{ "Event": { "published": true, "date": "2025-03-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-03-05", "timestamp": 1741219381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7783b333-76ea-4f9b-8b88-97562dd4b1be", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4c9053-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741199491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199491, "uuid": "1958d31a-4a35-459e-8865-ae451054e0a1", "comment": "Malware payload (Mirai)", "value": "34f41edcecbd60c08fcf5da2a68a2a4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199491, "uuid": "f42ced91-efaf-41fa-a2f2-99b787095e20", "comment": "Malware payload (Mirai)", "value": "0053de62cd3a8b1c7ae02be548ab8e22a2125b729aec8f54234a9d36a28544b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199491, "uuid": "da316624-ae99-4370-935d-527b29ba547c", "comment": "Malware payload (Mirai)", "value": "1661074ea45913bb5eec7872c1a76e024c85f942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199491, "uuid": "f6dd496c-1ab5-4511-a7f0-6ec6a44259c0", "comment": "Malware payload (Mirai)", "value": "73ab881bbdc9add61ca1f87982b66c6323c9ee75683ae2f10b8dde1fc041fe39a2232978054c50be1559ae92f7be566b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199491, "uuid": "6faec436-adf0-4c17-b0e5-65d4a74d0bd8", "value": "T1AD331A61B882A627C1D0137AF6AE668D3720B3E4D2CF3217DD752B113BC511B1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199491, "uuid": "2654b070-7154-473e-84dd-abf900c9f5c5", "value": "768:O9eQK3ZDyS9PshiSaTn/02GvqNII/AFTdOCOV4PMXCSC6Tqlb2p1w7Zy10U6:L3ZGS95sh65YFTsCw8UHC6T67410P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199491, "uuid": "5af67aaf-bcc2-4fc1-8b22-9d0170baf2e0", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199491, "uuid": "94cb1bbf-7df4-42eb-be46-ea7ee74d410b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199491, "uuid": "7fd05597-9906-4117-b841-7a656b2d4562", "value": "donk.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c565f2a4-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741155988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155988, "uuid": "9a21e292-e71c-44de-8e4b-f40bdf89cf13", "comment": "Malware payload", "value": "4f24896f99029583e47354fd96397fae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155988, "uuid": "46f5db7e-3440-4bbf-a1b6-98d7f42c3319", "comment": "Malware payload", "value": "00c5bbc67dcda7918cc6c49f2261ad76b7cc70a3812038fdcaebd3d7906c095d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155988, "uuid": "eca0007a-e8a4-406d-a0ce-7b6b3e36b031", "comment": "Malware payload", "value": "ecb439f315f40ca25ee8f668e168f551753fe758", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155988, "uuid": "60fbe205-e2a2-4b6e-937a-27af197f33c0", "comment": "Malware payload", "value": "e3fff8bb5242133583cdbd64fef4104e8eb3781b129019928866b42bae55410d269564a23d1f90dd7b18e7074c942648", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155988, "uuid": "fec4dfd8-fb4d-4e55-824a-60900105ce1d", "value": "T1123170CA11720D786CE4E927B2B60450B8C6E0C614CB7F45AFDD3CD968ADE487059A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155988, "uuid": "9b6c7ee7-f27e-4c94-a99a-8bb63ecf48d2", "value": "24:1OnU5TcsSCl2czfPamRQGXlGY/gUM03o4Uh:1V5TcsSCVznamRV1BBM03o4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155988, "uuid": "ee26c4ed-a1d4-4437-b9fd-741fe62f6e85", "value": 1770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155988, "uuid": "1a17ae5c-54d1-4140-a877-83806e518dbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155988, "uuid": "599a70b8-5af7-45b6-9e34-3bbe0ff51f0b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e007f606-f9f2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741200700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200700, "uuid": "fd7455a5-e672-44e3-acc7-851dd0c8a29c", "comment": "Malware payload (Prometei)", "value": "be0ed0f6b828ee36d030d8abaf521325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200700, "uuid": "8781fc2b-fe2b-4a71-a763-5cb7e07e3e12", "comment": "Malware payload (Prometei)", "value": "015b404bb87f072e3ee2f63426a47c1226a7897ffec6533115d5d1b80e5050c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200700, "uuid": "317f7cd5-b827-4627-bf7c-92a63f97064b", "comment": "Malware payload (Prometei)", "value": "21069a10da4102b3194ad97dcd51f6bd0b89ffc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200700, "uuid": "a26ea362-e6aa-4af1-aed5-b99702c20c77", "comment": "Malware payload (Prometei)", "value": "ac4671bd9cd3f233cd8acb8df27d1c189d7fbe115ce89d80cc0f7c03567f30de083712ea4507aa670dc42a1f1a8acfd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200700, "uuid": "8482bea4-cdb3-4f66-a094-f0a1fe3c0358", "value": "T1E4155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200700, "uuid": "1cb38521-2bf2-4100-8724-0bbd2c58c22c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplQ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741200700, "uuid": "85457b25-3c98-4cb1-9e9f-7c0f01dbd129", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741200700, "uuid": "0bac77cb-13f0-4bbc-9617-716184e51a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200700, "uuid": "6d59ae5f-f525-4c03-838b-e95ea068ec71", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d20356-fa0f-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741213004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213004, "uuid": "9eb5b6d2-28df-4212-b2c3-002507e76335", "comment": "Malware payload", "value": "00d5c5076e2509369efa7f7ea47f884b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213004, "uuid": "7fe7864b-a104-4d4d-afa8-01d9dd982fc1", "comment": "Malware payload", "value": "01cc4546042b6cb240e691f5c2fb3b27874f172d3fc8158aebb720d35d6e9cd4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213004, "uuid": "f1d5be82-ead8-4444-b086-f59677a5c270", "comment": "Malware payload", "value": "c9eaec3f4e9b07b109dc7ddb0e402a75a56b1cac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213004, "uuid": "a29d3fbe-3e45-4998-a37c-18a9daff3ea8", "comment": "Malware payload", "value": "815a98dd4b6ca29524b3eab7cc8159c4fa1005b08baec32f33a11b3d8cc7f9defc59742c7f027d24ded041af69c051a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213004, "uuid": "6886b20f-6a42-4533-8ffb-ec70217eea21", "value": "T10301398E52A9F2415D6CCD2D7067C10DBB61D2CEF86D5E80F29CA9F0EAC41047878FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213004, "uuid": "d8badf8c-3e6f-4467-b222-73dab4405a4e", "value": "24:3J3DMTtVWAbNWA3eJTW4DDWV4ZJn20tThy8:VMTPHbNH3eJTW4nXLnZtThy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213004, "uuid": "b9b0c76b-b847-4027-8d2b-c6b6659dc2e1", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213004, "uuid": "c67bbdc0-7095-4d6a-aaee-6fdf2fbb5a0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213004, "uuid": "b06d603e-e25a-4a42-b94b-c3c1b609d944", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f12cbd8-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741159306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159306, "uuid": "6bf6a3c0-2b6e-4bc5-a532-5c9257c41b04", "comment": "Malware payload (Prometei)", "value": "1d4447fb23b3e407d6a7f6f11acf4ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159306, "uuid": "48c99d5d-2fdc-4503-878a-f729099117e4", "comment": "Malware payload (Prometei)", "value": "01d3f0f07904c888649ff60ababf11920058ed1d17c4f2e8ae2a0621bcf66d8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159306, "uuid": "95e3a169-f15e-4fbe-b6e6-1a31ed2c0ae4", "comment": "Malware payload (Prometei)", "value": "d4a549986f757b6ebccd3c2c4f54bf532e50f960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159306, "uuid": "fc37f470-9ecd-442e-8eb2-211d7c5f8dc1", "comment": "Malware payload (Prometei)", "value": "8ee4da34258890056f902c567fa586f10e4b6d8f887fe2f9681ab6a1ae749bfd5deacda80ea994f19191a8be42b2d7ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159306, "uuid": "2105777c-68c6-4869-bdbd-42266c2683dc", "value": "T1AF155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159306, "uuid": "286fe274-e274-49fd-a16d-f34e274bf237", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mple:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159306, "uuid": "7a12d74a-1429-43e0-a8c2-bd5a94764231", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159306, "uuid": "dd47c36a-6af6-4299-a0e1-1ca866079751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159306, "uuid": "2247a653-3bfa-4ac2-a88a-c02ed5a081ce", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175403b1-f9e8-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741196069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196069, "uuid": "2f120520-a636-4574-b9bc-6f4cd294c151", "comment": "Malware payload (RemcosRAT)", "value": "80961411682250739f2a34b0da139cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196069, "uuid": "588457d9-bb10-4fc7-92c6-21e205890bd1", "comment": "Malware payload (RemcosRAT)", "value": "02554088cb84a654728125ac4ba0d2f226d5ef20365b26e22b54272ad92eae4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196069, "uuid": "9ef06c82-d09e-48d8-b8de-c7cdb7b93b8a", "comment": "Malware payload (RemcosRAT)", "value": "5d23df87445e4274087c298e4ea513c87b969055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196069, "uuid": "bbd60551-ee8e-4d62-a56f-86d38d615905", "comment": "Malware payload (RemcosRAT)", "value": "0d07b919f15944eb0ad76b89ea521d6f4771ff2a27370d9f3a624ebb0365413d146aee591229f7d31487ff6d8329e869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196069, "uuid": "01796a7b-1c66-42dd-844c-34da3edad6e7", "value": "T1ACD423A9D7C44C96F0F242742F6350B8D6339E218835C7132B84BD6A323796F5A5E3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196069, "uuid": "5c47067b-77a9-4319-910d-be3a435c1cdf", "value": "17b7d61bda0f7478e36d9ce3d4170680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196069, "uuid": "36d88d0a-0fe9-4497-a114-295dde88848e", "value": "12288:2iuvt+JEkyc34ZCR9krtbOC/r3JAE2vcPEeIV2Vm4MasW3Gu07b4GSpcGQWNl8:iV+JEqACQQ03L2v6V9MtW3GuhcDWv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741196069, "uuid": "f4e29084-8116-45b4-94f3-c5f045262fbc", "value": 651506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741196069, "uuid": "fb24a91d-5444-4dfd-8af9-977eee0b6534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196069, "uuid": "75f117c6-5935-4db0-a199-bcf19f2d7e3f", "value": "TT COPY PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894f4048-f9c7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741182086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182086, "uuid": "e32737ab-032f-480f-895d-0f1fdf922bd3", "comment": "Malware payload (Mirai)", "value": "527aa821d293ca1b79a708f87d417aa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182086, "uuid": "b7930d67-1fe7-4659-ba20-fa19ba714bb3", "comment": "Malware payload (Mirai)", "value": "028f08182d74bc036612c2759cf35f9f9a69d513efb251100a5ab2689c71c66d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182086, "uuid": "145dc6a9-7612-4d2d-b86d-35e07e811b15", "comment": "Malware payload (Mirai)", "value": "bca5b7aa0e00a051b644a7359ab72f54e2f05b19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182086, "uuid": "5569c583-73b4-4d92-8247-2be423216d9d", "comment": "Malware payload (Mirai)", "value": "5beb7ab4b746eb8c3ab1d11c5cfa204ca9e2fdc5949b711c2429ad4bd4b1af118bdd460ce6bea3ea4cc4a238c0552530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182086, "uuid": "2ded6ae9-79d9-4430-8241-7153be5d20ac", "value": "T14903E10913176DB8FCBFB67013261B58FE66BC337B0547E608C9B8690DF65661C62326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182086, "uuid": "df65d20b-d4f9-45b9-af53-e1f3e4ed5008", "value": "768:4wQfDk73z5yDAE194jlJL5WTFsI2Lfx1Qse2k6ggtRv9sPVT:4wmiVyDN1yj1sdYgF0FuVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182086, "uuid": "9cc2408d-dde6-4253-8451-e403b797b10f", "value": 39952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182086, "uuid": "ee19501a-adc1-4f0b-a2a7-16d2c030493d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182086, "uuid": "277d86bd-e78a-4387-8fcb-779682d220cc", "value": "5r3fqt67ew531has4231.