comment": "Malware payload (Stealc)", "value": "c32ccb9151f6eeceb567d083fa02d951555d008c22f3fb1e2aafe759d7120e2f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507536, "uuid": "3fad81bd-f85f-4c82-bad9-a1ca7bdee49c", "comment": "Malware payload (Stealc)", "value": "3ab7a91f0c657bd625bd14c76cea5d2343c1597c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507536, "uuid": "bad45783-fd1e-4e66-9cc5-8096615be5f5", "comment": "Malware payload (Stealc)", "value": "7a5e9188e7a74a857ba3e5b2520856ba0d3fe81919d60f7597c2f3957c8316d6421a756cfb35cc0dfcb6e5100d71b7ff", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507536, "uuid": "abfa81e3-1219-450b-b1d9-ba574616b32f", "value": "T1A6164A13E9E08669C4ABD338D8A251E2B6747C44473E36E75B803B762E773C05D36B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507536, "uuid": "289cc6f4-6e0f-444a-87ab-525f146d2e1c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507536, "uuid": "6124f6e1-a7aa-4f65-b5a1-65a8e3070a02", "value": "49152:T5jhU8gXLZhCkpzwelHH64buKizENwN/MmuJ:TmRa4izENOTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766507536, "uuid": "a8cc8854-5c32-434f-89a8-309e13b2a232", "value": 4020736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766507536, "uuid": "3f28b4ad-820b-48c0-9950-cb3d91cce5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507536, "uuid": "29a64e73-b6f1-485e-b21a-860a08c232cb", "value": "network topology mapper solarwinds crack 395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b14571-e016-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766504728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504728, "uuid": "30aac69f-6cf6-4ded-8eb9-ddfe1b7ca2c5", "comment": "Malware payload (Vidar)", "value": "ab552ba7aa8415743bdecc028c3c7005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504728, "uuid": "e9422a05-e20e-4463-932d-cbc18add6cf1", "comment": "Malware payload (Vidar)", "value": "c3443789d49632d020ff20843423fccc7a1a77b9ae3d9b66b628f0ebab1d724b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504728, "uuid": "a3acefef-7b23-4d1e-a9ce-f42b57c24c0b", "comment": "Malware payload (Vidar)", "value": "cffefcbf6421d63082154174853b044e537a0c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504728, "uuid": "bd788d54-d4ff-4d54-9833-a47027c0e49c", "comment": "Malware payload (Vidar)", "value": "ded35b37588d239a0310522819e5046832ea07d2c74572663ec1fd6e4da47d92d3f3ae564578a075cbf4bc51d825a216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504728, "uuid": "83a86682-0205-4a8a-a83c-dcbafe87d7b5", "value": "T111664A63FE944666C09FD27998B2514176703C48073022E77B912B752EBBBC4267BF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504728, "uuid": "1c9c76ca-d0db-468a-acfb-a75c8677aa60", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504728, "uuid": "a7bb6ef3-2940-4ad4-9fa9-e9008699339b", "value": "49152:qpVe656ToOedjSFX8CPMZxl+X/AJffJjU51Tfq3O/IZ6Lk1YGzYZPeNqdmEotH:qawOyxl+X/CfBj2VwtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766504728, "uuid": "5957c778-0d1f-42f2-859b-f5cd96b30a88", "value": 6858376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766504728, "uuid": "f2076c99-97a3-4c4d-b53e-2039e2d9d3e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504728, "uuid": "24b6d42a-08d0-4dde-8320-5b9c92d434af", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653e23e1-e00f-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766501717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501717, "uuid": "ae233443-a315-4cad-bdef-4c075ede4be6", "comment": "Malware payload (Stealc)", "value": "0a42d09393bb5ce22539963421830580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501717, "uuid": "3a57a9ec-d162-46ba-a705-6aad045ccb58", "comment": "Malware payload (Stealc)", "value": "c47ab9f234f20ff070f80a28fd49b6b809a9def8b90c6a7ad6c641e0272de687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501717, "uuid": "54d113fb-9dbf-4fc4-aef0-fceaf19cbfdf", "comment": "Malware payload (Stealc)", "value": "798493447c739a0e51b5604192d888081fa527a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501717, "uuid": "2a3b765d-5ce2-46d1-bb95-9be849314b1f", "comment": "Malware payload (Stealc)", "value": "a84aa7b81841859a0a596244b438355176ec4d54fdd7e3fd15aa8dfd7ef5f4615a235f3ca88f062d227f506eced3749a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501717, "uuid": "2ec5824f-b04c-49f3-8f60-2c93cbcfe8be", "value": "T12EF47D1AE7A502FAD0B7C178CE424552EBB278055338E78F03E15AA91F376705B7EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501717, "uuid": "0c1d2055-bd37-4bd9-9263-dc0369c4c37e", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501717, "uuid": "4e610575-01a1-4108-b332-3b2faf8c7030", "value": "12288:4VFR6dYKVC9eym65QBZ8C89iIdw50Pbav3YZtF15kjHCA:eREC9eym65EKCwi6K0PbO3kA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766501717, "uuid": "287d4a36-12c9-4623-8514-78c6d45b9cfd", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766501717, "uuid": "6728aba0-4218-4119-bf41-f359b1affafd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501717, "uuid": "47bf75be-7d26-4a7e-98d9-c96f03749fd9", "value": "0a42d09393bb5ce22539963421830580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b72f7f3-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488333, "uuid": "b88c610d-d2cf-4447-afa8-6920c5799918", "comment": "Malware payload", "value": "7b3dc7c9c456bf04dfe3c367d4f28c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488333, "uuid": "a40ca6e0-cdc0-407e-aab0-4854784679b5", "comment": "Malware payload", "value": "c4bee849f0cce0582e22412b93e00fa8962feaee24203a27b836e395a815649d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488333, "uuid": "deb3f4ec-a700-4086-8d12-a11652b7b638", "comment": "Malware payload", "value": "b73ebd2940916abbfca8a2262b892a5a15538c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488333, "uuid": "bdf18ac3-0886-4261-8bdc-f4d12013c3b3", "comment": "Malware payload", "value": "67cf8a192aaf97c4769386f83ddec88a69d04d42310262cee8b3fe6044da0040970f8948df010773ac78b917a63b9a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488333, "uuid": "fccb5164-b458-4aee-bf3a-c00d422f8751", "value": "T173E4120171C18675F8A310710AB98DAD4D6CFD3067985EDFFB980EAA8F251E07638D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488333, "uuid": "458c573b-b9e5-4f40-bf1b-1efcad67fb24", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488333, "uuid": "1ce98fd9-0e62-4783-ae4d-89608ff103dc", "value": "12288:0HztGhqRHSiKZM4DV0br2iCSFE2srlX7h7MsadmklcWrsL3lQa8pE2q0ej:cuKw7ePfCl3B7RQZPQ3EpFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488333, "uuid": "55bcb5ff-b229-431c-9e9c-178827cbe562", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488333, "uuid": "d53c5175-9710-4794-aed8-a7ee67ef5226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488333, "uuid": "32114ac7-7c08-4ac6-9c34-e125a5fbd213", "value": "c4bee849f0cce0582e22412b93e00fa8962feaee24203a27b836e395a815649d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253bdfd6-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478846, "uuid": "4d79dff7-d402-4adc-8514-0008169bda9c", "comment": "Malware payload", "value": "11e7aa42c2e396a9fa8ece803584132b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478846, "uuid": "18125685-e5cc-43e6-95c6-c8261de9591e", "comment": "Malware payload", "value": "c5a31f2c04e3d0e7aec2a3877597075386dc4def55db26c0a1a9d2c1f74a5f05", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478846, "uuid": "a0a7c7ee-79d9-4ba3-9ff9-f3a389c84037", "comment": "Malware payload", "value": "7fd366521f77bcc2c20d434f75fdba6d8a601714", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478846, "uuid": "2ac1ce9c-c345-4217-b6fc-bf929682a0bf", "comment": "Malware payload", "value": "2e6512bb3296e533a1256c1d843909b9642ddc321ab0664e6092e03971dbde48164553055cfb5c52d8a2aa1cc59b8b3d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478846, "uuid": "b91a69f6-9673-4c3e-bbfc-d084a68b46d6", "value": "T1F0634CEC7BD0A45A3542D6C55CBF8EFBCDDD203E0FA7464ED93EB81931052A4989B482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478846, "uuid": "bcc63a82-8156-42c1-91e9-98613ec67513", "value": "1536:I9l/AoSSMKRGRHReRqRjR2RtRKRWR0R3ReRaR4RCRKRmRURRRXRcRfRYRcRwRnRq:I9l/5MSGxeyV2HSWUheigqSm0DB8pA8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478846, "uuid": "d5d1f041-9ce2-4359-acb5-0d57ebae7bbe", "value": 70551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478846, "uuid": "11232d13-3cb1-4d65-a65d-9bce3bf9691d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478846, "uuid": "6f772142-c652-43e4-8f8c-cdabfa56f5de", "value": "invoice-1645080830.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176689d9-dfd5-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766476676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476676, "uuid": "84327002-cbbe-4104-a398-259b51893ea2", "comment": "Malware payload (HijackLoader)", "value": "572c9508bf0c1bdb1441ce02d8454cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476676, "uuid": "5d444f69-f904-424b-ab9a-908b6c1cbec3", "comment": "Malware payload (HijackLoader)", "value": "c6124eb41137fd565047878621d520d00854f7588b1a75ccb119db6b3103597b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476676, "uuid": "dcbbfd4a-48b2-4913-b154-ea6c4a42c529", "comment": "Malware payload (HijackLoader)", "value": "397b5468debcc9d419df75711b6e8ee0decf3178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476676, "uuid": "494cf402-6df0-4592-a0c8-e85ada2434df", "comment": "Malware payload (HijackLoader)", "value": "c5c55cb5be62be83e20eda088c5c264be9a8ceb170bf80d7395cafe0b505d740cfe52dc76fdf9fd85156449724c4dcfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476676, "uuid": "b47a0f20-9939-4d7e-a36f-1a1e8c583c1b", "value": "T182260213F28E673EE46A553A19729A10553FAE20541A8CB396EC3D8CCE391A01D7FF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476676, "uuid": "4dc8d177-0c43-4fb4-841e-17c12efeeb3e", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476676, "uuid": "3841639d-e26c-4c02-890d-b79728f0a00a", "value": "98304:rDbHnMcST8xqpgN2ugDuTRa3KgERpKJ0JNf4fax/:rDbH7SY4pOiDu1coRpKScaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476676, "uuid": "de987a05-cbc9-487b-b73c-f5f19d2ee19a", "value": 4505739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476676, "uuid": "3b7105ca-ec39-46d4-a84c-a3d90817fec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476676, "uuid": "eaa0f36c-7352-4ce9-9820-329d4b7f3f22", "value": "cotool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bce9604-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478992, "uuid": "ab520e53-8d95-4214-a2cb-02db1a6c7f87", "comment": "Malware payload", "value": "57a1b6f313a8777c29332186c5c19a00", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478992, "uuid": "6e33e34f-17d6-4841-9677-b1ecfcc087f0", "comment": "Malware payload", "value": "c63ed90f00ae9dd771ff0fe95d7d2da5d18116dcc489ecb71c78237ef1ce7976", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478992, "uuid": "813c6675-21be-4862-aac0-725ffd157035", "comment": "Malware payload", "value": "e8e7184d77e15464159b1283c1f2249d5c5a13fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478992, "uuid": "0f1d3be9-d325-40dc-a9de-7b1df699adc1", "comment": "Malware payload", "value": "3b2bda02444802542081c9efe46b41d3852e72a273a0ca7b7fb804d6c2b35d493eda9ca03058323e439dacd85aad1b07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478992, "uuid": "0add4383-f731-418e-af06-deecba671c51", "value": "T132732AD4E5003B665F38886ADCB3629F6F340D1042FA7054B6856DE38E99182EEFC76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478992, "uuid": "fa8148c3-504a-4021-b2e7-9492d540d17c", "value": "768:I8w/h62/jWs6oS+xISN0v7AbevN0dkfScBYrwz2y8kTAlGB:I9l/AoSSM86CusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478992, "uuid": "1ec2045a-d5da-414e-b55f-d5395a92787d", "value": 73486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478992, "uuid": "6f7201dd-2d8c-492f-99b9-d6487f4a234c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478992, "uuid": "3a1bf096-7842-4f01-8c1d-7cb284b879d7", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96559f8-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479149, "uuid": "0148370a-1cea-46fd-b3fc-a59051c613c7", "comment": "Malware payload", "value": "f41a85b1ebd81dec5437b17ac711a197", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479149, "uuid": "06044c7c-2030-4467-bcee-b4acd4977992", "comment": "Malware payload", "value": "c64a512f07e9b59f5edde0c15d8bf85ecd0f8dcf7ff2edb1cfbc915bbad9a5ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479149, "uuid": "b427936e-75c2-414e-84a7-8b58c6e141fd", "comment": "Malware payload", "value": "acdd4d29961abe16f97198d488a800e85f55ba0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479149, "uuid": "62b8f253-0551-45da-84ba-05f7bb2e4290", "comment": "Malware payload", "value": "cba60d432e8db5d025d35d4df945e1a581812267f352b491583c736b7c74c3f47c8e7ecd5330802d0abe521c08417149", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479149, "uuid": "a2bb9064-fe03-4c80-8187-fd657b5eda27", "value": "T1B0634B19AC1174CC4996C11BFB593292AAFC3CDA3B9E64CDC0C2B9770B56B0D1B650FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479149, "uuid": "4acd0576-d401-46a4-a7de-ce3f148153fa", "value": "768:I8w/h62/jWs6oS+xISN0vmISNipfTdkfScBYrwz2y8kTAlGB:I9l/AoSSMmtCusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479149, "uuid": "8965f39f-9b87-472a-947b-6299a6a0725c", "value": 70667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479149, "uuid": "55465f61-e9ac-450d-99ee-5685c2531ad2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479149, "uuid": "3facf264-88a0-4b4c-8938-32fda252fcaf", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5471ef4d-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478926, "uuid": "26f38c01-4daa-4fa0-9010-de8baf546f3a", "comment": "Malware payload", "value": "802bd6904d32e664dbc07f6946ce496b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478926, "uuid": "4fbbbcc3-7b32-4aad-a7aa-72ef05ed2530", "comment": "Malware payload", "value": "c67c8fb9f6c86868b20729918e50fe2be6bd9279a68cf6b5dbafeb9268415bac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478926, "uuid": "d0a1d5de-fa77-4520-ad7d-1a3dfb13b695", "comment": "Malware payload", "value": "279d0c25b2e30545a9c545813999d83513313191", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478926, "uuid": "df8cc44c-a64e-4401-878a-6ba275ea06ec", "comment": "Malware payload", "value": "099b4b5984b5d246808b6744fd5a429fc22f35191cc96b81efd23ddad7ac62c458771ae4cd70ae6f01ec286cc8f921ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478926, "uuid": "61a5a946-896d-407f-8ad1-0f5a30ad168d", "value": "T172633B8588D49EEDA37242785CCA84D65436F3C50BCEF9969BF374F2841E433AAC9472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478926, "uuid": "23923150-30e6-4b24-a26a-0cf9c99fa948", "value": "1536:I9l/AoSSMk9PQ9mmmeOB/41QBzcgigPCT2Bb7SRxWw/OpbEl/E4ErggOXn4yHYux:I9l/5MS5usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478926, "uuid": "3b7a2f4d-6f76-4b65-9a43-07856714ab23", "value": 70575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478926, "uuid": "47fcfd10-01e1-4587-b772-36d194217310", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478926, "uuid": "8ee5ff78-2e03-4efe-9ca8-2e4712e0d302", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef45493-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478567, "uuid": "f4bdcd40-86d4-4bb6-9bfd-8c5f1dc62aee", "comment": "Malware payload", "value": "fc2885b83cb1585ee418c263fbc689dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478567, "uuid": "5759cd47-0600-416b-8ae1-ce5400f001c6", "comment": "Malware payload", "value": "c6d8b319799abfafdeb1275db022a95c089d5af267a4d5f4f63cb83ce219e55f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478567, "uuid": "03a76ec3-742f-4a1d-95f2-45bc2161ed9c", "comment": "Malware payload", "value": "d06d60cc130242f100e13134429e6abb85c22054", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478567, "uuid": "9d8db76e-0dbe-4183-b960-78da9c4edea7", "comment": "Malware payload", "value": "971bea9f98a94bebe0c179fc98262ba5353c4ff5cd06998cada6ad3f389143203a68b585177074d714b45aec0e1d5a88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478567, "uuid": "1d14b538-8ee2-45e6-b4ab-ecdd386554a2", "value": "T1BF63FA6ACC41AC78CFBA492EFBEE633F5DCF544E46342794EF62851D2681988B4054E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478567, "uuid": "356efe77-d695-4fbb-91cf-473ad3d47c5d", "value": "768:I8w/h62/jWs6oS+xISN0v42saNZdkfScBYrwz2y8kTAlGB:I9l/AoSSMl/usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478567, "uuid": "dfac63eb-b3f2-4731-adf5-dffbee3e4097", "value": 72557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478567, "uuid": "d234fc6c-b2a8-4c10-86e6-185c43b05c92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478567, "uuid": "0ade6e1f-7f45-4b66-b407-dffdc3222d4d", "value": "invoice-1645080830.pdf (112).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a419461f-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522868, "uuid": "f2a113da-c94a-4daa-beec-ee29cbad2025", "comment": "Malware payload (Mirai)", "value": "f1cef24a91fa80d2b5050651f5160595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522868, "uuid": "0865e9bf-6f36-4ac5-b736-920a643f109f", "comment": "Malware payload (Mirai)", "value": "c6e76ea7bd94127ac850f04a940417c33b48a85700674355886b40211fdc0ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522868, "uuid": "61e379be-46dd-4796-9382-5cc7fa552a27", "comment": "Malware payload (Mirai)", "value": "c6e085be1e72971aa738d9cd28cb17f1c96cc76a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522868, "uuid": "f93b4c0f-e367-46ed-826b-5a7f47db4a3b", "comment": "Malware payload (Mirai)", "value": "dd1715be686080702026c9c49a5c15500254e16e6521847e619ea52574b5501c0ee88ebc218d106990e5f5f95b9a89d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522868, "uuid": "8d8430d4-27e6-472c-848d-cdbd5baa4f2c", "value": "T15792E12CE348DC27FA70BC7D4E6B1975F2306585A94CAA0E0033F5F9BE5131A6176671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522868, "uuid": "48632ebe-17f6-43a5-8d5e-f71dfb13dbca", "value": "384:UpIcUDD1OmJkueujc96xAAgxmUoSTCJw3CuUodgfAz2ecjiOq1jkuNM2aXqcl2B4:Iy1OOeujc96jgxsACJ7uUodgYij0jXvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522868, "uuid": "eb942a42-5933-4fed-b418-9d788f2890c0", "value": 20652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522868, "uuid": "54d96078-d2ee-408a-a6d3-f2053640d312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522868, "uuid": "c0fde895-dc75-48ca-8563-9b9eb667699e", "value": "87sbhas6as.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5755691-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525125, "uuid": "7b0a2bc9-c8b5-4978-944b-de1e82e0849c", "comment": "Malware payload (Mirai)", "value": "47680b96c3ecea8b27885f5e977811f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525125, "uuid": "fe36bfbd-7472-416e-a82d-065e5bdcde74", "comment": "Malware payload (Mirai)", "value": "c72f276fa3df330d2bc232e4277d480862755396b5a3a7f1eb708125499899ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525125, "uuid": "3d84d39e-2ff6-49bc-8a30-225b58a81304", "comment": "Malware payload (Mirai)", "value": "f5370b25055c231e520bee7c7465e72155a7f15e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525125, "uuid": "eb262709-d6d4-4f61-b89a-16e5e6ae589f", "comment": "Malware payload (Mirai)", "value": "1da6261543f4e13902c4d6a6f31356f6ebfc2f8fe3fc221ac4710087c78f2ebae90c900cf7a84f6084ea635a5908b1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525125, "uuid": "7db36af6-1de9-496b-b865-27eb37031a85", "value": "T1FE834B45F783E4F0E94A0AB0016FF73AB671DD321124DD7BDB84BD63E961A13909A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525125, "uuid": "bad74eac-4409-456e-a12b-2a610190a984", "value": "1536:WgM0GrSj+2fXnno79JF+OawXSCAMoz3PUi31kP3zC4N8TfwbZnYr:3M0GrS6O3A/+OawCLtW7CfjwbZnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525125, "uuid": "c18a2dac-0670-47a8-b9d8-be26ec0daf72", "value": 83680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525125, "uuid": "a946ed02-659e-4237-98d1-f0429444fb17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525125, "uuid": "bbc32c7e-bda8-46d2-b6be-13e13ace7d4a", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade682bc-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479076, "uuid": "02cd2b9e-056a-430d-8ec6-52a746b55118", "comment": "Malware payload", "value": "ff462ab93f6de9d4f5f1df2ccdcfbcb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479076, "uuid": "495b9d78-b26a-4fc2-a35e-129d33c53f47", "comment": "Malware payload", "value": "c835d10c29611c6c538d0f55407c6c1772217415686e3fadaf35ed008a0cf26b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479076, "uuid": "b949a1c5-1eff-44d6-8211-a0c2c99ac4db", "comment": "Malware payload", "value": "0874910ce6ee5b71f7900501602c54a19fa3c95f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479076, "uuid": "cfa1b1b1-c726-4dc7-ad9c-e42bc9a7c213", "comment": "Malware payload", "value": "466d7c3eacdd693ff9ad1311331d6479891b4b59d346dc5a5cec5dfeb14d45ee267d9cb93072986f5dca91edf9b6f247", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479076, "uuid": "3f8abead-c3f6-4e88-b5d2-df3ddc165dbf", "value": "T11E636A537C43716B3AA8B2F2C5C177908ED4DEDACDE093E0072BE189351D951EA1BAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479076, "uuid": "9e295739-d1bf-4fd5-8c22-f05cd4e88729", "value": "1536:I9l/AoSSMSwkS7hs1Nf5iAZdgsXwvo1LrlZ2QDQL6/LfuGRYMRjwnJjlWcXu1iux:I9l/5MSwkS7hs1Nf5iAZdgsXwvo1Lrld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479076, "uuid": "846f6509-7ebb-46e3-83fc-def1aa7ce971", "value": 70697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479076, "uuid": "a7e8bca0-b9df-4c0d-88fe-890c99df6a81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479076, "uuid": "32580ef5-642d-4dd1-8816-a7634748ea29", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3e6454-e04c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766528091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528091, "uuid": "604c9303-1865-4db1-a3b6-e8f5c849ce5e", "comment": "Malware payload", "value": "85103689864d41b4f07021046cee9684", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528091, "uuid": "d20e4b58-d0bd-4dd4-bf7d-e432223d5cd0", "comment": "Malware payload", "value": "c8a2bde264c1898a38ef5fb2a5bff198c5c2908ec7a4ea66b59681ab9bf82f46", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528091, "uuid": "5007e1da-55b3-4a89-947c-7cd460af9a37", "comment": "Malware payload", "value": "cc7ff5e5a6d64543e9dd0f64d4e92fbff4933b09", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528091, "uuid": "5f9970fe-81ee-4597-b9b0-7703469cc3c7", "comment": "Malware payload", "value": "b3fd288aa713a0e2bd40ce75d1d8c389a3de97772e0531709d3b6b4b747dca1d9361e4e0f644827b2fa0a3b4517f6dd5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766528091, "uuid": "2c140f3f-5952-4d0d-bc1c-ae9864fb53b8", "value": "T1F6673378484F267CEB967E7184B58E2D08F36E0003261636EA3A7F7E77957801BD61C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766528091, "uuid": "40e4ad24-6ae9-47cd-9de4-19bedc57f274", "value": "786432:4+xu0t4ZF+pl/ajbAs9Kb28HYoJMUQnc5ompr:4+xdt4ZFEifSi+hH7pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766528091, "uuid": "599623d4-0a90-481b-a8a7-dde5356115ae", "value": 32312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766528091, "uuid": "77ada6f4-dc9a-46f0-9b1e-d9e931255fbb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766528091, "uuid": "6d25c958-28fb-4a1c-82ec-0bbccc91b4a3", "value": "dbeaver-ce-25.3.0-x86_64-setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ecfcf5-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478799, "uuid": "56f6d6df-d323-4c9c-9b9d-de676605df33", "comment": "Malware payload", "value": "af18145a336d545b3eadaff66e91d6e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478799, "uuid": "43daedc0-50cd-4f57-98ec-38d409c4f9ff", "comment": "Malware payload", "value": "c8c0f29ae884187179b1891c83c89241fd60b524c1a98ab0f762dab84c589d73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478799, "uuid": "52711e53-e3c6-49e4-b26d-973dd0c700c2", "comment": "Malware payload", "value": "76faf173403ca9152bcf516f950817fa4e3dfc66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478799, "uuid": "cbe8993f-3589-4ba9-9008-ea6e59b3c0b6", "comment": "Malware payload", "value": "f35eaa71f40b0f662d17353e08641dff2246536bd79a10315deb61b1e7a63afca91483fb472bc5584b5b3d7fbc4822b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478799, "uuid": "03641bf3-2bf2-40b8-8f4b-7407f5f97c83", "value": "T151734C95D52370BB658C13CACA75113EE141B58FC1A5F02EF63C46F29A6736E1B0E82E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478799, "uuid": "68eb88a5-70d3-4f6e-adb5-995fcd565e2d", "value": "768:I8w/h62/jWs6oS+xISN0vtpfp/pCpwplpTpWpcpNpOYpupepypApkpHlpbpdpcph:I9l/AoSSMIJRusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478799, "uuid": "be547114-82a2-4b59-82db-823942012fb1", "value": 76286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478799, "uuid": "161a0d38-aa16-4ed1-9ff6-3726a685516b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478799, "uuid": "96f21b04-2c5d-49bc-9c88-a79dd2a1cab6", "value": "invoice-1645080830.pdf (73).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aacf688-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478882, "uuid": "c1967a91-7199-4729-993c-d812bde6d36d", "comment": "Malware payload", "value": "0011f852c37b89bb8caf689fe36057c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478882, "uuid": "d9930943-2b54-433c-9432-f5a94f083983", "comment": "Malware payload", "value": "c91f73cb1e07537c08d98649cbf4534be9adf98ed6288b672ad45439e375b408", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478882, "uuid": "55ac0bad-76f7-48c9-9cdd-9a9767be7fbc", "comment": "Malware payload", "value": "b7d6bc00869e93405bfa5043c99de5de621e9af6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478882, "uuid": "d6dff16b-9c8b-4639-8a03-7180f05edc69", "comment": "Malware payload", "value": "869f4ed2688d5850a82ca39685c539d910b2f685bb416d8404cbbb4d4166a2e8ebd837de195a27827b30d8b0cdbd713a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478882, "uuid": "b299204c-2a29-45ed-abb4-eaffd9f417c6", "value": "T195632B5E5CB22F595816B01C5F4D2E6CACE30E15C06D6D2B2A415AE0E40EB9F326CE7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478882, "uuid": "2707c12d-e4d8-44c2-83a1-13bb99ab2ac3", "value": "1536:I9l/AoSSM4bYJArnQ1Sy7SObEYI/3DzstzPpDCl/d9LGnMTLKVaOUAZ7vO8Jusrm:I9l/5M4bYJArnQ1Sy7SObEYI/3DzstzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478882, "uuid": "d0d92e0d-b4fa-4684-a4e9-7aa96f9e69ef", "value": 68705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478882, "uuid": "d56f7545-f093-49cd-bec4-f39d92d7e88d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478882, "uuid": "74cf465f-960c-4904-9f4b-0adf5e9e1787", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8c7eb5-e044-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766524463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524463, "uuid": "e7d8056b-11df-4e8e-afb8-b0c0102aa954", "comment": "Malware payload", "value": "8b98ff30b1b88b1b48b2bdea4f2f8590", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524463, "uuid": "5431e5a0-3de6-47f8-ac2a-e00dd297a561", "comment": "Malware payload", "value": "c95f9ef95bd0fabf48e025b98c9ce7a79e1c61aeb96b433e30d21d52082d5da7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524463, "uuid": "b6b9aba2-44cf-4abd-b980-71401392c7f1", "comment": "Malware payload", "value": "d097c8c37fea792faef88f7accc46ac017809b36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524463, "uuid": "0fbaba2c-a49d-4211-91c4-b962d3df19c1", "comment": "Malware payload", "value": "b693cd1cd90edbf267e3ded50640b33b5eef0876429f30e115c7087ba28dad36d7c917a8a884901a3e69d563833da43f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524463, "uuid": "39901750-8589-45ef-8b64-8ea8384170da", "value": "T1F4517A9D671300B6B8DEEA67BDA90804F54C94B25D8CDD90F5FE28FD368CE0864A174E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524463, "uuid": "470a449a-11c5-43eb-924b-568d9fb1d6df", "value": "48:vby7wIb0d0QwSHbDGwbbPqwLbF+twGbgWYw6bpkw9bKjwAbbuwjbvXvCwVJb4RwL:v6bYyQNHOIuC8DQzOQkNuK7fCsJUPOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524463, "uuid": "a799ba46-fdb5-44b7-81d4-7044fd52371d", "value": 2745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524463, "uuid": "a06c0e89-12f3-4096-a7f6-5b929fb22182", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524463, "uuid": "0fc80918-5918-4a17-a8a0-8bd7a34e3531", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95612693-dfe3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766482900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482900, "uuid": "33db1786-ae28-450f-864c-ca484d2fe12c", "comment": "Malware payload (Mirai)", "value": "d7188d83b5d4304a1e3fd81fb8bdfe25", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482900, "uuid": "b41979ca-58eb-4243-83d2-b0ebe759ce3c", "comment": "Malware payload (Mirai)", "value": "c970c135eaa6231d37c8ffc38a8a4e0af01807d0831a48254b013e1012942be9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482900, "uuid": "61406782-052c-4014-9158-cde1c609455c", "comment": "Malware payload (Mirai)", "value": "b1a80494011648aad602c6f2ae19a0d749fcaa1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766482900, "uuid": "43123a17-88c7-4dd3-91cf-3928af5d44fc", "comment": "Malware payload (Mirai)", "value": "6a9d50d6afa5a0d477d615e911ac4d8214716bb6a856749ff12444da8807d51a329e96591b8f98d43a0b638044ccb10a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482900, "uuid": "c1b95689-359c-482e-a8c5-75f5d22068cf", "value": "T1C241EDED12811B7B30064A29A3E355AD9C468FD1718A576CD5897C1B8C0F71C7BF9E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482900, "uuid": "315f3c0b-d7fd-4f4f-a450-7644542fee21", "value": "48:pIbdnsJavnhhapwMZBZZhVfRl7AF3OHnENMZ:pc9+u/aGuBvhtHWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766482900, "uuid": "fb6d4aa8-fd87-454f-8073-32f9c9754c4b", "value": 1954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766482900, "uuid": "045e675a-5b66-40dd-a687-63256703e31e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766482900, "uuid": "8cefa58d-c45c-44ab-9b0f-8652ffca4c54", "value": "wget_telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f770b3-e02b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766513961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513961, "uuid": "1757306f-feb6-4a66-a1c6-37996af20a27", "comment": "Malware payload (Mirai)", "value": "54e962365b62e3fd323bb820c1bc7684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513961, "uuid": "3f54ab29-5568-454b-a2fa-e4a49e931499", "comment": "Malware payload (Mirai)", "value": "c9b7e82f11bbb447ffd558b840e98e8d4472371545b80b35432b0502447e81fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513961, "uuid": "c3baad1f-b9b5-49dc-b95a-0deb8e1601f1", "comment": "Malware payload (Mirai)", "value": "b1ce52229f8e91b41bf5c13aed41cf6071b1612d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513961, "uuid": "b399f540-e958-4554-94fd-7943b8add475", "comment": "Malware payload (Mirai)", "value": "22783975e15e17a8b857caf5dbc4a460eb41a6d5f797149a85f0111b40bb646420fbd919550b119a7f6f0bd43282a5fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513961, "uuid": "939f9efb-643e-42cc-867e-418c01f341f1", "value": "T116631A326A369EA6D1C2747932BB636A75F1529E86B4C82CFC311E0DFF32844D247572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513961, "uuid": "fe3915b6-e1c7-40f1-904e-6e294383adcc", "value": "768:43L5JMDKL9m6ZUYMGa7HS2PWBxtDOQpodMO+9b9JxXPR:sL5CWp1ZUYM/7HSBxtyQpod2VrxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766513961, "uuid": "7a5799b3-3bf3-48b5-a341-dead0035894c", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766513961, "uuid": "174cfa92-ed1e-4d6f-afa0-ec3723ff8fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513961, "uuid": "c3270eea-27b3-48ce-8af7-95e2b8757748", "value": "shadow.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3988ee05-dfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766473297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473297, "uuid": "477d6265-b471-4f10-ab6e-38f5320d5a0a", "comment": "Malware payload (AgentTesla)", "value": "96a125bfccbd411212a93d60b5c889b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473297, "uuid": "47314f32-f93a-43ce-920e-aaa2506c0e56", "comment": "Malware payload (AgentTesla)", "value": "ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473297, "uuid": "49660d64-5477-4028-80b9-8b1ab8b7bbfd", "comment": "Malware payload (AgentTesla)", "value": "dd888799f9c77914119316974c893713c6d76c39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473297, "uuid": "aaac6434-1453-47fe-b9ac-dab3f1770898", "comment": "Malware payload (AgentTesla)", "value": "665f408c1c75001422e2eef15ee215774a1e662f0f5044db7d924bf1d8596393f438ec9463450f1f13d54e04b3604054", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473297, "uuid": "4025704a-9584-4eb3-8d71-04e49f104827", "value": "T114D4235E40318260447B5757A22DD7A8651CCF802C3B61B35DB80D266EAF7C6CFABEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473297, "uuid": "0bb18fda-47a5-4b04-9be2-2c139ad1ff19", "value": "12288:itQHZ4b48Mt/eQWYP9LO5RGttMmg5Yq2rkdGikDn1YzMSwKZ1tRIOTj9vC:WQHtt/dWyLMsttc5YTQwikD1cK21tbj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766473297, "uuid": "ec54c674-9dad-4fc9-8884-8cccbf2f49b0", "value": 615403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766473297, "uuid": "83cd460c-c98a-4fc4-a3d7-cce8ae658464", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473297, "uuid": "c31f96c5-a48e-44f6-926f-f662d75a1750", "value": "nCopy_of_Shipping_docs.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c555814-dfcc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766472953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472953, "uuid": "42e22b2c-682c-43f7-ae99-e4ca51a93082", "comment": "Malware payload (Mirai)", "value": "0ec12a1a1445607f054d4b05ac9b89ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472953, "uuid": "6732e7e4-d6ef-46b1-9f7e-9530219aea55", "comment": "Malware payload (Mirai)", "value": "ca5cd10672ae496a0afa907810c66f582e896669876b76e1d7aaef1e7c5af01d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472953, "uuid": "60701b26-eed5-4c93-929b-2d823a91495e", "comment": "Malware payload (Mirai)", "value": "060cdd5d574b1ffbada78c63cf5673785523e213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766472953, "uuid": "ccd5995c-7185-4790-becd-8edef83e8ad2", "comment": "Malware payload (Mirai)", "value": "5d07ec8f5b41d31ae79b46797d2b9a6599cb0e423c3bbff2e912818c34151c029c8c13f1cd2cf8a3063f356a95120b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472953, "uuid": "3e160b2e-b2a5-40f2-be63-13b6bc71cb46", "value": "T1EE63027B967112C3E6293CFD0D2EF6C2D8377261474EB399E6AF64824CDA9C70810497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472953, "uuid": "8d5f4535-a897-400d-a4d9-cc0da6978e9e", "value": "1536:2PZRx5ivJ3H4OBPKllBfAXT3tLsGnW5hd1n/JNmLWYNzcDNP:2PHivt4YPKhu9IGnW5hJNmFNENP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766472953, "uuid": "ebe8b5ab-83b7-4f22-bdf7-f3154fc3deb9", "value": 68172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766472953, "uuid": "a666ad56-c73f-4c90-a62f-8a99d42c6a4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766472953, "uuid": "be72318c-fdc3-4d44-813b-b132bfc2fb6b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89607f5-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510098, "uuid": "bff46692-31ae-4167-93e2-58b565a97e7b", "comment": "Malware payload", "value": "91eb636f921e1ba9d3de13900b225b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510098, "uuid": "8af8b65c-154d-4778-9c3e-30c83f4164e1", "comment": "Malware payload", "value": "cb9ce4fd7f421fdb13dd5317a57f045fd99c7bf31e8f107a31ca36c166e8e0a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510098, "uuid": "7ae167dc-c503-496f-9d89-802a5331f1c8", "comment": "Malware payload", "value": "aec2c4d0d16930a09816548f2d1c866385ab3d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510098, "uuid": "1539c773-af44-4f6d-8df7-3d4a3c5a9484", "comment": "Malware payload", "value": "b8c42a20a5660a5b51c273fceb456a0307b5c5e93ea8bb998b719928577a65b87f5d335e9d6ea93344cb2fb0417128a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510098, "uuid": "0f1fa76a-63f1-4e4f-ad07-b13e2a430a75", "value": "T16BE2E1671AF12ACFF1DB0E70A96B02B55EE5B6BD132C8B4C8D91166D1510E20CFF4972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510098, "uuid": "1e8ad3a5-e258-4d06-be36-37274c0fb80c", "value": "9e3c03122e5048a88cdc9a07d190f932", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510098, "uuid": "55adae25-3ef4-4cb4-9a6a-4127695e0661", "value": "768:WwBVypcggl9b86YjGTkgzOnQXIMMrEac9nKmExG1Z+6sW5R:9rGcaxgkg8QXIXrc9lExazsW5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510098, "uuid": "1b5ec986-df85-47af-b336-4153f74b5ea4", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510098, "uuid": "0540b0d4-e1ea-4bfe-ab6e-3517b8d7d305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510098, "uuid": "b7909921-8039-4d4e-81de-d5b43915d9e1", "value": "raw_cbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d488c67-e01b-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766506777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506777, "uuid": "2a50f0c9-3d22-4cab-a470-8a696059a2f5", "comment": "Malware payload (SpyNote)", "value": "e776598b0acc34d893c85b7adbe442e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506777, "uuid": "af0bcbc0-1bd0-46ea-a8bf-eaf17d1eb13a", "comment": "Malware payload (SpyNote)", "value": "cc93d01b68b59314a789c5355ac70b8e6965b9f64bb331b0337aac9d2da8aede", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506777, "uuid": "6456f378-0f39-4d38-84a8-c483502ad91b", "comment": "Malware payload (SpyNote)", "value": "977c42be18af2d999f1d944932ae77823e46ecbd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506777, "uuid": "6a6856c2-e890-43cb-8477-0900882b775e", "comment": "Malware payload (SpyNote)", "value": "a75409875deb8d3a89afbe33c61a19b18e6c15c3efc4c7e327c3caec33f5bacdf8d5cf20fd79c8e40c1f3bc1c2687216", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506777, "uuid": "4ba842cb-a67e-47b1-beaa-c424a2a05d4f", "value": "T181260243FB04DB8BD8AAC3F66F230DA929130F15C643A6DB09557A2D6E771C10EC5A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506777, "uuid": "24d64152-6d7a-4106-9ba5-aede6ce9fba2", "value": "98304:51ptt40CjOF2qcEteWAQm4V/4lQEmz/zBVTZ0tgfYHS:lL4Ty1cEodcCiz328H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766506777, "uuid": "2906edff-2f35-4a85-878a-b0b06b0f51d9", "value": 4640213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766506777, "uuid": "4f96875c-94e2-44cc-a13b-3a85f923fe3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506777, "uuid": "d46e4656-39b9-475d-9e96-1eec45d22e46", "value": "Blockchain.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0644a549-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530764, "uuid": "9d70f539-bdfe-44d3-bd9f-11b40f4ed173", "comment": "Malware payload (Mirai)", "value": "5a951eae7a59eefb7cbc29cfd1473f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530764, "uuid": "36c77a1b-6d1a-411e-9333-d8ab6d34abaa", "comment": "Malware payload (Mirai)", "value": "cc9c099ce17011141fc8c2bf54de483d4c90b29f5821347c1ade64e0e34f3fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530764, "uuid": "1d6b2c93-d329-44a2-ade6-904d9c104e0c", "comment": "Malware payload (Mirai)", "value": "0f54d9c13bbcc9f6c677ae348790f5bdf5d108b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530764, "uuid": "cb899da5-1332-4ae7-ba18-29be01ce364c", "comment": "Malware payload (Mirai)", "value": "62397f4de40443751b9df14e96cba1209e71e46af19d0d7dd521bd12bf1677c0bb8cdca54a52a9df44667cb106fe7572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530764, "uuid": "34339b75-b6a9-4496-892a-52e76842638d", "value": "T1A33329DAB402AD7CF89FEA7E80160E0AF22123551053072B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530764, "uuid": "e00af872-ea5f-4ceb-9df1-e9c109579499", "value": "768:7MehvKgc46P1omWQc7/JgFHdIp8LujWeXzpUGRJTPOMdL88pIlk:QIK34GWmbBF28Sjp1UGRJbOMdw8Sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530764, "uuid": "cbe59a88-9e04-48eb-ba8a-7927634dc1ef", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530764, "uuid": "73eeed2b-c7c1-4098-a7a8-1c0c7df7ec5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530764, "uuid": "25f2aad4-25c5-4eb2-be58-e06d5b66709a", "value": "Josho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38466ba5-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488327, "uuid": "acc33de5-54b8-4df3-be2c-0a1b23d0bea5", "comment": "Malware payload", "value": "d4e4025ddb7c77fbca9fd5f622dc56e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488327, "uuid": "ecf0cecf-e069-4341-9c66-75475536d5a2", "comment": "Malware payload", "value": "ccf088e293a50ee9479324d9174c4f270b6ac4cb77d3dc85b1a80735509ce027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488327, "uuid": "bd30a769-32c4-444d-ac53-fcc62981dd2c", "comment": "Malware payload", "value": "28d7d6ab7bf9142d5df7cbc33ecf6ba6a9db4a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488327, "uuid": "a4dbbf6b-72d7-429c-984e-ca0bf2df9220", "comment": "Malware payload", "value": "bd05affa5eab5b2a96c401fd407cb25e62e5516667d3c7d610cbb874140deb0d2f20e7342b7c12f6277150f19a23e5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488327, "uuid": "3687c1a2-5699-4bd1-830b-2ca0eded5e24", "value": "T195E4120172D2D876E17205B68A784EE8462EF5714B52CEDB73E8C4AE4F309C16C35E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488327, "uuid": "95306fa8-62e3-4e42-b8b3-df404cb2b06a", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488327, "uuid": "5cf10998-d1ff-4c1b-9d15-f52e22588622", "value": "12288:UHztGhqRHxqyvVJCfYP1p/d7istuDMJ2imq+Jrh+l+3BIEnh:8uKRXV/P1NdTtus2u+BhTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488327, "uuid": "25a56591-4195-441e-9ba2-afcefe3cde99", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488327, "uuid": "70ab4e2e-5981-47be-89ff-3b61e26e88e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488327, "uuid": "60a0baa3-650a-4baa-b63a-a62813625bb1", "value": "ccf088e293a50ee9479324d9174c4f270b6ac4cb77d3dc85b1a80735509ce027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f055614a-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478758, "uuid": "b357930b-061f-4e08-b7f8-36b7c3e9d878", "comment": "Malware payload", "value": "3a098c91cedd482854020d1d92ec981e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478758, "uuid": "7e1b58be-20ee-482c-ad08-6b8c30407781", "comment": "Malware payload", "value": "ccf2830646298d97a8afa16657ad6f3c97df41d26e1324b5fb8a1d61a10548a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478758, "uuid": "31043191-ef29-40f0-b6d5-287ff604ea02", "comment": "Malware payload", "value": "ad7b48b8471e6a268ae5aef690dcdda9f762d01b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478758, "uuid": "82782778-06e6-4590-91c9-9594b67b19f9", "comment": "Malware payload", "value": "d711438d77fc939efb648510a5a7af101c4e8b79f46db76898aa51cf24918f38095457b11fac08480f0759c5a904892a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478758, "uuid": "eb00f84b-036a-4313-b65d-6b0fbec67ba9", "value": "T1D863E9C9C3F298CC02E9F599AF6C2F872F5ED9E015563AE7E81D79B46C88C9C211A051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478758, "uuid": "15c3d3db-19b3-41da-814d-1f63f651366f", "value": "768:I8w/h62/jWs6oS+xISN0vOitlCJHJzteN3WdRRLZ1yeWy0KiyShsmVgmap1VvaFL:I9l/AoSSMg3RDusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478758, "uuid": "e472c6cf-0a53-4f85-94ee-6992733109b5", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478758, "uuid": "34b27cee-add4-401d-98bb-f26613a9bcf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478758, "uuid": "5afb9ba6-9d8b-4c86-b4b4-325135cac917", "value": "invoice-1645080830.pdf (79).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e943242e-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468867, "uuid": "45f536e8-f6a2-4f56-bc2f-58d7318e5d63", "comment": "Malware payload (Mirai)", "value": "f063cfa1ba190e0ac6465c2f888ddc4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468867, "uuid": "164c222b-5c3a-4e96-9898-e0fc8a888673", "comment": "Malware payload (Mirai)", "value": "ccf95a3eec1288e2cd0c6b4e73a636464c13bf16d480a0ab441c75a19e2fcc78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468867, "uuid": "b8a5aedb-e250-4fd3-96a2-6e18beb4d61c", "comment": "Malware payload (Mirai)", "value": "2a5563031629514fcde75f551dad1b03fa6acb6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468867, "uuid": "75531f62-7884-4249-bf6f-91091e4e5d2b", "comment": "Malware payload (Mirai)", "value": "7516e093e709a49c55f4bb87f931d654bc0d533c6a5cb24fa4ff9fd937c705c12e3dd4d33554f949edcf39df8a302452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468867, "uuid": "83ff4b17-cb31-4946-8438-6ff799aa18a5", "value": "T191C32853B400DD7FF88AD7764683CB35B53173A29BB3126276436937B8393A40D26E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468867, "uuid": "3771fb8d-d383-42b9-9073-55cefd158013", "value": "3072:EksoHPfMGEteBnYaPsktYRMJIrRpdfHYTV:Ekso8ZtaPsktFyReV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468867, "uuid": "85f2d696-c9b7-4bd5-be6e-ccb5c99b2db4", "value": 120456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468867, "uuid": "b19338cd-88ce-4ccc-af2c-62ad444cb206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468867, "uuid": "ac9a02c8-532e-4fd4-8552-77c3a282833d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1ca05e-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525114, "uuid": "89793b2e-6e4f-4784-8108-273ec1d52071", "comment": "Malware payload (Mirai)", "value": "04dbab4ae2cba91001f8751fbe8874e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525114, "uuid": "9c4a3cdb-62e9-4ddd-afe0-3a6a0ecd43c3", "comment": "Malware payload (Mirai)", "value": "cd2432cb295ba51ab64d24c880ccf5b5d5ff78ab5431fcfe1ab5953fa0c1d2fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525114, "uuid": "afbf2224-3bb0-46ff-af88-6be0f431181e", "comment": "Malware payload (Mirai)", "value": "33159cb9e6d792a3521ee8eebbd029d298f5e3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525114, "uuid": "48929159-7533-4a87-9ccc-9b29d263f1cd", "comment": "Malware payload (Mirai)", "value": "09084f129b24839d6909a02b2b6c8ab5d3a6acc9ae0b1806ebe74044df35b970c7b8f8527ad9e9646b5931b800b30b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525114, "uuid": "58f01ea3-40ee-41a6-9d5c-93dfb83ab36f", "value": "T180733B02774C0E43D1964EB4263F17E0B3EAA99121F8FB88650AEE46D675E33514BECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525114, "uuid": "15ec8c0c-86f2-4601-9286-3e51e8417a2e", "value": "1536:C0lJle+e2YM7p1GGxMkMKhOnvHYCLQSdIhETlFrm+phtJ2UwbZnIq:CoVGG9MoOlQSdIGFrTlwbZnIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525114, "uuid": "1e78a617-0661-425d-8258-d3b33983a710", "value": 79328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525114, "uuid": "1646e112-7cc4-43bd-8d4e-a2d773b45576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525114, "uuid": "6d9c6c43-1feb-4c57-ac62-f5dcbd370d47", "value": "440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da23a1c1-df9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766453380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453380, "uuid": "85cfec81-f606-4c31-85e9-d9ec628e8add", "comment": "Malware payload (Mirai)", "value": "00c038cc43595ee199a534be912756bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453380, "uuid": "402fbc07-3f15-4181-80b1-a02e5cf2b562", "comment": "Malware payload (Mirai)", "value": "cd69fc3faa8bfadd257a93ac2b25b41fe04f240173059456e870ea82838a571d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453380, "uuid": "3c8a20da-2fe0-4ec6-9f84-c5615ea70f1d", "comment": "Malware payload (Mirai)", "value": "cb8f32c46a5b319b1ea10f8a3b27a27d6edc4c8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453380, "uuid": "1d82779b-45ad-4716-bd24-64527f931a85", "comment": "Malware payload (Mirai)", "value": "1a1a5eaf20a095422130116a7cc11512f0ed0fa93953637f83643c9110b599ef45ea7bc5b0e8cb52f581870a8bc7790c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453380, "uuid": "1bef23c7-3c2c-4263-bcbe-8a60b1901aad", "value": "T1B8D36B22F47E591BC5C491B752F74736E1F2634960BC4A0E3D630E8CBF6169022A77AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453380, "uuid": "1edbe8fd-b1fb-43c7-9a0f-96add595b31f", "value": "3072:eA6aB4HbrJL+LTawaiHRE8SUti/1512gqNDlY1rxNt9Ey86:eAvBY339EH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453380, "uuid": "19d8ae79-4bd4-4478-95eb-c759f2e54477", "value": 130064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453380, "uuid": "13ce6998-d155-4e9e-ae12-ae3c9ae52b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453380, "uuid": "87863ef8-5714-4f32-979d-bc697c8ab039", "value": "rondo.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d4d82e-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478977, "uuid": "26eaed2b-b51a-4395-b190-14542f0154c3", "comment": "Malware payload", "value": "b143f929de84631e49c1cee22e344c27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478977, "uuid": "7a781b0b-65ec-4c47-8c6a-8d618e080e7d", "comment": "Malware payload", "value": "cdeafab539c1ce12419e47e6622d0c5366e24da0c23c897f2e127b924dfbf446", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478977, "uuid": "39d08bc1-77d2-49fd-aaeb-6516ae52c710", "comment": "Malware payload", "value": "85eb5e92facaf136f4f5b6a88db425c6c1b615d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478977, "uuid": "707f632b-82f6-4401-8e00-29adb19b7920", "comment": "Malware payload", "value": "afd43a83b8a5c7b37876b8bc1497759c5c6ecfed5a1e6d278883384db6917683f374684a7145f35f42af7ed02453f4bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478977, "uuid": "984f210b-a6ba-4e25-9928-d8186e548074", "value": "T1EA73088785A3B7CB639A3C026FE293E24A9BBDDD4C95900B6D714C8F1D9C520D756338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478977, "uuid": "f5800fba-aca4-437b-bb59-33a22c6db25a", "value": "768:I8w/h62/jWs6oS+xISN0vib4y40vodkfScBYrwz2y8kTAlGB:I9l/AoSSM//usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478977, "uuid": "23d0c764-6b87-4167-bd93-73ca8ba861e6", "value": 73471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478977, "uuid": "4c78fbe3-d4ca-47d2-8ae4-772a0f54e1b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478977, "uuid": "a19e7472-1cc8-4ef4-8ae3-10ff1c380364", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cec261e-dfcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766474242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474242, "uuid": "f54940da-b7c5-49e6-8784-ee4802247903", "comment": "Malware payload (Mirai)", "value": "68b16626cbe82d9a2e1bedce4a966ad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474242, "uuid": "1a000dad-adcb-4e1d-9067-533a61e502f1", "comment": "Malware payload (Mirai)", "value": "ce54deda8ab51d059c10bc964558358b8fc2928229cc24cdf4a1710cc21c61f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474242, "uuid": "adee21c0-891e-45a0-bfc5-8c6505aa7aa7", "comment": "Malware payload (Mirai)", "value": "01c0c0756b33f033151394ee640e9c6a5cc2649b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474242, "uuid": "ecbe4da0-c0bf-4e16-aae8-1d422a79b75c", "comment": "Malware payload (Mirai)", "value": "3f7fb3500c55cbe9e867254de27feb3231af5374258c5044f0827d6f470fca2a6d645133b31d5baee703c80810f7b972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474242, "uuid": "83382230-9b9f-479a-b243-e5fcceac1b42", "value": "T14FA3B087A150FFBEF054AD7FC5038E19AF11DF605A831B25A4BAF9905A7A3847353E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474242, "uuid": "e7f21aad-40ea-4fe4-ba0d-ef022e19fac1", "value": "1536:pmgC51VoP+xex1ciYaVzsfdcjOHjsxlrvlMaVDKbUoOXWnkb44J8rSQ:pmnoP+Qx1ciJVzsSOjEvlMaVD/Wn2USQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474242, "uuid": "3f6a39d2-b9e9-4d16-8c14-4bcd24f6726f", "value": 106968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474242, "uuid": "ae12a972-ddbd-4af3-a358-e28ae7ac5722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474242, "uuid": "d65acecf-471d-4ff5-ad34-f78d853c2945", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f016832-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478863, "uuid": "831d2963-4b7f-4aec-8e34-59b42eb0b657", "comment": "Malware payload", "value": "c8bc6c70d9042edc5fe5569f55825258", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478863, "uuid": "5a4b62a0-28e4-49ae-8ba9-37b894d047cf", "comment": "Malware payload", "value": "ceb911aedcafb5862b2818baf9cd91e4a8b2a6c203fe932266a59db7ff72b2b0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478863, "uuid": "51d3dedb-d0aa-44d3-a971-86729e8deebb", "comment": "Malware payload", "value": "92f2298492c6f54ce22885c549ef612c0fbd32a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478863, "uuid": "7eb3041d-9dff-497b-a878-dd4f15c1b8dc", "comment": "Malware payload", "value": "0365ac923384e604564c92be60ed78b7d33034d66ff2fed1949d09109d786bf6443c8a98c2925db14b7285ea14d3d1f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478863, "uuid": "259153a1-4b06-477a-a809-35ce7a730f19", "value": "T105631ABD9BD84F0716DCE52FE69E07729B611DEB6CF0111798A1A20314CD48ABA6C3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478863, "uuid": "17fa2b5d-0fd6-452c-95a0-7bd5982b4538", "value": "768:I8w/h62/jWs6oS+xISN0vA2ANwW6dkfScBYrwz2y8kTAlGB:I9l/AoSSMAlousrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478863, "uuid": "13be9b95-37cb-49cd-b4ec-5181359f322a", "value": 70557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478863, "uuid": "c951599a-c393-4d4e-8eb1-60300b2763fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478863, "uuid": "02be3e69-280a-4e96-8b33-cb4c0163aa34", "value": "invoice-1645080830.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badbeb9e-e040-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766522906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522906, "uuid": "c5016563-c656-474e-9c5b-8947784e1672", "comment": "Malware payload", "value": "753dadfc332236d5932e354b9993b2c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522906, "uuid": "d63b26d0-b4a9-402a-98bc-7678dd6f8ef3", "comment": "Malware payload", "value": "cee708fb0b2d9a1e61df1277840568867dc44b41d40fa4ccd11fd70064e50119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522906, "uuid": "07cf7fdd-3ea8-47f2-99af-18d745dfe084", "comment": "Malware payload", "value": "3d0b745baee8d2c8e4508905efb3baede84c7b4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522906, "uuid": "709e43b2-89e5-4873-ac35-9b14f9f35ce4", "comment": "Malware payload", "value": "5ee28a44ed4a0fdf957d4d692457347202f8d35aa6a53db507fed0a2c31c612c5aa0df9126b415397ca5a1351b41eb36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522906, "uuid": "91334a30-f8c2-4359-b274-e3a5e41ffbd8", "value": "T138E2D4516C925A2BC6E4237EB97F558D332173E882CFB61BCC125B14B68592F0D63B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522906, "uuid": "ed80c1b9-ac8a-43aa-b340-f34cea785872", "value": "768:BgfbCl0cNAszUfWkONw4zzxRmW0s9PNVk6K:qfbxcfoePw4hRmWhzVkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522906, "uuid": "0527b7d6-1edd-4676-8866-a6548a59e9b4", "value": 32880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522906, "uuid": "dd9d8f00-faa6-4fe2-bcae-6f877a1dfbd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522906, "uuid": "6444b3b2-4d61-42b8-84ca-2d9b749c4b97", "value": "87sbhas6as.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a2738-dfdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766480291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480291, "uuid": "79bd995d-01b9-4d54-ac33-e1a16fe09af0", "comment": "Malware payload", "value": "25e8328fd6054b548a9f082a1ed7a80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Vigorf.A", "colour": "#875674", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480291, "uuid": "af50a043-7190-4d82-bc8b-a2993955c661", "comment": "Malware payload", "value": "cefe8e08a63508ea77007f4800a8cd12a245789b648bd21e1bdf499bd51f5838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Vigorf.A", "colour": "#875674", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480291, "uuid": "8f5556ad-8cc4-4d72-8eba-2f57778ff46e", "comment": "Malware payload", "value": "fb962826c6bbdfb181a36b1ec1572a09937d017d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Vigorf.A", "colour": "#875674", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480291, "uuid": "40b0ee01-3085-4cd7-a1f5-2023bbbb8b23", "comment": "Malware payload", "value": "4b66069fcea994a5dff3560a95ef02c0a70d397fe8a5abbabd4800626476992f6e6a967d23eb6350e369fa7eb9a0fc71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Vigorf.A", "colour": "#875674", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480291, "uuid": "e220a71f-27c5-4ac3-935d-4a2ab9bc3027", "value": "T1AFF4AE0CFCACCF50D29711B9A32219D2F26D7918A73193337BD12E943C897A9569B6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480291, "uuid": "1438dcfe-f58f-4cb6-82ae-a7b23d691182", "value": "fd8f2c88fa4436ebefce520cbe5d1799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480291, "uuid": "e5709a07-3950-498b-a148-4e687c0e4254", "value": "12288:k5TXSK5TXH5c1UJAIsDTuYv7PNvxetURSx7dPSl0nKMRWM3:k1BN35pyIKTtu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766480291, "uuid": "923876a5-687f-4b61-9e0c-842571b38f48", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766480291, "uuid": "234b5e69-b2bb-4974-97ba-1a1e1a8f53cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480291, "uuid": "51c020a9-6182-418a-9cbb-efea85a4562c", "value": "\u540d\u535512\u670822\u65e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e7349c-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510119, "uuid": "ddabcc17-53c3-4b8b-adac-b70a97de2a66", "comment": "Malware payload", "value": "001fbd8638ec5d81b8a38aa6bb7bd9ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510119, "uuid": "7c85512b-511b-4ef0-8f47-85c45ba2de3d", "comment": "Malware payload", "value": "cf518a1c6d447d1537802e21a32994e5fe3670e7521abe51bf20e96e3495bd22", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510119, "uuid": "3f62cd9a-738c-4a99-94cd-53e53a76fa5d", "comment": "Malware payload", "value": "ce98a4427c285b8a1335f090d1fe4a16d7b5fef8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510119, "uuid": "ccb18f1e-dbe5-4462-8ac1-7ff947d0873c", "comment": "Malware payload", "value": "3454432945591107ced0e10c1f67a462ad5835904846ea6417ef7961d3ccfe262f67733cff50e208a8a342fceaf123f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510119, "uuid": "084e2329-c904-45f0-9744-74bc9c70e1ad", "value": "T1682612F2693DC0205CF70122BF579168B67744A9A25A04F47650A5C976ACCE2C3BF8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510119, "uuid": "fd13ea57-264c-4d5c-90e0-7a797081eebc", "value": "192:qhuku/uGUkueuWu3huRuUu6uhuXu6u/uLu0uZuXuJutuiu3uDuwusutuOupuSguC:qqUt2rLkcSpb77V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510119, "uuid": "9abeb929-9811-4731-87a9-04a6d79eb6ae", "value": 4829088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510119, "uuid": "7107d1ee-94b1-44ef-96c2-40ffbe6ca21c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510119, "uuid": "def5d51d-e92d-487b-8ebf-b872402e72f1", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a95da52-dfae-11f0-a129-42010a9c0007", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1766460011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766460011, "uuid": "35cafd0d-0f9d-4880-87b9-6207ff5eb999", "comment": "Malware payload (RemoteManipulator)", "value": "26d3d352efaaa029c7bdb2f9abd3b68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766460011, "uuid": "29acd351-8fbc-4681-9d5f-71b16745ab3b", "comment": "Malware payload (RemoteManipulator)", "value": "cffdbd452f87c26bb1b073d6be0dab16af4010306d12f80b30d73eb4aad40d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766460011, "uuid": "7f36593d-7f8b-4ed2-b3a2-0462f7db62a4", "comment": "Malware payload (RemoteManipulator)", "value": "243b647f8c13812f541beea0dfff4a40ba1282b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766460011, "uuid": "b6e0bf1c-9bbf-4d8b-946e-fa72ed77c5e8", "comment": "Malware payload (RemoteManipulator)", "value": "d3022ee3be56c8b9246deb045b4994d4964be6040ae5d93a8f5b31269b2223e943d4809781d3fd269fa287c89fc01577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766460011, "uuid": "783fcb4f-1ffe-4746-8f07-d8e4fc713d82", "value": "T1F127F117B388643DD07B1A3A483BA714963BBE61391ADC5B67F8184C4F392816E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766460011, "uuid": "2738a39c-d2e4-4509-9611-663366e354b0", "value": "03ddf423826fa1fcd7b9b240c54fc40f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766460011, "uuid": "7d3aaea9-6922-4a99-bf2d-46f624129e0e", "value": "393216:zbU5x1DFBPKITSwVvKukyyvPLLhaOshsOv5WBTC:sFItivKuryHBaOOEBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766460011, "uuid": "7a2d44ee-5f2b-4f11-9228-7d66d26b1078", "value": 21906944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766460011, "uuid": "86e07c5a-268e-4ea7-9881-9bfa4908049d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766460011, "uuid": "1489977e-2e56-41f9-98bf-ef2ebd7f9213", "value": "26d3d352efaaa029c7bdb2f9abd3b68e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e842d60-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478835, "uuid": "efe252bf-4ef2-415f-ba27-a3685424e5f3", "comment": "Malware payload", "value": "e8f7352e1eb608359e659326f8710e7f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478835, "uuid": "bfb56a00-1544-4060-b30a-b3cb22957ebc", "comment": "Malware payload", "value": "d04c480b162a6aa54304049ac031b560cd7483320d373e14a3bb055663d99ebe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478835, "uuid": "342e0838-0f81-49ec-9fc9-86babf74af55", "comment": "Malware payload", "value": "85dfadc8ae93e9ec71f8b6e3bea02203a1131969", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478835, "uuid": "c4ded2a3-6f59-44a4-a5ed-c3ae7ae7d390", "comment": "Malware payload", "value": "2e93903ed3f9a3b1588a097d932eb264ed99252cee5e4456d93bee87122ebdd4635eb714aea5a3bdf596cdb8d7dc59f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478835, "uuid": "35cc73a8-8cc2-4b27-bb0f-9f85f99e8da1", "value": "T18C630BD786A33C5E787F5EA8FA6726C6F064DC788812C711028B163568D5F689C04BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478835, "uuid": "1f4dabb3-a7ce-4ca1-9f64-19f08337f75d", "value": "768:I8w/h62/jWs6oS+xISN0vrRV9/xdkfScBYrwz2y8kTAlGB:I9l/AoSSMBpusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478835, "uuid": "b7fbf255-53da-4b3c-acb1-e9c699d97db4", "value": 70545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478835, "uuid": "12140aaf-4173-4bb4-a41c-5a50647ce6b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478835, "uuid": "350ae4df-4641-4f8e-b582-a10816d44b9e", "value": "invoice-1645080830.