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d4c8e6-f98e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741157489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157489, "uuid": "a15af99f-58ba-4c32-b96a-436f39cbb413", "comment": "Malware payload (Mirai)", "value": "4f0a981a7f0b82e6b929d8d0dee360d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157489, "uuid": "8010c7fc-1821-474f-95e7-b83e5bdad0b6", "comment": "Malware payload (Mirai)", "value": "02a18069f7bd7f639b6207ce44803ffb723df1d53746b351d541edc540216252", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157489, "uuid": "88a02a5e-2b57-4019-a30b-256b746c96c7", "comment": "Malware payload (Mirai)", "value": "f16606a74ce568a5448b4228c1012da7a0a1ed65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157489, "uuid": "9a8266f4-fa38-4812-b653-3f684bd0a44d", "comment": "Malware payload (Mirai)", "value": "666198b141d6179fe7ea3fc70c50b838812a83161c97356267d2f67d8538dc00e5bde46fc71a0c171ae57404ff0e9b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157489, "uuid": "daccba5b-1009-4c41-8db0-be0f283de141", "value": "T198432997F800DDBAF81AE73B84130406B230EBE506521B7263577577FDB61E42823E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157489, "uuid": "998aa864-bcd6-43f6-b58d-986ab3b259d2", "value": "1536:QtKAcEtWcJy+r840MWnwjQVxkFmx83fJlqpPU3:xQy+xyxqmO283", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157489, "uuid": "720d3c5d-b54f-4d58-b828-9169cc6e7a23", "value": 59080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157489, "uuid": "f9849692-4dab-4089-96f6-e26789f912b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157489, "uuid": "ed1ef5cc-2878-489e-8691-a6de7d209101", "value": "cbr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3059b96e-f9bb-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741176783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176783, "uuid": "1812f3b9-c1be-4b8b-84b5-1911ce7065b2", "comment": "Malware payload (XWorm)", "value": "884179d856f1870b50ee3b0ca606ca8a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176783, "uuid": "07001dc6-363d-4857-8413-d33267e7f097", "comment": "Malware payload (XWorm)", "value": "02a9d861a3ca7c4b9096e16d74fad94c6b577b954e800f4b23625d133add5c6f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176783, "uuid": "63367f9a-0b96-4db0-87fe-8ed3293d17ec", "comment": "Malware payload (XWorm)", "value": "12f60d3393ac5e5c93637c168cc678b05aec183a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176783, "uuid": "047bdd05-371d-486b-8359-ecbff1996226", "comment": "Malware payload (XWorm)", "value": "30c9d465acd36a0c59e8d7bb08657bf2f2e1744d2faf9ed91accbedfaa9c2c053be7cfefbbc8b5b38dc5985320bbc78d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176783, "uuid": "f2483a59-9692-46ff-8549-9e7c0d4187ce", "value": "T1B463E63ECAF2ECC003AF71D09A5D3F46544C2B97F6B45B9CFAE109651824244EFB6268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176783, "uuid": "cc5dde7b-a4e4-4d63-ae72-b84ccd0b048d", "value": "1536:IjfS0G9/uMZf+dCwNsHbsFfKi2lkH0ZkbmEKUgXEXzICKUnFhGg:f9/uzdCwNs7wZ2GHZHfTGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176783, "uuid": "00c500a3-3ef7-46fc-85ca-341423e7a4c9", "value": 68136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176783, "uuid": "161b49a0-13ef-40cd-b58d-016de2924ebc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176783, "uuid": "bde49340-1d4b-4161-bbcf-57738926e049", "value": "Account_Access_Alert_March05_2025_Report.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b984260-f9ac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741170386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170386, "uuid": "0ee67da3-e4e8-47ea-b208-a4882dec6d1b", "comment": "Malware payload (Mirai)", "value": "0f601d42e6884ac28bd1d64b97120b2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170386, "uuid": "e466ef37-ca6c-4693-8122-5960e05e430d", "comment": "Malware payload (Mirai)", "value": "035a14674a66d479dc97f27791a85a0f9d02f046069343ebb3d00c0785c721fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170386, "uuid": "e19b40e4-5613-4e65-b5cd-d58a69858b91", "comment": "Malware payload (Mirai)", "value": "c9c06ee76b9bf576979f1cf6f115bc924dc0fea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170386, "uuid": "63ffe3cf-1a43-473a-962c-1b03d534f353", "comment": "Malware payload (Mirai)", "value": "4d6627dcf776067371890aae2b6671bd831dc15072bfafd4c6419a7c3676183503c0799aee571a5d8eff252388621ea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170386, "uuid": "4d463571-d9aa-4c43-abf9-d05392d233c9", "value": "T14C043B56F6818A13C4D6177ABADF424533339B64D3DB33069928AFB43F8679E0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170386, "uuid": "fa22bd5c-daf0-4669-982b-a0202753ef50", "value": "3072:dM9gkwyp4FN4nawyPLtyc4LbZ6QdoxKprv9szvOLM/98WPwunmCwkoEH7:dM9gOUSnawyPLtyRZ/oQ5FszvIM/9BPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741170386, "uuid": "dd2b1345-050d-4892-b379-84403a4e2d3f", "value": 175340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741170386, "uuid": "c4602895-1355-440f-ad50-95abf03d3844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170386, "uuid": "477638ca-f9fc-40bf-a48d-3fbec5ec96df", "value": "efefa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071e884e-f99c-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741163400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163400, "uuid": "d65fe9b4-60a8-4a50-b101-1d7c7cf0fba2", "comment": "Malware payload", "value": "46515ec0ad1711350ac2cbfc5cf23243", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163400, "uuid": "903f0dc8-d7d9-4a1c-bf34-b0692ffe609f", "comment": "Malware payload", "value": "043545d1eb3eca5d8aa58e4e9e863c3c2340f46102d2c9dce2dcf71d41466d68", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163400, "uuid": "29998540-c7aa-4553-8004-6be98b551823", "comment": "Malware payload", "value": "96695f48cbad2cf061ddb212d9d7896ac7b7bc70", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163400, "uuid": "a082b989-a610-4e77-bed1-595315c692db", "comment": "Malware payload", "value": "a8900790fc22533832bb99556050ff954a0de314a6f6fb86ba9e3720d6216e4f4e49a5ce54b43772fbb7a33b660a5ec4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163400, "uuid": "cf1ffeaa-5be3-4806-a2be-86d4d81fc920", "value": "T1DC043B6C340981DA015CA39DE9A7B4C278B95259F32BF70DFB6C74570FE82E7D08429A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163400, "uuid": "93625b60-ce40-4a25-a3c1-0d44635bd6ad", "value": "1536:G9bjgvyD1sRtfECiMwV5TohyRJ1vr2LBJpUD:QpeRGTtohyRJ1vr2LBJpUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163400, "uuid": "a8eca0c9-8538-4f1b-bd02-56a1e88cd0d8", "value": 177305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163400, "uuid": "3e5dfe38-e125-49ac-a529-0617b05e1dca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163400, "uuid": "9bdf3744-b3f2-4756-b018-c52627499c26", "value": "Tuesdayconstraints.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92d28d5-f9d4-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741187750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187750, "uuid": "38502c22-da4c-4626-833c-dac3923d163f", "comment": "Malware payload (RemcosRAT)", "value": "9fe39257cdab9c4f99288a30fff0f185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187750, "uuid": "a0edb1b8-28d2-47f1-bfd2-44b22399b15b", "comment": "Malware payload (RemcosRAT)", "value": "043a0b84d0b99ebc387fecfd2182eb6dacd1e5f4f5107e727395f046c752d91c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187750, "uuid": "f62460a2-9e6a-4fb9-8283-d9276f392a8d", "comment": "Malware payload (RemcosRAT)", "value": "0e6b1869c2c6ea82ed488a9ed90a04b0bafc7c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187750, "uuid": "3da8bafb-52ce-4693-bb9f-2b9cf2b7fca0", "comment": "Malware payload (RemcosRAT)", "value": "1486da12abecba9fee06e08b83aa43985fcc8bb14fa7f2b8d598c4220ba4652b901e16c8a297070a809c9bd6fd88eaec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187750, "uuid": "f64e090f-b156-4974-8402-a32e46103f94", "value": "T17F049417B6CA86B1F2606776C4EB0500CFF4E981F763C70E7D8A235A0D537AA987521B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187750, "uuid": "818ff8cd-6f29-4817-a90c-c395a9295515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187750, "uuid": "313006b7-8bbe-453f-8154-d0b377212e46", "value": "3072:1fXJsZTcrGEg6/CbQPut0JqK0/k+ZkRABPraxP4yBJsBZGDhm9:1kTCpg0rS0JqK0/biTzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741187750, "uuid": "227dfaba-da5a-432b-b8fe-94c1d7c22e68", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741187750, "uuid": "44ff41c8-5771-4dad-82b9-bfececb6d594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187750, "uuid": "95dcfb5a-78f2-4e31-8eca-586de8252c08", "value": "COAU7257353570 _DELIVERY_NOTE.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a894c35-f99d-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741164076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164076, "uuid": "120f3c08-2645-4094-9277-f917305114e0", "comment": "Malware payload (LummaStealer)", "value": "7c2530b4c3311e56fd61c8fbc6eb9533", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164076, "uuid": "0f4e62fa-ef24-42a0-b4e2-732ab4a16df2", "comment": "Malware payload (LummaStealer)", "value": "051a2627972d2298d7edb1da10be267de266b918c69b502ff523302eaf5779c6", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164076, "uuid": "861d4a6f-d907-4e3d-82ee-3e521fee0007", "comment": "Malware payload (LummaStealer)", "value": "f9a226534337b9eb4d6a108a3df281572950bb16", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164076, "uuid": "47f0be0a-e748-4b8b-8f49-638c402aadbb", "comment": "Malware payload (LummaStealer)", "value": "037b994984b2bbc7e8c7f42cb5a7184d12fce7cf55a4c08f2934278e2c2f39a7d084e7c93af88ff3b7c9ecedb775609f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164076, "uuid": "51ec3387-3ec3-4909-a04b-f9bd84e06758", "value": "T138F623AC78B9B95BF1E4437BC7852CB6DB2CA540D78D3E9B8E2041067D8310E5F6B861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164076, "uuid": "81b7ec5e-39ce-435d-9986-c372a01368d9", "value": "393216:YoojINv2YOqqSOdWForYCkzbjaS5PQo5c+ANlvZXez+1kec:YDsOAnForYZzn3w1ZOz+1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741164076, "uuid": "662aace3-9eef-49e9-af86-fee66a01dc14", "value": 15558903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741164076, "uuid": "592b7ff9-4798-4d19-bccf-7791c7ef031d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164076, "uuid": "9489c0d1-01ae-4a64-a53d-710a0d4fa79a", "value": "000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba1277b-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741159461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159461, "uuid": "cd683382-353b-4096-ab81-1464cdc2a042", "comment": "Malware payload (RemcosRAT)", "value": "437a96c6c4bf0f6a9a43adaef14391a4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159461, "uuid": "97cac5ad-f473-4682-a85d-2d727435974e", "comment": "Malware payload (RemcosRAT)", "value": "058810680c17fa8e395e1ae25005755f3f8844c7eaf4100de5553af5d26053a9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159461, "uuid": "d8554c35-3a34-4e9d-9f9a-e8d6832bbf1c", "comment": "Malware payload (RemcosRAT)", "value": "1aeda3d74279a8c6fb734f7fdc59ac07affce558", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159461, "uuid": "052e3d13-ebdc-4177-a94b-2a344b665d6c", "comment": "Malware payload (RemcosRAT)", "value": "232f53403877b05b149e55af33f2ac67961412c1c09c1b626e401ce8f0367723cbd7f2562b2e87c36bcae932679856db", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159461, "uuid": "741ca490-c758-4827-b3c0-b6d7d0ff3728", "value": "T175138D6DBA2C0FE81E7737FDFB407D0C8479452D9F365CA3A8A402D876C54588E69AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159461, "uuid": "3a434a03-0e6c-411c-a3f7-1e5db64c2727", "value": "768:umMYqD/OCKbUzsAzm4ROQO1VYA2awFdSDonV8HgBU2:umDqzOXasAq4hY2awyDy8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159461, "uuid": "c9a0727f-6919-40ab-b503-06753b4819c1", "value": 43455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159461, "uuid": "8f6dfd0f-a7ae-43ee-9fc2-96a353924b33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159461, "uuid": "1495b1b2-b024-4a7d-b1e6-cacd5b517420", "value": "\u0e41\u0e1a\u0e1a\u0e04\u0e33\u0e02\u0e2d\u0e08\u0e31\u0e14\u0e2a\u0e23\u0e23\u0e07\u0e1a\u0e1b\u0e23\u0e30\u0e21\u0e32\u0e13 (\u0e21.