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c20c66-dfb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766461340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766461340, "uuid": "602f2f55-7451-43d7-9204-aede29be3766", "comment": "Malware payload (Formbook)", "value": "b2e6afd00bad004cad673c5ba6ee5478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766461340, "uuid": "50a5e491-4f43-4268-a624-ae89356fabb2", "comment": "Malware payload (Formbook)", "value": "d06458d564b03abe3b7b9697c5b1a8e3b3bd72131f05bf7a02e8113cf40c4fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766461340, "uuid": "bdabc913-192c-4004-82d4-334ac8ac1d55", "comment": "Malware payload (Formbook)", "value": "c4b8a6f07e844b674c57e8b6e4724d6f7e349fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766461340, "uuid": "6ba08f2a-909c-4606-94a5-519293016226", "comment": "Malware payload (Formbook)", "value": "9c91c0872e2c6015e0813325fc64e44dd691617f396ec3e2dc3024f589450baedad0cedfa50b6a997bf86df86d4036e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766461340, "uuid": "9647a918-918b-436c-bde6-56a8b9073c57", "value": "T1DAC5AD25E3D906A8D527EA38CA61A333D7B178464731D58F0A98D7162F73E909F3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766461340, "uuid": "1fe570de-637a-4bca-92bc-6e4bbae57887", "value": "95de1cd7eecd16b9d38ba1ad174caf95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766461340, "uuid": "cbd1b598-991a-43bf-9e5d-e038a70bf841", "value": "49152:Ug81eBY59XSCAJgpCCNh1DfwRfxEBLBR:KICIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766461340, "uuid": "c797689d-2265-4949-b31c-42ec44a09cb0", "value": 2567680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766461340, "uuid": "3322ae4c-71d5-4a90-999f-da91455933e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766461340, "uuid": "aba4e06c-fc15-45ac-8cae-0526026becee", "value": "BANK CONFIRMATION SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eebe012-e019-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766506082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506082, "uuid": "e63e55c7-4ef7-4b4c-850f-df25fd3ed657", "comment": "Malware payload (Vidar)", "value": "7eb3a3fce3ac814eae5f6dce3274916e", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506082, "uuid": "58ada3a9-b2bb-4c5f-9315-2e85a1cb4d88", "comment": "Malware payload (Vidar)", "value": "d09482e0f77d9da74a45fde16efe60d38f5cd7c7e32484b99b9421765c3266a2", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506082, "uuid": "af900714-9c2c-4eeb-9eb7-a5ff9b1ea05c", "comment": "Malware payload (Vidar)", "value": "7842bffec88bc9c9d55322117982fcbc22bd1198", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766506082, "uuid": "9dde368a-adac-4910-b885-67a72a2dac6b", "comment": "Malware payload (Vidar)", "value": "3ee84ae395678c2c44594b1b07e1b246a6334cf5e245cbbd7968f5fa96a27d96f8de88cd066861f4c5c4717777256a85", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506082, "uuid": "78ed0100-d2ed-4b1e-b53f-b0417d37ff3d", "value": "T102863335F4645A4BD17F64796DEC050AE0C7E06B24A39BE0CC28528B6D04EFBF70A94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506082, "uuid": "d262cd01-b54a-4812-9c53-8b56e35f4827", "value": "196608:Hw8sZ2wjsnnITbj/vvLMbKFjUlAXFDBigNnWfa7zAOgAAbrQR:/sZ2wjRLUKFzqSoa7zhbAb0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766506082, "uuid": "4a67ece9-d877-41ab-9427-99076c137155", "value": 8470977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766506082, "uuid": "00875a1d-3cd9-46f5-8fdb-5c0facfdfe5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766506082, "uuid": "d0fa6941-a16c-4172-a119-91c21c2eabc4", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9313278-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525131, "uuid": "7cd84bf8-d3cb-4754-a087-f5dfbf47db36", "comment": "Malware payload (Mirai)", "value": "501ed0b0c6bdd37b481b09d3645eed10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525131, "uuid": "45a29c49-d96a-4aed-bdf8-6aa6de857268", "comment": "Malware payload (Mirai)", "value": "d153fa995a1ff5f52db47993ba694a358578fd2e1dbc4739590ba8ffcd4f6d19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525131, "uuid": "11de3edd-31da-43d3-a9ba-64d8d2897d2e", "comment": "Malware payload (Mirai)", "value": "b5d4bbb8ed2270c31f5aa5f4d91b77261679de6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525131, "uuid": "770e5dcf-086a-4f4b-b3a6-3bcdaba2dbfb", "comment": "Malware payload (Mirai)", "value": "ab56d3c1b86e6868aad6902297c64355985e4e70b2559aed207fd64721d58cbdb89e58f6faf4fdf57de0fecb19f53227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525131, "uuid": "ecc58e9f-fafa-414d-90c1-6aeef4890b8f", "value": "T1B8639EB3CA266D54C04882B5B9B44EB83393E44086671FFA56D7C96AC483EECF1463F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525131, "uuid": "8162d5f7-464b-43dd-9d23-18a166bc788b", "value": "1536:Pan/fmyv0FNhY8T1U339wrKXGMGzwKASCOlhl/d+1yUwbZnU:PSHv8a8T10aOX0wKASXhlFylwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525131, "uuid": "7f98b7ee-1923-49d0-be54-78e99f8a3efa", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525131, "uuid": "42e00289-5b07-4cdb-ae4d-7fc1d1ed50ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525131, "uuid": "af3c549a-bcdc-4ed1-9cb9-5a12213990c4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34f6836-df93-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448564, "uuid": "1b62f04c-fbe2-4d0b-a828-c096f1a9f88a", "comment": "Malware payload (Mirai)", "value": "73ae639c648527ce932076c1d81c7848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448564, "uuid": "3b491447-989e-41d3-90ba-822ae06ad81d", "comment": "Malware payload (Mirai)", "value": "d174ad26557e6c17c86c266a1c3d9b1e3e10385946b9abb8041aaa8b041d3af2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448564, "uuid": "7084337e-eeb6-42f4-97a4-8cefc1ea40cd", "comment": "Malware payload (Mirai)", "value": "562a02e010d707fe5b6c96c291eebb7625965aef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448564, "uuid": "2c60f0a8-69db-48a5-8aba-d02cab9019ea", "comment": "Malware payload (Mirai)", "value": "01877eb3dd9f2cdebdc91546dac81d377128c6b1fbfa5f17ca36655f8a62043524be130d91b7fde1fda7d4dc9f568a55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448564, "uuid": "dd72b982-9a9c-42a7-940d-bedbd2c9dd0a", "value": "T1BBC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448564, "uuid": "cad41bf9-9e6c-4899-b6e5-6814ae11b52a", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy1w:VoRNjmj1VGFVrRiya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448564, "uuid": "e2e4054d-0129-4515-953b-a460b97f7b67", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448564, "uuid": "2c433684-59a8-4e94-aaf6-7b7f92c205e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448564, "uuid": "40af5bf0-1ac8-4ac3-9baf-c9c0d8107185", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24eee2c9-dfdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766480134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480134, "uuid": "3b6eb923-e62b-4010-bf1d-3812667a41da", "comment": "Malware payload", "value": "575ffff1e02f8f0110e8830a904195c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480134, "uuid": "13edfd25-3b50-49f3-b670-b1f56d3085cf", "comment": "Malware payload", "value": "d206f254c84fbeb5c0918b59ad017fdf91e77ccb34bb22f4f59379ce8b638636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480134, "uuid": "5098f963-e611-48e0-9dff-ac0b0ff89520", "comment": "Malware payload", "value": "43561a54b25eb020229dc4b286d9deba85d931b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480134, "uuid": "b57fe373-f280-4279-9419-a6adeabbbc32", "comment": "Malware payload", "value": "6f1b0bc7bbdaa686c84ab7cdfcc3434ed487f3a3e5a157f976d7919060ce2aa663d23db94484f8e0e9c0b405a207e56c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480134, "uuid": "445f0106-584b-4fdb-acec-b2c7bea34324", "value": "T18F73B65AE76721E8C9BEC4389252B63AFA6174694730ABCB87504B570F71BE0BD3D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480134, "uuid": "d45e2a74-8108-463b-9891-1a12790f662d", "value": "a61d990e7a255f3c56bfaded5a9c78ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480134, "uuid": "68e37916-567b-4449-bcd3-aeddc188291e", "value": "1536:SSz2N6K9RGA/8N0FuxxSTqx42OMZN69P7wHDAf9w24K2jVYQ:p+RGA/8N0Oo+xIMHDAVV4K2JYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766480134, "uuid": "b5ca3ffb-dc90-49e3-8802-f31add9d7c67", "value": 76768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766480134, "uuid": "9327a461-71a6-4ce4-add7-421df90ce687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480134, "uuid": "9b642d2c-7112-4a9a-8af4-b22188c6cf26", "value": "11.17\u8fdd\u7eaa\u4eba\u5458\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11037d6f-e04c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766527775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527775, "uuid": "6e5afcd1-0f43-4a1f-bd81-826273015e58", "comment": "Malware payload", "value": "41b63f01769333f18fecfa793df191ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527775, "uuid": "75a6066a-0101-4672-b071-b33ce542ccba", "comment": "Malware payload", "value": "d266deb9916a1c48c980813610e9fd5785a857fb278b3ff83ef44ec5ed35a277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527775, "uuid": "5f5f4e12-a0cc-42ea-8b47-2a6e8e290124", "comment": "Malware payload", "value": "8a42bbf793e3ed1d318ee75a15b9971189f2cd64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766527775, "uuid": "9abdde9f-187b-4969-832a-d1bf1a96b10b", "comment": "Malware payload", "value": "0019152259ed836c1d5f9f19b6c6d9a9c6fc64ec0b467ff7d4643aee1b9a07c7562aa9d22970995182bcc30f4e4ee2ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766527775, "uuid": "25925fda-3284-4649-9533-fa9ba286426b", "value": "T16AE63A47E8E21D99C4EA8174D16A826BBA617C0D1B3823EB17E0F3341F37BD05A76791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766527775, "uuid": "80ef7da5-2a2c-42b9-a797-19473def862a", "value": "98304:XWFNeg+KfP+k2cA6JD/pKTtaim7R384qZHUUpA6FcV/fW:Xw+2XE6eTsieR384CHU/jVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766527775, "uuid": "f0e254e9-9cc4-4676-8144-5c5f047a9d47", "value": 15061140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766527775, "uuid": "13c8fed9-f712-4d0a-8759-dcd6f13dee6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766527775, "uuid": "8f0cf4eb-ac2f-48b7-8c85-476239992527", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4e88c0-dfa0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766453973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453973, "uuid": "d3d6eb9c-4ae4-43fc-8fad-113dc4d15223", "comment": "Malware payload (Mirai)", "value": "e48fe884328536c5c3757aa7ab74d6d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453973, "uuid": "001d3e39-2200-4705-9216-1f70b8dc8fb2", "comment": "Malware payload (Mirai)", "value": "d303197d2da39d114bb896f3c7cf55c9f3635e415ab66f97fadbbc884209000a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453973, "uuid": "a1bff553-c7b1-4e89-b061-c2dff2b79a8a", "comment": "Malware payload (Mirai)", "value": "559107764198b8468d91af4d69cc6a18b22de8fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453973, "uuid": "59d4649d-2d22-49c3-befc-6b68c24ed9dc", "comment": "Malware payload (Mirai)", "value": "29c6dd1ba933db4eace54e7e7843661d58e82c4f1ef4e9277580286608f4f0d26537abdddfd58a035005893e2b5a0326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453973, "uuid": "7a7f538f-d7e5-4ddc-9612-fb97a86a2c45", "value": "T1E943F786B991DA16CAD1657BFF4F82DC371643A8D1EF730399186B61368B82B0E3F441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453973, "uuid": "a3ed0dd5-38f2-4666-9f2f-afb5bb0a4ce3", "value": "768:dd/LMC7zQSOt1Ud3CMKH/AlK2f7Dg+DYcCTNNJdwvAVcwQXMoMiZ3UHPSnFgdT2P:v/LHgrAlnfX6J2ic58P3SGdT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453973, "uuid": "7747beb7-b624-4932-a934-9a1185a94de3", "value": 59296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453973, "uuid": "d00e5e7d-d4e5-4c67-97e6-7e8eff4773fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453973, "uuid": "b1aca78c-0440-48d8-b2b2-5538b547ecfd", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b550dc-e04c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766528150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528150, "uuid": "018f26f8-a76d-4e85-830a-b157ef426535", "comment": "Malware payload", "value": "f703183fd3a7d0d0d72150dcd3b02583", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528150, "uuid": "28d20a7f-15d8-430d-ac43-f73c26382dda", "comment": "Malware payload", "value": "d36aa8dd142f9645600c964fe134d907130ee5f001b09a8fa135145670ffa5d6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528150, "uuid": "bfa3207b-3d06-4665-b67a-23c5ceb32fa9", "comment": "Malware payload", "value": "462738f0ea21b2fe8018c220a2d290a01feee032", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766528150, "uuid": "f7da0822-1159-461c-bbb1-deb4a0a3ecf4", "comment": "Malware payload", "value": "000f86bbba87c3eeb9a22c28f83c36d11606b7e2ec6a163d70b7f20a35260a51d04424804021365331225665973f4946", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766528150, "uuid": "86944211-2c6b-4892-9242-7f7ed924bd7c", "value": "T17873BE24CABF10B9DEC9FF7F5193E6616B11625B2E606D343FF0A38A1DB5520842C94E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766528150, "uuid": "5f640ba1-f7b0-4dfd-ab8d-7800241db0e2", "value": "1536:FyYzOWSdvltxlqhd9JsauHM4iisVauAIvTsJLMF4E6:ZSWSBLxyrJWMBJvwJIFH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766528150, "uuid": "a0b7a8a1-b3ab-4f21-9d23-84c78d4df9ad", "value": 80002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766528150, "uuid": "8252e5e4-ed7e-46bd-9594-38f4bd6e6dfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766528150, "uuid": "78644c5d-c673-423f-8952-7c79d41aba30", "value": "AllegatoRocco.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f962c6a-dfee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487561, "uuid": "b9541f75-3024-4404-ba88-954283c962f7", "comment": "Malware payload", "value": "2b04f5e11f985670bb5bf4d87409aebd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487561, "uuid": "29397973-bf96-4a82-8ef8-6e55fa76d4a7", "comment": "Malware payload", "value": "d3ef9f47ab20192f4f1acb7098a4481f2faca5778e3e31e8aa61414af87328d7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487561, "uuid": "921b2e44-1cf3-4c51-b645-41764c8a317e", "comment": "Malware payload", "value": "d7a82babebe7c46a736e8fd337bd49ac570eb553", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487561, "uuid": "29facb9e-89cf-4487-bfcd-c2d42bdffa69", "comment": "Malware payload", "value": "45bc583546d6dbee916c3f721e3a451ca840188aba08dcdf81b05b52e1fa622fcb06787d2f1a2514051b741c165f7a26", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487561, "uuid": "b3c158c4-f1f0-4c5c-b956-400732228572", "value": "T1E551DD0E5517469D27F216BABD112C08E80C461FC15D2865B88C53C01F2A5644823EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487561, "uuid": "57069698-8a25-4f60-a934-fc9b29df044d", "value": "12:MABu0bJ64iaucuxyGAH2TSlqxd3pj//pnZY8VjSsKQRDOW5T0uiyhhv:u0bwt5c5GC2dTx3pni8EsKEyW5Diyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487561, "uuid": "03154a9d-a11f-4470-b1a6-ed2f8bba766a", "value": 2762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487561, "uuid": "16ede568-e79a-492e-b1ea-ada45456fcc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487561, "uuid": "a6907b25-7d79-497b-aa8a-dce84a49dbfc", "value": "Part3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911020b1-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479027, "uuid": "99a3c5a0-723f-4466-9596-4096e4caabc5", "comment": "Malware payload", "value": "3b1beccea53e23e6320d6a9e7027f205", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479027, "uuid": "8fe51464-e8b4-4b7e-9888-e54f8a1249db", "comment": "Malware payload", "value": "d48925f419dc3be389cf417dbbcb1bd642f4a185105761b8305caabfa2996d48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479027, "uuid": "981b7397-4bfd-47fc-a76e-762084976a9c", "comment": "Malware payload", "value": "97f14636ce923d35e455b2c998b5a4c1ac52f75d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479027, "uuid": "763bd6e2-68e7-4274-990d-c9fa3c63e80c", "comment": "Malware payload", "value": "d35a95ab5098150a0e3e614b7c74eaa1722053b14c9477f00e9a625c5f3b49265d36d92537fcc7fa23a0be44ed279fe1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479027, "uuid": "544d4651-ddee-4df4-9052-319d46c85444", "value": "T1FC6319D36CC1108C333CA692EBDCA745AD5CFBB055A07726362A2136C9D7C7216F66E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479027, "uuid": "9cd3c58d-9295-4672-b2e3-4770c37bb0a8", "value": "768:I8w/h62/jWs6oS+xISN0vSkZkykFkykcknkCkxkwk5kYkkk9kMk4kqkbkgkckck5:I9l/AoSSMfbfusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479027, "uuid": "a0be8f31-5afb-449a-8dee-d813566bb69d", "value": 72521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479027, "uuid": "4e19a31e-4f10-42ff-ab79-98f501f0716a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479027, "uuid": "d07c2d3d-aa3b-4a3d-bf04-7a0335696e53", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5699e507-e027-11f0-a129-42010a9c0007", "comment": "Malware payload (CHStealer)", "timestamp": 1766512000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512000, "uuid": "0ec809cf-dda7-4c93-bc9a-3f2c487affca", "comment": "Malware payload (CHStealer)", "value": "254095aa02da7eaaf038ecfc67ecdb41", "object_relation": "md5", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512000, "uuid": "9ee95045-4236-49c4-a53e-e36b4ceec34a", "comment": "Malware payload (CHStealer)", "value": "d495dfad379d3de7012419aefac5778c74e9a241967f8a364dc5a32ab2179534", "object_relation": "sha256", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512000, "uuid": "8381331f-fb0a-4a71-9bee-a7f2e55d5d41", "comment": "Malware payload (CHStealer)", "value": "91ce655ecccd9173ddba00b79411eb2dd35026e7", "object_relation": "sha1", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512000, "uuid": "2f08b26f-a768-489e-9c60-3429f1116cf4", "comment": "Malware payload (CHStealer)", "value": "514c72e80429a3e6999351317ea5d28d5b30e21b7a8c702e570a382fb019a5a545fc3a5f47dca93fc313f3e1a92489de", "object_relation": "sha3-384", "Tag": [ { "name": "185-11-61-40", "colour": "#8EBAC4", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512000, "uuid": "b2425b31-8cac-4360-af18-20772231752e", "value": "T10E360233B28A633EE06A5A3759B2D2215C3B7A51A51F8C0696E40C4CFF2E1601E7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512000, "uuid": "e8592c3a-2704-46d1-bae0-f857e74e09a4", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512000, "uuid": "e73dbf57-d03f-41f2-9ab2-6a955191cd42", "value": "98304:HN66SJwbZXvIr5JXuXs3gVotOEAN3v5IR:/6uXsuoQPN3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766512000, "uuid": "6970ff7d-09ab-4ae6-bbab-ecd14c778588", "value": 4876288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766512000, "uuid": "99db312c-bc7b-4feb-adfd-4d27a84e8cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512000, "uuid": "15b01d75-565d-43c9-be4d-78896f9f0d70", "value": "Landman S02E06 1080p WEB h264-ETHEL_patched.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0846e33b-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530767, "uuid": "a021d7aa-cd34-489c-a8a7-af11e9b316d0", "comment": "Malware payload (Mirai)", "value": "093ce1e69eb30593146e23856bd2c8ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530767, "uuid": "d68bc94f-3713-4e9f-bf44-bb1f4ce20aea", "comment": "Malware payload (Mirai)", "value": "d4a281f98652b85f13cd75ed1d7aba91a4af9e563145fedf28123c308eb55434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530767, "uuid": "7cc844ec-73d7-4751-b569-4c83008712e6", "comment": "Malware payload (Mirai)", "value": "303017fa04350e7238e0745b78a14697c32f19d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530767, "uuid": "75e760e5-3a32-4a55-a321-e42a5561178c", "comment": "Malware payload (Mirai)", "value": "4872e47aade377ddd485a19c13fe1ee35aaf8fb895de9e8dd32979c4a71bb830091d43be31ca081f3292024c03cf5a1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530767, "uuid": "ce185425-14d0-41e9-8dd1-575ce7bf3387", "value": "T15AC32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A9E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530767, "uuid": "b7464c0c-f7a1-4328-8dc0-ee898df6b166", "value": "3072:IZMu4C+u2TLhLRE90bYK5h9T96NOU+5/YtM/9gM/:eMu4C+uURfbYK5hb6J+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530767, "uuid": "c4a1071f-4ccb-434d-898a-94c8336cba5d", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530767, "uuid": "286da3b1-7229-4f96-8729-a27dca300d44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530767, "uuid": "fe7d21d0-f2ee-4475-8934-dab79e41fedd", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db2ab52-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478512, "uuid": "a29e07ac-d3ae-49b8-ba3c-6e4120d79248", "comment": "Malware payload", "value": "05d270274e3a1455b20c04ea1aa92548", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478512, "uuid": "938e4be9-4515-4799-b121-6ad885086118", "comment": "Malware payload", "value": "d4d1b900e3a2bb833a41ec6036c1015441121e04dec3ca09e563f83be9f1e351", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478512, "uuid": "ba2f5869-0d3f-4550-808a-66d15444b45c", "comment": "Malware payload", "value": "99cb516ec734e52673153769319d80523f4a9e96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478512, "uuid": "55607cc3-1f75-4381-9f8b-15c1adfed729", "comment": "Malware payload", "value": "871070f917c63bcf5ad2eee1a45e42db8beca3fd21fbc1fbe6df2f5b9cbb3f6a5ae3ccf11769665b45937d1bcdac7a83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478512, "uuid": "c1cb92a6-0b90-4f8b-8688-479ed805a45b", "value": "T146731B949C43AEDD8681FA4335877FDC49B7CB27083AFAC891875451A5C6D83CE6C2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478512, "uuid": "3a0ab81e-570c-4b63-939a-cb4df1a9fdc5", "value": "1536:I9l/AoSSMVFbzf3G3fNo/vg3pEJsZsSWWHaWCs6BFy+k3mCL4SLxCWIdVL6cR3EE:I9l/5MVFbzf3G3fNo/vg3pEJsZsSWWHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478512, "uuid": "71d57edc-1e6a-4983-9f2e-c437dbba0079", "value": 74400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478512, "uuid": "337041f7-883f-4aba-b8e5-9c0dab3bba94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478512, "uuid": "0e0f5a2e-b97f-436e-9b1b-4739ed974b3f", "value": "invoice-1645080830.pdf (120).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff5eb7d-e016-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766504795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504795, "uuid": "86f67ff8-0248-469d-a39e-55574a50287b", "comment": "Malware payload (AsyncRAT)", "value": "efb464936649cf2066718807f1121e3f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504795, "uuid": "1a2d5793-1c3b-485e-bfb7-601763c269df", "comment": "Malware payload (AsyncRAT)", "value": "d66af8fb064d5606405675e1f610ebf62bf3caefed5347e1a6b24cfd0faac7dd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504795, "uuid": "54f45787-3e94-4089-90ec-6e19d74f1f09", "comment": "Malware payload (AsyncRAT)", "value": "e3a826ded224f617be08ee0a0ae64ca20b89cdce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766504795, "uuid": "4638223c-7a07-46b6-9a10-a54b88fcfa12", "comment": "Malware payload (AsyncRAT)", "value": "0dbc15353593134d33915c498195d8d64d76783cf8161aeb530d2f4eb4f30542072cf0d01503eeb137203a27ed60e058", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504795, "uuid": "0fc5626a-c8bd-46c1-b190-51cda98bc379", "value": "T1D8233B003BED812BF2BE4F7899F22145467AB6633603E54E2CC451975713FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504795, "uuid": "8fd8109a-6b87-4f4a-8a31-3c6e1a123587", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504795, "uuid": "79c7afdd-859e-4eaf-b560-e34e815f82e5", "value": "768:ru66dT9slTJWUhDuzmo2qLFO5QSCBzHSNjPI7zjbDgX3iHcPsOXSVuHZ3DBDZKw:ru66dT9We2WO59ESK73bcXSHcPsm5HZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766504795, "uuid": "4d5bb203-e6d0-4529-8874-4be469f0d84d", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766504795, "uuid": "4720406a-8bd0-4390-8bd2-22b10957e134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766504795, "uuid": "9d503cb7-a03b-4b19-a427-b3d01c15ba3f", "value": "firefox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2624b749-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510201, "uuid": "e3221512-ffdd-422b-bbbb-fffcc7dceefa", "comment": "Malware payload", "value": "70404392e151c2e2f3c3e913792ae92f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510201, "uuid": "9481bc37-aed6-412b-a761-be6e9534b361", "comment": "Malware payload", "value": "d6a52b360155c240c26d52a7b0fe03c20bf188fd0a3f93117b7a45c5312cd372", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510201, "uuid": "ce8c46bd-836c-4826-86c4-ab0332482aa7", "comment": "Malware payload", "value": "997b1dc61c6bc93ed8d7f107901126a8acc23378", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510201, "uuid": "6a59e3ef-1472-4d3d-aedf-b8dd8a3744f7", "comment": "Malware payload", "value": "f51ec49e3eee360e8332370337161b359ed0103a97d6a4158a0ed45a3b97b927c4134ff1a6a7ecb71344e3afb0857897", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510201, "uuid": "4e3d8aff-10c1-4214-8c04-52886fdd5a49", "value": "T118D502BB48B269579B504563EB0F2C1A339B19D13B54D341EA5191AC2F3B1D38FA2B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510201, "uuid": "9feaec78-2e9a-4438-bab6-34f339947c21", "value": "49152:DOc2yD4lTPJepTjdVICxVKjeNkzPkPA750KsgMuHfUwHO9:DoyEFPJmPvbfKqNEL50xLuHfUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510201, "uuid": "1e12e73f-b34c-47f7-8d38-7af830438352", "value": 2914445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510201, "uuid": "6f241cc1-6700-4abb-8761-9837260fc147", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510201, "uuid": "6a43f0da-9fe4-4c42-bf22-598fb3557e96", "value": "QUOTATION REQUEST REF# AHK-3052-2025.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b912b7d2-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524192, "uuid": "fc38b06c-9cf3-446c-a121-7aaf58619f64", "comment": "Malware payload (Mirai)", "value": "89d4d16db4edad9185d73a136df6059c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524192, "uuid": "c2d74c49-4540-46a1-85d0-9c3542679169", "comment": "Malware payload (Mirai)", "value": "d6e90ce4b86378eb5ae7a91cbdef8eeb46afd173f013b216f08d2275b9f02efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524192, "uuid": "a4fe4c25-42d2-467f-a21c-4c59e1543dad", "comment": "Malware payload (Mirai)", "value": "2cfb9d047fa1381b5ddc9e5f602a6804c3f67956", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524192, "uuid": "13a4938f-34eb-4cef-a50f-cb022456d298", "comment": "Malware payload (Mirai)", "value": "c6ce1bd9a0d0852856582dfed6f18650d200524a6f56c0322edd115f233a4d120ff82d23107b7aa65e56e21ba5a51877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524192, "uuid": "5d6f040b-44aa-4874-8cea-4b8dd6f3eb15", "value": "T14F14074AB9919F11D5D231FEFA9F419833136BA8D7FA7102DD206F6033C699B0B7A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524192, "uuid": "37424254-70d8-4f33-8520-40e5639abd56", "value": "6144:0d425iSP/c88zc/vCcSaU/MvNL1QH0hP14iWXjw6i:0d4To/Nqc/vCZaUcNL1QHGeiWXjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524192, "uuid": "79e3c3e9-ce04-4470-9f3b-823dbde81310", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524192, "uuid": "70a37f64-df0d-4441-933a-01b66ab6b9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524192, "uuid": "3befa49f-2afe-4690-8f40-9365bd43bd78", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d4e32c-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478816, "uuid": "f168329f-3eec-4974-95fe-c383cfcfd46d", "comment": "Malware payload", "value": "f23a200510c000b2632428de5d34c3f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478816, "uuid": "b0782f8f-8e7a-4054-b70d-fec1920a3b6c", "comment": "Malware payload", "value": "d7bde8f9739ef759ee9803a5165afd1ff7c050333d856eb87ae87d8b37f31a04", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478816, "uuid": "0a8c6dc3-cbcb-4251-89db-38a816c686ed", "comment": "Malware payload", "value": "812d51d8e6b466d36ed6e497ee31c28066e666b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478816, "uuid": "dd59bb65-6334-48ed-8f6a-bbdf7e1c219b", "comment": "Malware payload", "value": "83828cd8212fbe2eb16a7233b1c4c67095b9befb5d91f655b380a64de2e127af48bee201c7a7adfee70b4b259904d29f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478816, "uuid": "059c5297-08be-4ab5-a3bc-00aad42117b1", "value": "T11973F9ECFB63E7A4087EB052895A606E97CD77842A9807EC3087CC594F4F91C4AD8D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478816, "uuid": "55712188-8a62-4511-840b-0b6895596fe9", "value": "768:I8w/h62/jWs6oS+xISN0v6OSKf/dkfScBYrwz2y8kTAlGB:I9l/AoSSMlXusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478816, "uuid": "321e8ff8-b808-402d-ab32-93dbbd9a055b", "value": 73393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478816, "uuid": "39b1dfe9-5e49-4da6-8a7e-1b876482e2ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478816, "uuid": "a61f3c15-a65d-4364-a369-860ca69a9ae8", "value": "invoice-1645080830.