\u0e21\u0e2b\u0e34\u0e14\u0e25)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d390754-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741158310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158310, "uuid": "8c8fd178-7e81-4b15-94d8-9e9c978a8a29", "comment": "Malware payload (LummaStealer)", "value": "ff9fadae6dcffb10cf0c557cff17e6e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158310, "uuid": "3ed1fa09-a314-402b-a5ec-b87bebd12223", "comment": "Malware payload (LummaStealer)", "value": "05c17e3f7d356b895ad3933855669b5ad97832b63566921ca67adef187fed6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158310, "uuid": "73888449-394c-4c72-9eff-2ada26c0868b", "comment": "Malware payload (LummaStealer)", "value": "1f0ff025a55226804330bc70c98ef129d7db64d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158310, "uuid": "3b149b70-571e-422e-9c78-e03ee723cc00", "comment": "Malware payload (LummaStealer)", "value": "20951585dc1e5081304dbcb87e43369fec68d25a0d522a9781de77a67060cfe1b38de0abd6dc7705740d3bdc5f1efb07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158310, "uuid": "a9c3e993-954a-4e35-96ca-627ce7aa7e22", "value": "T1D0D539A6640972CFE8DE16FC8827CD83995D07F84B108DC3AC6D747A7D62CC556BAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158310, "uuid": "6c0f7482-9ef8-432d-8362-07f7de92362e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158310, "uuid": "1779b1cb-e838-4365-aea9-c9df292ad9e5", "value": "49152:d7Rrz0BqPaOYTiMhvYFTCzaiJRePw8osIm7s8n+u67JXC9y:d7Rrz0BqPmTiyYFTCzaiJReI8vs2Z67i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158310, "uuid": "faef9869-fdfa-46ca-a55c-797696df201d", "value": 2986496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158310, "uuid": "b9120f8c-e8d9-4f14-a2a1-e71c317ca562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158310, "uuid": "96a96c1c-ac8b-4e0a-b3c7-01c2c4c1a60f", "value": "ff9fadae6dcffb10cf0c557cff17e6e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3d0181-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181798, "uuid": "d539135e-dbdd-4f1a-b31b-1b180cb45c80", "comment": "Malware payload (Mirai)", "value": "408e6d5904ef02dc7cef326e19830be3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181798, "uuid": "e069ec82-a622-4e7d-b97a-d38870a5a8b9", "comment": "Malware payload (Mirai)", "value": "05dc1599acc67a0eb780eec720dfba5f176f405bf813b324d20bf91832a8e71a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181798, "uuid": "2c680e6d-a6a3-4a24-8db2-e8fa6978cc44", "comment": "Malware payload (Mirai)", "value": "80c32a9ae53145b41d7efe5ba570cd39c30c17dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181798, "uuid": "3a236092-bce6-4ddd-81f2-a76745c18c1a", "comment": "Malware payload (Mirai)", "value": "8fbafd2d2836e6e645e4957f81e6f032651b9cc47f99397d2b9a33bb8896998cf67e25aa5804618862b7102ae357b5c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181798, "uuid": "d06d47c7-8f36-430b-a5dd-014cff365e33", "value": "T16EA34A32BE762D23C1C6647B21F70715B1F253CE25B8C62A7EB20E4AEF646402553AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181798, "uuid": "13f52b36-dfb9-4954-a2d1-213b5a6a4511", "value": "1536:fFD7SY+1nvRLcNwys7G/X5vABPdma9BZlM5rztJJlqxwbZnaj:ND+tONUA5k4gBZl8HQwbZnaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181798, "uuid": "086b97c2-9c57-49b0-8e58-d34923369366", "value": 99912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181798, "uuid": "f839d68e-22d1-405c-94c8-1d0f1d643b3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181798, "uuid": "ee9065e0-bcca-419a-9ef7-88bc818f8c48", "value": "5r3fqt67ew531has4231.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261268a8-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741158298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158298, "uuid": "3dabca88-901c-4ccc-a9a1-015c92579d16", "comment": "Malware payload", "value": "3babce4f85902c7bcfde22e222508c4e", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158298, "uuid": "09aa69f7-5d7f-46a9-a317-05ef2ea54bc7", "comment": "Malware payload", "value": "06b678b55cb81e6999b25903def2ac02336dc6c9ff3cd6afdaafffd55e2e5302", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158298, "uuid": "c44af201-268a-45ff-bebe-fd83662884ec", "comment": "Malware payload", "value": "4898ae5c075322b47ab2f512b5463ee6116d98f7", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158298, "uuid": "7bc181ff-f8e2-44cc-a594-b5770c4fe123", "comment": "Malware payload", "value": "df725961c0f959e0567c502155eb7f21a258b5562d38aba0d48ed7bf4b61d474771a1b030d7341ae57fa5884d6a45862", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158298, "uuid": "70f5e30d-42bc-46f0-81e2-1945642893fd", "value": "T1BD157B5A63E828E5D1779138C7775383D7B6B8161320D6DF02E086663F276E27E3A390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158298, "uuid": "60878273-bf17-4bbd-8dc7-ea5c28cca8a8", "value": "cfca4a34c112c1814d56edc0be75de3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158298, "uuid": "7ae6f7f8-24e8-434e-9b9c-e0b909c32ed7", "value": "24576:9lBq4/QlK9/CqNzb5lgV6tZVPKilGRl1D:9lBj/V6QtGily", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158298, "uuid": "192a4fd5-d37e-4670-98d8-6b1ac2ae6f36", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158298, "uuid": "d547c446-30a8-4c8e-a499-0f09ba0d6955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158298, "uuid": "5bc53aaa-46c4-4554-84e7-238e83960c8a", "value": "3babce4f85902c7bcfde22e222508c4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0945d9c6-f9bd-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741177577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177577, "uuid": "1a9250df-73ff-42e0-bf8e-f6121e2ae936", "comment": "Malware payload (Mirai)", "value": "91cdb7dbf660e36dfaf014394e1e46ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177577, "uuid": "855a9eac-5158-47e7-a731-18ac4d4104f7", "comment": "Malware payload (Mirai)", "value": "07aa61d6d46d87cefd1151cf9ec56fe6d86122e89e9b9e398e55d5f814be30e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177577, "uuid": "9e021502-1e66-403c-b5d7-f169aceca45b", "comment": "Malware payload (Mirai)", "value": "40804786a4fb3bc378a7611d32c6e175918b0f79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177577, "uuid": "5aad4dd7-3be6-4692-af92-cf212eddcc86", "comment": "Malware payload (Mirai)", "value": "783e10f39dbf364eb6454802cc1a526c8152bea32232b2724d92f3370de0dbc3eb8fd677b99f9adc629b5f5da2e5f4dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177577, "uuid": "d37c8497-224d-4b82-94cc-a586ab0a6897", "value": "T133E30985F9419F13C6D612BBFB5E428D772A17A8D3EE72038D256F21378685B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177577, "uuid": "a8c6f8d4-b580-4918-9aa0-ab4f13466ea5", "value": "1536:hQC3lbc/cpRH9DCBMN8Pc5l2pEnfe4VpdRkTuTApvLvxOF8AyjO4pqTEllJwyws5:hQCu/0Hdb5lW4TkSTApzeMOsooZYoKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741177577, "uuid": "599246a7-6458-4981-815a-76f37076c206", "value": 146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741177577, "uuid": "baeaee03-1cd1-4566-be88-e6cdec46408f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177577, "uuid": "855ec9da-c003-4842-a3b3-08f0371691d7", "value": "vejfa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f156e78-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741176378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176378, "uuid": "ce5205bd-f803-4264-80c3-c6c2444ec197", "comment": "Malware payload (Mirai)", "value": "154a75cfbc8dde24c63ac971dce85135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176378, "uuid": "1e3e43b2-5eed-4e21-8270-e9da86252366", "comment": "Malware payload (Mirai)", "value": "08158c04ed19fb363f23817b8207b295c0cd90b09417a817b69f99037d854f8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176378, "uuid": "9e84a454-2818-44a1-a051-fad1a3773ee6", "comment": "Malware payload (Mirai)", "value": "9513cf1fbd6d3eec6d0b15bb3c7281468cffdef1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176378, "uuid": "f56a73fc-9a5e-4a13-8a41-82a6091bca5c", "comment": "Malware payload (Mirai)", "value": "5be1c8ea6ddb22a78753e339cb5495c1bef0b589b839607f393965060a37133a5aee172d18066993d2effe95652b78d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176378, "uuid": "dc0576db-fdb9-4d70-84de-b0cba295677b", "value": "T167331BC5F981A625C7C15577FF0F02493719878CE2EA3343A92D5FA077CB95A0E2A606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176378, "uuid": "a1721ec6-a35c-4fab-94d4-0dbd128a3405", "value": "768:1Utx4xcCWQnr5belCA7SvDpPNDpHeGXfO+ybDgVNIhIxeC+rs+4cqbJ6lftm6bEZ:lhnt6CA7S7PoJk0/Ef8Ix79+PjCmtJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176378, "uuid": "92330800-e474-415d-98b5-095d5f284c9b", "value": 54772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176378, "uuid": "c432c452-c2a9-4ef9-ba5f-c8654d3ddf47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176378, "uuid": "2cda66e2-cff7-4a7d-b017-e4d940378aa1", "value": "cbr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fd90a4-f9d2-11ef-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741186809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186809, "uuid": "2f31ec43-3999-42ca-a984-c65dbc3c7741", "comment": "Malware payload (GuLoader)", "value": "e9ca856d7b224f9935fc304cd84b16c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186809, "uuid": "2a81fcb4-5514-40bf-b207-8d9a54917545", "comment": "Malware payload (GuLoader)", "value": "0983fe1203f18c5253717af5863bdb086c5b6f601c05024b0e5636a3649727d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186809, "uuid": "cd07c6b5-32d2-4a6d-9c6f-43498bdad5e3", "comment": "Malware payload (GuLoader)", "value": "8f3a6df78ae8af086ba91961bc5640bae93c1fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186809, "uuid": "a417ef90-b8eb-4a2d-8aa0-4a24b6c1d480", "comment": "Malware payload (GuLoader)", "value": "0b964d07bffa92a6ec2bce6ffc34e8115c5f3e60816b35e9acff0a8acbb4910b09e0303c87c001e74957ed9e46433c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186809, "uuid": "62261f0c-5c9e-434c-8232-7d4d65bfd6a8", "value": "T1AAD42355FAD8E0B5F4B157F059B3C6BADA36E902C04A060B771CEF9B1A31A1EC48D391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186809, "uuid": "ada489a4-42a7-4000-b6fb-cf5ac1fea974", "value": "17b7d61bda0f7478e36d9ce3d4170680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186809, "uuid": "3f0aa6e4-661e-4cae-a10e-c8b4b9b34451", "value": "12288:2iuvt+JEh4LTuDVU/xFZlkwPX6CvVifwcX4gJRVhL0MrQvLS/gWjDWJ0:iV+JEIPo74ur5dMvLtWi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741186809, "uuid": "f3268000-a0a8-490b-8564-2223e2366025", "value": 639874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741186809, "uuid": "986bdcf8-b58f-4d44-ba3b-50b88006c6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186809, "uuid": "737aabf9-a893-41d4-b116-24cd9cef2ceb", "value": "rRessourcestyrings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877a2c61-f9c2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741179936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179936, "uuid": "6d11411d-7792-40dc-b8be-c1e3bb19417b", "comment": "Malware payload (Formbook)", "value": "577295ff0a41d0c465beb328277f34ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179936, "uuid": "d618a24d-a8f6-481d-b93d-ac53114941cf", "comment": "Malware payload (Formbook)", "value": "0aade5a390c3f8e5fef65f6070f598b9b0baf0abec9787d8fa7f430b28593e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179936, "uuid": "b917bccc-1f9b-4e3d-893b-6724a3e9fb56", "comment": "Malware payload (Formbook)", "value": "259c96554b2ca820760715fc84d945930d2098f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179936, "uuid": "6ac530be-c4e9-45db-9bfa-61ea97aa2576", "comment": "Malware payload (Formbook)", "value": "bcb1cba4ac5b220edb4321fd471f2f378ded5952eebe30b2a0a213e5a9a42e0b746c94a879edc286d389bf7f88fdb2e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179936, "uuid": "dbb96347-3244-4c04-957f-86c393829fc1", "value": "T105F4F0743698EB06CA6697F85931E17047F82DE9B810C22A9FEE6CDF7975F000D64293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179936, "uuid": "6008016f-f115-48ba-89bb-de47b613a72a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179936, "uuid": "50646ce1-812e-45c9-96a4-2a818fb6f3fc", "value": "24576:nnTL9Pf70LvOQRTueOkQ8dwmM671xf0Q:3dALWQRTuD8/h7/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741179936, "uuid": "97339309-8255-4eb0-b301-20b58534d161", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741179936, "uuid": "dd7f65b7-a08f-4d61-a6ea-8e44db806a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179936, "uuid": "df78c1d9-6635-4840-b463-5c0fa71fcf30", "value": "updated quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b4b156-f9e2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741193788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193788, "uuid": "7a1ee8ea-896c-4202-8e25-9f92b814e37d", "comment": "Malware payload (Mirai)", "value": "9a9ae52c8cd959d923f4aba7820c6c48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193788, "uuid": "1f99ac8a-67a6-4798-a686-7d287098112b", "comment": "Malware payload (Mirai)", "value": "0b2392ad25a39abf0eec115c3f923cdb4619f852849dbd7cef9c23238ed40a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193788, "uuid": "1900f013-fc05-4da8-aba0-51349fd4c578", "comment": "Malware payload (Mirai)", "value": "7d959dc0edd60d8120edafb64aa2ab1a61f2eb50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193788, "uuid": "2c86cd96-3fe2-4017-8265-9e7622463c31", "comment": "Malware payload (Mirai)", "value": "67eaa1b1aa9dd0d0b3c507f5f6ddd6966383fc6e69eedd9f91008b72d95285fe72ac8ee504008151d98b1721ca57b576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193788, "uuid": "672a74f1-7f9e-4f79-9f99-8c23424b97dc", "value": "T189F33B46AA418B17C0D6177AFADF424533239B64D3DB33069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193788, "uuid": "8237ef63-ef1d-4883-85a0-b65052a04487", "value": "3072:yEbs/68Sov5GUakqRovFNiaeud6sdEjqPrXmH3EM/9aYZAc:fbs/6CwUakqRovFNheHsKjqTXmHUM/9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193788, "uuid": "8a5b9db7-ff1c-41c3-ba4b-665a92a723cc", "value": 