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc2bd5c-e04f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766529082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529082, "uuid": "24b69993-261a-4b40-97ba-83470ef46293", "comment": "Malware payload", "value": "ca4a9a441b6dc5b9aef8128122c26733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529082, "uuid": "6fdec115-55eb-4ec9-b7a6-1861cb817901", "comment": "Malware payload", "value": "d83d2920bc2239a905565f5d3e84a0676b37914d4dac50273449e9516d8a3151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529082, "uuid": "2517c28b-2e56-4c3f-945e-c5380ffb4895", "comment": "Malware payload", "value": "7a373e48d2d55aacc8a4cb094c113fe3ce968e74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529082, "uuid": "8e8955c6-e927-46f8-822a-dccf43f133ef", "comment": "Malware payload", "value": "22b4f97bb21da70e15c3e22dfe3712c75b2e8bfe052a3b108ca797b4799f33b89b16f9e0ba99a96f9e6708087e419ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529082, "uuid": "8b5db5b3-f9c1-4e4c-85f4-859860d4c0c5", "value": "T1F7F23B21D8782ECDC0655AB1E0F1CD7E8B27265298075EBA6AE3C92844C7FC5B14A374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529082, "uuid": "015a4470-d00d-4db2-84be-ada59f48e94e", "value": "384:claAAAggggYLw4sOy++w8/OD0px/QpF8jtNLCZIemy7pvr5awYxBIUkiZb6x3LP6:c1AHZsl++RGQpmpLiyV9aw1qsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766529082, "uuid": "a2802138-efdc-45c5-b2c6-62095c0bf8a4", "value": 34543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766529082, "uuid": "54ad1f76-c540-4f88-834d-bb325bcdf028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529082, "uuid": "2bc05e0b-3828-4899-b373-669502ec7b5a", "value": "SecuriteInfo.com.E32.Agent.AH.gen.Eldorado.26913.24963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82dafe6-df92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766448196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448196, "uuid": "e11d9e52-451b-47ee-b828-d8747be1a533", "comment": "Malware payload (Mirai)", "value": "b282183571ef6e96acacc25d545b3786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448196, "uuid": "a3706ec1-85a6-4059-94b0-16d48ec07f8c", "comment": "Malware payload (Mirai)", "value": "d9b25f6ecf8b649cfafaf1d0020f91773d77dfeb74c38f09de2a73dd8631b49e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448196, "uuid": "b82c9a95-c162-4503-81d8-95a0435ded4e", "comment": "Malware payload (Mirai)", "value": "695a1ef44415427d3708282f0e6437a5cd338edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448196, "uuid": "53b99607-86ca-49d3-823e-c097833d9caf", "comment": "Malware payload (Mirai)", "value": "6f15dec69c6e448230e7588a7bd6247b53b6e869ed0d79709d6b8ce3c006f69a6361c9807995347f6b1c2fe39186981f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448196, "uuid": "8777673a-ec40-45af-9b9f-baea7179ef68", "value": "T1B0634AC59A53E5F5EC19093514B3F7775A31F4351028EAA3E3D5AA36B842302FB4B2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448196, "uuid": "d32040d2-e922-4cbf-b0a9-cdd621881eb4", "value": "1536:Q5CPIv7BNZUMoVQ8zPDYPLNevYWHy4ipBxuR1dPRR0:Q5UIvF7JoWigLSYQZCjcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448196, "uuid": "3a14ef47-ce40-43a1-83ca-463cf9633615", "value": 68240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448196, "uuid": "8be199ec-c5f6-4c45-b4e7-976e4ca5a449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448196, "uuid": "16f102a6-1d7e-4219-b59a-81ef3664ffed", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67989ce-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531891, "uuid": "46d1a23c-d77e-4c0f-93cb-e9738eed50d9", "comment": "Malware payload (SheetRAT)", "value": "a69656fbd88f94e2af3607680ce577ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531891, "uuid": "d9e1692d-296e-4faf-88f3-b93582c07bb0", "comment": "Malware payload (SheetRAT)", "value": "da21dd874bb2f4a97e2024564470d6821d3ff3a92364f6ae727a943807f2755e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531891, "uuid": "e626272c-992b-458f-aede-a579fb525d7a", "comment": "Malware payload (SheetRAT)", "value": "257dadc278efad518616e93d7f8a6de034186266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531891, "uuid": "2b155f45-a48a-4da6-b7f6-68f038109804", "comment": "Malware payload (SheetRAT)", "value": "f95248927e7473fb7540a8344d3d79902bffc97bcce893e595f002bc44834f69106172be5483a513d679fcc7b609107c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531891, "uuid": "49cd1506-88f7-4e69-9ba9-25f7f02a17ff", "value": "T1AB94B30CBE91F805DE6E3DB7CBE614044B7129C12E219286316AAFFD8B6537758E217C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531891, "uuid": "ba272648-f734-4098-8b15-b122503e5bf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531891, "uuid": "33d6f1ec-1ba9-4456-8c37-755a8c347d14", "value": "6144:XzU/W9wsu0othqMw4BABr9e6VlWT8b9urfwv/czo52b40da1TF58R/v:Xzhhu0bYBABr9PVle81Kat8R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531891, "uuid": "e3070c6a-fa8a-40ab-a465-879c17d6796b", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531891, "uuid": "2936365c-7cd6-4033-ae21-5f057125d81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531891, "uuid": "e64f2440-185d-4cbd-9118-76b8bc7652e3", "value": "nmvyghksmshu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4cb084-e014-11f0-a129-42010a9c0007", "comment": "Malware payload (DeerStealer)", "timestamp": 1766503714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503714, "uuid": "ea5d9220-e0a3-4665-b369-9dd62c7332f1", "comment": "Malware payload (DeerStealer)", "value": "2fe8c93bf8b99b55efbfb758ed4c8c42", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503714, "uuid": "c6a1efe1-8b30-4772-a2e5-c55fb04136f9", "comment": "Malware payload (DeerStealer)", "value": "da690a0f459e4c2167d0d5794a385bd7707a64e0b7e934b9f7d18b43b7065a81", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503714, "uuid": "45b9053a-1e4f-498d-b8eb-815cb4523aff", "comment": "Malware payload (DeerStealer)", "value": "c8091bf9f6a3154e7eef872fd63ecfb64724cd9c", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766503714, "uuid": "6177721d-3c8f-4ac1-9475-f9d5c9e81626", "comment": "Malware payload (DeerStealer)", "value": "79c54388938eed9557441d11e71e64731285c5f219ea9ef1c7ad78453c2849d551d451a833d2e4b59b75d1f147d166bd", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503714, "uuid": "74131ab6-6374-4b38-89a2-2030adea7b52", "value": "T1C9863368EA134B9FC9D2B6F2001F98B132617D802699D6D767E37D45EE36240C86F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503714, "uuid": "1d7949c3-e486-4832-9a33-4eb0f57b8303", "value": "98304:X7lYSK+Kq8wdseWDp5VhvjnoPsnkpqcIeNzEc1ODTnOeOss46iUPXKgRt5AMWdoV:5WtwdWVV2sF1cITnCsVps/tlGAWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766503714, "uuid": "8540a15e-63b2-44eb-bf53-8ac2fbde6a5a", "value": 8200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766503714, "uuid": "e422ed49-33f1-42ee-9937-331ef00a7a01", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766503714, "uuid": "954a6638-60f5-43e6-8290-a76ba185db51", "value": "SecuriteInfo.com.Other.Malware-gen.19821347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef99a1f5-df93-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766448692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448692, "uuid": "aac333af-decb-43d2-9997-f7cf91ec6773", "comment": "Malware payload (AsyncRAT)", "value": "9e76cd70215b19cab63ca1a6519952cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448692, "uuid": "45353ea1-ba13-4b01-bf69-5b79e2b41494", "comment": "Malware payload (AsyncRAT)", "value": "da7eb889527f8d132c6fede94dd354e8d3558658b4ef0e9584c6cb8f3c57bfde", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448692, "uuid": "3e2a93ef-ef17-4022-b4bb-b82e34877b0f", "comment": "Malware payload (AsyncRAT)", "value": "3336b518616d8ad9cbbf244706725cbd6116c2f2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766448692, "uuid": "e906540a-38ba-48da-895e-648831dd77f0", "comment": "Malware payload (AsyncRAT)", "value": "4865831e0f8d0dc5d7ca089acea849b3faac6f5fc8c6b07203f04bde868fe18493d47b51f1f1520a0f5fe4920756350b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448692, "uuid": "baed8180-9524-4651-af1f-629de9c8aa45", "value": "T100738D187BEA4129F1FF6FB15DE47696DB39B7231A02961F38C5024E0613A85CE407FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448692, "uuid": "29204434-5252-4986-9349-bb44e49a2e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448692, "uuid": "73feab52-3d6a-4c5e-a0ba-ca9b6251d35a", "value": "1536:uJNhtz2YfwfxBnxfWnfzAJcwX9EUqZbeJPTdvBh6VdOyOd+0cU8XHaqWu:Y1z2YfwftWb1wXe9ZbeJhpkdNOd+0cUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766448692, "uuid": "7a610fc9-7df2-441a-a1fa-f3aefcf7758f", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766448692, "uuid": "dd69c5da-0ad8-498b-ad66-215363f0a895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766448692, "uuid": "3fdbcd2e-5859-452b-b8b1-e8eded1769f0", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf437ea-dfc9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766471907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471907, "uuid": "507b36b3-3121-42c3-9fdd-bcaa51ed0b04", "comment": "Malware payload (Mirai)", "value": "bded0b67b0ba525c9e9a71a2e4135d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471907, "uuid": "ddf22e3e-1dcf-4108-9a29-b368f75e375e", "comment": "Malware payload (Mirai)", "value": "dae18b68f82a50b8cb28aaeada78e5511b853cad6001642dbb81c47006423259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471907, "uuid": "8cbe7ee6-da09-4f1f-9a77-58168b7b714b", "comment": "Malware payload (Mirai)", "value": "0c91c9ea94f6ef59459a33194da0afdcca7633b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471907, "uuid": "24e4e4b4-66e9-4d22-83a6-26a64f32c4e7", "comment": "Malware payload (Mirai)", "value": "c4e513df54ab40e386365ceaee7eaa721b79ad3c5d212c3f5010d6fa42ac96d3be22dac53705afbd33f86981f3ed9f32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471907, "uuid": "2fc75067-830e-4ef2-8dda-c6a68f5d8c82", "value": "T1C76302EBDF385C1FEDC9B0B3346D3C02119AA44580FD805B94E782C1AB5A9C78DF945A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471907, "uuid": "76b27383-0ae3-4569-a845-170c0638e997", "value": "1536:yVmzzMm2WCeHjfUDHherQeCOEmLw7uXuFYxAiOD+lrbrPu:nzzsDDHIE1OLouXIXi+0brPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766471907, "uuid": "7c157652-3ac6-402d-a5c2-8ce5627fa724", "value": 67272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766471907, "uuid": "505d95c6-0cda-44ab-ab2e-d179cc369261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471907, "uuid": "b78f3edf-0f89-4bfc-985b-73a5733fd6d5", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f2f519-e051-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766529907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529907, "uuid": "7b244203-7aa2-4a6c-8702-4a0db51c41e8", "comment": "Malware payload (AsyncRAT)", "value": "2ced3f5e0955d6c2dd2501bf718ad6ee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529907, "uuid": "0ad24561-c214-47d4-b1a5-118ce48b42f9", "comment": "Malware payload (AsyncRAT)", "value": "dc1b0a55ed16d4a92ec2ce20c41a8ce9619a6af17afe54b4eea55a758a7ee6b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529907, "uuid": "fa07c832-d66d-42c5-89eb-d0beea45227e", "comment": "Malware payload (AsyncRAT)", "value": "1f214cc92ad79485aee80c4cfb320c84c86b4ea5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529907, "uuid": "8db295e8-fa3c-4fac-824f-40ff0a3b38a7", "comment": "Malware payload (AsyncRAT)", "value": "58c0f4e56f6a7a6f0458a05f478da4d1785dd43eca6b6f930b4d5fccf89c4cc408459f2d1f111d7c6f6dfdb4713283d5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529907, "uuid": "8c4d95ad-f35d-4916-8e0e-2e21c0408584", "value": "T11C531B043BE98125F2BE9B74ADF265944AB8F5677906D50E1CC401CA0B32FC69D42BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529907, "uuid": "1a058e73-fc3e-4a49-a2e9-a44a26fac5b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529907, "uuid": "ae415146-d85f-4eb9-ab6a-dd1da65ba994", "value": "1536:/Ax11tuzi79PbWirMbzi7YBui/ClxSyJ5p493WMx:/Ax114zi75bWirMb27YreJj03Rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766529907, "uuid": "fb73919a-c1ab-43d0-9d33-ee47062de7f3", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766529907, "uuid": "0be967cb-8b20-40c0-a699-29eb8da20cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529907, "uuid": "4f743db5-7e0b-4ee2-aed1-5997f2516796", "value": "2ced3f5e0955d6c2dd2501bf718ad6ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea883736-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478748, "uuid": "fe0c9f23-c823-40b0-a19b-f5cee6d7a9ed", "comment": "Malware payload", "value": "298822656d60cc8f5e2ec8bd94d14e07", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478748, "uuid": "c700c21d-a21a-4e65-aa8b-c6e43b24f051", "comment": "Malware payload", "value": "dd1937330f8b10026eb29045fb3d57e1364bf1fe8a80b92568fc4a055ad99c1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478748, "uuid": "b28ef1be-a685-4eff-9755-eee61931bda4", "comment": "Malware payload", "value": "913a44e3067813a4a522e1f34aecd29a677d43a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478748, "uuid": "08d8fc44-364b-4df9-9690-96a13bb5f4b3", "comment": "Malware payload", "value": "6a137ab957ea3728ebaf3195ff1ede80e17564e353a52579616c7789d18714b426cc4f247d00911035c1eb89042ffcf0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478748, "uuid": "b9d490bd-146f-4566-a8c3-07fb24ecd57e", "value": "T1B6631B1D6F69186D58682347B7DBFC2C900A0D3EBC051AEFB1247292124A1FEF75876E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478748, "uuid": "9c389a88-4c4a-444f-8c2f-ebab6ee7a132", "value": "1536:I9l/AoSSMncfzFNaw/r1OIMeeRNU6UgsdCMdBrOx4HPIUUWknD05CTfqUC00Yzux:I9l/5MnhusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478748, "uuid": "d9c56dc8-fd56-45c4-93ec-71bcff48111d", "value": 70639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478748, "uuid": "959d7fe2-5730-49ea-a62b-f64f9eac97a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478748, "uuid": "4b9d7a22-796a-4d5d-87c8-82b7388b54df", "value": "invoice-1645080830.pdf (80).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c02d50-e00f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766501718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501718, "uuid": "50ac5037-3f99-4feb-aa70-503eb80e032f", "comment": "Malware payload", "value": "d23e234ed9e7ffdb7b019976ad524acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MemAlpha", "colour": "#85034F", "exportable": true, "hide_tag": false }, { "name": "MemAlphaStealer", "colour": "#C41544", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501718, "uuid": "24897306-8195-49e9-ae37-52878cd6b3e3", "comment": "Malware payload", "value": "dd8dba79544bc8c456039f125bfddfc13b173c12debd6893f9eefd80abc706fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MemAlpha", "colour": "#85034F", "exportable": true, "hide_tag": false }, { "name": "MemAlphaStealer", "colour": "#C41544", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501718, "uuid": "f51c11eb-33f3-4e25-8866-d7b09d97f265", "comment": "Malware payload", "value": "8662e93b3d15e495e319b81e1d3d52e1c9a25d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MemAlpha", "colour": "#85034F", "exportable": true, "hide_tag": false }, { "name": "MemAlphaStealer", "colour": "#C41544", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766501718, "uuid": "235dc261-e562-4a50-b647-a0371798d06b", "comment": "Malware payload", "value": "92bfb45f33c85b19759940cc5697da705b14998e3a088917f968d38fa2ebd193a38f2c63cc2abcb50da5ec82658dbc9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MemAlpha", "colour": "#85034F", "exportable": true, "hide_tag": false }, { "name": "MemAlphaStealer", "colour": "#C41544", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501718, "uuid": "93f22199-f2d3-4928-aba0-31f7f71df8ac", "value": "T19CF5F9039D588B53E06997F8BD130E6C2F5A6B0DE9927AFF44164EDB3E217124C8D12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501718, "uuid": "6d71a147-651a-4cac-9333-d1a860892ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501718, "uuid": "6a52a551-73fc-4ba1-852c-8fcedb475a4b", "value": "49152:Xdqnt2BmnfEbQAsQ3Vm8O1iFidvyLA2Dd0wzdwCSA/Bkj0KR:Xd/B3ZhQH+kvyLnbdzSA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766501718, "uuid": "b253514b-5f96-4771-9c28-7aeff905100b", "value": 3394048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766501718, "uuid": "5a090e0e-7c54-47f3-9fe8-68cfadab8a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766501718, "uuid": "f6335b7c-9c7c-4c0a-b4af-0c9118a00b5c", "value": "dd8dba79544bc8c456039f125bfddfc13b173c12debd6893f9eefd80abc706fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf89508-df9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766453382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453382, "uuid": "c887f8bc-5624-4bde-808b-a3772c6f12bb", "comment": "Malware payload (Mirai)", "value": "a6852a0b5a1da93cc21ed708c94375ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453382, "uuid": "ded8bb2f-26f2-404c-94ac-e581e1f5c607", "comment": "Malware payload (Mirai)", "value": "de5c88522c86068215d8831e3df0b34c7147e340e38c177164fcb3668fddd21f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453382, "uuid": "56f97bb4-b578-4700-a514-803b11330575", "comment": "Malware payload (Mirai)", "value": "352f57ea495806e7b4618dcdcf2ae688b162d222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453382, "uuid": "24d5015f-bea3-48f9-b440-c8f1b4fdb26f", "comment": "Malware payload (Mirai)", "value": "1dfbda70995ff578d33f03c7e7475cdca59789d295886127311bbf3a5147aad032d127bda56bbe709265814ff59af1eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453382, "uuid": "f5c3e881-9ed6-4364-bd44-d928192b19d2", "value": "T1A6D31845F881AF10C6C626BBFE4F528A331357ACE3EE7212DD145B2427CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453382, "uuid": "ba097a4c-d5f3-4f36-a728-edd7e20ec445", "value": "3072:nLFotpl2GYCgUXnGihD/rVwzIXe6kLakRz48iCQ9Fzti0LEMkqkH0SnzE:nLFotpl2GYCggnGi1/CIXedLakRz48iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453382, "uuid": "eac05ebd-a9ba-4aff-813e-c7ce9479382f", "value": 141160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453382, "uuid": "4808aa49-1203-4a53-95af-87fc8382d96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453382, "uuid": "ec511c94-a548-41dc-a29a-4e200ece030a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5615c11a-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488377, "uuid": "319cabf3-6372-4d0a-b934-b9ca061b6925", "comment": "Malware payload", "value": "3f4699c17966857c625426fbbda039b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488377, "uuid": "83213393-90c6-488b-b7ec-84e761e50627", "comment": "Malware payload", "value": "dece1423c08ab0f3ce07e0358b424f41891977842bba20807564c00e8a783c75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488377, "uuid": "e5622373-a267-4769-9b32-dc70ca344cb1", "comment": "Malware payload", "value": "6497b975c47e55dd0ac08e7c1faf7142de7a637c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488377, "uuid": "ef29706b-2f0a-4df0-91d4-46d65cd3aba5", "comment": "Malware payload", "value": "caa3aa4c4d242d50a0eddb1d627f4d1e747facd27deed62e8ec3aaea5724759e9512a9f6c79222f6094a3917ee8368db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488377, "uuid": "85a0ff86-5824-4299-ac91-f94b6d0439d3", "value": "T1F2C57C31B902803AEDB554B7D2B959B66A288C147B1BF2E395EC74C046B21F325FD34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488377, "uuid": "d34cac81-97c1-4cd8-85e9-12d3d74fc99e", "value": "bf31f75de465e5022a052fd959325045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488377, "uuid": "09530e28-4779-4939-8cd4-fed5373a693e", "value": "49152:MLFTVWvNvZoHK61QJYuC2TboWADOjUfZpTeCIVlHP2nmMbUPEbV1b3ZjSbh:ouJRHgOjfrjHumMb1hnjSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488377, "uuid": "8fbd2cb0-df83-4e3e-9c73-6b5bd379f4e5", "value": 2744320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488377, "uuid": "2afeb663-e2ff-4330-948c-650f5d1c6236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488377, "uuid": "f518d9b0-df1a-46ed-aafa-7cc0ffed299a", "value": "python34.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2b4fa9-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766524573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524573, "uuid": "dd1e231d-6ab9-4169-98e6-e53d5be36def", "comment": "Malware payload (SalatStealer)", "value": "9e65f0ff4e8a50a7d258a8d6f241fc48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524573, "uuid": "d820247c-03d8-462c-8321-a8d766a9e0fa", "comment": "Malware payload (SalatStealer)", "value": "dfadd772ae8dda0dc519285b2209c30051af2eedca98c75dd616074123e2323f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524573, "uuid": "f114af58-1348-4b2c-a3e0-0df44acd4d80", "comment": "Malware payload (SalatStealer)", "value": "a8435805dbca4e8c157876012e4593f0aa7185cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524573, "uuid": "a6d9c747-edc8-4824-aba4-230dcf0ae870", "comment": "Malware payload (SalatStealer)", "value": "b468a7b4a78da7ca2f0d2f1ef79b143e865211d5a2903b117007e378c332e76f2943f7eb87f74f472d93a1595782b4a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524573, "uuid": "336ba051-3314-48df-954c-c8113d3dc4ac", "value": "T12DF5335A9F054AB9CCC956FE1043D6796BB01C01B72A276BD9C71F332F10AB179B482B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524573, "uuid": "e18a448c-7d2e-40ad-ae54-ace2dc448b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524573, "uuid": "4ccb3619-2ab6-4a7a-95bd-d8a413c18bb5", "value": "49152:f/OBTWtCavL8PRoT3jYnvkuN1YCQepn4eXS3ixuAzDWJuYFG4nLxU7e7/RFlh6WN:KTWtCCLdAZ6eQ3alDWgUzRQWwbv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524573, "uuid": "b918d1ee-f7f1-4c0a-86ce-aca5da7c7f1b", "value": 3366912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524573, "uuid": "35299846-bbbe-4651-bc11-999396a20caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524573, "uuid": "96ba496e-fa1e-4475-a7b3-abded0e9194d", "value": "RAYSER_TOOLS V1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99abfa63-dfdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766480330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480330, "uuid": "c76a1c57-1561-4911-9be5-3a49fd81232d", "comment": "Malware payload", "value": "7d7e35cfd753db1542a11c26743948a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480330, "uuid": "d25617f5-f0a2-4f4a-8c61-b3a6afff69fd", "comment": "Malware payload", "value": "dfbb2328afd33dbecc280ce7ace009d52bf09a27234751b00ce81c793430f8d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480330, "uuid": "1dde2681-bb06-47e3-bc24-64bab549d0f6", "comment": "Malware payload", "value": "d803d21cc7abc211b2832930edc937e86c5f3b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480330, "uuid": "2180a607-b659-495e-a31e-530bfc4e52c4", "comment": "Malware payload", "value": "e958cc945cf314db0cb1f5ef32bc433a747841e8954d5c49959421d84cafd39cd2bad0a734b2cfbc0a202dd81864ca8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480330, "uuid": "3f57f04c-be88-495f-9e6a-ba90b774cbd7", "value": "T144C32B6AEC819A51C9D716BBFA1E558D332313BCD3DF32179E284F24278692B0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480330, "uuid": "bafa7ce8-0878-4faf-8341-4891b6b3753d", "value": "3072:jOVXA75GJEYqOPqNJFCa1E1crZyjOT1Dk:6VXA75GJEXOPq7kaOqyji1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766480330, "uuid": "a16e3da1-718a-48cd-a9ed-50427f021084", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766480330, "uuid": "cea86c6b-4013-4b30-8ea1-bf455ebba4fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480330, "uuid": "ffa33bc6-ed54-4010-b622-a9ed012493e9", "value": "rondo.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a51fb25-e051-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766529938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529938, "uuid": "3675950a-b98e-47bb-9e7d-4f719512b168", "comment": "Malware payload", "value": "87542f52d4592d419d49926d9c5f903a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529938, "uuid": "8b3b36de-319f-4f50-b781-70109be35a5d", "comment": "Malware payload", "value": "dfc2b5035a2c4b1bb26e23036a06453b0c20631bc7ab3a7ccdfcc236eeb1cc80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529938, "uuid": "d9ab559a-168f-48b2-9456-9a4ed9ef13bc", "comment": "Malware payload", "value": "4a44b1564e27caba78532d971c4b96f6eb2240de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529938, "uuid": "94312fc1-802c-4dcf-95bd-1fc90265361e", "comment": "Malware payload", "value": "9b752b7c60549fed1790386f27c68a5ff62c968e52bcd2aeed312d49044c4e5a43e150e4505e52cfe3a6bc058fc39ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529938, "uuid": "de8ce3ae-d009-47c3-b5d2-3a1f8275a925", "value": "T100C34C02B31C580BD6F71FF027AB53E1B36B965156B0E286360D93494176F329A4AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529938, "uuid": "b7947076-8f95-441f-bfab-62caa2f64a02", "value": "1536:+QXUExWUvnacWr8CiTMlb6J7l0I1DeItxUX0oIRwfgagIgrZ1TY0U/V3nf9PRj:5UXsa+RMlbmSiSEwbglrulPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766529938, "uuid": "dc52fae0-0403-4b21-821a-fed821029da8", "value": 124476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766529938, "uuid": "ec650bee-9653-46a5-8fac-4f2b013e52a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529938, "uuid": "774be893-9d53-4182-8d6e-bdd1fbab4a32", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9bdf88-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766511799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511799, "uuid": "d4730686-9cdd-4f89-bd75-ea74d154dc8c", "comment": "Malware payload (QuasarRAT)", "value": "02ce1d871c8834b9653f841fdcd8658a", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511799, "uuid": "416b21db-3022-49ba-bd85-22dcf6649d2a", "comment": "Malware payload (QuasarRAT)", "value": "e04c0a63203c01287f3caeb0713dbdaf55cf31a3fbaf5fdefd9e1047beb9436b", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511799, "uuid": "93d352b3-228a-490b-954d-669891cda727", "comment": "Malware payload (QuasarRAT)", "value": "7cf01912e56864c38756a0c16a68ea0213653a0e", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511799, "uuid": "bb5faf0d-ff37-4bc4-95b9-bf90701fff4b", "comment": "Malware payload (QuasarRAT)", "value": "b83d36261511b54333c55f5f4dd2679fb9042fd05f6ce13bb3e50d09a5e8c19b90530b1bac7f4c91b57ecaa9cbbc9b21", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511799, "uuid": "5b92866d-4795-4b2f-8c53-ebbe72ab2a0a", "value": "T100361233B28A673EE06E5A3759B6D2205D3B6621A44F8C56D6F44C4CCF2E1A01E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511799, "uuid": "f66792e2-e22d-42ef-9df4-1e4a4bd8dfad", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511799, "uuid": "e0a8ee50-9f65-44b1-a702-d453a76f743f", "value": "98304:DN66JbK5muJg6l2+lAMplu87b27IX7tffcQWhza1mVQi96GK1pbxc5:zJW55JBRAM/uuhrdF0xhI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511799, "uuid": "cbe9cf1f-4b9b-488e-b41e-f2dd46849dd3", "value": 5171448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511799, "uuid": "c475f9c8-e9c1-405d-ba12-a9bc5624486a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511799, "uuid": "18cbeee4-28d9-4ad7-84a7-85ac9272e30f", "value": "Cross-platform_25.49.22_INSTALL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e443ad58-e055-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1766531995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531995, "uuid": "1cf71ccd-b16b-404f-a0de-ba969fa5c54b", "comment": "Malware payload (SheetRAT)", "value": "5735696415bc457fea39faa14181457c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531995, "uuid": "7d714063-f0a3-4116-8e3e-b26adb6ea9d0", "comment": "Malware payload (SheetRAT)", "value": "e04c74060a9de080179cf90271fe0f3f1ddefade7c87d65a28bcdf45ef9c0651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531995, "uuid": "4381e74a-45f7-4df2-821c-85e59bdd518a", "comment": "Malware payload (SheetRAT)", "value": "253594a08fa2f6365a8f63959b9c5aa91795882a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766531995, "uuid": "2da8b957-011d-40ad-9152-4dc4e707fea4", "comment": "Malware payload (SheetRAT)", "value": "9de8f9a9324eadbba895235f4adfade3ec45b1ecae122f55cb52d7e5d6005e698d25de4fe589549699cb299d8f9e7f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531995, "uuid": "9830fe48-d8b3-4378-9c90-b34dcf2a71ed", "value": "T1B694D60CFE92E806DE1E3DB7CBE614004B7129C12E229656315A7FFD8B6537758A21BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531995, "uuid": "8c58e653-4a74-4333-9c20-0129d14c7c6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531995, "uuid": "9c3f2c82-5188-4893-be53-dba384b2c490", "value": "6144:l//XZIuLeyfeytNZRJTnZe6VlWT8b9HHpknFHG4cYn7mpfeCbbzdR/C:Uute2ZPVle8D23Spf5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766531995, "uuid": "fb24c17f-49bf-40da-aebd-546246a93882", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766531995, "uuid": "da036bac-c2a8-4ece-bc11-e04f440988f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766531995, "uuid": "a0a1e8ab-af04-4e5a-acd6-e06de3be271c", "value": "vmivehfclhal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae1d71-dffb-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766492997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492997, "uuid": "e81a527d-cc2a-4b04-9bf5-9e324e766834", "comment": "Malware payload (Vidar)", "value": "1e0c3a0961189eff6fdb06975d911f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492997, "uuid": "0d36caa8-edb1-44e2-a0e2-1d5558ef1a93", "comment": "Malware payload (Vidar)", "value": "e117abd7a8aa487be3e4542302905c8f62fd142bbe0de0448fa6f7dd261ebbe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492997, "uuid": "98c3ae4f-657a-425e-a8b9-1fc4b50c4c82", "comment": "Malware payload (Vidar)", "value": "fca842c7a6db8b968e4aadff5e13a2acc8e6f3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766492997, "uuid": "0283a823-ffed-428e-9c03-9181ad85ec7e", "comment": "Malware payload (Vidar)", "value": "c176b774dbf6c04d21dcd771dff8ba4d8f11594b02b7a6cd953dcd29e626b59535dee31812403cb5879818d193f90033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492997, "uuid": "f5fb88b9-d26c-4c10-86d8-a7da0928306a", "value": "T10F666C53FE954666C19FD279D8B2514676703C48073022D73BA22B351EBBBC42A3BB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492997, "uuid": "c3803883-4a72-48d3-8931-51f52f2b5d4b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492997, "uuid": "71823b23-0cc2-4676-9e6c-5725fccbd9f8", "value": "49152:3yCmr2MkPg9ThdzSeQvMHiqPjPH28FwMQTD56VuHwR6j8r92hyAzKSdm+6o:3QD9TG32rwMCTYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766492997, "uuid": "5fa9ccb0-f0ae-4308-8570-e07d39d5f7b7", "value": 6706312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766492997, "uuid": "fefec660-5c14-42a8-9c45-b87b5d6895fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766492997, "uuid": "12e30306-10f6-452f-9a8e-034cf7d2e31e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a4816d-dff2-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766489135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489135, "uuid": "bee34a74-9d67-46dd-9969-f00903db2e19", "comment": "Malware payload (AgentTesla)", "value": "57ece00ecd82dca27533ff297420aec4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489135, "uuid": "5743d81d-b279-48bd-90cb-25b41a9f9986", "comment": "Malware payload (AgentTesla)", "value": "e193a354d9f74a6f7aed9de2cd5f55a1a88008bdf7fc924358599c50beddafb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489135, "uuid": "f04c5251-7005-4edc-b639-48afa1a5e997", "comment": "Malware payload (AgentTesla)", "value": "b396ff1c0fb5ba43aad3c00b2a9d7dfb412c48a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766489135, "uuid": "3882354f-ab57-43ee-83c1-8d6f77a8ca02", "comment": "Malware payload (AgentTesla)", "value": "a3a37040222d9bf9173d71429a0d83ac799bbd28bb754f0b3140682ae9ca7c87ab40007a7d4db8961b8cd2bd52f3b89b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489135, "uuid": "c3ac83bd-829a-4812-bb62-da0144509df9", "value": "T1137326A78C095AD7F21C87F9BE124DE87F090318E9827EFF04661FD67E506135C4A86A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489135, "uuid": "032de82c-fafb-409e-b821-58fb172899fd", "value": "1536:vvHD/Huiw6wQfxf28aBotckqVHmvru5266DeqkET6hjKjl:vjOi2kraGtcNVGvru526gezwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766489135, "uuid": "4308fa2f-9510-441c-8fb8-0e36233e1a7e", "value": 74768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766489135, "uuid": "3f795847-e8d5-4d94-8213-aba93b2f7069", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766489135, "uuid": "f8bf2cf7-c0f5-4079-a88a-1fb21643c583", "value": "122220253214.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a45a6ca-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478962, "uuid": "c8bc7c0e-c7d1-43c1-90f1-06caeb66661c", "comment": "Malware payload", "value": "e5bd1e4abdfcb725fce53513569ffa62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478962, "uuid": "e5265c9d-c801-4098-93a8-a538e8c86285", "comment": "Malware payload", "value": "e20d7fb7d1521c6bc7a04e1a48f08f2888b0b869af8573b98c8bff98b11146ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478962, "uuid": "623d6acd-3c19-435d-bce2-40349b52ebbd", "comment": "Malware payload", "value": "527890021fb3633e92c412a7a2464515eb26ae5f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478962, "uuid": "f75ba0cc-a02b-4a84-889f-ebc936ba09e0", "comment": "Malware payload", "value": "ecbf1487159a77ae02bc4cf122f2ff1710bbda22bbfb6b4dd9d38b03d4e48c3252b3cb3bf0e981d3a8cebf5cba5eeeec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478962, "uuid": "913a472a-40cc-4445-bc83-5db3c71c5c70", "value": "T14D630A481BD1A1BA08909EA0EF5C3E4E5F3806DAD9476316771678D11828AF5C8F1BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478962, "uuid": "1a7c2c2d-c32c-4c69-adad-e9e877f41831", "value": "768:I8w/h62/jWs6oS+xISN0vwr5CukdkfScBYrwz2y8kTAlGB:I9l/AoSSMuIusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478962, "uuid": "8c2a0b4d-ae02-4620-b5ae-28ec5d0532e0", "value": 71529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478962, "uuid": "e7e73def-b67f-4307-9def-9588d76563d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478962, "uuid": "74bcdbd4-1ce3-4af4-8ef7-8f95581ba56f", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38791b1-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478656, "uuid": "f2b78473-d816-4cb6-b650-f0ecb6314422", "comment": "Malware payload", "value": "1a56acc908e5db68af0f529980d8e93d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478656, "uuid": "cae943a8-afa1-42b6-9654-a410ba630c59", "comment": "Malware payload", "value": "e2147e1e62079591b6add79fb0e8d4282b5ebee35c40adee597d374c6bd7cc40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478656, "uuid": "aa17d92e-5f64-493b-86c0-9b541599128f", "comment": "Malware payload", "value": "76fe8aa6035198feb9e81099919cd3ad1b11af3a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478656, "uuid": "626662a9-8597-438e-b42f-03c6ed3688bd", "comment": "Malware payload", "value": "5ff2315e03c01ab5be53b43f153264037d97a380ba7d2752969cd5eec2197dfe049ddcf0d36be887c3bd1b0f2b4359df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478656, "uuid": "28942645-f456-480a-bb29-d139d4e1cf00", "value": "T119734CD432AC56791DBB746BCA2C6F37AFF3CD698E634421A2C2AB505779B53072021C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478656, "uuid": "e3f705d4-5ac2-4f2b-ba68-0d77f3e18d4b", "value": "1536:I9l/AoSSMcRJphIGCNiQ/hdNMrCzxqZXDwEahCwhNsp5dAUZ6Abx6OVTUJPfvEg3:I9l/5McRJphIGCNiQ/hdNMrCzxqZTwEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478656, "uuid": "15b853e9-82e4-422c-b63d-75bc819a4716", "value": 75454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478656, "uuid": "417292bf-cd4f-48ce-a13f-c6a8c62261ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478656, "uuid": "77422678-1697-4ca4-8311-7d0f29d10bb4", "value": "invoice-1645080830.pdf (96).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd57d9a-e026-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1766511581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511581, "uuid": "c28c50f0-5417-434c-b95a-fe7800b53852", "comment": "Malware payload (SpyNote)", "value": "7b09dcf1f0a6b8d13c479a7f2105f9f0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511581, "uuid": "c6008f56-6a89-4b35-9fb4-8a825378aa65", "comment": "Malware payload (SpyNote)", "value": "e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511581, "uuid": "a1a972c6-96e2-4c83-983a-9445a9843cc2", "comment": "Malware payload (SpyNote)", "value": "56789c19aad5966cfe5f8ae64ec65f6516eb3755", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766511581, "uuid": "e04cc0cd-be4c-4a82-8edb-dee1940e97f1", "comment": "Malware payload (SpyNote)", "value": "ada3b0726b6c1972f822aa04234be54bd9148f7c4fb35a62637ec74624a23bf3b7f5c2ce4909d0055dd697d96760352d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511581, "uuid": "99b4265f-7022-4f15-a977-7fc09413caad", "value": "T14DF45B86FB4AF867C9F3C7368275C66A96464C544B43D7471A85723C0DBBAC08B89FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511581, "uuid": "97ed5326-7cea-44a0-83f7-2a7e4cb5b011", "value": "12288:ZPkOKa1a8LzeXx7etU70OU5WmpYshXZPbGwidNpg/:Z8ta1ameXgte0OU5WmD9idNpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766511581, "uuid": "a6d83a8f-5dd3-4f96-8ac7-690f61d3b893", "value": 778701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766511581, "uuid": "678b7308-85dd-4e48-99b5-5148682d1974", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766511581, "uuid": "63f5f8c7-438e-44ed-ace1-8eda1a1f2262", "value": "Standoff2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0c51d0-dfc3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766469167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469167, "uuid": "4be14a40-10a0-4731-9970-f703a7e8094b", "comment": "Malware payload (Mirai)", "value": "2e74ded9f4fee004165be46039d4a248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469167, "uuid": "c512f448-4bf3-4efb-a6e9-395b0179bf4d", "comment": "Malware payload (Mirai)", "value": "e2cdca01b67c4c02896bde653f4be67194e0a2398c69cfbc06190b1f4fa2c153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469167, "uuid": "1dfeacb8-4eeb-4636-838f-44810e2ba33d", "comment": "Malware payload (Mirai)", "value": "7980c0d115b31bfd818d4b850d92b638f7d98c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469167, "uuid": "efb60e95-d26b-458a-a46e-92c19f38d68c", "comment": "Malware payload (Mirai)", "value": "da7fcc1a13268c666b5d8b2ab39440ab1ef7d957bf18cf7ee37ca802b6057431011b041b728c5906915027932945733c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469167, "uuid": "75fe6b9c-664c-4bbb-9d2b-b2d7049e18c3", "value": "T13AD3CF31E4646D92DC110AB934BAC6B80750AFB003D65482EFFDEA5EA477D8839AD371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469167, "uuid": "1d9321bc-5d8b-48b9-9952-3be45f1c8361", "value": "1536:sEO204fFlQwM09De/RPKboyV/CrlbCmE5HLUD+5eJ+gB2pVmfVb+kE0r:sEnFli0JeRKbH/CrlbCmmHX5NDp4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766469167, "uuid": "80f8bbb3-35ee-41f3-acd6-10c0de6591f6", "value": 131708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766469167, "uuid": "5f004828-1747-416e-9720-a3d6594f7e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469167, "uuid": "79a688c6-c6f8-4b77-8521-b30beff7f50e", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0430a8-e04f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766529084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529084, "uuid": "daf989cd-be1d-442f-9152-2ec78d5ddcdb", "comment": "Malware payload", "value": "eec317e4b6b6d1f16106c09486d6fc02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529084, "uuid": "c37b69eb-c3a0-4ec2-99a7-780931482036", "comment": "Malware payload", "value": "e3327525d88f06b73c1cfe8d19dc8d76eaf9f59e90c079b23e658793aab00820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529084, "uuid": "752720b7-6eb8-4dbc-8efa-4f0dedc8ca0b", "comment": "Malware payload", "value": "92581d08534765e702866df133bdd2a17312391e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766529084, "uuid": "eff2268f-c91e-4725-861b-3b8d8984ab37", "comment": "Malware payload", "value": "92e45e11a918e8ddc9b4caf7bf9c92687fc55cb4cd4adac3486f4db4d5930fca0db17dce0c917dd75ce6fc2a90b6243d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529084, "uuid": "60d7fddc-fe4a-49fb-979f-8714b04d4a20", "value": "T154B37C10E583DAB2F52240B301B7C7314E72E57A2C95D902D3FD6878EDB1A51EA0A3BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529084, "uuid": "cad70364-e5d5-4f46-a08c-e590f8154c03", "value": "3072:nfmM6+/g5eOSSSvk4sOmdc6AIFX3PElOxi32KpzS:nxk5eOLLgIFhA32O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766529084, "uuid": "28c29bff-58bb-4bb0-b073-171ab5e665e7", "value": 112735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766529084, "uuid": "34d4a7a2-4e97-4341-b7a9-2a84d2b9109c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766529084, "uuid": "67c6f3e9-b2e2-4312-b4de-00f870184b0c", "value": "SecuriteInfo.com.ELF.Mirai.APD.tr.2788.28897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa86cb1-e03e-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkComet)", "timestamp": 1766521805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521805, "uuid": "500b9552-dcb4-414a-b71b-7547fa04686c", "comment": "Malware payload (DarkComet)", "value": "a2e41678f6cd777d5816d0fe03c70c74", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521805, "uuid": "d720ba00-cba0-4e0b-a4ee-59838796dd1b", "comment": "Malware payload (DarkComet)", "value": "e363af09f7b1aea4c9a9e4c4bda3eef345956bd5e4f00e0725632a9f4c632420", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521805, "uuid": "1c5c3518-fc93-4603-9981-99285712fe82", "comment": "Malware payload (DarkComet)", "value": "648bebba0d9ce88b74307a533de9a725c8e92342", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766521805, "uuid": "d5f7e07d-4ae2-4eee-b819-5fb98b5afddb", "comment": "Malware payload (DarkComet)", "value": "1712cf56b026fd15c836cd311cc4dabc1a80e5848a9fadec7af753f9c07d0683e019f528673a86c50acfc42dcf0b5561", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521805, "uuid": "b4d66611-c6fe-47bf-b6e0-20ff2833d05d", "value": "T102442292BFC59C43EAFE6AFC061A0B149B55339F0E9F83526F350248B152986174B63D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521805, "uuid": "ed8e9220-16dc-474c-bc16-80aca83f7db7", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521805, "uuid": "68b803ab-ab36-4b2f-8f74-344f90d541ba", "value": "6144:xcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37s6:xcW7KEZlPzCy37s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766521805, "uuid": "cb515ec2-9556-48e7-885e-5b610ae8bfe5", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766521805, "uuid": "55b7be24-1ba7-4df8-adf6-a5a3bef23259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766521805, "uuid": "f6406736-b609-46a4-8be8-c21779d3a916", "value": "Aktif ET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5aace5-e028-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766512361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512361, "uuid": "d93fb4b5-80f2-43dd-91db-0f2438c7104e", "comment": "Malware payload", "value": "3cf2f91cfbea2092c7c58ee947ef9cec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512361, "uuid": "3a5fa744-8a92-4a32-bd0f-3f5ffab4c0da", "comment": "Malware payload", "value": "e37163f35399331a33787d94fa0558535d6a5b446a0bea0d4fd738ad57654b86", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512361, "uuid": "be9c1f7c-3920-467d-989b-d0cf94ee9aae", "comment": "Malware payload", "value": "b4cdcacb69cb9a277b9fd275c293fa58635244f0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766512361, "uuid": "35f944b3-09ac-4e7a-9fe1-5cef6a8b8d60", "comment": "Malware payload", "value": "cc748d09286107487120d5d9763336a2e944d74320f34e25ffeaeca09416e2de11acbcdf80f0b2051157f0e0415cd449", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512361, "uuid": "b2887ce6-bc52-4fcd-b737-8d4e6f0d5dc2", "value": "T16C07D003EC9455EAC1AAA33189B39253BA717C485B3663D32B90F3382F767D06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512361, "uuid": "d62ce2c4-788e-4d33-8c83-7624d545c0d4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512361, "uuid": "3ba16639-5403-4e15-997a-748e73a73ed7", "value": "196608:I8eSjXkA6scbLFrSK/mKOoiMC6b8H6wJIFmw+GJ0bIUKAdDGhL66hmRqlyH:I8eSj0A6scbhSxolC6YpJDCO7Uk30y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766512361, "uuid": "3d8cb24c-37c3-40ab-b870-20eaa03d38b2", "value": 17432576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766512361, "uuid": "c7b13dd0-58b6-4d9b-bc09-4331d6203c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766512361, "uuid": "fbb4a7fe-a906-4787-9096-0acf5a76874a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623da781-dffd-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766493981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493981, "uuid": "4db63c40-01d7-464b-b7b8-3ee884b5f225", "comment": "Malware payload (Vidar)", "value": "15e8e4f80f2982ebea90f517d3f8fafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493981, "uuid": "0817ccd0-c2ea-4e49-8c9e-47a0fe7c8893", "comment": "Malware payload (Vidar)", "value": "e3c5c738d4419433809b2f3bd660599189942733182b244b61767c80ed8e8a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493981, "uuid": "1a0b0dfc-1f76-4870-ba70-c63ab2a0d5f6", "comment": "Malware payload (Vidar)", "value": "5d76a4e48844e097211a5eb71415f302d952a425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493981, "uuid": "cfd7c134-16d8-4e16-a338-42f7c3975a33", "comment": "Malware payload (Vidar)", "value": "a3870175678ab2fbfe7ad8004d0036200cb75a3fba1d3284e942b2ef0f8e90e75147972f089dad181defd4373434d692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493981, "uuid": "b0313014-c944-4141-a584-a42202c9c088", "value": "T103564A63FD904666C09FD179D8B3818576703C48473022D76FA22B651EBBBC42A7BB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493981, "uuid": "5d049ebc-9776-4c85-ae3b-6557e88cc131", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493981, "uuid": "e6c13381-a553-4d5a-b6d7-37f73bd69121", "value": "49152:tXRhBvMcPpMZPfMwlYZv/Hsfh1IaJy6AO3Xufo5arEV4mT45v+twdmej/D:trJMQ/A1ISy60Dj/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493981, "uuid": "a20c3e5e-b49d-4e97-a37c-8396aee55298", "value": 6441096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493981, "uuid": "000de871-d05d-4086-8bb4-51908e983c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493981, "uuid": "0db72214-3890-4fd3-9bef-44953fa2a82d", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a208fb2-e05b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766534367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534367, "uuid": "d4132609-32e2-408f-a4a5-f3dce0f82b50", "comment": "Malware payload", "value": "8f41dacc99f9d1b81688024ca01dfdd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534367, "uuid": "fd9d715c-d52b-4faa-93ab-7f28950dbb29", "comment": "Malware payload", "value": "e3d0bbd0b740c0773b362a113c256724c40c8f0bf4f090992df2032b496adc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534367, "uuid": "7781d38c-5dc5-4859-b7ca-172ad034a54b", "comment": "Malware payload", "value": "33fe675a122e99ac7a64984952e1bf984e168cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766534367, "uuid": "3626cc09-c752-45b3-8aa0-90040bca1e34", "comment": "Malware payload", "value": "9351b90f467e824892d5e6042577338fb46fd3f957417adebce3e304ca2e35932f38f51f6c91418f1054b82c434fb0cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534367, "uuid": "5603afe3-9cb1-48a9-9424-c6fe7178cc9d", "value": "T119E3AFD7B24F1910C86106F01BD39FDF3A6362028E57C9F72E1DAA7B28751DB6946382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534367, "uuid": "a218b02c-961b-48df-839e-723488a62717", "value": "1536:E+sWcm+hVoMVz5UVEJbGIDrZQu9JRcMTbhkMJo6cMGwYektUA+xmFUD0gg4SnBdo:8aM+VurZQ2iKOMGwEtUA6ogwn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766534367, "uuid": "c59b161b-6d03-4695-a579-aec2f207004a", "value": 148892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766534367, "uuid": "f6977e8b-ffcb-4e4d-a6e9-fb31633d7405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766534367, "uuid": "f8f9e3ea-b0b3-404d-bfc1-b0bdf8e21829", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd41592e-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766476122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476122, "uuid": "f844c1b8-d13f-4320-9ac8-a7246a9a6853", "comment": "Malware payload", "value": "3b7a93024fcd02a7badd6228eb35f456", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476122, "uuid": "604d824f-e31a-49c2-90b1-8efcc1d7ecc3", "comment": "Malware payload", "value": "e408c88bbc1a287a4d42718389bab721084a03d36a955070b6677c8edd434d75", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476122, "uuid": "b78b2f6f-ff7a-49c2-a789-e2db327200d2", "comment": "Malware payload", "value": "ff8a5d9f9c0d97f6facdda29a9e4f658e0fba148", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476122, "uuid": "9242fa2b-2b87-41fe-9620-5d9edbc15b78", "comment": "Malware payload", "value": "2befbdbd0b26e3b0c784a2167d333cbc0cff26740945a838a527c6048548bdbb54de690fe5d9f3915cb7744437498db1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476122, "uuid": "db1acc52-4653-4e1e-b978-db09599c44ed", "value": "T101186B4267FA0185E9F79A3489F65213D673BC0A6B3086CF364C176A1F736E08E76721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476122, "uuid": "915557dc-d588-4bd8-b1d7-31b73432b6fb", "value": "15759d909431a737cd0ba268e8d3270b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476122, "uuid": "3e8645ce-ee9c-4fc4-9968-cc6927be5d87", "value": "393216:E7eIv64rGOW4JCcjB7nWNVVoNcU+kUWWyAH4p1NQu58EASEhoIaE2lShu9XPTA0L:EVvz0yT1AMQJhG688SEVBxOWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476122, "uuid": "98ea951c-df13-454b-89c8-0ba168fa2a96", "value": 92976128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476122, "uuid": "ed2e2abf-a304-4766-853d-d785d5583530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476122, "uuid": "6aea1b4f-08ae-46e0-9d32-b11559940783", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ab4b54-dfa0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766454282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454282, "uuid": "7f012402-988b-4872-8901-a9b3456a621b", "comment": "Malware payload (Mirai)", "value": "ad9a3665128c7497a21703d836abf23a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454282, "uuid": "d7b2c0e7-698c-4365-9dc2-a6170f896e2f", "comment": "Malware payload (Mirai)", "value": "e40c3673eb3de0778a8a5f9827c4ac53502db150e03a1f35c243d0cfb0bf6e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454282, "uuid": "7bffc88f-389b-441c-8c29-946aa3b513bd", "comment": "Malware payload (Mirai)", "value": "cc30d8b4ef7236b6fc89f2f74cd8c7a7cd77e654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766454282, "uuid": "b0051759-29ae-4b98-8a49-35da7cb5691d", "comment": "Malware payload (Mirai)", "value": "eb72076c6bf356e7dfc2af435a6bda0cc0185c2ad1dd35e00831908955f09ff37849eb5667b9b4635538e00ea9323565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766454282, "uuid": "b32dfb3d-61f8-4789-a4ef-4e0484e32e86", "value": "T120F3080ABF601EFBE86FDD3706A9070524DC651722A83B793634D928FA4A54F49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766454282, "uuid": "7407f21b-e5db-448e-a8c3-c0c5b60756e5", "value": "3072:YfhsDqI7FeRlGcHro8MUQ/fNZXXTHr7dNg3bnzdH:YfhsDXeRlGcH0VUUlZXXTL03/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766454282, "uuid": "1bfb75ff-c95d-4d60-8719-3edd06b59fc0", "value": 157748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766454282, "uuid": "d314f750-6f8a-4438-b32e-721894123d61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766454282, "uuid": "0d89eea5-fd88-49e2-9a55-8718f221688d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854af063-dffd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766494040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494040, "uuid": "5da393c0-9865-4456-800b-f6f4decce8bf", "comment": "Malware payload (Mirai)", "value": "36d96a3930621459ceb43273d9193754", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494040, "uuid": "f2a7aec3-453f-4b45-ab5e-e5437bbbdca7", "comment": "Malware payload (Mirai)", "value": "e4ba6157e063d98719b97b059302cf06bbf114b93ca625eb2d62547ee5975cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494040, "uuid": "be498fe6-f5e1-4972-9edb-59b7b97adf22", "comment": "Malware payload (Mirai)", "value": "3074809238ae47cd78c6ff0d056239b28f1b163e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766494040, "uuid": "077488a8-92fa-4d09-855f-8d348073800d", "comment": "Malware payload (Mirai)", "value": "8c98935827e53957bee8c31e82ef95bae221894f461d55beee9cd89e3b28fb43f5f6c599b66bddb9dd0849b6b0ab52e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494040, "uuid": "c8813319-8643-469b-ad91-7e893b52dbbc", "value": "T15BC34B0A78D230FCC287D131566EDF61AA36749C42183DBB9387AE711D36EE12E16F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494040, "uuid": "342886b9-32a9-48ce-af1a-d92441614847", "value": "1536:vKYP3dUXwT5hfLBjeOuR0YgsQkdVT7u+OHey1/HjxHPYMbVSl6/HBxnc3oJKCc9b:CYlBLFeBdzdxuL+y1Pj9Rc+yE1yVSAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766494040, "uuid": "978cb21f-e2f0-49d1-8ce6-c6c2ee331b87", "value": 127904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766494040, "uuid": "de2863a5-fc43-43ed-8fe9-34128d0ed433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766494040, "uuid": "5c283dc2-af9e-45af-833f-985e73ce3a5e", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305943af-e006-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766497763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497763, "uuid": "802e888e-90bf-4e2e-8db4-49c86db9476a", "comment": "Malware payload (njrat)", "value": "4e0d03472ab1d8896731cf552e75f239", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497763, "uuid": "fc902ad7-3ee2-4981-b937-9cd9a42b8c16", "comment": "Malware payload (njrat)", "value": "e54f398b81ea6cd06564536964e061bc0384607daa4a0ea577c502746fb4f745", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497763, "uuid": "480e0222-c730-4a1e-a1c8-fe2d5bd20f3f", "comment": "Malware payload (njrat)", "value": "6de7b8fef6e32544bf344e61daf6a3816fe5eabf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497763, "uuid": "86ded60e-0d4d-4e1f-988a-ab366c0a3554", "comment": "Malware payload (njrat)", "value": "60d094cde85ad885ef75efda28b1802cf716abddf6b40a273ff0ac836e729789d97828883142219845f93ff6f65d419e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497763, "uuid": "2c65a455-0855-4299-a3c8-76ce4ef9609c", "value": "T17B535B002B98C961E2AD4AF8ACF2550146B5D6772102DB5E7CC804DB6B9FFC64A137FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497763, "uuid": "0359386d-3665-4fa9-bd0f-17b600c2c372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497763, "uuid": "bc17d6d9-fcf9-46ce-a5b8-1514c7a7a8c6", "value": "768:+XDoRAOe3EEiPw7lig9JkfcXveeObMbNCl1+6SCv7mqb2nIpwH1oeQi6ITol8GpY:+XDoME3qQeeiMl8GbbXwnQo5GVbVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497763, "uuid": "d478f8c0-ca2c-4c47-bccf-c89b5bbfdbd7", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497763, "uuid": "aea85acb-8801-4050-9dcc-ecfce84b6a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497763, "uuid": "20abe85b-f69a-476b-b0e4-be11e9a23e8e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fe4ede-dfec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766486654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486654, "uuid": "71b2dc50-dce7-4cb3-bdfd-c241486a2f93", "comment": "Malware payload", "value": "c3809d74d66e06521cbc8efd22d2cf03", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486654, "uuid": "1aa320f8-003e-4780-8101-db5c0aafcbd3", "comment": "Malware payload", "value": "e557b3dad1f2d8a294450ba1f5d2c8ce8aee296af27b8d6282ad291fb9c82e0f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486654, "uuid": "670a9e63-695c-4e59-8f52-cc24780f7a14", "comment": "Malware payload", "value": "20db0d1c7d06d515a9c81a3581da62c1e8ae4df9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766486654, "uuid": "87cf70aa-da68-4b22-9d19-00cc86440496", "comment": "Malware payload", "value": "9407eb444c55a4b7feabb47a4457b31f9b850e37b522ed000687c7cc0ea6277ee3e222b01e997460f255a4d595dd7cff", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486654, "uuid": "5a8e26ee-898e-498e-8bf7-8fd68e16e807", "value": "T19931D00106DE5665C1718F375CADDB058BB2F4829E314F6E4288C94D2944640FC35B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486654, "uuid": "68e8a5f7-6fe5-40b2-99c1-2108ce925c7d", "value": "24:8QJ9Ir2HdvOAxZ1+/AYeF7aD0dGO4I085vZ4Odro0m:8AZHv9Yy7sIjx4Oa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766486654, "uuid": "64ad45f4-9ffd-47cb-b1b9-a94017c0c54a", "value": 1872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766486654, "uuid": "6d5dc022-11bb-4f1f-9070-082fb1634001", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766486654, "uuid": "f3db22c4-7041-499a-b8a4-e8b0165034b6", "value": "e557b3dad1f2d8a294450ba1f5d2c8ce8aee296af27b8d6282ad291fb9c82e0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbae9ba-dfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766457814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457814, "uuid": "47ec404d-c4d4-439b-9c24-173c23ee7970", "comment": "Malware payload (Mirai)", "value": "74d55af8860ba46c47a93381f52ad543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457814, "uuid": "f4c11153-d69b-429b-b992-a1cfef501d44", "comment": "Malware payload (Mirai)", "value": "e5e9346a47bce22519a79482111400fa4d1cb57614773f44d27c47574d1fa442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457814, "uuid": "b0fabdad-ca54-4117-8768-98077e7be776", "comment": "Malware payload (Mirai)", "value": "a60c3d6af08cd60e421a858d8ec5652047dbe25a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766457814, "uuid": "971bed36-5c23-4a6c-a965-2a79c5aa09b6", "comment": "Malware payload (Mirai)", "value": "63b9fb4b34ce2651af5d91d4620ea535ae7058e857c0b6e895eea4d0f2e2d8c0c8b9f4df75d2deec6f5f1f4989687e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457814, "uuid": "86a3898c-1b28-4cf7-abb7-6fe7617fcb3c", "value": "T1E782CF2451AA1022CA70993EE93EC3A2725B1735C0F631EB7511909858DE59FD3FD7CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457814, "uuid": "3b38db9f-d1ed-4701-a1b7-51f0b5346981", "value": "384:gshnpofXG92JuMPDXKVggzi6OYxrrcwkTdjDfKMhymdGUop5h36:gs4faiuEKVnZOSrwjdj+Ms3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766457814, "uuid": "06445450-c087-40d5-ba39-ee5a03002277", "value": 18628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766457814, "uuid": "5408b93e-f6c1-40a2-b0e3-87f83c61d2b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766457814, "uuid": "1b4de702-d0b6-48b0-9365-588fe2c2e059", "value": "ntarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1a2069-dfc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766469864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469864, "uuid": "b416471b-3635-4bab-b97c-e7d125eec32a", "comment": "Malware payload (Mirai)", "value": "9d93017e003d0dbf2d78833bdb275093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469864, "uuid": "71614204-8697-431c-95ad-3e184d13731b", "comment": "Malware payload (Mirai)", "value": "e65b2de38c4f3597ba8c788326624745f984ed514b24cabd0f106aec8ab779b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469864, "uuid": "073ae635-0f96-4ef2-97e3-78656e58139b", "comment": "Malware payload (Mirai)", "value": "8eb9be1036379bad043228a49e15f5619bef7d0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469864, "uuid": "65fa20ed-5b81-4f6b-81cd-0cd52b2a7072", "comment": "Malware payload (Mirai)", "value": "462ce209ccb92a1cc2a70bae39de463106167613567ed801479a2229cf572ba622faf5b1655e40baef5705632ab93547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469864, "uuid": "ac4ac3a8-86ee-458c-a1d1-969e71cd7da2", "value": "T161D3BF30F029ACA1DC1106B834B6957C1741FFF407E91583EEAEE99E14B7D45BAECA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469864, "uuid": "f87abeae-90ee-4e03-9008-e101b665273f", "value": "3072:SKWptbVsmXJVvLG7tHCfD9WC2GJ4NbknVh:SKcb5fLm1CfDVHmBknn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766469864, "uuid": "658c7754-e2ec-41dd-936f-1afa27063ebf", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766469864, "uuid": "1b0feb6d-8108-4995-80a2-6628f4f50c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469864, "uuid": "a5c85fc9-0d7d-48c2-b173-d872e30e03fb", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eca9577-df95-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766449361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449361, "uuid": "eac484c4-024a-48bd-82f4-858ac68cbdd2", "comment": "Malware payload (Mirai)", "value": "3ff038ad0e1879087006bf4d581ae72d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449361, "uuid": "790798b3-1fd3-46ff-816e-92c181fcfb4a", "comment": "Malware payload (Mirai)", "value": "e6d8b55806df62fb5e5e38cf2b62a7a80850599d2d884fb278d8eefb0251456c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449361, "uuid": "71aac830-6725-47a4-a7f4-362f81c5c298", "comment": "Malware payload (Mirai)", "value": "723567f20eab75c81b13637d9e09204ec14523e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449361, "uuid": "e241bf8d-d582-4efe-9449-a70ddd127df9", "comment": "Malware payload (Mirai)", "value": "67c634dcc9b54e504c3905a25d7325899be176a82f30cfdb5d12fe2a50ea5d689a79398e7acd1084a4484eccd6c1f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449361, "uuid": "2b4f4f28-2986-4eb6-8962-cacfa0475ad4", "value": "T18AB30985B981AA22C6C256B7FF4F428D771A539CE3EE3203CD195F64338B95A0D3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449361, "uuid": "a3548bdf-8544-49a9-bec3-fd31d4a61e5f", "value": "3072:tXoPaHGZ9B4GxvT3cCal0hLeDS5rGyInz4:t4PaHM9mGxvTMCal0hLeDSVGV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449361, "uuid": "f782201e-b5af-4b69-bcb9-049bb50ea01f", "value": 115944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449361, "uuid": "cc879af4-46ef-4177-a308-047530d62a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449361, "uuid": "67eb791c-ee3e-416b-9e20-95edf95493e6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7080df73-dfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766473389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473389, "uuid": "b083d994-773b-4276-9483-2cff75e4c460", "comment": "Malware payload (Mirai)", "value": "36cb6b260c4a1f2409ccac8bf42e4f46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473389, "uuid": "a66b66c8-bc79-4e8a-b702-09bc7c401a9a", "comment": "Malware payload (Mirai)", "value": "e70aeff02a6c90a75c0ab3692a17e9311e32be5acae9db02965de8679e6dd9cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473389, "uuid": "14bc9475-3545-4e41-91e1-7196b3ea213d", "comment": "Malware payload (Mirai)", "value": "69fdb0bcecdc7ed2d9f0e5fb330b678220a30cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473389, "uuid": "1fed7ec3-2529-487d-86ae-3fdf38462529", "comment": "Malware payload (Mirai)", "value": "2ef88f40315e08999d69a5943db8e7f7aae5ead7a475715b45c7ba8539c6f369fbf7d269fc531bda057683c76703f6dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473389, "uuid": "3fb059ac-c7d9-480c-816f-974b25e154fc", "value": "T13F838D87ED63EDB0D8210039522A97619D32E5312432ED0BF7953B39EC96701DF5A3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473389, "uuid": "44f2c235-c8f0-4a8e-ab84-c8f631169211", "value": "1536:AjXcD175o5ScyXT6aIeQtnjMHWmIhWMqgI+8AeNKawP3PG2Zs/+pChMP8v6uJ:N1v6btnQPmz5QXu3PXs2Qw8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766473389, "uuid": "8f24c1d7-def8-4788-8006-8640cde856ba", "value": 87292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766473389, "uuid": "c45b0535-8a11-46ae-bec0-67e80f74ad74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473389, "uuid": "cd75d1e7-cfe6-48f4-86eb-e916e9207e23", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0921935-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1766476127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476127, "uuid": "9322d166-f315-4bf0-9af4-31f423f98fb8", "comment": "Malware payload (Joker)", "value": "651abcc80b3bf2f05436251dab899a6a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476127, "uuid": "65b57937-788c-45e4-bac4-c75e2d5c68b5", "comment": "Malware payload (Joker)", "value": "e744d2e0ea2649cdd2eed0ace7442cf228582021f21e570fd288ea5054e38520", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476127, "uuid": "732d5237-274c-4874-b4db-61778ca243a4", "comment": "Malware payload (Joker)", "value": "973b5c97bcb4906bc59ce5af9f1a13a29fc56c8c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476127, "uuid": "bd12d792-21ef-4925-b749-303a777eccdd", "comment": "Malware payload (Joker)", "value": "cf887b5118d57122a9628eb3252d83953f4ad0ed5d73f913e743a930d1b70c507e03899cfe148fac69de56fff43a4003", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476127, "uuid": "0ff03c39-a596-4a33-8bc8-6e2f99e1427c", "value": "T17F97122EE70C7826CCB9B07A9E5A327132596CB82711D3D72501B2DD39F36E08759BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476127, "uuid": "436baa95-cd54-44d9-81d8-287b03758bae", "value": "786432:2oWNvsdiDvcKqtXsJyECwDbVNCaMe2O3PDs:2oWpCntXkyEBD/CZ6/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476127, "uuid": "9596e76e-5f25-4818-9048-48ce228df2da", "value": 39959735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476127, "uuid": "008eafb9-e22f-4be4-93a0-cf9d4c454a6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476127, "uuid": "ba6eb70e-d580-45eb-ab52-56b1ba0402e0", "value": "Fancy+Cleaner_8.6.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c106cc-e040-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766522869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522869, "uuid": "f9d8fec1-b2dc-40c7-9262-69caf745c03d", "comment": "Malware payload", "value": "3ad077e246e4ed8b83f975e2e30b969b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522869, "uuid": "f6a7f209-814b-432d-bb1d-8f64fee3b3b2", "comment": "Malware payload", "value": "e772ce7b80a5d0914cba2df2489f2d76a7116a646bc44c526dc1647b3112d7b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522869, "uuid": "ab7d1408-596f-43a8-ada8-e79375f04914", "comment": "Malware payload", "value": "c0ec1d1f1110afea959c08844c6e1182b180e545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522869, "uuid": "0e69c183-b565-4491-b851-278f54cccc3a", "comment": "Malware payload", "value": "2096218b606979dace66194ada5d682887479ecad71e5372a77e25a372fa3937e44e9e1f87e66ebedc4da8193fb15b7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522869, "uuid": "70b20827-f54b-4dd3-80ab-fd5f896c9fe4", "value": "T18182BF70E3EE6221D5B08D33CD71891BA2664BF4D2BA33F22390497CA9D551F78F9446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522869, "uuid": "7955bf87-d3f8-48b2-a312-11fcf965b98c", "value": "384:Um66ATActvcKfZ2tC3k3SXP/T/6WyZTEhymdGUop5hx:pJAz9cuktIBXTiHZos3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522869, "uuid": "ec3d59ad-a035-4515-8feb-d4151226b491", "value": 18188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522869, "uuid": "fafd01fa-98a3-451a-a95f-b3ff8d28faaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522869, "uuid": "99fc439c-e9f8-48f4-92be-c3e1429dbade", "value": "87sbhas6as.