168765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193788, "uuid": "aa0cef88-b31f-4059-8d08-471d95241c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193788, "uuid": "10f10e92-1585-426d-8e2a-b60b4cc3d6f9", "value": "efefa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa47862f-f9d4-11ef-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741187725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187725, "uuid": "4fa9af61-6d6a-4128-94b6-be054a60593b", "comment": "Malware payload (GuLoader)", "value": "8eb05d8aaf3037c6a0b340a431991739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187725, "uuid": "244cbecb-3749-4cfe-ae27-15934fced174", "comment": "Malware payload (GuLoader)", "value": "0b7a38fd140361d0c6497da61ce0ef60d6a3da2593048843e524097a794baa4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187725, "uuid": "1b38896c-a187-4414-b115-1bfdc4f24d72", "comment": "Malware payload (GuLoader)", "value": "e6b5f3ad0687c8cc03d95eed2b115083da6285ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187725, "uuid": "939f7f55-8541-433c-837b-ef4c1ef11889", "comment": "Malware payload (GuLoader)", "value": "08a58b4bf1b429786ff50e06c852e4c68e0ecd60aad7d99a2e4baf87c61e283f931669464788dc104f590218dba6d10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187725, "uuid": "8ede52be-3b59-4246-a916-690be01fcd4a", "value": "T12AD42352E2C5A833CA9217F26EB29F0FDFB87D20411256C7B790AE2F3563186954F391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187725, "uuid": "b961b7f4-1f1b-4f64-808b-8096b280f663", "value": "17b7d61bda0f7478e36d9ce3d4170680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187725, "uuid": "f522f76f-98f2-4213-bd70-3509d0d99df5", "value": "12288:2iuvt+JE09akzG5rpr5itLScBZ0t443ClE38RCK60rqR40fs:iV+JE0o02pM63Cu37lR49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741187725, "uuid": "f85ac7af-f899-4fa4-8a05-2ec0325713d3", "value": 638556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741187725, "uuid": "70f2c60b-58c8-4e93-b598-70bc032b4ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187725, "uuid": "68b905c3-c248-4cbd-a358-c61b07336fef", "value": "Zahlung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af778b6d-f98f-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741158099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158099, "uuid": "35e9bca1-c68f-422a-b4a2-cad79ced3281", "comment": "Malware payload", "value": "f9f58bb76b18a64be12f8bc5a479cc19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158099, "uuid": "d079ebde-ff5c-409c-9943-19c1a0d0ee69", "comment": "Malware payload", "value": "0c4410da36aeedc4d5f1018a16cb64fc2d9808f2e1ce7047588868fc9c1ab15f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158099, "uuid": "82dbab0b-b0cb-4681-90ae-15b22c96cf67", "comment": "Malware payload", "value": "f04dd19156d57f23671bfff8c72c33a61d14fdbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158099, "uuid": "4c395eb6-7868-426c-8377-5f16cc0b8e44", "comment": "Malware payload", "value": "5edff5d76d8ad396a31b6c155dd58a2b64d8d77222eeeafc3034e2aa9ac693effbae7aca8c4d21df9ab6e186f9f21d13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158099, "uuid": "be95943d-06a1-47ec-be96-2aecacbc5e35", "value": "T194A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158099, "uuid": "7e071107-8dc9-4a07-831c-9199dc740855", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kpmAhId:fma7JLqHxcncWZViTH6xVRFORmAhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158099, "uuid": "69445160-8283-490f-9f8a-fe72a2e4d74c", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158099, "uuid": "83f1e853-9f30-4486-b629-03da9904e8a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158099, "uuid": "98c47e22-8841-42c5-84f8-25dcc22e7d39", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eab636-f9b3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741173380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173380, "uuid": "46cf5712-39e4-4bed-a2f2-dcc9f420787c", "comment": "Malware payload (Mirai)", "value": "7d7ae1ff6a49a7916583f0a32250795f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173380, "uuid": "cc9aca2d-9956-4394-82b5-a74aaa7bfcbe", "comment": "Malware payload (Mirai)", "value": "0c4b60136e051d29b3037985e39dbe8236543b77f8bc11db04d4c62a920a7a4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173380, "uuid": "fcafe69d-1ba5-403b-aa8d-9b80e72fb358", "comment": "Malware payload (Mirai)", "value": "5c30c38d04e09d5b56c63af0bf57df8f004cdac2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173380, "uuid": "61f30544-17aa-4e40-bcd8-cb0d2de88b29", "comment": "Malware payload (Mirai)", "value": "41a5aed3b2b7dec64be2e4ba620ffbba073b4e072b6cd98a4735db9747565567c2f1b366bba1ebde72ef7e86c5002e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173380, "uuid": "adf26e13-ae1b-4cfb-b66c-2f3d696cd70d", "value": "T156334C42F30C094BFAA32DB0363B27D1D39FE98031E4E6C4B61E9A499172A315656EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173380, "uuid": "b20710ca-fa29-4646-b5ae-9fe936a56f24", "value": "768:tcGRb23Gy1DBcNe/QwC9uGYT+CLDO9ZJffF9StLY3RCIE:tpb22yZBo/w8utTjXkZZbSZY3RC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741173380, "uuid": "fb59e723-086a-48e3-9662-c4f7fe923727", "value": 53032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741173380, "uuid": "b218b4c0-91e1-4b27-b79c-cdd1173f6e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173380, "uuid": "7ac4a92f-ad42-4bd5-ac37-2600662eb122", "value": "cbr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d69d8f7-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741156297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156297, "uuid": "8e47ca26-df6f-4ee2-9952-9969c75ad0ba", "comment": "Malware payload (Mirai)", "value": "51fc42e7befe27d7597fc818721ec663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156297, "uuid": "a357bda3-b75f-4ce3-8fdd-34f19d8c2bdf", "comment": "Malware payload (Mirai)", "value": "0cb38cd1037eb79a40cb1d72f8250a00f0fb147a043790f2487df8848b2aa43f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156297, "uuid": "d1673be3-e609-4841-8d01-fe7aae21575c", "comment": "Malware payload (Mirai)", "value": "c2dd2e39d5d15eb4695b267151ad5451d62eb003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156297, "uuid": "15974799-d8b3-406f-af66-b1d2fcd36c70", "comment": "Malware payload (Mirai)", "value": "2205de28542f01dc9bc7ccaad57be25c2ae5715f3e90a63b39e9caa835a2252077341fd4ed921e96ab7fd07fe5f44d88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156297, "uuid": "0f67979d-7a64-4aa5-a8bd-5cfdc3a3eceb", "value": "T127638E72D41A6D58D1850570A8348F311F23F2C982A36FF72AE582B5844BEBCF909FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156297, "uuid": "2687dce2-5d37-4b52-ab47-5aa8bcc39949", "value": "1536:watr+Vv2K80Dmj5tX4LFWKZp0MoxZMdCepNe7410w:wfv2KojjXCFpZKZMdRe4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156297, "uuid": "05649a0f-6f66-42e1-86bb-cf2f83dadfca", "value": 68156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156297, "uuid": "16c140bd-9069-4492-bcab-7e081ba3c668", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156297, "uuid": "87f66e24-b7b5-4434-b0b9-82979d459d58", "value": "donk.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3e3a12-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166816, "uuid": "45a1ca25-5f2b-491e-b798-9c806e2fa791", "comment": "Malware payload", "value": "53eb5b4f6f3cc16fd5763350cbda9e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166816, "uuid": "b46a512c-b8d0-424d-86bc-1f959ac9910e", "comment": "Malware payload", "value": "0d9d9319c7e198dc7e5ad16fcb32e0208e9ae9c597d6ef55529fd1e70f2fd92c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166816, "uuid": "b1406818-75fd-4730-b135-ce53260cd935", "comment": "Malware payload", "value": "da73b1ed9b03e3e04f44b83c8e0432ad9e259cce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166816, "uuid": "9932a366-88f4-4449-a62b-76c341420f43", "comment": "Malware payload", "value": "e95827ad0634797912e51eb636eff13478caeb89fd5678ea1977104d6ce89b42fce4e620419d303325a23e0887d9ed45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166816, "uuid": "d4edfc77-94a6-4cbc-8687-b97ff0d6ca9a", "value": "T1C4662947E89150E8C0EEE174CA669223BA703C89473077D72B60F7F42B76BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166816, "uuid": "97e7bc66-49b4-49fb-9a75-077abf3f200e", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXE:glRJXp8L/KyZcCb7pEew+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166816, "uuid": "d126bbe1-1acf-4520-9ea8-5a2b0c46eab7", "value": 7050256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166816, "uuid": "43bc1361-b1d0-4240-91b0-0166db5bb51e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166816, "uuid": "de22cc6d-dfba-4a57-9f34-80f8fff34dbb", "value": "0d9d9319c7e198dc7e5ad16fcb32e0208e9ae9c597d6ef55529fd1e70f2fd92c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a3c8ac-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199804, "uuid": "edc138ef-aae2-4081-815c-40f1fbeddd36", "comment": "Malware payload", "value": "5c7dba2de6231934d3d67acf6413dc67", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199804, "uuid": "2980683d-fb9b-4dab-b36a-bc90dfd277d0", "comment": "Malware payload", "value": "0f9e55072021b23d59c5ca2d34cb49630167333ee5320cf9ed1fb9001a8686ed", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199804, "uuid": "29135fef-1101-4873-b0cd-6ba5fc504469", "comment": "Malware payload", "value": "be749cb7093f863992fce055913d579e693b1b52", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199804, "uuid": "cb9d6939-a116-449a-989f-ddd5e3758987", "comment": "Malware payload", "value": "23255869329b8c505785b7c8819b722ce5990729aed40c8355db922600f669921adba0676950fc9cd44affe8edccf199", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199804, "uuid": "22343f3b-cc2c-4fc5-90b9-bc681ffcb99a", "value": "T1B8D533B4EBD66080FDC867749FFE0BCFA2C4431D4E484B275A39909DEF292516DB2264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199804, "uuid": "72175a76-e14e-4301-8eca-7deeb5b8ee2d", "value": "49152:KWeAC8ZTj7TxHLEsfQVYUcc0bRWZD9uDjApyndSlhNsIM7vOS2/e:YAC8ZTj7T1EsfcYe0bRWZD9unApyndSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199804, "uuid": "7c349890-59e3-4f83-9d79-a8142f5b8439", "value": 2843211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199804, "uuid": "cc768025-ca14-487b-8f2f-85bc7bc398f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199804, "uuid": "48c7dd6e-709f-43b6-830c-9154b5a7468b", "value": "005200CITA_346849175676.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc778bb0-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181796, "uuid": "a5c6a8f2-0201-4a8c-bcbb-92faf76d91e3", "comment": "Malware payload (Mirai)", "value": "6988e7cea896df8758fe920e241705e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181796, "uuid": "a321be59-66af-4055-9217-cf837790c75a", "comment": "Malware payload (Mirai)", "value": "10c374f1cc7fe4c5e3b158c55ab2d9249967a2a502e1e7b322967d71cc748971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181796, "uuid": "6f5548bb-ca5b-4ff3-97c3-80e8fd066697", "comment": "Malware payload (Mirai)", "value": "1df0dd83b1693af82fdba9d73b23206db5ab998d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181796, "uuid": "a1ae774e-f588-4316-b67c-581e6127131c", "comment": "Malware payload (Mirai)", "value": "86047ca7cba995f24718cb0bd2c1a7e05deeda0a90ba4d4b5e3f9e1d7ca01a6cc4f1732daf16e2eb416d12c819c8a36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181796, "uuid": "914c8e30-2bc6-4f67-9a95-e9b3a1e1ba7b", "value": "T14103F13A1A3E74AFD090E874A8C813A00D621FB3BD53AD5FB967D5EB8D00479B821E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181796, "uuid": "b128d56c-107d-4ee8-9a8f-b9814820f4be", "value": "768:mD/TwbAq802Yvd79T+sY3q9XI4Ft0Tj25doj/5JgGlzDpUYsj:mD/s1802Yvdx5ayoj/rVqYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181796, "uuid": "8d26108e-c885-4cd8-b9ab-a90f74da442c", "value": 39924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181796, "uuid": "879332fc-852a-4a3a-a2b4-061c4293c3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181796, "uuid": "17cd5dbd-c074-4c70-a286-50285f954b62", "value": "5r3fqt67ew531has4231.