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c9b5db-e058-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766533120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533120, "uuid": "01c5a82a-9040-4a5e-b176-8f77affb5443", "comment": "Malware payload", "value": "31d029b4d43257e6c3eebe09185606bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533120, "uuid": "e5b37034-f844-42af-9027-66ba33eae7af", "comment": "Malware payload", "value": "e88fbee45cf9c2a0ca4c40571a48ed9145f256beeedaa6fea64279f0c22597be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533120, "uuid": "d90524c0-ea93-440c-9d66-0fa3180d1a96", "comment": "Malware payload", "value": "7ba163babac57296ced02a434c0fad341c3c9895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766533120, "uuid": "19d5d9d6-9bd4-4bef-8d93-f46e00489fc2", "comment": "Malware payload", "value": "2d10f6cfed42bf061eb48e6372ca95a4a81b35e0cca955bfbba6dce8a8e68d17f8dbc5c376216f307570f6b9c5601139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533120, "uuid": "c88d732d-659e-4855-9081-d4b2c5ce1d10", "value": "T1DBB38D82EA97E472E8521075162BA3628A33E5357431CD47E7A82E35FCB9750CF1A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533120, "uuid": "e3fb43aa-c41e-43a8-8446-a6d43317135d", "value": "1536:d9dHhQJswOvODB/EKd4JauEiPTWhh+jfEYCBW4fVtHppL8KcyDNtBvMyW6MTlK5r:yRxMEqm4jSnHXDTxMqg5uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766533120, "uuid": "2279840f-59a0-4a6c-b248-bec5ddc72f4e", "value": 107812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766533120, "uuid": "563df445-49a0-4e2c-920e-e721aea30219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766533120, "uuid": "d285123a-ba08-459d-bdbd-9013f80d9e51", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61a0e43-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522871, "uuid": "79be8c7c-e980-4ff7-8091-523527b05b16", "comment": "Malware payload (Mirai)", "value": "debb2c43ee84f268f13075642d83ec7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522871, "uuid": "5b0de7ec-fb0a-492b-b58a-8d946a467868", "comment": "Malware payload (Mirai)", "value": "e95f1cf56783fbc0b64f8a670aaa34db9ea36efb87f3d607d07962b5c24af03e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522871, "uuid": "c095d034-1872-4814-b5ec-d071df7f392a", "comment": "Malware payload (Mirai)", "value": "b2a77b94710c00a6af994a628e0dc474c1c857cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522871, "uuid": "118608cb-85c8-4a54-a38c-595d2e00c7dd", "comment": "Malware payload (Mirai)", "value": "486f13399f061b40ff8e932c89ca3c220c1df9eb1fc71d54ba460fd1547b2ba5921f3eafd34e56e264e9d513186cfdf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522871, "uuid": "f00a3b10-f160-4ce0-95cc-dc35124bfaac", "value": "T126133A217A762E07C4D1B8BA61F34768B2F1569F26E8CA4E7D730E4FEF2094065132B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522871, "uuid": "849a4d29-1178-4f97-9a6c-ac0cbd6d05b5", "value": "384:eHw4ww3Xac4wh4fVU16G8GZS9LTTV6OEsEeTYXZcU6EqvsKR3mfqqZL1FU+peOHB:UJ3qchmXX9hldTKksKlmfqG1O+BuoDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522871, "uuid": "8a3e1960-489d-448e-a4e8-3e28d0d9168b", "value": 42632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522871, "uuid": "86618c83-bf11-413e-b590-42ea7e49d545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522871, "uuid": "cb43928a-70fb-4551-9370-023fad805c24", "value": "87sbhas6as.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f155121-e056-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766532147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532147, "uuid": "e4ee3e27-4dce-4df9-8337-cda734ba82e4", "comment": "Malware payload (Mirai)", "value": "ab764cd599c3573a541c8c36016450c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532147, "uuid": "eb4c4ec9-7399-429b-aba5-040a74f12c26", "comment": "Malware payload (Mirai)", "value": "ea87b448b2882c1c5ee8759d1a517892c91bf3d42f809c430823c27846152728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532147, "uuid": "039fc5c2-ad0e-417f-b54d-fadf28cf9fd8", "comment": "Malware payload (Mirai)", "value": "954b273f4911e53736886ae159dcae4825829536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766532147, "uuid": "7b9508a1-986f-4f80-b443-ecc61cf39604", "comment": "Malware payload (Mirai)", "value": "bc5235b454667327847271b20dd9e27e35f94a6f9134bef88991c6108603ac1d0fbf01152d3816257703d6ed8da1a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532147, "uuid": "4aba7c84-9a02-4a8c-a504-ffb895f46edc", "value": "T197D34A53F404DE6FF88AC7364193CB35B63173A55BB312627643263BA93D3A10D26E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532147, "uuid": "5cb4f2bf-9724-438f-bb78-9a8d61fbaad9", "value": "3072:I+VMpKZiX1OCJQdp19YUlXeX9wtE2Mny+1YXyj:I+VbZiX1O9YUlXY9yNtyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766532147, "uuid": "9f923276-cab5-4a81-888d-2deaf8f9beae", "value": 133016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766532147, "uuid": "520be591-07f9-4141-a10c-1fe1f50eadb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766532147, "uuid": "6129dec8-0e6a-4407-acc3-de4eb1c85d55", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cae995f-dfce-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1766473732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473732, "uuid": "ccd2e9b6-7889-4dc1-82c5-16041a278778", "comment": "Malware payload (Gh0stRAT)", "value": "bffa4be5770c93d6c26f77ea43d0635a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473732, "uuid": "50ca7844-b237-4ce1-9a7f-1c259ff3f1cd", "comment": "Malware payload (Gh0stRAT)", "value": "eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473732, "uuid": "f959c8c3-c49f-45d4-82ba-5cdef54ca55e", "comment": "Malware payload (Gh0stRAT)", "value": "f50b3dc88de68e64294696203986ed31b525e579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473732, "uuid": "b9acde34-5301-4db2-9aba-b5d26a0383af", "comment": "Malware payload (Gh0stRAT)", "value": "f013ff1ddd80580be434121309e9790fc85f9f64792d1a18ddfaca01c87e2e35d2d2217138520418dd73fd77e00d6447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473732, "uuid": "ffbfe102-a993-4f8a-8315-d767bcf28c45", "value": "T137373323B3C7653FF16E4A3A0A77D2260937B61165124C66DBE818ACCF261D16D3FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473732, "uuid": "4d05758d-bd26-4955-b47f-7259b727dfad", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473732, "uuid": "20489051-b6a3-4d3f-89ef-6e48dad0e440", "value": "393216:ThG+++1eM+xIa9VAD0/MzXKUcXPWl19aLLYRBPfNAcEU9vj7ER07s:wcc9o0/M5lHsLe6G7hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766473732, "uuid": "6c449c02-4dc0-49ed-bcdf-8b8f43e85198", "value": 22984219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766473732, "uuid": "04487122-ec41-494e-a09d-14d313fbd72d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473732, "uuid": "02dbd856-9061-49a6-9fba-4c6558e76ee1", "value": "MPC-HC.2.5.6.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb63a1d7-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510129, "uuid": "2e129286-42c6-4ed5-8a42-cc9e601621e8", "comment": "Malware payload", "value": "c887e10dc9b7edc784151a9088f8f1e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510129, "uuid": "9394beee-1f33-4797-82c4-848d56f06427", "comment": "Malware payload", "value": "eb5c7c6370d533e6675ef2fb8b5f3f10cabc36584ddd3d3ad026af5266e84ed7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510129, "uuid": "0ae3b14d-31d6-4286-ad18-c9cacab8ebbc", "comment": "Malware payload", "value": "f79c56c4b9bab23212264041c7ec4e9dba3226eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510129, "uuid": "4f1ad062-8fc8-44d2-bc7f-f7304ff61821", "comment": "Malware payload", "value": "78fdc850c93c3dcf9f01546be46654cc55acad53f403f7692936de9fb0371b7e253a15978a4bf14e9d57aee8346bf4d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510129, "uuid": "909a62a1-6169-4d56-81c2-aef776591a5e", "value": "T13226B865AF3169C0D7F4380D8F306AEB58795AFD88939D59353282E9CEB41E460A7F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510129, "uuid": "ce5143c2-c4e3-4587-825d-2905cac4b6ec", "value": "768:q/5s2DoaXwiqjbyAQKWWyPonK1V0rmfBXbUeMsQdZ2sKDei1QbsaXfbQ:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510129, "uuid": "2557f048-49de-4f8f-922d-7012a2f27ef0", "value": 4482653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510129, "uuid": "dfa5498d-2fb7-4be8-b2ae-dd8d623c3209", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510129, "uuid": "51ea7dbf-6b47-4b53-a660-abc82221a3d9", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c61f3c-e040-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766522872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522872, "uuid": "53f68488-5f79-4ee2-bc2d-93fc29bdd18a", "comment": "Malware payload (Mirai)", "value": "480c15660c1420494fc61e9874f71096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522872, "uuid": "dd652bb7-e962-4d66-8342-10b8b51fd12e", "comment": "Malware payload (Mirai)", "value": "eb736a1abb507ca54ec04e023d6e23df952d29a2f5d7b38cad8afe8b496482d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522872, "uuid": "285cfa85-1b9e-41c3-a2f7-8375123619be", "comment": "Malware payload (Mirai)", "value": "08aa1e74b3cf6860dc8ad818f1f91896a515d024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766522872, "uuid": "efc9eded-a683-4f1c-aee5-3f5f57623df6", "comment": "Malware payload (Mirai)", "value": "3c39385b7cc8ce54348dcb6b7fc0307884e5903eefd2464e9e023888c9d0f47c9e515c60b9f8b3e708cbd1443343f7b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522872, "uuid": "cb25a1c6-c80b-44b0-83bc-83cd50aeb923", "value": "T18413E15CE731EA25C6282B73D2694E40BFF64EB9B0DD907743809BDC3890A4F6879196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522872, "uuid": "88fea482-9fc6-431c-910e-9a98d02371ff", "value": "768:k7Fn8R8nmCp97Z2iyjQeg3QCab5gbKekjIUSYon9q3UELEIoqn8U4N+etSsrW+nh:kaRKV9Yiy0DiNguISo2LEIo08IjsrWoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766522872, "uuid": "7edcb300-075b-4356-8051-b9ff959bd59f", "value": 43348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766522872, "uuid": "5fe77bc7-7d56-4772-b7b2-28602486d2a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766522872, "uuid": "62d9c449-12a6-460e-9507-12a07b8a3679", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0f27d3-e005-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766497432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497432, "uuid": "83b28b28-ff8f-438d-9a97-dc90996cf9b3", "comment": "Malware payload (Mirai)", "value": "fefe7bf81493eb9a1c9307ec4bb8cf83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497432, "uuid": "e720265a-24b3-4d1c-81cf-e2a5c4af933e", "comment": "Malware payload (Mirai)", "value": "eb9e1cf68eb14e4adcdfa704496393a5650750460d44a27fc6810a8fb943c18d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497432, "uuid": "ce49a831-77ba-4329-91c5-a96eb304a026", "comment": "Malware payload (Mirai)", "value": "2f78f013ae80121511e8dd678547031fb08563ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766497432, "uuid": "3f3fe3b7-b0dc-4fe0-a68e-4510aad9c05a", "comment": "Malware payload (Mirai)", "value": "ae6490a32105ce56d225739bdfabe2371030eb0396590da17fe2220c9460ea285419bce4757e337fbd577ea28bf2b795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497432, "uuid": "04188c48-691e-4143-89bf-0934a7abd363", "value": "T10663C752B8829107C9D892F7B71E019E331513A8D2EB3307AC356F6136C9D5F0EA7E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497432, "uuid": "3bcf8ad1-fffa-4b0e-8148-3384cfc24623", "value": "1536:qE/i/QCO2t5TktVzXRXXGLxASEwnYv6n9dM+r:qEK/QF2tNkt7UzXYkdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766497432, "uuid": "683390c2-db40-4b0b-b82d-bbc347aae952", "value": 73040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766497432, "uuid": "96045a9a-675a-48b8-a027-0b36ca59de32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766497432, "uuid": "b3bef836-7c73-492c-987a-3a117882ef7e", "value": "shadow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af18ab9-dfdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766480332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480332, "uuid": "39dcd110-ac41-4c62-80e6-98208a78ee0d", "comment": "Malware payload", "value": "f76b158a880d35587a682ab23bca3194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480332, "uuid": "878cab95-9d79-46a0-842f-c96228e6de73", "comment": "Malware payload", "value": "ebcc84ced0d80f19ca1b24f2bd0119ebe86a47942b6cfbcf337bd77d5ee66d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480332, "uuid": "3a83478c-1bfd-461f-8d1e-779aeb50b411", "comment": "Malware payload", "value": "08abdf252e729680e526061461ffec227fae45f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766480332, "uuid": "9187b29b-cdac-44d3-852e-7250b87235b1", "comment": "Malware payload", "value": "600f6c0ac3f9a185e366091f93955835dfcb0c1552ba80b121083c9620f3c2ddf1fcb768ebeb05e3e08fb95423b2a128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480332, "uuid": "e16949b2-91b7-4d9f-9e11-a6ab08d45f20", "value": "T12A96335873B414D9FDB7953EAA64508273E2B4328761C9DF0BBC02993E0B6F15E3A748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480332, "uuid": "50ca428d-ed15-4423-827f-0616142b9450", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480332, "uuid": "11b5b451-e300-4ba4-b225-24f05d70996b", "value": "196608:dhMfPtbW897GJr1LDsBTG9WdVBbWQGa/R6:vMH1S3sB1BbWQhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766480332, "uuid": "3cd7da7c-8043-4f9c-940d-45ad10c9f15e", "value": 9178653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766480332, "uuid": "c6b648ba-e8a6-4cc5-b606-84d228e31fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766480332, "uuid": "5560b40f-c628-4ebf-b607-f93e429fafc1", "value": "\u6570\u636e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65e4e22-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479144, "uuid": "27e0499b-8913-4816-a887-bec8cff0c97e", "comment": "Malware payload", "value": "4d356172aef210c581bb2062864a493c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479144, "uuid": "4c8b72fa-cca5-4eb2-a719-71cad780eb6e", "comment": "Malware payload", "value": "ec2f93d208d1f78e0afb50f1dced51d03cdb1bea4fd3662fa44fbbedb18c3269", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479144, "uuid": "d9da7f8c-a291-490c-9449-a57322aace41", "comment": "Malware payload", "value": "e6e1de336321e1952c3cbf6f87f33f440c137933", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479144, "uuid": "6dc89248-5e5c-4b99-b9ed-15e7b5abef36", "comment": "Malware payload", "value": "cd0d8c01d9c0a8aba6462d072c73c92979fc5d82a538e29fb682e0bee6270742368a50d552bb5e0eb55094523254b116", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479144, "uuid": "d2c9903a-111a-4631-8ad0-bdc42f116fb0", "value": "T1E4731B8E5C357D0539FD194D29A216F1CE4BC2E31B4018CF2A5AB89AF03A4A7346D9F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479144, "uuid": "0dcde292-bc67-4f7f-b268-769f7f08cfae", "value": "768:I8w/h62/jWs6oS+xISN0vXQjAXimN4yrOl/ay+O/M/S19C0mJhTPHVWQdfuHDYiy:I9l/AoSSMotusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479144, "uuid": "3291e607-bd01-4d40-b6f1-2878be0a865c", "value": 75338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479144, "uuid": "1df9eb18-7a25-4abd-8a84-ab05a7c08933", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479144, "uuid": "493b21fb-a983-4aa8-90ed-109dcbf01f27", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6a7649-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478588, "uuid": "43eda9bf-0bfd-4261-b127-4141c086a049", "comment": "Malware payload", "value": "04434ad201e69a23c508254a890ea449", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478588, "uuid": "fc374b3f-e57c-496d-9d16-3252015ed5b1", "comment": "Malware payload", "value": "ec5c78405dc73d0a5f11254c4014b6c4041d75e7104abc60d6ca45c8cc42a66a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478588, "uuid": "2958a8d1-a14d-4e99-9a45-1b05fe579b4a", "comment": "Malware payload", "value": "a7fa9227453ac94a0daefe26307ca87300b070dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478588, "uuid": "1b81af76-def5-453f-8901-f014c3613f21", "comment": "Malware payload", "value": "a0b7b9bea3d559a526b73a5bc4d1564d826e24e621e20f29552c3339746f6e684dbea688c3fdfa3a9f926234e2fc6d93", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478588, "uuid": "880b2c76-ca90-4b3c-8163-e12a66fc375f", "value": "T168731A3D4F30B655D52958B44B2D741E08E36B9788280BE99F0CFB12E11EF2599F87E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478588, "uuid": "97eb2da0-48b4-4020-a245-919b612bcd02", "value": "768:I8w/h62/jWs6oS+xISN0vx+mkyhYdkfScBYrwz2y8kTAlGB:I9l/AoSSM7IusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478588, "uuid": "1bb6241f-d4a7-46ba-9b5a-15e68a007e57", "value": 73401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478588, "uuid": "6ae4e241-351a-4362-9c05-25d8e2ffb5e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478588, "uuid": "3c80afa1-6615-46fb-9386-a00c5c825493", "value": "invoice-1645080830.pdf (109).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64464899-dffc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766493555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493555, "uuid": "e08da474-beb5-4917-885f-18128ff66d14", "comment": "Malware payload (Mirai)", "value": "e217a9c326d6ce0de33099ae3b997713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493555, "uuid": "5c0462e7-5dd7-4b64-8b66-d80f916f98f3", "comment": "Malware payload (Mirai)", "value": "ecded577a5a44afbe60e7528d0fedb054660519b88e607075272ee14e1cd3f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493555, "uuid": "789bcade-990a-461a-b1ac-10154d7985e5", "comment": "Malware payload (Mirai)", "value": "9d744bcb464f61b6da05f24c3e464bce241aa78a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766493555, "uuid": "0b76d3b4-debe-4903-8390-1936280bee01", "comment": "Malware payload (Mirai)", "value": "8e5b2e6dc492ac588195e72efbdd28de57210ebe1de1de12590ae8b2c46c58a3f1ebb9cc5bb5ce421af33308fbb1f277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493555, "uuid": "f49b68c7-4161-44a8-8705-36452fba9d05", "value": "T161B3D80A7E12CFAEF359827007F74E31965837962FE1D585E19CEA411F602CE641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493555, "uuid": "ec4a383f-a1cb-4936-b919-98a8126d8d7b", "value": "1536:uRGOn01HmPFmOZVGoEAOrn3wqsCjf5Dporse30jln/ml61d6qdvT:uRGOnu8ZVGoE7wqsCjf5Wr21/m4ndvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766493555, "uuid": "53abb591-245e-457b-8a5b-eee0c529bc51", "value": 107636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766493555, "uuid": "5ea8fc8b-4715-476f-9e70-4c8a85cb11dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766493555, "uuid": "5b4fd263-867d-4292-92d3-2c091a7d71b0", "value": "nova.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e0e329-e011-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766502602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502602, "uuid": "49f1d737-f2fd-49ea-a459-4081dcf6a335", "comment": "Malware payload", "value": "e5dfb6befdc3a2c05f457d119a9641d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502602, "uuid": "8093b8b1-b863-45db-819a-35bd281124ac", "comment": "Malware payload", "value": "ecf5dc29f65433be909f7eaa4398fc8e16423677db62bf8c25a6559f8e18330d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502602, "uuid": "d683b868-fed7-45f8-8878-72fdc000db2f", "comment": "Malware payload", "value": "4c0981ab5b774ab44aba96960567dc8663d6e5d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766502602, "uuid": "f6693ac2-d4fd-498f-a806-d2ac78e792cb", "comment": "Malware payload", "value": "dcb8629b0d7d483061109626fb0c74e0e90401267f43eb25863d9f5eb0ff12baa5691f45b3511e171698d9a4c1878b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hlsofficeaam", "colour": "#9E526A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502602, "uuid": "4894ffbd-37eb-4927-acef-55b387600cb8", "value": "T162925C5EF79944D9E117C538C956265EF073B2250712AACF03A243861FB27D0BD3CBA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502602, "uuid": "88ea7d8e-f2e6-45ab-ad42-472138c3c256", "value": "1ffc81931f373e008ca3b4517738fc36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502602, "uuid": "9aec0dd2-651a-4919-92af-2e1c42dad602", "value": "192:sBc3XarvXj6JavAbVbOGX40dTGXoh4j5XgBGqFywfJOh/TnFyOL5uo048:gc3XaruJa+BrXjoVd/qFyIe/Tbuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766502602, "uuid": "c08ab257-ea84-4118-b975-f03c79500fd4", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766502602, "uuid": "f0fb0768-8d08-4853-815f-ec20a971de24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766502602, "uuid": "d3ae308e-2f29-46f5-b512-94d00351a2a2", "value": "ecf5dc29f65433be909f7eaa4398fc8e16423677db62bf8c25a6559f8e18330d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea4ca37-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468903, "uuid": "59609351-4f0c-4681-aab7-b99ffe3d4248", "comment": "Malware payload (Mirai)", "value": "2b2087614ef477ad50982357a05f8695", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468903, "uuid": "25ae31b7-1881-4ae2-be11-e0ea02efd3cd", "comment": "Malware payload (Mirai)", "value": "ed375461dfa61518dd34450ee7b8cc43b2ea0c8eba7a88a82fe62f17c817fdc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468903, "uuid": "12a20850-db06-4720-afd7-7894bd888314", "comment": "Malware payload (Mirai)", "value": "aad29c1129d67c2f7626f9f8db75de3434e88ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468903, "uuid": "4e9aee17-fbda-4923-9cb9-4db4e6fb870b", "comment": "Malware payload (Mirai)", "value": "5e5293527d440f6b63730671b211f9c31aa96f673b8212bee6531e42f120eff7000bc440df24b4a6169aeea363b8748b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468903, "uuid": "469c9a76-166b-43eb-bf17-719691088a61", "value": "T1A4145A12FB0C0463CA831CF48E3F07FAA3621A9104F99115690D7F5A6A75D37A58BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468903, "uuid": "003932a5-cc25-441b-8f3d-1017cde22ae0", "value": "3072:LpPvG842c7PxIN4rllATpVMyPrJPYKP3Ndxe4DcYjkVbDgnYUaE:Lg8k71ATTHzFYKPhvLIV/gJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468903, "uuid": "6453b48e-1963-4596-9683-693a0b8803a4", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468903, "uuid": "9705a7be-f8ee-484f-ba4e-99e895a27cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468903, "uuid": "b4fd36de-fa90-4c6c-9a3c-baa00e257380", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d908340-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478914, "uuid": "2a88c054-bc0f-4c32-b182-77bf9f783cb9", "comment": "Malware payload", "value": "fb0905cd6059eaa50e5013206cc67ab1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478914, "uuid": "17cce035-cfdb-4422-be9f-fdb91e6cb6cf", "comment": "Malware payload", "value": "ede25aafc1a857cf9c44ecda5bc60f3aba4042ed64491d98b54fd991beb0935a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478914, "uuid": "61083f01-c27e-4cb9-bfe4-c0c38ea84c59", "comment": "Malware payload", "value": "fd429f502504ccf2225ff60dfd57af82bb316d12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478914, "uuid": "0f015ec3-c6c2-47d8-9c40-4c3ef054cb82", "comment": "Malware payload", "value": "0fe4e5fc73597d79fe7c1ae1b235864a8b4a7299c97f84f0ab726736556e2d9b9670fc9f24609702f241adcf09a7905f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478914, "uuid": "2e685eea-6237-4884-9014-07125086aa98", "value": "T195636C2ADF119CE776B16FDF111F650DB1A42A3F6AADB0166D7AFBC64100D824032CE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478914, "uuid": "154eabf1-6fd7-41a9-8792-7e3ca68db1ec", "value": "1536:I9l/AoSSM7eiLrmffmZo0zB1VpCL5VQ/n+sYDcFSkNiM9JMIsv9Ew11G1ayfT1SE:I9l/5MMfusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478914, "uuid": "ba5d706e-128a-47cf-8368-abf07e819d32", "value": 72488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478914, "uuid": "20187108-0e28-4699-aa76-8ae764177f9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478914, "uuid": "1764d3f4-8b19-439e-9d31-54eafa848bc1", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5663d2-e02a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766513411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513411, "uuid": "e060bab8-f28d-4447-9b40-0338bf43a559", "comment": "Malware payload (Mirai)", "value": "361ca0e2abbfbb0dc5c56590e0d67591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513411, "uuid": "79d2352f-28e7-4072-b739-83c428a32b64", "comment": "Malware payload (Mirai)", "value": "ede5eb7e11a22069cc9e6d7466f3a73b62720feda27abff6d7464560a20a714f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513411, "uuid": "013bca86-41bd-4bef-8d87-b57e3da47a57", "comment": "Malware payload (Mirai)", "value": "71dabb85c3307be90faa96076bd273e99ac8dcb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766513411, "uuid": "c56d6ea2-03e2-4b84-95f0-a4f7680f4680", "comment": "Malware payload (Mirai)", "value": "ae6f6431dccda7e3ee34387f47e0073f62c7cb84a7359f21b8166e661599ede546eab216db0210c2e74bf718c63877a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513411, "uuid": "42fc64d9-6835-49ee-8856-9b2cab76f092", "value": "T149F34A07F5C084FDC496C1744BBEB536ED32B19E1238B26B27D4AA222E4DE315F2DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513411, "uuid": "3da1ec34-9c22-4389-9e5b-ae9bc982dfa9", "value": "3072:fweroMz6wSSUaeg+bEfteb/g0wM5A1zUEKUTwQ4nVhATNIjLT:fweroMz6wSSUumEgEK9n/LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766513411, "uuid": "f8a54ac6-4104-443b-8176-efd94f584507", "value": 166168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766513411, "uuid": "d7ea8089-540f-4309-9101-c8c58ccb9c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766513411, "uuid": "8ffa99b8-ae71-4624-a5bc-05c1281b487e", "value": "yamaha.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079a6016-e053-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530766, "uuid": "e5ea7021-f065-44e4-9418-ef1314d96231", "comment": "Malware payload (Mirai)", "value": "2144b075c5b4413cfec3703fbf3b62a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530766, "uuid": "37a5f714-528b-45e0-ad1f-b7ae21edb8eb", "comment": "Malware payload (Mirai)", "value": "efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530766, "uuid": "6ac03d3a-806e-4afe-a25e-6b494e02f768", "comment": "Malware payload (Mirai)", "value": "7c40d110bd81b3b05c53ec35cafe8a9727141005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530766, "uuid": "dd3c9f31-263b-4ea3-bf0e-2ef200e2feb5", "comment": "Malware payload (Mirai)", "value": "403e380427463a2bdd125cccbcdeb2675461625365c3c339cfb8c5b4d81958eccc5a690145388a5511d54d917f479d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530766, "uuid": "26612bcd-57b7-4cfc-a46d-a6044bf3674d", "value": "T1E263961A3E219FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530766, "uuid": "13c08d2e-6f69-476a-a851-a15d9f198963", "value": "1536:AHNFnXDuPq/SyZBp9tZI0v6bqfg/Kkz73o2x8WW:gNFXDKGrnI0SWYz73o2OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530766, "uuid": "5c9ff711-02b7-4cf7-9d84-c2fd53712a50", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530766, "uuid": "3eb2af05-2c84-435a-89f3-8fdd40e4757b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530766, "uuid": "48303886-a745-44ba-b7c1-55df4b042976", "value": "Josho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23af60a5-df95-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766449209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449209, "uuid": "be5b6158-7dab-4f0a-942b-3e237151823a", "comment": "Malware payload (AsyncRAT)", "value": "17f16ce3c2dc504192c7a4947ecdb2cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449209, "uuid": "6e3173bf-80bf-470e-ad26-8c04b959e30f", "comment": "Malware payload (AsyncRAT)", "value": "efe6be91b98100385c58e2b22d264c755c677e99be70e578f496e248235b8ad8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449209, "uuid": "b47c09f4-bd3c-4ffd-a9d0-766e4734f544", "comment": "Malware payload (AsyncRAT)", "value": "0442d69ecab27bd7a3f0ef439a7b94e811e80c0b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766449209, "uuid": "2c928fc5-0d08-48d5-9788-2451d77d1d1a", "comment": "Malware payload (AsyncRAT)", "value": "ec6b1cf79e2602fd9a34de8bfc773d9a7d2ea16f1b12384ea76094e0148fc2721f29431996553289b1a31f998ad1878a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449209, "uuid": "e5acef7c-961f-4a52-b0c0-c51bda2c3dec", "value": "T12EB3C8143EEB4029F17BAF7069D075F689FEB3633603F55A18A542860A13AC1ED83D79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449209, "uuid": "46613377-060e-4ce2-a89e-583f9291cdd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449209, "uuid": "5bd94ab8-e1a4-48da-aa8b-6964bc12afca", "value": "3072:Rx8iQ82w4KYPeqKSwIPQkrYwbAQLtMlNpMfVS58mrx:/Q82w4KYPeqKqQ2YwbLGlw0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766449209, "uuid": "ac0ff375-e195-4743-81a4-ca4f2079ec49", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766449209, "uuid": "11015fe1-afc7-45e7-9776-dbaf3da1dbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766449209, "uuid": "cf197b11-f43d-4111-8337-b3672e0ef8b5", "value": "17f16ce3c2dc504192c7a4947ecdb2cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bace06-e035-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766517906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517906, "uuid": "085803fd-acf8-4742-85d6-82ef642e38b2", "comment": "Malware payload (ValleyRAT)", "value": "5b42f01de9150edb1da52716d4645b30", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517906, "uuid": "6bd7ec2b-a488-4da0-b427-eda757a710a0", "comment": "Malware payload (ValleyRAT)", "value": "f002a5d322d4e2bf9263fa3c1f9fc7d4a12f3641c7c2402b62a17a338c02716c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517906, "uuid": "928d448a-d695-436f-98da-2e8b3d189d2c", "comment": "Malware payload (ValleyRAT)", "value": "71663e3c13868272baab7673166a1dfcc19e6b3c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766517906, "uuid": "ab9e2192-6ab8-4e2c-b54a-387c6f441305", "comment": "Malware payload (ValleyRAT)", "value": "2299e295a59017e6a5e9c95ce3f37f2f65059e040a57eb73045a8bcd2adca66d8ba9c0509c517c17de48164da8fed459", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517906, "uuid": "8e1c371a-0c9e-4743-a1db-fb10798f429a", "value": "T150173324A28BC536D15E057BE86DFF5E19787EB3073041E7B6993CAA44F08C29679E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517906, "uuid": "15beb549-af0f-43c4-90f8-7f047c50d25b", "value": "393216:KWKl3EsI1OexM/oZ90D3tmcj7CauZsVgtGDaf37iBoL7T:ulMoermdRCmyE+f3Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766517906, "uuid": "4d667191-d78f-44c0-a670-df71fe807128", "value": 18805760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766517906, "uuid": "0a83f505-944b-4b75-8038-45b0db31a6eb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766517906, "uuid": "98497361-c410-4fd2-b107-48b9465c1c3f", "value": "LetsVPN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7b5257-dfc9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766471909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471909, "uuid": "59857b6c-366a-460f-a09f-ba63e9e4a3c2", "comment": "Malware payload (Gafgyt)", "value": "00ad18f0513d41ddd3ee60302ef9f16b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471909, "uuid": "d46186e9-1586-4e98-ac86-11138f7fafe6", "comment": "Malware payload (Gafgyt)", "value": "f025adcb0cfe1b89161d7f971cc827a7811c9a43dc9d67a36322cba44dfbaba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471909, "uuid": "268d6cac-3c94-4df4-85ec-74462d26a6a3", "comment": "Malware payload (Gafgyt)", "value": "63f8613e7ac61dbe22c27d2b268e027c06e6c6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766471909, "uuid": "ce5e7ed7-ffb5-4ad5-95ca-e5c39ef5e67c", "comment": "Malware payload (Gafgyt)", "value": "43f976a6bb8bfdcd2970c13aae158b890ffc6d1df4c3ee5ff22e2ffe84056615081a8c567be6cceb4d490f53028e32e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471909, "uuid": "1f25852e-94f4-4ba7-877f-9e76d2ccf919", "value": "T1F5A37C03B584C0FDC4C6D6780EAEA21AC922F46C62B5B65F27C47F163E5EF112B5A361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471909, "uuid": "03988e8f-9cbb-45f1-afcf-50f4f5c2bfd8", "value": "3072:2OVVYmbyjm1o2GXZ4ilKkhAdKLNQ9igKrV:2KhJa4+Kk+sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766471909, "uuid": "dbb5e7c9-8b2f-49c5-a296-0d9a4961ea79", "value": 105576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766471909, "uuid": "6e8c7c3d-229a-4a4c-b6ca-59153e2f464d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766471909, "uuid": "4a01475e-550d-43d1-9c28-2917121ef724", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e483d7c-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478593, "uuid": "f3c2764b-a2c0-4cfd-8dbe-98ea1c17f305", "comment": "Malware payload", "value": "c75a7dde59d5cbdf30b340f725b52ff3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478593, "uuid": "3bfccde2-e705-4580-a3ea-d50c08eb1ed1", "comment": "Malware payload", "value": "f02a4917411541657dba3bce233bc2eee088228bd33fc859715ba4eefd6c3bf8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478593, "uuid": "6d7210fa-93e4-47b2-8d8d-0c63a488db75", "comment": "Malware payload", "value": "b82c17615d4462bee4c5d478ded12c9f9b57c57e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478593, "uuid": "80b10ff1-da96-4645-84b8-82651f8e72af", "comment": "Malware payload", "value": "0a0bcf187b42117f5103df144852440182ad7f424dbccc2b76db2e63eccc027fdac315a3ebb41e268a11fb406c35888e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478593, "uuid": "1bb2a2a6-2571-4726-a7ef-3994a2853b4b", "value": "T1AE631A16816E5C203F669CD0EF2E2C87543C9B3995381A7F88617CB3953C8DE722A9F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478593, "uuid": "2eda8ec3-547a-4751-b890-f1cb60c2c9d8", "value": "768:I8w/h62/jWs6oS+xISN0vaZ5ZGZmZhZFZDZeZEZVZk/ZMZCZmZeZ3cZo/ZG/ZmZn:I9l/AoSSMCtusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478593, "uuid": "c7d9e136-94a8-49fb-97b2-890f8f8cd345", "value": 70580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478593, "uuid": "89c0bf0d-7b6c-4feb-9320-56756b646e53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478593, "uuid": "874da2bd-bfe1-4036-8ab9-965584a60b44", "value": "invoice-1645080830.pdf (110).