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e24e65-f9c8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741182616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182616, "uuid": "e4fe49f7-23e1-48fb-a33a-f7d69fe95d4d", "comment": "Malware payload", "value": "263cd4a2436b9b1a1fed4ea1a4e37ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182616, "uuid": "44bd2329-27b1-44f5-a43e-fb055e6946de", "comment": "Malware payload", "value": "118f50ae13d9eaf1b865d700c1977df6184b8976e421cb002a14bbd12fa9b69d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182616, "uuid": "d56faa3a-6ad2-4b0f-b073-a215494d0025", "comment": "Malware payload", "value": "9d7be910c4089f0b3b771619e5b5081946db737f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182616, "uuid": "eefbcbf2-c83f-479e-8309-f932a8815776", "comment": "Malware payload", "value": "a995fba6e90eb5cd3b042180a69e8f34857a18694610d594435c4c45770b8e2db460e1875ec2385683210fe030e0d007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182616, "uuid": "766b9801-dc93-4800-8415-7ae59c7abe22", "value": "T1ACE2298273A305CCF53B91B485F6351AE5713C65167ACFCF0382895B1F36A80AE1676E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182616, "uuid": "5ea093b0-31dd-4363-882e-dbe47080444e", "value": "0d90f0a220fe667a4f08a904d51c45d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182616, "uuid": "0f1ef86c-7caf-4a9f-83e6-d49b02d55f92", "value": "768:bnnVEe3IHCG+RjXtVn5I9i7G5HN3V+w9m5/jBw7CJg3Kt:bVLejE3Ii74N3B9mBjHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182616, "uuid": "21d732b7-d3d9-4a99-bc0d-99a4ad2f88b3", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182616, "uuid": "0fcba759-2133-4ddb-adb6-67475be90ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182616, "uuid": "363234d1-5949-414a-ac26-9ee797f5abcb", "value": "Chlorates.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe06001-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741158287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158287, "uuid": "297d6900-65a8-4205-842e-5b53887a41c1", "comment": "Malware payload (LummaStealer)", "value": "e82c4c3f7a2994eeecc1f81a5e4a4180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158287, "uuid": "4a2c598d-1acd-406a-9e40-ab70b7412cf3", "comment": "Malware payload (LummaStealer)", "value": "11eec5d71c7fadae9d7176448d8fff3de44ec8d3b4df86f0eca59e06adf202d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158287, "uuid": "bd70733e-b70b-405a-aebe-ca933de56c6a", "comment": "Malware payload (LummaStealer)", "value": "660820f778073332dcd5ec446d2fcf00de887abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158287, "uuid": "b9fc2bf9-c58f-4837-a0fd-c6ef4794cd7d", "comment": "Malware payload (LummaStealer)", "value": "e616aab6fcde862d89b36a6150cadc6d27ebc3b51921fbe7881efd4ab0d7992d45cac08d22e110d469b63a3a8a873742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158287, "uuid": "70268330-2911-46e1-9e09-13bd8e4a04f7", "value": "T1A58661A09427A046F9D2387C9B503ACAF52929F62D534930750E7F2CFC98918E7F9F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158287, "uuid": "2db12d7c-690f-4311-b6bc-3986b084cc3b", "value": "b3fa2489ecefe39098b5f9ed4b8177eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158287, "uuid": "a8398b00-50a5-4a83-a56e-80f401b96314", "value": "98304:cLOsFGmdzUZB0Dg62kDXGIl2i+dlD64lQZ+gSBPfmAWY5/x9mgX2k1Tfltl/fTy5:oS1WmX6dLuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158287, "uuid": "d28e68ed-db8d-410a-9be3-fcfe40727eac", "value": 7979952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158287, "uuid": "60c74451-d705-44a7-aea8-2b2bfd252ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158287, "uuid": "35195f59-5e01-4df1-9871-aa9cfc842264", "value": "e82c4c3f7a2994eeecc1f81a5e4a4180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6295d78-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159908, "uuid": "bebdd719-5adf-44c8-bf80-2ddf9eabaaae", "comment": "Malware payload (Mirai)", "value": "5c8d87a8876dc79c993436b6863d687d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159908, "uuid": "14735729-ac25-4689-b0c0-47a43dbec1e5", "comment": "Malware payload (Mirai)", "value": "11fc7ab0cfc69108ce6caeccabba24a0ff81481457c557eff4778fd2e6198c4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159908, "uuid": "65e03bdc-4777-455b-a885-a67e163ac93e", "comment": "Malware payload (Mirai)", "value": "61ef474740f8923a8e7e113975864261568086c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159908, "uuid": "29ba3d8f-b36f-4c79-9680-1ac383a7d1c7", "comment": "Malware payload (Mirai)", "value": "50ce8b4470dd6eb9ac1efd8f139915a401e76a301407607b5d341ba2d595af072ecee8f00e7488b0f5b8c66416ce8fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159908, "uuid": "61344a7f-1eac-4733-ba15-feb423618319", "value": "T1B6C31B45F8404B23C6C612BBFB5E428D3B2A17E8D3EE720399255F61378686B0E37946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159908, "uuid": "bc996170-bf12-4b68-9465-ef9da66a2390", "value": "1536:p3Ka0rG5yC/cMDhygtsOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQQ:5Kaprhh7iOXWFh4UXcYFkWpZlvWNmK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159908, "uuid": "74016dff-6e0c-4e01-b9dc-3e398ecf8bda", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159908, "uuid": "0f9e0643-58ef-4c3f-bdaa-ce51ec58d666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159908, "uuid": "7951d518-aa63-46ea-9d3f-86f8db2509c3", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d805579-f9f3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741200991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200991, "uuid": "bd2fda63-f57f-43b0-b36f-84ac52d264de", "comment": "Malware payload (Mirai)", "value": "612dba382b19b5cc5ddc4ccfbb90cfb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200991, "uuid": "e2d99d33-f56c-49f3-931f-113f4deb49e8", "comment": "Malware payload (Mirai)", "value": "123822676c0205f91b8a960bde12a737f93261980c8b1131a7017899907fc269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200991, "uuid": "75fa51f5-4d19-4977-9f1a-a571afe61d8d", "comment": "Malware payload (Mirai)", "value": "88f99f428fe8e4b2b3eb00c44b14feb3f1fc9242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200991, "uuid": "cbd5cccd-0575-4ca7-8a1a-5453095629bd", "comment": "Malware payload (Mirai)", "value": "a6816e4a5bf2027ded95a94aee06d5f64c73b7fa96344d56ca91fa12db4c6104bab49250c7c92d45eed9c43f1bff6723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200991, "uuid": "8cbff97d-09e8-43a9-abf2-3f7383fc2854", "value": "T11BF33D56F6418B13C0D61779B6DF42453322ABA4E3DB73069924AFF43F867AE0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200991, "uuid": "5d5df865-134f-4c90-aecc-e2cf3b730496", "value": "3072:5VA0TrpnQ6nuMaIaHKk+dIcVsbLGT+h4xjSs/dM/9Sh/mswMVQR:3A0TrpQNpIaHKk+dIQsSWcjSsFM/9e/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741200991, "uuid": "ee645312-070a-49d9-8e30-28b3ec44d739", "value": 159943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741200991, "uuid": "481673c2-0ba5-47ca-8c5b-6e60e9d30651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200991, "uuid": "c9c4f98c-f4c7-4a53-910c-928dc2b955b2", "value": "donk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978a7dca-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162353, "uuid": "6d26785d-049f-4c37-a8c0-54f3ff6ed1fa", "comment": "Malware payload (LummaStealer)", "value": "c83ea72877981be2d651f27b0b56efec", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162353, "uuid": "6ff65d88-5249-4173-80f5-fd7818578b60", "comment": "Malware payload (LummaStealer)", "value": "13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162353, "uuid": "ce61963a-0885-40f7-b0c0-b193fbd5eced", "comment": "Malware payload (LummaStealer)", "value": "8d79c3cd3d04165b5cd5c43d6f628359940709a7", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162353, "uuid": "200be935-4a74-4511-a3f4-a6e281644458", "comment": "Malware payload (LummaStealer)", "value": "b8b6031b41e70ace3018f89048ebff894b7dcdc340f0a46a4a1f8ad3daad5bcb846a23e62fa62b2c17667c54c03d2bd2", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162353, "uuid": "cb8aa752-6073-49b7-96e4-9e4c3c6972b8", "value": "T138A4F18672C84B11C46A1A78C0F7592913F6EA83BAB2E7493E8C81C91E877D5CD4D7CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162353, "uuid": "cac9e16f-6f58-4711-89a7-9a6a0109b633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162353, "uuid": "e1c7c951-97ba-4fd5-882a-24dd503a3ae5", "value": "6144:bncN0em3Zxf6ziPJK2EUC/elB/xvpzwxvapH4Wguea8VAi52597eN++8cPtmD:i0df6+PBtlBxqdaN4Wgq8VHu7eYfcPtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162353, "uuid": "b8870106-ff11-42e4-bc8e-1d2f5650f081", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162353, "uuid": "8e83c346-55ba-4a6d-8585-82fd668d3d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162353, "uuid": "d8a72c49-1d20-43dc-a120-04670b65ca39", "value": "random(6).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99374c21-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160209, "uuid": "7adc7031-812a-4a75-a602-f736148abe98", "comment": "Malware payload (Gafgyt)", "value": "5744b126aaaf936d6abd0c926cb3607f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160209, "uuid": "a5bc0511-66ef-4961-97bb-812d257f7954", "comment": "Malware payload (Gafgyt)", "value": "1379f22b0325522df4e2e52e011f107e3cbb65c82c9d3b39b1468856ce1d9a39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160209, "uuid": "7574d552-033c-4b94-bbb9-f92fa10e05b2", "comment": "Malware payload (Gafgyt)", "value": "15550b091c7e1860d00c93f6d687f1bc0c5bd0e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160209, "uuid": "cca88714-f64f-4b55-aede-c228c9d2d2b6", "comment": "Malware payload (Gafgyt)", "value": "e8ae8bf35f392b9e22a6564bf3e46d6c0ff545e8a6924bc11df6a672f2fcc03cc3827df2cc449db6400312e2b76d58da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160209, "uuid": "50c344dc-5818-4bde-ad5c-28baf2266438", "value": "T13DC33A01D9509B27C6D2277AF79F529E73332B68A7CB331156286BB42FC179D1E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160209, "uuid": "8a5124c2-9f69-46d1-ae35-6589f2d760f7", "value": "3072:nErC/jf7SNgxjQYKVZaSibNNt7QmeO07egEmO/my+QCj6i5fK:R+NVZaSibgO07e7my+QCjF5fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160209, "uuid": "4ade9534-3ac9-40aa-acce-6d60d4bbde2e", "value": 125882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160209, "uuid": "f1383140-074e-4b9f-b7fe-738cceff6f11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160209, "uuid": "f1937de3-4940-4819-a7b9-dfde84133f03", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f09b3c3-f9fe-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741205718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741205718, "uuid": "565a5989-9ae5-4158-bcee-bccfd1a6c311", "comment": "Malware payload (DCRat)", "value": "3b668985faeacbe0a75bed07c794d72f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741205718, "uuid": "79fa765d-f5b9-4798-8611-bfd00467154c", "comment": "Malware payload (DCRat)", "value": "145547261489beee525c72491f2bc2a323257f3a557e98fd38a135d05127736a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741205718, "uuid": "bc593db8-be95-4111-a8ef-bc84bd595e05", "comment": "Malware payload (DCRat)", "value": "a467c01825dfd47cfc65a8fb4fb45d7aceac890e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741205718, "uuid": "a8fdf983-f15b-4b0a-92fa-872f21a13632", "comment": "Malware payload (DCRat)", "value": "7a0fc13661448df6b4cf6c14089d605759a35975e50ab4d3b5a0ed4ba5f27bd6cbdac2b7925dc930665ee412e1b10623", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741205718, "uuid": "75da90e8-47fc-4bd0-9843-ff70ff3e74de", "value": "T10627F01A96924E7BC2A41771845B103D4295C3363966FF0F3A0F21E27817BB6CE761BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741205718, "uuid": "8c878c89-7c2f-4dc1-87ff-b9c22e28f73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741205718, "uuid": "e4ebdd49-8bae-4dad-b8bb-b9793bbd3af0", "value": "49152:YHrWFudbY00IsYv0NEq0zL94rckLccLj3ekETq2pGgG+sc4Ua9SWIVSJeEVWFn9:Yuy0Ib0eq03rcf3oGV+scNdUeEVY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741205718, "uuid": "da19ba74-096e-4739-b7c6-3aa61ba44b64", "value": 20581376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741205718, "uuid": "4793538f-b0df-4fa1-abb0-3709f428a3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741205718, "uuid": "1925997a-9aff-48dd-a40a-cdccdd5eca3e", "value": "3b668985faeacbe0a75bed07c794d72f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43bfdaa-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159476, "uuid": "bbd6d2cc-3ce5-43c6-95af-e9ef8ab7ca8c", "comment": "Malware payload", "value": "b3365b3ad2b09af90fe85ce8ce9abf22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159476, "uuid": "92ac93ba-3b8b-445b-88d2-d8f179578c7c", "comment": "Malware payload", "value": "149b738bcae964617e623fbe5129a795ef8decf1edec21a05805216b95d3faa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159476, "uuid": "317672be-35de-4b12-bae6-b89a3f90c34d", "comment": "Malware payload", "value": "5806dd7c48bc8b9b6ed79c32c0ac9192e280bd20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159476, "uuid": "9382d256-fdfd-4457-881d-f7538427e071", "comment": "Malware payload", "value": "9cd65add1bf3aca69f9e3c41b3aa87f3139df302288ce0fb5ca47348352ba78fc63ca95f1184c9d99533351333a17d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159476, "uuid": "a9cd8daa-9309-4071-a594-c83cb474659b", "value": "T17995E09E7368E72ED57D8AB2E061845F17F8D041B3D2FBBF9D42DEA01843741698806B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159476, "uuid": "6408ac79-ecd4-4a6e-8495-be5fee04bd42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159476, "uuid": "784dab34-4180-4958-8ed9-4c28af121606", "value": "49152:nfGdIVFDMFfsmeV3M4vtxV5UVkuM+o7Vt+BBb:u0ifspVcAtdUVPo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159476, "uuid": "aa61c6a9-f116-45e5-9ccd-cdce5dc3be3f", "value": 1997824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159476, "uuid": "30fd859c-4b98-4c8c-b40f-824d4b78921f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159476, "uuid": "4056ff13-8ac3-40b4-9c57-31bf952fe699", "value": "Tckfyjzm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f9c4ca-f9b0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741172172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172172, "uuid": "bdc44523-6305-464c-955b-273248b14257", "comment": "Malware payload (Mirai)", "value": "29a10ff1981cbb03f83aceb35d0aa00b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172172, "uuid": "30b3637e-9b60-4117-8f98-e8c48b1868c7", "comment": "Malware payload (Mirai)", "value": "14fc8d0e3ef6d620408ae694a396e1972363b91364784f3f1357478c4f0f66ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172172, "uuid": "d27ddcff-b109-4d2e-a62b-c0e5178f769c", "comment": "Malware payload (Mirai)", "value": "a4d4373dc3b4e3dfa4c675c5c67ef1fb3a1d73e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172172, "uuid": "c0e7e6fb-4afd-49d3-b61c-e15778b2a8ff", "comment": "Malware payload (Mirai)", "value": "8c4703894a3ad77dea9da4aed647221d8aa84f640038bc15f7467927c45c1aba88043eaaa62d3a9421be7a669e409e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172172, "uuid": "3d1d2a61-ac0e-498c-b968-84620e28e710", "value": "T14F14991E6E228F7DF668873447B78A25A75C33D627E1D684D1ACC2141E6038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172172, "uuid": "27f7a247-e83c-45e7-bab4-898dd8c5f121", "value": "6144:whQVKIoTOVP0LDmdYiNiqeO4c0qyxO3xN:A6WGYiIO5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741172172, "uuid": "0e79a66d-72db-4ce5-aa8b-66091bff7f08", "value": 198032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741172172, "uuid": "0b57a9eb-7cc2-4819-91a2-fec4dfcfd016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172172, "uuid": "691c09ce-8841-460f-a3d1-83e36c88b5ae", "value": "jfeeps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28a9238-f98c-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741156896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156896, "uuid": "ad93735f-a44f-44f3-94fb-cddbb3542085", "comment": "Malware payload (Mirai)", "value": "cd5b40b5bada10c59de926f7e0a7afa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156896, "uuid": "4ddf5f8f-b7f1-42e7-b4da-b5c08628ff78", "comment": "Malware payload (Mirai)", "value": "167430ffb5a388d59cf2dcddaa471c6990f3050716df18730a6df7051e7098bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156896, "uuid": "159e3030-2810-4018-b76f-2c9a0b9793ea", "comment": "Malware payload (Mirai)", "value": "12c7c506087fb1b9880926f5d5face41469b2569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156896, "uuid": "71e39ee5-05f6-4e30-9d85-6adc65176514", "comment": "Malware payload (Mirai)", "value": "4a4a44fce825f447d5fe92a5c98db0abefa3fdf80bbd999b05cbc7fa30586240dddf7939b96dadee3623300b0b0babca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156896, "uuid": "776cfe5e-4783-44bf-ad15-ec3a08d13209", "value": "T1C5130974381DF2E9E8A82334E4472EF62A9245983DEDE6D3B0564131F9F538CAD45E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156896, "uuid": "e525d879-1a6a-4723-b85c-13b1174e3c71", "value": "768:ATwwbCV9yeN42q7kjQp1vo3/PdH++DljzgYKJm1NnwRIDoEgRaQj+X5y1TRCoSZR:+JAyqP3/PdHMTmvwb0g+X5y1TRMs+jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156896, "uuid": "6a5d0033-17fb-4715-90eb-94d2c42a588f", "value": 42616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156896, "uuid": "69a5bf4b-6038-4fac-9be4-6fe5f0bd4245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156896, "uuid": "b42fd48e-4aa8-4787-a952-1b3e14c0c325", "value": "cbr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad38e637-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199756, "uuid": "de90bd6f-e3b2-4dee-931a-0c3b658923e5", "comment": "Malware payload", "value": "f4b4411e19cefb7a54ad4f02378f7100", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199756, "uuid": "3a2e6142-83a2-426f-8dd4-3d32e7b86603", "comment": "Malware payload", "value": "169d709fcfaa4521ca41cd1ba47584e5a815f251999d05e4842dc021925569fb", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199756, "uuid": "267ef807-1a26-4e97-9d67-d8b014dbb97e", "comment": "Malware payload", "value": "f14d139c0a61ec20be3366432472087c541e979c", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199756, "uuid": "7b4d37da-2b46-4fae-88e9-eed9d04dbed1", "comment": "Malware payload", "value": "7a1976d5fe34e15d62f5e4810e9109113599c6b7e7def1f0ba9e79f10296b6429967c9fbc96c1336349ce85b738dd312", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199756, "uuid": "e3148faf-0675-4c20-ab01-bbe3bbcde048", "value": "T1A9D533998F824314FAC877346FDE27CE2BE50BB156D08A335774FA989F29003E6AD445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199756, "uuid": "c182846e-4219-48b9-b3c1-1aa73ca165be", "value": "49152:sM357aZh8gjpjAdMmoWMe7zzVBgXWWmP2fnmuKbZEOcUBxafqDsRs/N2Q2/F:sUij5DW3UZNmuw04afJs/gx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199756, "uuid": "2561ec7f-4d1d-495b-90d4-c5eb57bdfa55", "value": 2900592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199756, "uuid": "e5e54eab-60c3-44cc-a66d-f305348d841c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199756, "uuid": "cec4a6e8-ef3a-4236-96c1-f9134b457497", "value": "549200CITA_120006381634.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b97d696-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741158414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158414, "uuid": "c7a581de-34e0-4dfd-97db-d7b002706e79", "comment": "Malware payload (Mirai)", "value": "ba07415c00c4b470cc8160cfb42710e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158414, "uuid": "d53d4581-2114-4b6f-ab1e-bd30ad91dc02", "comment": "Malware payload (Mirai)", "value": "16b87862384fa3ea046580ab0b0e983de96c090b1c308daf59b9b475c7a47b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158414, "uuid": "d029d96d-b14f-4f74-b08b-9b11bb54ce7e", "comment": "Malware payload (Mirai)", "value": "ea1c163450b0fd64d48acdc7202045089477f570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158414, "uuid": "82f39bca-87c5-4517-b169-05e6374a9a40", "comment": "Malware payload (Mirai)", "value": "7d3b63ea59dd413b87a4b502f0af24ade05b072e3ad59a1657d10b17d6820dcd51e2453adfcd2ac76dfcba062941cd96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158414, "uuid": "8e1e56ab-e78f-43a8-b1d3-23e84908f825", "value": "T118631B96B980AB24C6C2557BFE0F114E33138B6CE3DE73129D285B7077C796B0E2A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158414, "uuid": "0ea72702-2ece-441d-9b62-138c2fe20d57", "value": "1536:Q/nsrDYfNJSj9da0kQsMIiEro0WeWnn5qYIC:QNJ+daVro0WeWnnM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158414, "uuid": "39a71d65-bcbf-4442-9b45-7689a13d9a4d", "value": 68508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158414, "uuid": "309cc92d-da8a-4aab-af57-d2e922a1d60f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158414, "uuid": "fa368e06-ea7c-4482-8359-dc9bce8d1f38", "value": "cbr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdca25c-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160215, "uuid": "523adb63-c60a-40c8-b53a-82412651cef3", "comment": "Malware payload (Gafgyt)", "value": "5779b93c99baea628b628ce849ef6214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160215, "uuid": "2a1b60f5-57d1-4c7c-acea-c2a3ccac3b98", "comment": "Malware payload (Gafgyt)", "value": "1709b02971823ea8c5c5385764b96ef40f02fed09bde331cb7ff69463fc0a454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160215, "uuid": "67dd5175-ba26-4dde-a90f-7bd63f0278f1", "comment": "Malware payload (Gafgyt)", "value": "47c616dd2523a8dcda8fb451cfc224f9b3893daf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160215, "uuid": "6fb7e902-30c9-47aa-a9d1-fa70d9410a92", "comment": "Malware payload (Gafgyt)", "value": "7a1d356edfe2aba910b738e80f1210c59b194058aa93d1f05dfc094b11d9fd87b5be73eed52a790af9260dab4c5e3e9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160215, "uuid": "b1b752cc-d3cb-4416-b1bc-820ab643e098", "value": "T130A30801FC404B27C7D22BBBF79E828D77355A5867D733116A396EB02BC57982E39224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160215, "uuid": "b122ab08-8d24-483a-9c70-e1802ae52907", "value": "3072:c/1lxkoWAKnzOv1rsRyffIycy/kJ0s8uX/UWHQlyujA0dP:H/Ryn3cy/I/UWHQlyujA0dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160215, "uuid": "1cc4dbc1-986c-4a06-a49d-5f693ee7b9df", "value": 107054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160215, "uuid": "b361e1fa-5120-4e1e-a83f-4024e2bd05e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160215, "uuid": "5831daf0-733d-49bf-9369-fbf6c6701724", "value": "jew.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73046bb-f9ca-11ef-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741183559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183559, "uuid": "2741790b-c899-465e-b8d3-d297e74641c1", "comment": "Malware payload (GuLoader)", "value": "2ffafb07067e2f6155f36802e91068f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183559, "uuid": "1d5d1d3c-1f34-4b03-9fa6-d730b9527797", "comment": "Malware payload (GuLoader)", "value": "171899b7a9f3de492f097370a50d44724293a3a5bb9f878a01c648909cf0c11b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183559, "uuid": "0b527533-0482-4da2-813a-59ad4b8475ff", "comment": "Malware payload (GuLoader)", "value": "aca68ed000d064070fb5b8a51e2bb550a7757731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183559, "uuid": "8a10a182-062c-4b56-9719-0fd1cdd8c821", "comment": "Malware payload (GuLoader)", "value": "455500fa49f3bd69aab497edcf66f6a0476e6c3803b1ed66817d5633898fadf4ed6c875979a884fc9fc4d97468318658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183559, "uuid": "2f5801d5-61e9-4be1-90df-929e0693559c", "value": "T1FCD42306B6C5BC0FD9E251730B374669E233BC8940799B8B2B702C5A7E77369581F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183559, "uuid": "11837aee-5867-45cb-98bc-3bfcc30494c8", "value": "17b7d61bda0f7478e36d9ce3d4170680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183559, "uuid": "add34cb3-8b38-41d4-99da-59442e0bf8bd", "value": "12288:2iuvt+JEKXmmeOoDw1l7P3TOLAL4EZqTBldkO:iV+JEKXmmoDw1Z3TtsEETD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183559, "uuid": "f689e3ed-fa53-4ca2-ab24-a4cfd8a29a4a", "value": 646525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183559, "uuid": "5c2f79d8-1f0e-4f16-8039-dbe5526d3a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183559, "uuid": "8e45d351-52f0-4124-96ea-b1e0c01247b3", "value": "TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe0b582-fa0e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741212692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212692, "uuid": "2ebb2c82-4bae-47bc-b120-99225de11385", "comment": "Malware payload (Mirai)", "value": "1677d865348fa74443d0867d2fc9ccb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212692, "uuid": "8cf84923-bc01-4ddd-83bb-41c0f8b1af72", "comment": "Malware payload (Mirai)", "value": "173843337666b4817ac8df68ca48c25c7234fda8d27a61c23b22d99cc7f88b59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212692, "uuid": "fccac4a0-0c07-4898-9f20-27d779323cfd", "comment": "Malware payload (Mirai)", "value": "50a3f6dcbed54103ba23119b12f957fa05e0fb7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212692, "uuid": "28402ce2-a4d5-440e-8060-456e0e8f1a9b", "comment": "Malware payload (Mirai)", "value": "8467a4c461d2fe4dfc6faf9b26c74dd34e35d8c7006e5f6f2685e1c234505023eb96a401d6e438779132afb9d0e829e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212692, "uuid": "f22c753f-e3a4-4110-bb04-513c9f7fcc0a", "value": "T19CD35B63C8396F58C566E2B0F1718F782B93A65581470FBE5AA7C2B44047D9CF60A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212692, "uuid": "4a5d93cc-7828-4678-99c4-3e2d7848efc1", "value": "3072:IOJULRmojEjxVNcxPA+qN1Pz3WhvwNBY6dAbnm4:IOJUdYxVNch0XGhvDuAbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212692, "uuid": "278e9c32-3bfd-44bb-a1da-ef549af787a5", "value": 138116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212692, "uuid": "32fba688-8f7d-428f-a84c-22ccb480a2c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212692, "uuid": "2e5cdbe8-8331-46af-be3e-0bc64188ca8f", "value": "eehah4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c8b98e-f9e2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741193784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193784, "uuid": "9b8f062d-7ea1-4232-b780-e0814e5bb4ca", "comment": "Malware payload (Mirai)", "value": "75302aa257cf41d65952d60f288d0ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193784, "uuid": "9a2fdfe3-de23-4093-b3af-172c1158a94e", "comment": "Malware payload (Mirai)", "value": "178a1ab63f45a19f011f99504eb2a6bc07859a8488e9c8ed9095db0152fbaf2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193784, "uuid": "daee1f42-ddff-4c8c-8953-f119c1e156bb", "comment": "Malware payload (Mirai)", "value": "ef33887ab498d8067cde3254da15b86a22b15334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193784, "uuid": "634a254a-f5a1-42fd-837a-e0756ed30f9f", "comment": "Malware payload (Mirai)", "value": "aa928610fb4ddc59f7c23ed68a89898a2bbc097bf9613beea6b63fa3b94bb53b93158472283c6862d1306576a42d75ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193784, "uuid": "1e2447e6-dd17-4546-a27d-71d88f454ed8", "value": "T10B03E15C13469175CA3158FAAAE607841FB20FF6C02FCC02E4A8C16652731FCB4ADADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193784, "uuid": "22402333-466a-463e-80fb-9e8261091361", "value": "768:uEdmHMWo1ERuWlyynQ9CqxABeBd3Up1tvLkskfiMh3JH+yJj+JgGlzDpUYsk:usmHM/+ltnqABeBiRosGiMhAypqVqY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193784, "uuid": "4a35d937-6736-4fb0-a2e2-bd81c38a3685", "value": 39864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193784, "uuid": "cfdf3a20-dcc4-426f-a373-bd4d87dcfb2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193784, "uuid": "d9ab49f0-85c3-45db-a416-2f6a942477a8", "value": "5r3fqt67ew531has4231.