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf01f5-dfd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766477238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477238, "uuid": "4f6f4e9a-5e65-4d6f-811b-2a3106979641", "comment": "Malware payload (Stealc)", "value": "f352230b079940ed939068cc6c17d826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477238, "uuid": "bc448004-0188-40f5-b408-91943f0b03d8", "comment": "Malware payload (Stealc)", "value": "f0beb45e0791321dd7d7a01a313cb591a463624306b0d6e2ea3ae4f1a3a17974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477238, "uuid": "bd8da6c2-59d1-4eb7-8173-e7b52d84a06b", "comment": "Malware payload (Stealc)", "value": "6a31ba664332eabfb38bf443173b5172eb51130b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766477238, "uuid": "fc8c0ab8-052b-4793-80a4-3aa1b6a23a00", "comment": "Malware payload (Stealc)", "value": "11d9ab6b5b3f247980fe936cf4e5cfb95cffb2c106adc38a44694868cfa73b55ba26b975e2c3264c6d3f13ad3cedf3ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "melasio-com", "colour": "#1D4A20", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477238, "uuid": "3c370a1b-ca04-4ecb-9520-20ddeadccd44", "value": "T10D260213F24E673EE46A5A3659729910543FAE20641B8CA396EC3E4CCF391A01D7FE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477238, "uuid": "74befa51-1c86-4aa9-9054-6b491b2bccd0", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477238, "uuid": "db919d62-05f1-4d89-b251-136217187837", "value": "98304:rDbXnMcST8EYU/sgfDOZvROnVbpKJ0JNf4fax/:rDbX7SYPUkgfDOapKSca9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766477238, "uuid": "d1e89266-66ab-4c2e-a41f-a488dcc9b977", "value": 4427652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766477238, "uuid": "c813e7c8-dfbf-447b-99da-a13501a2f7a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766477238, "uuid": "d7c985b3-75c3-47ea-a91e-364c568068b8", "value": "f0beb45e0791321dd7d7a01a313cb591a463624306b0d6e2ea3ae4f1a3a17974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c77cb1c-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478483, "uuid": "0d402f01-95d8-43ff-b097-283d85039711", "comment": "Malware payload", "value": "b81ffbdff5713fe957207d31ca2eedd4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478483, "uuid": "1a4288ce-6d65-49ba-a0a0-e16f8d27e61d", "comment": "Malware payload", "value": "f104f56010f2053b9ef314adc78962aa3937fb93fffeff627f40ed611be4f630", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478483, "uuid": "695a0ee6-bf24-4c30-9702-a36892b789dd", "comment": "Malware payload", "value": "d71ef9bd6e0ddda3d717a8206ed9fbb164e1e110", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478483, "uuid": "96116304-5f09-44ff-978d-b966b0043f6e", "comment": "Malware payload", "value": "a74fd3249f4486bb3d8496df46e29eb6dd48a7c992b94bfe432fd70a5c4340b5f8cf581657a187e603beaa315a29e5ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478483, "uuid": "506cbc4e-fad2-4ead-a589-b330e65e606b", "value": "T14E734C511F03287BC5B75815DC9A211FD456DE324E4CCEB8EEB34BA60B12C53AC09AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478483, "uuid": "3878eb0b-5b0f-40fc-9f77-c798e0348e61", "value": "1536:I9l/AoSSMtlelhlyltlMlolel+lDlulrlnlsl9lwlSlclfl+lJlVlaldlgl3l0l+:I9l/5M3QrE3yOQwRAZlSn2ki9wT/sHGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478483, "uuid": "33aa94be-5772-4b40-bc18-b69608c2af3a", "value": 73522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478483, "uuid": "6cc40de2-0d0f-4f1f-a917-b92727518c39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478483, "uuid": "2f028752-8a78-4b25-b530-1d204dd41a47", "value": "invoice-1645080830.pdf (126).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb0bbd3-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524335, "uuid": "d69a9bae-d1cc-4f6b-819c-e7ffad1b4318", "comment": "Malware payload (Mirai)", "value": "67db7812bba60e4efe1dd9054b9849ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524335, "uuid": "7f01ee69-716e-49f6-bdc4-cdf75acfe8a3", "comment": "Malware payload (Mirai)", "value": "f1285532c415ab571797d7187581c63ab81b375ec29587d6bdd383ed6f868c1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524335, "uuid": "447f9b9b-8d67-457a-81c6-757af99efa7d", "comment": "Malware payload (Mirai)", "value": "34ac042b26c77eab52591b4961fe853403e10e9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524335, "uuid": "f78b720b-407c-4ea3-a98d-4bd9b32d6406", "comment": "Malware payload (Mirai)", "value": "c370f15d3a80fca0b752b9bc72b2ee75d051ad15339d9fd7e9d6234070672d775f70d86ab6574da536669e74744c7515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524335, "uuid": "1a7d7ba7-2a3b-4480-a0e9-9db54334623f", "value": "T11F041B0335244F1BD9D212B4142E57E883BEE9E438F57689595F8B730B34F2A588AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524335, "uuid": "bceb235d-893d-43bd-bf4b-09f2ea63c01a", "value": "3072:m/AztG+oWgOKNIM9Rxh05T4x7k7QbEIX3d:KwtG+vSxOaAaEa3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524335, "uuid": "0e3df0b5-81dc-4e60-8e1d-2f32e1b6c2b2", "value": 173148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524335, "uuid": "e001b702-931e-48a2-a434-b75de364b637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524335, "uuid": "796ae447-903e-42e0-9f7b-fa4985d0873a", "value": "pandora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9f95c6-e052-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766530637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530637, "uuid": "0e5db9c5-f945-4e35-8a64-5ddf0af55c0c", "comment": "Malware payload (Mirai)", "value": "db5a69eaec120f23a280408e1135aa2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530637, "uuid": "877d7714-3d6f-4f54-9576-80f068f8ce06", "comment": "Malware payload (Mirai)", "value": "f14d819db519a54b4d2fa427e95a5f95ad0736444c13469551c2aaa4db84decd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530637, "uuid": "3d99e188-0e88-4f8d-baef-79401aa7d246", "comment": "Malware payload (Mirai)", "value": "199d40763e0dffc4a03bc58271c88c2a48be2300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766530637, "uuid": "36036850-d643-4123-a7bb-774472f676f8", "comment": "Malware payload (Mirai)", "value": "1a6f5a32e69cb32205361f6c2dec91c7026cefe79529fc9141481a3cb45aec0df3fefe80ed954aa24c3054f20f8f2602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530637, "uuid": "1ab4512f-4900-4091-a260-3e902f4a2595", "value": "T1752308C27942B639C3D1577BEEAF014E3354A7D8D1DA3397C8280B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530637, "uuid": "45edbfbc-3ed5-4377-a657-298c6514c7d7", "value": "768:sJeKpHsmyayL1ScT+GRvFES1un1wnjvsDoCerCw7sC/9nX+6k7wCVy/rCxHghW1W:sYFmSJScT4MjvR7sCFnXPfhWt59se+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766530637, "uuid": "54bf59bb-3475-4bdb-9195-231d934284aa", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766530637, "uuid": "f160d299-f7c2-4489-9865-255bde4fcc23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766530637, "uuid": "9c496809-3a94-4a98-bc6d-22341ac58232", "value": "Josho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bf45f4-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478743, "uuid": "15e3e8b0-e498-4294-8a39-fe61aeecc766", "comment": "Malware payload", "value": "3a62c9f1b88de18a608abd361e872b13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478743, "uuid": "47bca34c-8de5-4b46-8c59-cb1551fda5c6", "comment": "Malware payload", "value": "f2b90afc198069812b93e8f4c40dc6e433214223f2afa7427437263aa7b95537", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478743, "uuid": "f92d2b50-5eeb-4bd3-a254-eccd7c02f75f", "comment": "Malware payload", "value": "36f5b53612f2252cc6cef2ec984afc040554987b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478743, "uuid": "353f257c-f163-442a-96c4-3f9b4eeea44a", "comment": "Malware payload", "value": "910d4e7b3978004d0d2d7f26e42b0da9fb33854b186490e5e12b4c4db6dffe87f7cc88b8afc8070f8ac1f87c4ac72029", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478743, "uuid": "01790710-e32f-44fc-b2ba-6aec3b1fe033", "value": "T1EE733B826C35F9D712E5E381F878C2108925BE136D44B2ED5CF2A86EF6E7BC0596294C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478743, "uuid": "94314a01-eeff-4e45-9d1a-d35704fd5c5e", "value": "1536:I9l/AoSSMvYiNcO3SBv5cBktvvJsgHk13o83jsXTwx2OFwOMtDHbwZ6iCwRpi20a:I9l/5MvYiNcO3SBv5cBktvvJsgHk13oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478743, "uuid": "f435671d-3795-44e7-9185-807ef22111f8", "value": 73468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478743, "uuid": "1e03b224-125a-48b9-959c-4517705c121d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478743, "uuid": "5d58e95f-15fc-442d-81dc-476517f2a1af", "value": "invoice-1645080830.pdf (83).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601bc373-dfee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487535, "uuid": "4c61103c-b757-4ab9-af75-e1d5215b1e7a", "comment": "Malware payload", "value": "77a9d6a80f7481d3f7d68fa3b7f34e71", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487535, "uuid": "cee82ec3-27fa-4344-9770-a361fe0e2a8b", "comment": "Malware payload", "value": "f32ef0d43b7030d470935102c8cd0ae2b2b1c9e3cb8e4ad7a7912c1c30eeb679", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487535, "uuid": "563fcf81-9f4f-4c76-8998-2b6c447f175b", "comment": "Malware payload", "value": "1e67ff45b4be59ede7194ab35f4ab78cb9c31c76", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487535, "uuid": "4975e297-4f50-4ad1-989f-6cc67bc2b3cd", "comment": "Malware payload", "value": "cecfc67ba2dcd311899f921e8d8bb1615f192b99e4daa9ec6130bd4fb7c73cdb6fd51d79bc74ab357a8404a87cd3cffa", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487535, "uuid": "14024e4e-48b9-4ab1-af19-f1e3e8a2300c", "value": "T1EF01F12BB50549584DF52EE45476A9457F9E90930B10D7DC7280E272FB0A35FC6389D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487535, "uuid": "f11b3df8-9ea4-467e-b013-86e0246b3e1a", "value": "24:wKXEInlWd9+trTRbwZIIqcjmmxEN6rmzUBmOE:vHRbmq/mqN6rmwmOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487535, "uuid": "0565c601-3ffd-4c7b-a953-56b5bffd44e1", "value": 833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487535, "uuid": "e506f292-815c-4ae5-bb5c-0f41c3b1f396", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487535, "uuid": "38ce2388-87fd-4a72-aef4-0725537c2ec7", "value": "RealtekCodec.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6651ca-e03b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766520708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520708, "uuid": "c5446c42-94c8-414e-abd7-8b0bb029bdc0", "comment": "Malware payload", "value": "10cafd8c2fe286ff4a849869bbe4a8ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520708, "uuid": "138ac02c-885e-4ba0-be23-1ad906d00124", "comment": "Malware payload", "value": "f32efb391e2af6fc3991d94287e09609306027c46bc8ac81f680988018d02262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520708, "uuid": "928a8969-cf20-4700-8d53-97edb11ddb61", "comment": "Malware payload", "value": "083188f74bf2444550b6b188591464fbd1b12c98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766520708, "uuid": "94875480-c3bd-4c28-9d9e-d3b8753e46f9", "comment": "Malware payload", "value": "f0b3fa04388cdbc7e3b461c555d66af0047af440e6680ab4c21a6c7c2c921f9b702e96b1b1b9e36500a0314346dec7e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520708, "uuid": "28c33b09-b224-4c07-87fd-8137e22bd774", "value": "T1011184037D335E32C215C43E9CF329785A26D2D552EEEA896B82A8452CC3100AD28564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520708, "uuid": "4e1cba74-6bb7-4769-b3db-cec9ccfc4b94", "value": "12:BD/ou8shKepI2Gcx/O1KKlmP1ZTqhi2J30STiMSbuuW+Icl4B7t6xstmqJwlEHs5:08GAm/mPfTqIOEuiAi4Nms6lEMgP/1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766520708, "uuid": "aea653ba-5cf7-474b-ac89-6df2cb34faa6", "value": 974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766520708, "uuid": "7005359c-5d6a-4042-985a-1fd50d09ac3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766520708, "uuid": "55a157fb-2188-4cd3-b4d5-d32c859782ef", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4160ebb7-e023-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510247, "uuid": "c8bb97f1-27a8-4f29-ad58-837c1082a95d", "comment": "Malware payload", "value": "7615cd8ee1b0352eb86ad7be16754d2e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510247, "uuid": "e034cc62-8c7d-4d8d-abef-d2a06a1d4458", "comment": "Malware payload", "value": "f389fa1b3c670b8985f34851fa490ed18ac2f0bea2166b734bc11ab01c1cb803", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510247, "uuid": "5fcbebae-1fb1-409a-bb7c-5ef91a86842e", "comment": "Malware payload", "value": "601188bd783322d8ce7373c4177523708d95fb03", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510247, "uuid": "271ace92-ebfd-4442-8bb7-949d9337c968", "comment": "Malware payload", "value": "889654d64403abc50af3fe9e3e1f16ec9de7f3627837cc8bd0124d2fb27cb9ddc5f09f39876f0b7ae315fba96aea53da", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510247, "uuid": "1a35c11b-53be-4441-8d0d-fbb2239d2b6c", "value": "T175D4237CD999788D574150F287B375CADA33F22E638758229FB9CACD50D6ACC6720E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510247, "uuid": "ccc734ec-abd4-480e-bab1-7849e3d16e70", "value": "12288:tg85pPjXWwZ7yvJs8mK1Xuj/AYF6ta/OoLqCDrzY9OQCh/xs6AdCvF+iWqUlb:60Xk91XI4tauErzY93cvAdCvEi3UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510247, "uuid": "bdf031a7-5f1f-420f-a434-61dcb1ce6de6", "value": 630857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510247, "uuid": "98d53b29-1666-48a2-82f3-59061331c18f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510247, "uuid": "f5f869ba-85de-4376-9693-737cd7bfc7a8", "value": "Comprobante.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524d455a-e020-11f0-a129-42010a9c0007", "comment": "Malware payload (StormKitty)", "timestamp": 1766508987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508987, "uuid": "142916d8-f65c-4d56-bb56-690283280198", "comment": "Malware payload (StormKitty)", "value": "f8b4de48377048dae1a44ec5db2248df", "object_relation": "md5", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508987, "uuid": "fcd79bb5-361e-45fb-bc1d-53e29c2c84a0", "comment": "Malware payload (StormKitty)", "value": "f3a4b0da6aee356030a581a3423a43136821add76ba78f22455e5bc99b947c56", "object_relation": "sha256", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508987, "uuid": "12cf4036-f07c-4692-be34-2ce4fce31ad6", "comment": "Malware payload (StormKitty)", "value": "6c3de7926cd0e9cdf2ba4d81b6d4b6ddd3396e36", "object_relation": "sha1", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766508987, "uuid": "0f499f9d-0c32-499f-a878-b97dcdfbf715", "comment": "Malware payload (StormKitty)", "value": "e183158e1c5a8aaef2650adc952bc5984e8ea2690e1ade434639cb6fc66f9f57ce0c1e6be5be19560ddc128a44a5af48", "object_relation": "sha3-384", "Tag": [ { "name": "178-22-24-175", "colour": "#1151F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508987, "uuid": "9ec189f7-df64-4610-97bd-7f95eb1ebc60", "value": "T1DC268D09EC240674C5A9827056F304D99E3ABDD53B501AF726BD7ABD0F235C46ABE2CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508987, "uuid": "f5345063-8cc6-4d97-98c7-1d7680ed8b14", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508987, "uuid": "3117e7a7-472b-4465-ad02-d6637efda876", "value": "49152:0Q6PXmDllrb/T0vO90d7HjmAFd4A64nsfJMBq+AQrNKtpMdTuV5dHJM/5+0zX8MY:ptoBq+tWqSb+MMXFH5yU4BDGerofk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766508987, "uuid": "6af65298-ce9f-4fa2-8fa5-c5dc00cb3ed4", "value": 4790392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766508987, "uuid": "e7d9aa42-b360-49f0-a72c-3797323ddf71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766508987, "uuid": "feddb915-fdf8-4f34-99e9-cc0c810da7ca", "value": "IDM_64~1.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87368ec4-df9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766453670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453670, "uuid": "f5c7ac59-c15c-4d4f-bee2-79d57703f45e", "comment": "Malware payload (Mirai)", "value": "f6a13530c193ccb95f88e13743e9a2ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453670, "uuid": "9d2ba23d-97a9-4fea-ab61-724610b53f2f", "comment": "Malware payload (Mirai)", "value": "f3c5ea97f6d0d8211aa92519ae6c6cc8ee757d5bc30c846d11acbc1a682ffe9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453670, "uuid": "4f721fee-56b5-468e-8393-dbe7b614b26e", "comment": "Malware payload (Mirai)", "value": "130c7e4816d8548586887611c4c61f35b5124fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766453670, "uuid": "1273ed18-1615-4e92-a9ed-afc9b97b5316", "comment": "Malware payload (Mirai)", "value": "e368d40bc6f73f21ef7256958c2264b219d98cb0b030689c6d7a990714c5f46674f4b296263ea4b69a7ac5c7a76c82c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453670, "uuid": "588e2c36-1cad-416c-be9f-d2cbd5fa5cb6", "value": "T12783F69AF9819F51D5D562BAFF0F518C331347ACE3EE72039D246B24278A92B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453670, "uuid": "e494e70c-2a3a-4ded-94d5-fe8e9d3c2a5a", "value": "1536:GNnIraLq7qnQVRD1+shAL/uNSyk7n3/lC13NMNlWsoirxf23j/7q4ZiYm4HT2bVi:RraO5VRD1+eAL/kBk7n3/lCdstxfO7qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766453670, "uuid": "71688771-2590-42cd-8b0b-6136d9730641", "value": 84028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766453670, "uuid": "e91347fa-3953-4e98-bb8d-3fa161d3963c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766453670, "uuid": "1cabbb3e-fbad-4241-b639-64c41e00baea", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350c4e1f-dff0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766488322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488322, "uuid": "83317416-6a28-49da-8066-2a9700ad6561", "comment": "Malware payload", "value": "bc29ef85dc2f7e0b3aad5d79bc7e2575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488322, "uuid": "fa4f8563-7a22-4b4c-8745-bbc9153310b0", "comment": "Malware payload", "value": "f3dea778d977cb8a6948c2b42205593521752b90b17f53580841c5968aee1dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488322, "uuid": "f5454461-5749-4d5e-b600-b097f9adec5d", "comment": "Malware payload", "value": "c99ddeb89dcebedb9b56763f656dcec692d93856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766488322, "uuid": "3ba19112-bb20-4a1d-b730-4303ebd35060", "comment": "Malware payload", "value": "472344db7470c73255d99efcde907f41323c81a7742dcdfc406811fbd9b07f12d0d49738339e4289dedfe11cc3b48dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loque2025-mysynology-net", "colour": "#B6C91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488322, "uuid": "8abe9df5-b3c1-446a-ab23-6e8b88c9520f", "value": "T16FE4120071D1A872E9732B710AF88AB8957DEC3047526EEFB38855FA4F359D06D3285B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488322, "uuid": "fedc0275-bb5d-43b0-ba40-66254bf34db2", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488322, "uuid": "d528381d-9363-404f-9716-1fdb7b8886d3", "value": "12288:ZHztGhqRHBSIkK1Q0bSQ5aV3wvKG5c5zKaVORbvQHUf+ZY5m5FDJItFzZyKr:HuKowSuyV0arHu+e5mzD2t5ZZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766488322, "uuid": "b20e3d15-f0f3-4bcb-8edf-d631eea4f37d", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766488322, "uuid": "24323e7b-f983-4194-ae22-208036aa90e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766488322, "uuid": "11b147b6-8da2-4e00-8956-3415b6e3dde6", "value": "f3dea778d977cb8a6948c2b42205593521752b90b17f53580841c5968aee1dcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67717479-dfee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766487547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487547, "uuid": "5f531c29-eb0a-40f2-8eba-f1a137b2277b", "comment": "Malware payload", "value": "8ae3ec0d127cb27d7cf9d85be7e0ecd0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487547, "uuid": "5b558d3e-0f85-4c72-b0e6-6ec5c37fea43", "comment": "Malware payload", "value": "f5e1ac589881d19d7015c095751e5de2f63882a90a34d31d70cf4ab8d18109d8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487547, "uuid": "1300d7f2-53e5-42dd-a12a-0ca25111c717", "comment": "Malware payload", "value": "edede6682d755caade9d9678891dbf1afbaa95bb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766487547, "uuid": "9408da84-9e1c-42e8-bb65-3d2db77dc328", "comment": "Malware payload", "value": "7768193335646d7c479243152c43cf1deeb789c00eacafcbf7bf5cf9094a1848a9c9d4fd7d1a8b0f6418acff764e5638", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487547, "uuid": "8fe64bb1-cd38-48d0-a080-0534361dc0f8", "value": "T1FE3150549CC0F20B6572552AE75153C2EF2A87A3461A4038F8CC473F2FBA18A5053467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487547, "uuid": "09003688-bc2e-4225-9187-85dc6f35c194", "value": "48:cCkAzFvUAQ4oL60uydbQ9I3YODOLedqw1CV2Ub3:LJzFvs4d0uydbQ9OdqwCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766487547, "uuid": "c3ead7d5-a6fe-4049-8a4b-52b32dc9bf34", "value": 1616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766487547, "uuid": "0f7c671d-829b-4920-80e8-8e1c286417c3", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766487547, "uuid": "11db83e3-422e-4b4f-99d3-27665cecabcb", "value": "AudioTask.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bfbd83-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478919, "uuid": "bce95f74-666e-4ad4-826c-4ca281c1165e", "comment": "Malware payload", "value": "ce63b7a58595b2b9702ed3879f7b757f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478919, "uuid": "b1f3b097-2177-44e1-ae04-d6122add4e53", "comment": "Malware payload", "value": "f67b7d67ea2c3ba8e681b369e3d2833b28668f0c7d79870931705eccf64c0077", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478919, "uuid": "9db26ce1-ac8e-48ed-845f-76e97560621e", "comment": "Malware payload", "value": "437b83196fb0e6571530c1a789ed73abdef0255f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478919, "uuid": "ef22f465-63b2-42a4-8514-7234638c1566", "comment": "Malware payload", "value": "33aca0bc346c2511a20e655ee1c282a3a62642b0fa16465dc4849592ec2a9c03e3777e7eecf7ea4e01b6fcf1e9e6038a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478919, "uuid": "401b3ed0-e1b0-4ac2-96ed-b33cc2973771", "value": "T16963FA36BD8BADCEF13540DDA9D138D763E0B5440EE8B5E1898AFD379580922C53236B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478919, "uuid": "2710db68-3afd-4bc4-a04a-01cbda9f060c", "value": "1536:I9l/AoSSM0d4dtdJdkdYdsd3dxdKd/dYd3d+d5d5d4dOdbdedEdRdEdgdSdhdrdE:I9l/5MNausriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478919, "uuid": "02641ca4-ef86-4a9d-8275-82b29de36493", "value": 71510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478919, "uuid": "68ff9021-0549-4db6-8eb6-58e698ce3a82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478919, "uuid": "135605ff-77b8-43f9-ab33-8c9486a1bdff", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2855151e-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478852, "uuid": "7c0f83bc-dd07-41b9-8b03-2658d63b1dc5", "comment": "Malware payload", "value": "fdd1a0264fc09304669eef676c9fc945", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478852, "uuid": "a7422638-8f74-42f7-984e-ac4763f5a5d9", "comment": "Malware payload", "value": "f73e1c5631722085cc8d620f3fba7c60ba880bd8215471c2562a37d95bfe9ba4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478852, "uuid": "44a8d66c-349c-4232-9010-c385e25b2a3a", "comment": "Malware payload", "value": "c71f19edbc2aa77aefc737f83878150a1c1fef33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478852, "uuid": "1eefe6a2-e829-4f82-b4b3-47097c97f4e2", "comment": "Malware payload", "value": "97a25730e5f42d56cd07f315cf2dccac4d87c7754c1a095d35f760f71ccfff45a0ba28a4801e3ea9f2734ac23ffa399d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478852, "uuid": "444fc6dc-b1eb-494b-838f-ff9b8d39b6e3", "value": "T127733AD6DDD27B17A7FB20D2D9CA21A20A1C98B74FD0856DC22CBBF6059F41B1D86C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478852, "uuid": "aacd91db-38fb-4a54-bbd3-1a0535ba0740", "value": "1536:I9l/AoSSMaDzfj3W5LoqUarksvoNY+vuaycvmcYij21HOByITg3VeQuKm7hnB3I3:I9l/5MaDzfj3W5LoqUarksvoNY+vuayf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478852, "uuid": "09cfb3ff-cab7-440a-9ada-d88a733abf90", "value": 74448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478852, "uuid": "0e9e9d27-98cb-4187-8152-c319c2060bb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478852, "uuid": "fd0554d4-bbbb-48ee-874e-83853efa6e9c", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6114800-e01d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766507839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507839, "uuid": "73a06780-f4e8-4a9e-a3f4-864c67ff3bf2", "comment": "Malware payload", "value": "c42e0a63a7b159aad46b982b60413d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507839, "uuid": "ab22bd0c-f7cb-4d58-bad4-f65414d9053c", "comment": "Malware payload", "value": "f74d900499b545e2b2e2b2faf194e021ebe118d2f59d4fc7c3710f57b2955608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507839, "uuid": "8a0f1c65-1cc2-4e10-a499-1f4f4629026a", "comment": "Malware payload", "value": "2ef194035834fb807c8d1a78325faacd61090be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766507839, "uuid": "ab83a515-43e5-40d0-8d0f-124ff84fc88d", "comment": "Malware payload", "value": "9543c4a585bd6e984d05bb13cea5bc4a98aace22f73b14a53fb226a10f36f0d55e3fe9b46a4848e400baefe63bf1ff78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507839, "uuid": "92948e79-5724-4fd5-8d8e-adfa0e611e82", "value": "T104E36C1BB3A541B7E1B69239C9634A46F7B378120760DB5F03A4433A5F23391AD2FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507839, "uuid": "f4a8b367-5519-40e4-b627-89aaa5b2fce9", "value": "da67b667987ef99f4d54927beb9941c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507839, "uuid": "c2e03e2f-a039-4805-8807-657a4db361c5", "value": "3072:W9n//pit1QVLsiAE0OrvKHxdQqnX418g:Wx/piXQhJvrvaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766507839, "uuid": "774e7045-2285-4175-b1d2-e2c78b6eba72", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766507839, "uuid": "c6b7536d-da98-4413-afe2-80bd75bba24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766507839, "uuid": "53ba0f6b-2706-46e7-bcf0-145eebf98119", "value": "towardnerve_642.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86224379-dfd0-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1766474714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474714, "uuid": "dbe5ea00-1306-475a-89ae-ef6fce08ed77", "comment": "Malware payload (NetSupport)", "value": "da9f9a2afb57086a039acd47e2a07d3a", "object_relation": "md5", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474714, "uuid": "e3737ec9-1d36-4f0d-8f3d-bc2755be0cb1", "comment": "Malware payload (NetSupport)", "value": "f7d13cb6db2aefec961d1ba8cd01a9093d2e698c4878f02646918881b46f820a", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474714, "uuid": "0d4a7291-7324-4a42-bcb8-fe1c036aead7", "comment": "Malware payload (NetSupport)", "value": "b90c206ce8dac8c18ecb4add7cfadfd79f3d7cd6", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766474714, "uuid": "a42dc8cd-3d5d-41d7-a4d7-17c36b2beb2e", "comment": "Malware payload (NetSupport)", "value": "6decc3c66f6a3763395b3c24e00086d41aa12fcaab095cf1abbf1e9f661bf2df8679629992702123b9de1585a938b2c1", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-95", "colour": "#261F91", "exportable": true, "hide_tag": false }, { "name": "77-90-60-32", "colour": "#057B75", "exportable": true, "hide_tag": false }, { "name": "accountspagemain-com", "colour": "#1389F9", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "rentalsmcx-com", "colour": "#FDBABD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474714, "uuid": "4c9d31ef-f385-453f-8100-7fc83d439d38", "value": "T1A5F00E034F0769AACB96C2CAE0029800EC6E1936230638213DD09E602ECC4ECE032AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474714, "uuid": "31ab7caa-e9d5-473f-93e5-e997c24cfeb2", "value": "12:ZdKV1DwvziBncm0JNPTlOeAH+LgyaICQkmMhA9nCEFoI1kD8:ZAV1DwvH71lOe0+LAQshAlPqD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766474714, "uuid": "4a7155b5-711b-47c1-9ba4-acc0bd71a942", "value": 515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766474714, "uuid": "8d4f2e7f-e8c4-4981-b58f-99ebf27c6aca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766474714, "uuid": "53ffd007-4364-4992-a12c-a2d15a819ac4", "value": "123.