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982d625c-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159348, "uuid": "3b63cbe8-e110-474f-b254-3dd50117c761", "comment": "Malware payload", "value": "fe9774651d3067a54cee9b53bc68b6ed", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159348, "uuid": "2271daab-0f90-42f7-b898-4a392683125a", "comment": "Malware payload", "value": "17e4445ed19c35c715f094a3f05833607dc704a754385f84e5be50c25a67fa5b", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159348, "uuid": "1f0fc9c8-9350-47b6-84de-682ed8945539", "comment": "Malware payload", "value": "c5c30f51ee9822e1569c6ef2f221068f145c48a5", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159348, "uuid": "2699b5ff-98ec-413c-a16c-80916b880a9a", "comment": "Malware payload", "value": "f04e380b859d385dee5e232bef934586488e4e2371977e3cfb75c90b7b20e885896b805a54668e0c1fa3c039d44add5f", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159348, "uuid": "896ab6f7-0c91-4fbe-b46e-2f8f92724fa8", "value": "T13B4523D9AC94BF03DF09813A478AD45E484BBE4F2759900B3372B71E1172BEE447786A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159348, "uuid": "7cd8d92a-3421-44a2-8bbd-d7f2fe7f71ae", "value": "24576:oJJIwgJeFJJMso3FxESfr+X0JJneXXFA8kbGMij:oJzgJWJuso1xPcG8Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159348, "uuid": "169331e4-0f09-4069-b526-32f229c3e3d8", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159348, "uuid": "38fce184-4096-4442-ae09-93c852ee2708", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159348, "uuid": "01648c46-239a-44ea-90f6-e9e874009490", "value": "transferencia HSBC.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1d9720-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162361, "uuid": "d447f602-ada4-4a1e-bb11-3e1ba027eac2", "comment": "Malware payload (LummaStealer)", "value": "9402d6d7437788f412e114edbdfdb86c", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162361, "uuid": "394693cb-802f-4377-b9ec-eeda47bf5657", "comment": "Malware payload (LummaStealer)", "value": "182830d293735597ff553763a216968eb93f992b5177f42f85010714198bd50e", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162361, "uuid": "c2ad76e7-90ae-4eeb-a768-4cda720dd60a", "comment": "Malware payload (LummaStealer)", "value": "8ff9f6c1e08cb1670941221b81da008a532bd88d", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162361, "uuid": "67acddef-c57f-4775-b694-26d80c270a30", "comment": "Malware payload (LummaStealer)", "value": "842e0da515ff0aa9ef598bb8481a0f80a8b3e98b4f0d28174ef1cd5496893e174bec6f379da0bd30b202080c91895910", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162361, "uuid": "310659da-c173-4d9f-8463-976ceb13ce4e", "value": "T11DE55B52A864B2CFD69E97B8D027CEC2695D43B907604CC79C69B67EBC62CC015BDC38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162361, "uuid": "fbb35d5b-59ae-43e6-9716-d415d0198352", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162361, "uuid": "d7b66b64-ebf5-4bc2-93a4-05525ec5ea28", "value": "49152:Dy2dVmrAA4CmoODFmCo/ydutFODO2GwMLUFn:D8kA4CmoO5Po/yduBw4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162361, "uuid": "e469aa36-756a-4a02-83ca-3a7485b59652", "value": 3132416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162361, "uuid": "47e0b91f-1bc1-433a-a2bc-5a3b6375a168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162361, "uuid": "bb8de0e1-f4bb-48de-823e-3228bbb9a7a0", "value": "random(7).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a899cd8c-f9f5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741201896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201896, "uuid": "132e3d85-b394-4f4e-9aa0-a5ba7b03d0a0", "comment": "Malware payload (Mirai)", "value": "726b7fee1f804252231423063418e41b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201896, "uuid": "5992f88b-669f-4201-82b1-87d5ebe595eb", "comment": "Malware payload (Mirai)", "value": "186dccd366a86066672dc73fa54f2f7104e391326caa059eac24a9781924b308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201896, "uuid": "e957dd7e-5305-48ee-a01f-3e350f99b782", "comment": "Malware payload (Mirai)", "value": "260e4e63348727e921e4279b5795c7b0b3aa1ad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201896, "uuid": "5a215d2b-5de9-4970-a931-c94719cfe71c", "comment": "Malware payload (Mirai)", "value": "5912486b2005b93ee9cead06e522ffe0ef4468f80c3dd0421903ff19c49d41d5f3595dc695aec307e3f2258dc3a27c34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201896, "uuid": "07fc0d29-b7db-440c-9a65-c1369c82a990", "value": "T1F2831A56F8815B21D5D5027AF92E018D332327F8E3DEB213AE205F61778A96B0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201896, "uuid": "c893a53d-77ce-47a0-859f-d9458e045528", "value": "1536:2onGmaqwTeNs3DnnKlzR52hDBAaiCDMwQmM4iDY84cak06Z5FYM7410t:yqmeNszn8zRuAadcYbcak06ZH14Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741201896, "uuid": "6367d0d8-e386-4e1d-8f35-3eff11d93c7a", "value": 88640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741201896, "uuid": "2b91296b-a041-45f1-bb52-0774e6b566ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201896, "uuid": "8d4faee6-7477-4b06-8990-452a7da40c05", "value": "donk.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d78dd3-f9c9-11ef-ad17-42010a9c0004", "comment": "Malware payload (PureLogStealer)", "timestamp": 1741183012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183012, "uuid": "6b86617f-ef6d-40ff-82ec-ad50e4cfd63d", "comment": "Malware payload (PureLogStealer)", "value": "c1ddca06fa84ba904c18912f9a38c983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183012, "uuid": "0822b049-9bcb-4b1c-8ef1-f1c50888aab9", "comment": "Malware payload (PureLogStealer)", "value": "186f2e8050a7770d1e334a75570701dd24d3f69a917d9291642a62045ad9a8b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183012, "uuid": "31018ebc-9a13-4f7d-9319-9f8aa58e75f0", "comment": "Malware payload (PureLogStealer)", "value": "f51776140e2afdc26b61afdb98917bfe74b43099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183012, "uuid": "1b5dc9f4-6a26-4581-8a2b-f745a19fc013", "comment": "Malware payload (PureLogStealer)", "value": "d1aeffe31b40b5ab6be8b7915afce8b20e0b6bb2abb8160909c89880af110baeaf6502005eaf5b2a89f4590579ff272f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183012, "uuid": "fa2c3b26-5a5c-47cb-a66c-2d6e44837413", "value": "T166048317B6DB8DB1C2746F76C4AB050007B4F989E663C71E3D8ED35A09437AB989138B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183012, "uuid": "b66b6b19-6dfc-4c91-9b51-d4e7138a87b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183012, "uuid": "cbe1c658-5e37-4c0b-9bfb-a13daf5684be", "value": "3072:GXqXjRvSXaqiX4MW3SpG4PfNBdpQW/7GWavXJ3CpI:igWipGifbdRrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183012, "uuid": "5526aee6-ebe2-4cc3-b7cd-f31ba0954ec1", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183012, "uuid": "d755a791-cf89-4351-bc6d-85954c5390e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183012, "uuid": "52c4667b-734d-47b6-9dda-baae4b91256e", "value": "Zam\u00f3wienie PK PR-560 PRECIZO.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec597bb1-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199862, "uuid": "ff6d7893-831c-42ac-8bea-a0ff7c7b6b30", "comment": "Malware payload", "value": "fa51104b0795aafcf41bb145936cd115", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199862, "uuid": "c928f460-40c6-4a29-950f-34a8ef50d549", "comment": "Malware payload", "value": "18b607f3eea80480112d251bb4357f5208778c2bf23db431fc21111eaa7e952a", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199862, "uuid": "8c32f186-705a-4679-9a19-4af315f0826a", "comment": "Malware payload", "value": "fdb1c97c3755360a54c871acaa04d29a89e245bb", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199862, "uuid": "ed4b76ec-9df9-4a63-a677-f1bea3ef74c7", "comment": "Malware payload", "value": "1e4014c92d4364d6f7838281db8ac54c2444b77cb0a4a961f6682934b741d31f558aad8bf07cf69cff92db42066bfb50", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199862, "uuid": "05661db3-3b3c-471a-824d-c39174e7bb5a", "value": "T1F5D5338B3FDE8241ED549B396BD94BCDF2F016AA0A10DD2B4718F0B47F2B1426B78495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199862, "uuid": "2a752a73-2236-43cb-b381-6213808789a8", "value": "49152:z1UW9QoIuuTkuzK9oGionUQMM5IQwvet3LGNP6NEBMwvpU2C9Upt+PV9GKDGgAEQ:KWhuh29oGrnU1IIQwvzlJpUBipCbGwR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199862, "uuid": "1d95b3b6-422b-4b97-b354-b06416df6924", "value": 2747138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199862, "uuid": "dd23058c-16c9-4a71-9db9-5c9a060629c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199862, "uuid": "230d4b41-8ad4-4859-b474-98709e3f2654", "value": "441500CITA_740032214688.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f394b8-f9ef-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741199199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199199, "uuid": "e6e0c0f5-0c66-4921-a62d-a4500a396e9a", "comment": "Malware payload (Gafgyt)", "value": "a70f4bc15c5b399de5c3f066f7185973", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199199, "uuid": "530b59f0-86bc-430d-be15-bfb162128c84", "comment": "Malware payload (Gafgyt)", "value": "1909a407766d028d3c093472b44aa98c9e61892d552a28cd5a4fccbc3b08f1a5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199199, "uuid": "c3208fb6-d40d-453a-a11c-0207b5f1ecb5", "comment": "Malware payload (Gafgyt)", "value": "b901c9043ee387c820e412cf757e76a5d8ef019c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199199, "uuid": "bff040e6-8a21-48f7-84aa-d980b7e8a82a", "comment": "Malware payload (Gafgyt)", "value": "cb9484ba472f8fd2a13c388fb3e5916c95c23098114591f07b15c4af90094cd268fd5722b7e586a1a3391ab6997cc523", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199199, "uuid": "a2db5406-2076-4468-ac69-cfd07f9d928f", "value": "T12F3144DA21E10E746C95E93732AA490436D5E9C794CF1F19ACEC3CFA908CE447450B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199199, "uuid": "6f7f2293-7f39-4b3d-9811-6f72abeadf35", "value": "12:q0FcV0Fm0FNIc43fX0FfeekX0Fm0FmX0FTe0FUfX0FTi0FIl0FpyaM0FcWK0FQ59:vc+TWc4kfasTmsTbOsT3IO8aFcKQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199199, "uuid": "4c439017-b110-4ba1-9af0-c18d33573290", "value": 1587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199199, "uuid": "613e2fe4-5c38-4d66-a1ef-c16d0297905e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199199, "uuid": "5b9965c7-26f8-455e-8e86-bd5b698db298", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b49bfdb-fa16-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741215859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215859, "uuid": "8a665f79-9e81-4a9e-8250-1a23e7bbe6ff", "comment": "Malware payload", "value": "26db1208fa0a593048b09ce83208fc2f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215859, "uuid": "b118e045-1b50-4e7e-a3af-1643a459825f", "comment": "Malware payload", "value": "1a4d7b488a91e25548e5511035c8550d53d3571b9f6e38c5d7b2ff2e558e2a60", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215859, "uuid": "514bc9b7-fe07-4820-ab32-9d2f189e6e57", "comment": "Malware payload", "value": "776bf9cc70ca6084283480e60adf0f3511bad2c8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215859, "uuid": "fcd70e18-468b-4bc4-a1dd-95afb50c727e", "comment": "Malware payload", "value": "d954f22c09c648bbca119c4b6eb5c7c8911576dce2142f0279274d29b5204f8a19a32f322fb12f0e8a666a0f3adf2561", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741215859, "uuid": "7c2910bb-6db9-44fd-9b89-478b7697978c", "value": "T1C90633513764C233D69A293794BA8B263A27FD711B30D0CB33917A6C1A34AC1EE75793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741215859, "uuid": "7ad50ee4-f9f0-4de3-b42d-7524500969b2", "value": "98304:FpTD2r6gNfIMhcj52wOqC9JYOqvXq/PUr9Z37zz:T2r6gdIMOjFOn9JYOC6XUZL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741215859, "uuid": "2b91921a-9870-4244-9bce-7502fbd0b52b", "value": 4014080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741215859, "uuid": "2e3ee332-85fc-48ef-a877-0acc25fec095", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741215859, "uuid": "a07f3f5f-096c-4eb9-bd51-2b207b4a5053", "value": "1setup2847_sys_work.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fce9c0a-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741176380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176380, "uuid": "8ab4d347-8e84-4d1d-807b-c017aaffb958", "comment": "Malware payload (Mirai)", "value": "2daef788961be6e5a478109430408cf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176380, "uuid": "6dc4fe49-1d56-4a88-a063-c2333c4d0bbb", "comment": "Malware payload (Mirai)", "value": "1a5bbace67c2d0a151218119fd93f2b571b794115f747904132884e36a2a7d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176380, "uuid": "33f8cc6b-5fad-4905-b578-382c4593620d", "comment": "Malware payload (Mirai)", "value": "f8558f3344ab71e33871d016b8be6a7cf3cb0973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176380, "uuid": "72739f43-d2d1-485f-b5b9-e3aa25266641", "comment": "Malware payload (Mirai)", "value": "b7cc2408168b3c0c92d54be05a04b74d8deac3281427f3a9882c2e86a35a4baa01f2c0bd4b8761058ba1bfce703225ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176380, "uuid": "6994fad3-ba1d-4088-85ea-d3dd32f695bd", "value": "T129F33A0BB5C0C8FDC4DAC1B44BAEB53AD971F55D1138B26B27C4EA226E5DE204F2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176380, "uuid": "1d3f2bc7-d3c9-494e-8e2f-b046b7ac9e5d", "value": "3072:jGRGhBtHKf2EnAhyMqzyhxxbc+DAFpWYIUQp2hWyWwduAL1l:jGRGh7HKf2EnAhBljyxQts8Q1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176380, "uuid": "eb784a7e-3cbd-44bc-bfb5-0342069dce11", "value": 160168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176380, "uuid": "891ec82b-50a0-4661-a245-b23c8f1a66b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176380, "uuid": "41acfbfa-f4f5-4302-abb2-dda728227fdd", "value": "weje64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e69c0ab-f9a7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741168217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741168217, "uuid": "4368489f-148a-4bb0-9a01-c12f10590c13", "comment": "Malware payload (Formbook)", "value": "ce901f91244366477cd0b769d92f9034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741168217, "uuid": "a1fd9d8b-8ad6-4196-8756-7a4189f5ba2d", "comment": "Malware payload (Formbook)", "value": "1b72e6203b4d26cbe44b55e7df27b3477badd3270cf900bb13c2af47bed80516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741168217, "uuid": "e9cf84db-2d17-40ce-9c7d-d3e4db2395b6", "comment": "Malware payload (Formbook)", "value": "6f49860e768725f78bf3855d18efe329b3553355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741168217, "uuid": "825e3994-3654-47d2-8ce7-196d8ea5c402", "comment": "Malware payload (Formbook)", "value": "145c54f801479aaa633629c9bfbed04de629e4898cccbb31b8ded605d03fd4d24d29e9b363a935f15a7b9536cc7912f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741168217, "uuid": "7cb8ce32-b5bc-4c89-a87a-fc40ac48f999", "value": "T1E8047517B6BA85B1F2E46B77C8AB050047B4F581E66BC71F7D8A135A0D437AA98C130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741168217, "uuid": "bb99484f-82d7-4f50-a9fe-025c9762a2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741168217, "uuid": "b5894642-a53d-4421-a6cf-d9006ca88385", "value": "3072:5rsawEN2scoJ7FWN3WfHC5kan0r0i4tyAyptWKye6vx2PvLn3:5H7FLf4kan0rBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741168217, "uuid": "36c943c0-34d7-449d-928e-6399b49df2aa", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741168217, "uuid": "076deb97-7a0a-44a1-a369-78454a445a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741168217, "uuid": "5a029b40-7149-4782-8016-66a07893250a", "value": "pictures and specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af10a030-f997-11ef-ad17-42010a9c0004", "comment": "Malware payload (DarkTortilla)", "timestamp": 1741161534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161534, "uuid": "a88007ef-4a8d-46cf-9cb3-0e56fd0e214d", "comment": "Malware payload (DarkTortilla)", "value": "ceb366557439e56de3a4c8b732eb62bf", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161534, "uuid": "191750f3-1213-4373-a1db-eefc409b8c16", "comment": "Malware payload (DarkTortilla)", "value": "1b8c4746c352392583850da7a0665013e4b5af33dad7143dab54bdef962342f7", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161534, "uuid": "f3b52d6e-4110-42d7-9efa-2067068e4c6b", "comment": "Malware payload (DarkTortilla)", "value": "5781fc6bb858bd07807fee022b87f79700c068f5", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161534, "uuid": "274104af-9537-4f5c-a4ae-7b293c5be303", "comment": "Malware payload (DarkTortilla)", "value": "7093369c37aa7192f724c086eb7d56b3f28afffb544ac0b1ed3246e0442dd603c1ae842a62c269d7ca76918863d55176", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161534, "uuid": "329a29f5-9db4-496b-877d-8bd750e2f14f", "value": "T1FA657B265A8D8745DC6F3A32E63604AAC1737E5B6CE9F2B930C579B4CFF23818503652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161534, "uuid": "bf35ddd2-f865-48e1-a28e-e0957002624e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161534, "uuid": "d90d70d0-282a-4a56-b34f-c0f75b0540e7", "value": "12288:nzwlJmS5uLyUDBkgiPbyCHEJyRe1zHYLTc6MOxwBoNdcdi8XikBG:nzwlES5uOU6PPboB1z+w6MOxwBgco8XW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741161534, "uuid": "70c9f072-2b27-442c-880b-5c24fc105ee9", "value": 1481080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741161534, "uuid": "8716a526-f5cd-411a-99ac-96dd3897369c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161534, "uuid": "cc8e1b08-f148-4025-a1d2-ee4cf6f734c0", "value": "PKO,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e61cd4-fa00-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741206446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206446, "uuid": "b2d230cf-ec58-4863-a942-290988017fa5", "comment": "Malware payload (SnakeKeylogger)", "value": "6edc9fb001a6b76bc545692bfb986daf", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206446, "uuid": "1a4e3445-3ce2-44d7-aa9d-aecae13d1c58", "comment": "Malware payload (SnakeKeylogger)", "value": "1c9ac3120e70efcc3b789e80466252d7288434e912d92b301075aee635b2f887", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206446, "uuid": "3ba7988f-2bb1-44c4-b1d7-03819de4bed0", "comment": "Malware payload (SnakeKeylogger)", "value": "3ff34fbcb5efc957e78d3e974c02b721b4fa654e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206446, "uuid": "e0426d40-f6c0-4ffd-a215-b81ab90c0816", "comment": "Malware payload (SnakeKeylogger)", "value": "0176c646fd5fd74a40fc1fd7e50ddc099bf8af8084d852f8fdbd3e93f1f0a050a80fb6a7d518bb5068c87fbc4a2a81e9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741206446, "uuid": "f2cded87-ef1b-4b53-99d6-890d7733352a", "value": "T193A4231458CB60BABB59EB38EA1FC868BC01DC55C277D9D1636553E844BBDF8C280DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741206446, "uuid": "6a1486e3-d373-4504-b805-e4af4e7f1ceb", "value": "6144:yP7pGVmIIE+WF0HflTSI/Pfo0VwaYB53veJeN1C+nkyR09pwPPN7T7l0rJ5OjIfX:UtAmIIXWulTSInPVwv8cnkyRXP5lw5s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741206446, "uuid": "0b3b8209-7d7d-4a52-8f99-64b2a717759a", "value": 473525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741206446, "uuid": "4fc9864a-c064-4a0b-aa6a-754559d45b40", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741206446, "uuid": "797616c5-e9b7-44e5-bb56-9d7752a4150b", "value": "Order 32389.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4d715d-fa0b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741211488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211488, "uuid": "558f27a7-a9ac-4792-8d55-366a0fd57691", "comment": "Malware payload (Mirai)", "value": "e7443cb8a37b1c476578e43971de687a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211488, "uuid": "9c3121c1-14cd-44d3-8527-0047055d29fc", "comment": "Malware payload (Mirai)", "value": "1d672603551f05053477c2abfac905fda61d0c7415e25eca2e7a8dd59a3d8b99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211488, "uuid": "e27dfbf2-3b40-47bc-a052-8168565779ff", "comment": "Malware payload (Mirai)", "value": "3431b6e77f3a8d11082b83090c53a30abe4c58e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211488, "uuid": "75a352f6-0d68-41c3-a21c-4a46c09842a7", "comment": "Malware payload (Mirai)", "value": "6eda2bbed5ddd5fc5014391f7362fdb1cab447fb5cb4f4bd38c4195b627335531bf6e52c2a030536f10c2b3e168b6cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211488, "uuid": "3ef686c7-9bfc-4fc2-8702-7bb575bae45b", "value": "T16FB328C0FA8BD1F6D45708714033B33F9A32E4256035DA5EEF9AAE26DA27582961731C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211488, "uuid": "baf266bd-2b59-4e9d-9d98-33847578ed9a", "value": "1536:BcCeI64PIZzGINBz7YJvstbG/A+b6zeWYwpMs3UgV88qQc8JHPAj:BcCF64wZDBHevstbGoJjBpMGUgi6Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741211488, "uuid": "83d21a4b-0d95-4a85-9602-5be1ae42a307", "value": 109416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741211488, "uuid": "97a43114-d619-4d86-9d28-d5fbe6febccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211488, "uuid": "4ababcb0-ce48-4af8-aa5f-aac30e1a52e2", "value": "rjfe686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f021cf0-f965-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139791, "uuid": "d64a90c8-9746-47e4-a801-cd94274e1522", "comment": "Malware payload (Mirai)", "value": "f213d120e16dc47eb848eddaa6f350ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139791, "uuid": "13dc0b99-274b-4770-9889-3fa192fd72bc", "comment": "Malware payload (Mirai)", "value": "1d72fe9dd02b0e9bb6f2b7038d50a8565b9e09e011692c2cb84aa4355c38b723", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139791, "uuid": "ec61ba53-4ed1-4170-8bf9-1aa68c5a3733", "comment": "Malware payload (Mirai)", "value": "40a15e9325e77d3571de29441da69f6895acc915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139791, "uuid": "29b529ee-3caf-43e4-a62d-03f2e98bc2ca", "comment": "Malware payload (Mirai)", "value": "f3c2f7b0962667935129f8e71a0c7d84a1ec4e541791d4260a36a4dcbb03dc7205993769eef2c90433b27d4765efe1bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139791, "uuid": "87d94ce4-20b9-4f9d-90a5-55b885a4a958", "value": "T18E933925B9391E27C0D1A47A21F78711F6F163CD22E4861E3DB10E9EFF24A502953AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139791, "uuid": "fff1b950-c66b-4385-934d-cf17cb173b22", "value": "1536:l3poS7/PWRdL81razypaYzbjME35cSnn94g6vSKRfXYk5+C1tnwLjH:BpbXME3p6ZvScXYU+4wLjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139791, "uuid": "b91908a3-4663-4bac-8a7e-2876f857af3d", "value": 93384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139791, "uuid": "9b59f5dc-135f-4d15-b64b-f2cb52c629a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139791, "uuid": "bbfc8804-1138-4854-83f8-f4b13f6b5768", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0db8717-f97e-11ef-ad17-42010a9c0004", "comment": "Malware payload (KoiLoader)", "timestamp": 1741150907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150907, "uuid": "2fc0a0af-d6cb-4169-85a4-9539c615c675", "comment": "Malware payload (KoiLoader)", "value": "ac65e94826f3ebb7ad25d5f6b1992905", "object_relation": "md5", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150907, "uuid": "711320da-ceb1-4a5e-b4da-dbcd0e295110", "comment": "Malware payload (KoiLoader)", "value": "1db538c6ab7ce63b72b8f8233e0e694c1d7840a2fca2b9d6f1e19e89d3d7e7f8", "object_relation": "sha256", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150907, "uuid": "98c179f5-88e8-4b84-b1cf-945631b9f6a5", "comment": "Malware payload (KoiLoader)", "value": "a597dc22462ca63877d80d280a2abaacbd36a6cb", "object_relation": "sha1", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150907, "uuid": "a4e15949-2d80-4fb3-8ae9-fbb1fdcfd012", "comment": "Malware payload (KoiLoader)", "value": "e8fc65c27383dbfae3d5529e4