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2c1b44-dfcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766473387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473387, "uuid": "4d7ce4b6-52ea-4994-b314-3728389fa57a", "comment": "Malware payload (Mirai)", "value": "c02d013df6266640fef98ba879321e75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473387, "uuid": "8fc724b5-d8b0-442b-871f-f247149b4f80", "comment": "Malware payload (Mirai)", "value": "f7f62a496442ac53a59fe117e9cda1375ac656bb6e3d1b77af5954e2267b0937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473387, "uuid": "fec24705-ff5b-4998-93b7-c8ccdb3e6c5e", "comment": "Malware payload (Mirai)", "value": "739e7da621db9125d7ecb5e04a2c61d6e161005c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766473387, "uuid": "e69ad7db-d37c-4a90-8e8b-5afbdf40f903", "comment": "Malware payload (Mirai)", "value": "fee112c0af44a48d6732bfdbddaf74dd0dff2c0a306ad4fda6a34adf67adbae93354a5c1b672f737e016b3009efee8e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473387, "uuid": "f9127375-584a-4483-807f-d6b266056688", "value": "T10C047020FE0663B2CC721A3497966E5A6E7704559FEB26312D1F523DDE628508F30F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473387, "uuid": "c0ef85d0-330a-409c-8dd5-73793b30a761", "value": "3072:ZQKPbqnmdAPBR6n34wnKH7B/m/so1DgqBpKUKc:Z7Pbq6ApUn34dc310AJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766473387, "uuid": "40c67052-4603-40eb-8dea-50776d05d610", "value": 189076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766473387, "uuid": "8b5beb12-e561-48f9-b272-baec1faf94ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766473387, "uuid": "f1db4ac7-467f-4b74-8d5f-2aaf7b078252", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4f40b9-dfd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478675, "uuid": "b5720be2-6b86-4ebb-a39e-57d8b026b3bd", "comment": "Malware payload", "value": "eae35e4aa90b140bf00bd417f12b77d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478675, "uuid": "d126fdf3-b82f-4ee0-b48e-166784b57df5", "comment": "Malware payload", "value": "f7fa2ec0a5067f3faff582946091e5b8bcb293d67e1cf5db55bfac05295caf51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478675, "uuid": "b1d76d29-4b0c-439f-82cc-b2000cd6d9aa", "comment": "Malware payload", "value": "d5e6f7dbbb87ac5073e3618c5fffd9ccc7a7a785", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478675, "uuid": "81652f01-c162-44ab-b2cc-23901ff5dec9", "comment": "Malware payload", "value": "126834a7caf4878b59efdc25676b06b6a5eefd7e6031fed6c2f381b9787df502b3e8c9bb90509792b48c563572ee754b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478675, "uuid": "8c503649-ade7-4e95-bc0d-ea318f3c7e2e", "value": "T148631CAD2DE7EC82C7A752A16D55683F1F81A988FC4EC8C55F8F5805A09CC480FB7D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478675, "uuid": "d7171878-fe6e-4e3c-848d-2c5e6ea3f83c", "value": "768:I8w/h62/jWs6oS+xISN0vBW9cTPu/oGmDtRM/DqpbvvYE3cEA+PG90qOAgVsQS0Z:I9l/AoSSMevusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478675, "uuid": "c8e6f507-362e-41df-9d47-570a206211c7", "value": 72502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478675, "uuid": "8f6a98e8-d87e-46a3-a959-0f78d6fee95e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478675, "uuid": "9684c458-8298-4f0b-94b7-4dd4b1e1c586", "value": "invoice-1645080830.pdf (95).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df969aa8-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766476153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476153, "uuid": "d92fa93d-b713-453c-96f8-1efc551576e0", "comment": "Malware payload", "value": "14cfa86506da3f2b836eba3fc891383c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476153, "uuid": "e90ade22-940d-4543-ae96-f227e57cd091", "comment": "Malware payload", "value": "f81cacf4ad0e6b0dc84d08ddb82bd50e3f042e159326b961cf61d5daabc38901", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476153, "uuid": "f2cbd0cb-8c2e-4e72-94a0-17a6c9296097", "comment": "Malware payload", "value": "c00a0e72024195121e88de4e5a94e7b2dda4c27a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476153, "uuid": "652129ff-c90d-4e3e-a7f3-112d8d9d6a03", "comment": "Malware payload", "value": "9facc3f6de9c28574d36fe722d90e819c2f5c4c07fef1b70cb95288938e20be11ffa1037c525c94dc53e31bf5bf50218", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476153, "uuid": "3731681f-b93b-4299-957b-70d40f19d76b", "value": "T14B186B4267FA0185E9F79A3489F65213D673BC0A6B3086CF364C176A1F736E08E76721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476153, "uuid": "4f74b4a1-d184-46b9-9e7b-e6448960ebcd", "value": "15759d909431a737cd0ba268e8d3270b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476153, "uuid": "a12df518-5b34-41fb-999d-af1a17da8c21", "value": "393216:77eIv64rGOW4JCcjB7nWNVVoNcU+kUWWyAH4p1NQu58EASEhoIaE2lShu9XPTA0K:7Vvz0yT1AMQJhG688SEVBxOWr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476153, "uuid": "409a5493-9122-4727-9b02-cdc9828df329", "value": 92999168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476153, "uuid": "56f6eead-15c9-48f1-8124-478358d4fa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476153, "uuid": "1e6abe48-0291-4094-aee8-eea4a5d52b69", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5f3c1d-e044-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766524466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524466, "uuid": "25b4f1a2-fa17-4e2b-98f2-dc88b1b07aff", "comment": "Malware payload", "value": "8db6d2308cee1f703b7e4148caee2e94", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524466, "uuid": "a079c67b-81e4-40b3-90c8-300cb88bb4b5", "comment": "Malware payload", "value": "f87906b4f409e1b6703c5dee85119e4e51b1a5f34a46d9f2aa31b9de7499194e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524466, "uuid": "d407d46c-37c8-49f9-a309-730af9940049", "comment": "Malware payload", "value": "139f7f519fa0e50b9cdd9ecc48a3f08977a0371f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524466, "uuid": "05984c26-451c-4e2a-a378-7729016fe8aa", "comment": "Malware payload", "value": "b2a9a9fbe609078445cfa542abb368a564612c728d27d178fcfddc3de7b63cea4d70444cf265b24490baa091cf3795ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524466, "uuid": "27e2892d-69f7-4d4c-9cf8-66a945dc3235", "value": "T15D2127FECF5581360CD88A7434098529E90C8EF0A898DEE4384A46F27F98B14EE49F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524466, "uuid": "b5d9eb99-d07c-4388-86c9-fd76cf2aef7d", "value": "24:dfIR9XIY9DNIiIl9tKKII59s7gIs4Il9XIv9fIC9ZIr90r4I0Og9n1VInMl9TI4W:dfIR9XIY99Il9tRIG9HIxIl9XIv9fIC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524466, "uuid": "f2c058d5-6e97-499e-a32a-b37306d523ed", "value": 1429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524466, "uuid": "e033ad4f-0196-4855-b73b-5407e2ff7f76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524466, "uuid": "a7b24395-f969-422a-a029-ed03e32c57a1", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfc0e68-dfc3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766469169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469169, "uuid": "46fca699-3bd0-4b89-96d7-27c0035425ce", "comment": "Malware payload (Mirai)", "value": "200ecb92d4c7fea308c04dffa870181c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469169, "uuid": "50f2ebdd-076f-4a18-8350-9b02d78c7800", "comment": "Malware payload (Mirai)", "value": "f94a0be42b432a58164459f5879e58f84683a3c64c19a57a028960a49fd14ea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469169, "uuid": "79ceae2b-9489-4cae-98c3-ecb36a984699", "comment": "Malware payload (Mirai)", "value": "146364255d0ee6c6ee87dd071ee0aea36c209e0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766469169, "uuid": "a0aa0627-006d-48d7-ab96-86cf2aa148d1", "comment": "Malware payload (Mirai)", "value": "7cb08e65047c9c72835161de224c2010a9aa051aed8ea75b6df181bcd279e637c067755372bc3fd738b3c5c7ca5a6b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469169, "uuid": "392eaf3f-d271-4f57-8b92-ddb8e09f84c4", "value": "T1F7B34C02B32C880BD6F71FF427BB63E1A36A979015B1E3863609A3455176F325A45FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469169, "uuid": "b2086dc5-6486-4ce3-b63c-9de1a4e3e551", "value": "1536:YY/qLB+G25hzYHSLjI5w4mbbmu5o17FfLlmtrJDPrZG0GuR9b2q:C+mQk5w44e1RJm1YuR9b2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766469169, "uuid": "01508a07-a161-4e6e-b70b-8ba7df1e8ce6", "value": 112340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766469169, "uuid": "63133a19-3e0e-4e34-bb7f-c883e4566dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766469169, "uuid": "93879b3a-ed42-49ad-81b4-796eeac31ae3", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deed4699-dfe7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766484741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484741, "uuid": "113fe89c-0d73-4dc0-85e7-5623fc2c8682", "comment": "Malware payload (Mirai)", "value": "847c401bc833b2a04c3658d7ac31593a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484741, "uuid": "05380207-2b16-4294-90b8-0256e7b8cbaf", "comment": "Malware payload (Mirai)", "value": "f9880bbe5a89d7f785f0aadf21949d7348386abe000122689e28bf57427ae803", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484741, "uuid": "a55e7048-9c3a-4dd2-ad63-52e995905826", "comment": "Malware payload (Mirai)", "value": "da6db16ac33c20a5be7835aba759220504a83663", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766484741, "uuid": "a1dd0ea6-65c0-4119-a42e-5103fe977261", "comment": "Malware payload (Mirai)", "value": "aa7657e517f277471a9f44ed8f4111a9a9639eb8eaeb6f9c358deef33d713c611cdacbe2b0b41346636fb5a321e855f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484741, "uuid": "d11cf6a1-6716-4a36-873a-4bc2638260e7", "value": "T1D12121CE100EDB213B8F5E5063B6F964D5E2E8A32E570D23DFD44862C4A864077ADED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484741, "uuid": "f6bab6c7-9a7b-4a00-993a-a0c98a5384fb", "value": "24:od7R7UdejAdiOiNIadEodMr7CdfCdIkdcOcNhda0dGCGDdOJ6dvZ:oMhU/fc/uFNhRIRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766484741, "uuid": "5abbfcb1-41db-40e6-a45b-48197115e8f7", "value": 1331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766484741, "uuid": "c55041e1-a038-431a-893b-32c15649c429", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766484741, "uuid": "dcf7fffb-361c-4970-87ea-ceba1264b4c9", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d789aa20-dfd3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766476139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476139, "uuid": "bea55e47-3433-4f19-a31d-75b9093f5e38", "comment": "Malware payload", "value": "965a5a3852e8722225b0d225e183533b", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476139, "uuid": "8016385f-5b42-4647-ae35-de857194119e", "comment": "Malware payload", "value": "f9c11409aeda4da9d5b73afb5d7f61af703f04c73f24604a8434049087b33fe0", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476139, "uuid": "d0ef1578-72f6-4932-81ac-5aad60a99054", "comment": "Malware payload", "value": "ee17e4a600f33297d8c3f0c3ad7d175285d09c47", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766476139, "uuid": "677328c0-1918-46ab-a71e-68a2bbc0b824", "comment": "Malware payload", "value": "8164fab9160779b53046d734f8392e0691116675e1f3e4d558b8a6d82459ab6ed6a1fbc78434f07954f6a229034954aa", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476139, "uuid": "2e69cd28-4fff-4330-8964-c6e84d526da1", "value": "T1EEA5BA005743C077E55E183E8477922AA1E97F9C0F93AAB3A84434BE5DB06939D3B91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476139, "uuid": "da1b1a17-95bf-4ab5-8037-14f4ce62a9aa", "value": "3863068adb8c7fdb73a85a72b6f0a8e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476139, "uuid": "dc8f958a-e609-4a68-809f-3a41983c8fa4", "value": "12288:uVn86nhJKsIkIDA99p4LqTPUptG8F5jEm88Yw66QQs50K6mtobK+S0O1ZdLIIENm:YnRnKHkBvtUpZMmh3KjoE0yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766476139, "uuid": "cc8843d6-7c5a-4093-ad3d-e84d05b10a99", "value": 2154496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766476139, "uuid": "0dad50f7-1d49-428c-9a98-5a35113d43a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766476139, "uuid": "e4d1f5c7-05a7-4b0f-827c-ba10960d885e", "value": "Lawwasoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e2b2f9-e00c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766500260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500260, "uuid": "15668dae-aa2b-4058-9c73-57374077460c", "comment": "Malware payload", "value": "768340224d23f8bffa1fe956d5e5a7d8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500260, "uuid": "fcc0084c-f17e-434c-8ffc-32202c55673c", "comment": "Malware payload", "value": "f9f305728d2fca504cc323840f259261b2fa043e7801f5f15ae6d2b9eef4e46b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500260, "uuid": "bf0770be-ab7d-4208-99ec-b82cf3e322fb", "comment": "Malware payload", "value": "300b8d7a9f312aff061b846337f860048e440362", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766500260, "uuid": "4a3d7e4f-c551-4deb-a519-c886a5ca1b3c", "comment": "Malware payload", "value": "aada197cc4a6b8ca82e113b5b057f006f9f85d5475b6c8b65ec34df6d8f10e479fb4b37366100247879ee7fd120ae51a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500260, "uuid": "db480be5-2c01-48ef-bd04-9f13f75a3079", "value": "T1B99271017294C95BD58449364ED6E6EF3B79FC92EE41870732C8B72FAC7A640C81275A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500260, "uuid": "6973f4b1-c8df-471e-8097-a8fdf8bf8b2f", "value": "192:bzNLcdlMNYFY81g7YYp0nZv/2uyQO9j3GGXSa:FLYlMNypSEY0B4j3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766500260, "uuid": "0c248199-ebc2-4ba7-af1c-28bd1396da47", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766500260, "uuid": "d822cf14-68ea-4a32-8423-5e9928150f46", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766500260, "uuid": "743df4c6-7045-4105-a885-0eecfb11675d", "value": "SecuriteInfo.com.Heur.28223.8264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcff04a-dfc2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766468875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468875, "uuid": "473564a4-5ff8-49e9-b3c3-4f5b27099eab", "comment": "Malware payload (Mirai)", "value": "f41a7681dedfdfd1147029b0f79e333a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468875, "uuid": "8dd2702c-c3dc-43a8-817b-0b09ed57d37b", "comment": "Malware payload (Mirai)", "value": "fa3aca53a9ce6132422aea7163f99c1df8afbe576d1cd4391f0350a983686064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468875, "uuid": "c48b2641-90a9-4455-ab57-e4112c17d526", "comment": "Malware payload (Mirai)", "value": "4ac1552887ea6e51f676e76d01af321048be7b4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766468875, "uuid": "362e1bae-2d4b-4224-a61f-34ab651fc1bb", "comment": "Malware payload (Mirai)", "value": "f4555bcb7b3a95e0e24cc2cf4d976adda49d4a8c10f1389860286e249e55da615d3fd0c00c4e8b832ba12d2176a439d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468875, "uuid": "d76d6b53-06ad-4019-aef5-8c1fbc4b10be", "value": "T1B34302EB2AFC8897F627157654311B6E2166C4EEAC613A10D3FEEC51131667B7B08F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468875, "uuid": "e0b962fe-a4c8-409b-8349-cca1b6aa2845", "value": "1536:oPrkpM5x4bx6Duzoiwkh3YwLxphGmFIOn2oV+5i0DLtvYLqMsSW:oPrwM4bkMwkygFIOD+PDNYLhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766468875, "uuid": "15b87608-c4d4-461f-8906-888a8dc75cf7", "value": 60420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766468875, "uuid": "0ea923a1-5ec6-4c01-a4d0-95c12a3519d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766468875, "uuid": "4fbab672-49f3-46a1-804d-6138fea361bc", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a185fed-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766479042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479042, "uuid": "fd94cea1-228d-445e-8bfa-fe8960d2e48b", "comment": "Malware payload", "value": "6d9b65b2078fb88f737a70ad3a762299", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479042, "uuid": "7fa6ae8b-198b-4c71-a0aa-b64dd741646b", "comment": "Malware payload", "value": "fb2ddf04cca34e81f0466983023bdc26561a9a31cc18ec93d8f0538bdee5bba0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479042, "uuid": "27f4a945-bc01-41f7-a96d-52a421804779", "comment": "Malware payload", "value": "be73b8f2daeb982cca1aeb485c92a0c7e7d91ce0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766479042, "uuid": "4335ce72-de80-4239-ba20-56dbe60e4c3e", "comment": "Malware payload", "value": "3c33dfc3696a80d95111a4b94d425eebb3dd4b0000c87f8ced8dcee96519674e529285c7749881d9686e708fa3a9a279", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479042, "uuid": "567f4c1c-7eba-4af3-b24d-7b3fbe184dc2", "value": "T1FF6307F99353253E034E5B8D317EBFB306E2AA88E45F34754AF319981C32F191BA8095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479042, "uuid": "2123e401-151a-4957-a7dc-00c238050c78", "value": "1536:I9l/AoSSMyh7WMcqMQUJYRKMJaGMcjQNUwaBHdtQsEe/friud6YdZ1GLtfe0eMFU:I9l/5M91usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766479042, "uuid": "45b36a17-5e32-4adf-b0ba-df831ec6dbf5", "value": 72522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766479042, "uuid": "89c95fcd-71c3-4fc9-b9e7-59d71d188384", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766479042, "uuid": "1c7e5077-736a-4bff-be4b-d644da1cded5", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61203bf5-dfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766478947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478947, "uuid": "cbcde06f-491e-4a2e-ace6-31155fcff9b3", "comment": "Malware payload", "value": "4128e25699b730d7719cc5a8dd341ad3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478947, "uuid": "8801ef30-4af4-4c6f-ba43-6fd1b8dd86be", "comment": "Malware payload", "value": "fc08f7746c927226502259cbf58689dac2c5b467a05c37415049135a7d60bf02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478947, "uuid": "17523286-d76c-489e-8afc-3df47ff50cc9", "comment": "Malware payload", "value": "7842b3c807b2cd42d5c9083dc4674330c210a80a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766478947, "uuid": "af89454e-a432-4c3d-b476-4a98d1d46be7", "comment": "Malware payload", "value": "a2356d11e20663e989d461047eaf697a83664743fbf923a0dcc18464fb1d286bc2e56c30f3434982036e38174e77807e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478947, "uuid": "29e98c28-10e2-4107-bee8-b80a1f740a5f", "value": "T1AD632C9BCCC2933049D8016DDE6523493666DCA197D833258A2171B30F8E3EE997E9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478947, "uuid": "043e7bbd-53c0-4b7e-baa8-a463ec7cbc6f", "value": "768:I8w/h62/jWs6oS+xISN0vc0va1YdkfScBYrwz2y8kTAlGB:I9l/AoSSM4musrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766478947, "uuid": "acdd3ccc-df65-4091-86c5-ac1b4a986842", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766478947, "uuid": "a37971fe-06c5-4e4b-a5d7-2cbcdb40c7b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766478947, "uuid": "98fb8043-f24b-4a0c-b958-8c328c029206", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de671255-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525113, "uuid": "c38759bc-2315-41a6-8e51-df251337f372", "comment": "Malware payload (Mirai)", "value": "0b0daaaf2827aeb716d863c2478063a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525113, "uuid": "5d011dc3-a561-4fc4-b2cd-b2a10791e2ae", "comment": "Malware payload (Mirai)", "value": "fc75b436894076ef74c43ff643cb50f10ece98931f09f1faea51381d2d412c09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525113, "uuid": "66e084c9-65bb-44f3-9594-7267ea97ce3c", "comment": "Malware payload (Mirai)", "value": "e13470a820dca0ed053c1e92e0e980498ed8f998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525113, "uuid": "6eebddcd-576a-4f00-a9f8-38f6ffdc3cb9", "comment": "Malware payload (Mirai)", "value": "64364458db50ea9ce50708b421341ca163214bf7d5b7c985e551829cc30ccdf1a8b0053a255fe7de2f8401e01b1ed107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525113, "uuid": "e2001d8f-9077-46fc-8b7b-5cf36fa92408", "value": "T14E834A41FD819A12CAC52377FB6E028D332663E8D2EF72139D216F11B7C691B0E6B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525113, "uuid": "789505bc-3c3f-44c4-aadc-a98b0cf423c9", "value": "1536:ELZWikqzzFG5nq1T1RdJ6TikwvQKSAmbgY29Pw/e4d/xuUwbZnUB:ELcikq6IVJQDwI7AmbP/xbwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525113, "uuid": "6b037122-d7e4-4a40-8016-f6f02da3d4b0", "value": 81176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525113, "uuid": "d03f6f12-a730-4b50-9f5d-8c9166d4a036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525113, "uuid": "5021f294-7c1d-42a0-98fd-8d0d18e33504", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac61c2e-e022-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766510102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510102, "uuid": "0d184ced-0315-4a84-84e0-eb33a04e1e11", "comment": "Malware payload", "value": "f31eb8cc974a6cad20f9d298822a82f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510102, "uuid": "09ffbfb9-cb86-434e-a05f-223e9fb74ebf", "comment": "Malware payload", "value": "fca41f17c29ff73b6912f42514df11d2b4747fec552efa86ac707f8ac265614b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510102, "uuid": "075b993c-7ccb-46ec-9bbe-b74ef7a88509", "comment": "Malware payload", "value": "7c5a1e50a6c083a41a3b5bf0eb32e42bd38a9798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766510102, "uuid": "b8f18014-3c2d-4177-be66-926c969f405a", "comment": "Malware payload", "value": "d4ca2d26a103438f55558b2abc4615c11e48c57f444eea8e0fb3fc1833c1b776af4abd8681dccda6b8363aa91f415507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510102, "uuid": "afefa021-f4cf-42a5-81ed-27eb0c587da0", "value": "T16BF2D1A327B5471BFE2D4C73562B636959DEB03C0251A72F60485AAF2C248E0DCD9FC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510102, "uuid": "30a94b02-2000-433f-9050-6caf3ab52bb6", "value": "f3293c789533ed7182a2471ee6ec63ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510102, "uuid": "ad030511-ce6a-471b-98df-064ed68868e2", "value": "768:W/YnZQHYPzVOCHo938s6RkzeUdX3KeC3oMPSJ3R7hz/nsLpv:7ZnPJOCIgRcRdKeC3XsNUpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766510102, "uuid": "c87c5a72-c6dd-4a9d-91b4-5f14228aae94", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766510102, "uuid": "e6f988e7-d12a-42f9-8623-b067b0fb994c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766510102, "uuid": "bd824c07-6c6c-4037-ac97-66307546c886", "value": "cbot_stealth.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a6f1c2-e045-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766525120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525120, "uuid": "3606a1fd-8b97-433b-aa82-a34eedfb980e", "comment": "Malware payload (Mirai)", "value": "bde1630de37c6e64f1f6ec4f05a6b39a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525120, "uuid": "f3a095d1-6650-45cf-9d23-5a6190fffa8e", "comment": "Malware payload (Mirai)", "value": "fd2758576375cf2eb5b19f0d878aa1cf7fc124a1d12b7879cdec01af01b5d696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525120, "uuid": "372d206e-129b-425b-b97c-9ee5dd3b45a4", "comment": "Malware payload (Mirai)", "value": "a9290d4896f1bc075742b5d2bec53e35dfd069f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766525120, "uuid": "4747df96-7f40-4e0c-a498-88a1f64c58a1", "comment": "Malware payload (Mirai)", "value": "61a461855c8c4048a5e09778f6377b458be0c32316f0450ce630429aadfc90819fc6e3c4f4342f6d69a2a2cf9f5016d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525120, "uuid": "0959cb15-f89a-41f7-b256-d4e08ac621cd", "value": "T125733980FA4784F5D8474930807BF23FFA31D5794071C76EEF5AAE26DD27A02A217299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525120, "uuid": "85d823e4-cfe0-47a5-b6f9-50f4c32431f3", "value": "1536:uksfxN3P/JjnMGv4idjcD/BUYrueWN8oX7GsNTNYrt4swbZn5Q:uks73P/JbvPdjcD/BA2oX7GshN8wbZn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766525120, "uuid": "eb35c7a2-aaa5-4723-8986-37e88b5454dc", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766525120, "uuid": "b6aa647d-a98a-44e0-b671-77c58b165c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766525120, "uuid": "56a3a1dd-b9b7-4135-850a-c502e30ec88d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba3d17b-df9a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766451343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451343, "uuid": "8ea0c094-501f-45d9-864b-486ecc2361c5", "comment": "Malware payload", "value": "ff761170f8af6ace3f983f633b3e0a93", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451343, "uuid": "60e37d0e-d118-489f-9705-e4db56c6356e", "comment": "Malware payload", "value": "fe053c06a51a9bfb58ef6ce12e2405b429c8ceb1a39c167a246c1b67f24548dd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451343, "uuid": "cadaa71c-25b2-40de-9601-0217771255ba", "comment": "Malware payload", "value": "0a2c3ebf18c39832fd284c255d7cb6f894238bef", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766451343, "uuid": "79d93dd3-e382-4bdb-8b83-373a3d966b41", "comment": "Malware payload", "value": "a5c2d11d477ca509824a5064097ff5cc5bb9c7fb06c5687f4b044809d0a61d21a5acfae5e697d0bf5383f3243ea2a34b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451343, "uuid": "1ed71906-d874-44f6-8e4a-5ec51d76f53f", "value": "T1D06302138C48ADAF47F77EB05E0E15EB9D8157C0B863C589D9B22E4E5B7022A5F9C0B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451343, "uuid": "43a4fa6b-b4b1-444d-bb1b-d6cdfb007b13", "value": "1536:jqwbN/dSN1OyDMY82NzCMBA5/ViItPbGPS9xdgeMmug:jqwLir8SB0oItPUS9xdTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766451343, "uuid": "cd5c6fc3-7038-4b62-b1ed-112b563bbe7d", "value": 67925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766451343, "uuid": "65d2f4a8-896b-4daf-aa6c-02871858c5a8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766451343, "uuid": "eb9904ad-e83a-4b28-8aa0-5348f8ace48b", "value": "windrat-windows-client.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6551766-e043-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524187, "uuid": "29437fd1-1427-41a7-aa40-a6b77266f774", "comment": "Malware payload (Mirai)", "value": "3372fc37d5b2e0a98dd545ae9ecc394f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524187, "uuid": "d343d237-7b3f-4302-a098-32e896086c07", "comment": "Malware payload (Mirai)", "value": "fef023de9752f5cdc8b693858e339919130a049ff81b1039123b82b1c25e1941", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524187, "uuid": "17fe0203-667f-4590-83cd-b32151007545", "comment": "Malware payload (Mirai)", "value": "2a0c9fb4421159f87784964aff98abbf964f7fc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524187, "uuid": "b295ec22-b6da-4216-8ef2-a192a092cdad", "comment": "Malware payload (Mirai)", "value": "ccc75f6a5ed0b736a6e1863e4e2fe54a523877f0d4eb4c23b67a1ba466de9660675ec523647b21f506298bab9276c0db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524187, "uuid": "8e75123d-adae-48f0-98a4-73ec5c55c9fd", "value": "T13814F946BD518F23C6C311FBFB9E429C372667A8D2EB3102DD257FA437864DA093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524187, "uuid": "54fd4940-72b9-4353-a0d1-b0604101543f", "value": "3072:Y3TlJxGMSsd8EsAiEmjRqTiJKzTp6c4JVQZsIhatd9jO7nGbWL:GDxwZETLmjkOJ8Toc4JVisNX9jVWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524187, "uuid": "7b4465cb-1bac-4fc5-afd0-04c40cb3d554", "value": 206172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524187, "uuid": "2fb787aa-4582-4b29-a155-14de54076591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524187, "uuid": "2a726863-b2a0-4e0b-bc56-01bdb0aef4b6", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b48cd0-dfab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766458953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458953, "uuid": "8bdc8041-5bf9-4f8c-8093-e44b5c6c2166", "comment": "Malware payload (Mirai)", "value": "5ef643b3a4ee818c01ab0253bf5c53e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458953, "uuid": "856b1670-ffe6-47cd-b082-bbe0583c4456", "comment": "Malware payload (Mirai)", "value": "ff07e6e405b5008d7f2227624d592cd35a30b45bcdf0ee2a91ef6d9f7aff9c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458953, "uuid": "9578221d-8ded-4e99-8189-106eb77ff15b", "comment": "Malware payload (Mirai)", "value": "a31bcc56d52cb500e0b3092491b94aeed1e0310a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766458953, "uuid": "4e9592e9-64b6-4a33-a1b3-167e6b3f3cc5", "comment": "Malware payload (Mirai)", "value": "bc8ef676f3c72be03526d067405a8cbc4d7d0af730053c63191e4b0a6a5010577590cb9dfc8b0c52c1902229905a7aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458953, "uuid": "38d53196-da35-470d-964c-7b661f7cecb7", "value": "T1D5736B32BA751D2BC5D0A87A21F30325F2F2478A25EC8A1A7D710D8EBF6165032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458953, "uuid": "d167fbe4-18f7-4cb8-853d-16429cda4b2e", "value": "1536:0dLStZm4fVhl9Bv82sh12Q7Vt7WZNM5V6tNBAe6RtLh8/XK:4u/35WfVBaN8V6tLyCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766458953, "uuid": "751a1fc4-3130-43f8-8201-9d2602e037c8", "value": 77720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766458953, "uuid": "a84d5031-0982-422c-ac69-76582b44c77a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766458953, "uuid": "2b3c866f-fc14-4028-89c1-c0e6e17ee20a", "value": "ntspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139dcf25-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524343, "uuid": "7da1a5d6-eb1f-4c17-875f-d96a7e73a691", "comment": "Malware payload (Mirai)", "value": "4f27b20b103e66e7de71d54bb8710313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524343, "uuid": "f3d1076b-26ec-4297-a16e-89a86cdc9116", "comment": "Malware payload (Mirai)", "value": "ff453bab29c59b990fbcba18e12ded3b4cb1fe9b99dfaa5a32ddef95464888cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524343, "uuid": "93b4510a-70a8-4832-9246-0fe242224924", "comment": "Malware payload (Mirai)", "value": "53c613553381380178f7e9649db59bbfe9291fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524343, "uuid": "021a0ba1-b1de-4854-a3cd-10a2544db7fc", "comment": "Malware payload (Mirai)", "value": "49d9b8c26a6ed8e246f9796fc029261efbe3a04a6595993fc52fa7c97af61cd9c39ab3d1f0719855d2c1a4b551769244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524343, "uuid": "e8171762-a54b-47fa-ba5d-ec3f35ad608b", "value": "T1B314F68168819A26C6E423BAF57E50CE332477E9D1CFB16B8C211F1177C985F0C67B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524343, "uuid": "023efe0a-ba45-4352-b62f-cf6038302570", "value": "3072:l7vP6BmaZdfvm8ae+p9amsICUEd3jEqeKAyS3wNc7F:l7vP6waZtvm8B6cEqe5yCJ7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524343, "uuid": "01afa988-d133-4ab3-84a8-a810cd581bd8", "value": 197628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524343, "uuid": "177e6270-4c9a-4e3d-8ad6-4d1674624f9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524343, "uuid": "09c3df0f-cf53-4065-bdd7-4e92c18f67da", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101cd4f7-e044-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766524338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524338, "uuid": "10524c4d-0737-45e3-a005-a0a1902efdd9", "comment": "Malware payload (Mirai)", "value": "7aa378bb1fdc227e83bcc95dd1ca278d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524338, "uuid": "f06a6e37-d721-479e-84b1-86506f3ecf6d", "comment": "Malware payload (Mirai)", "value": "ff6da359951f0f8cfb1c2e83fdb4a753512097ec9903de4a70ebebb63b99d2b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524338, "uuid": "ce104dc1-5c94-40c8-80c2-94c913a076c2", "comment": "Malware payload (Mirai)", "value": "2d22c1ba6e6be6ca3f3e038fbdeb1fb7041874bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766524338, "uuid": "2871b848-36b5-46da-bdb5-40b8ee1d2f21", "comment": "Malware payload (Mirai)", "value": "161d320c20a834043f5586ba9f748348f775a10f202054ffbb3d06b47fedd2606a2fede70d7cc232dddb52698165185e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524338, "uuid": "e11613a3-3f6d-4019-9e2d-615e432920c8", "value": "T1CC14F78168819A26C6E423BAF57E50CE332477E9D1CFB16B8C211F1177C985F0C67B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524338, "uuid": "dbb238b3-3b23-4e97-8586-ccd96ffd2ee1", "value": "3072:l7vP6BmaZdfvm8ae+p9amsICUEd3jEqeKAHS3wNc7a:l7vP6waZtvm8B6cEqe5HCJ7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766524338, "uuid": "5ba02263-0fc4-4c9c-8b1b-fb74026ad316", "value": 197628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766524338, "uuid": "9e50a96f-9ec3-4c3f-8dd8-b02029fdf677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766524338, "uuid": "1a88b887-5816-4523-9c44-6637e92ea56e", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }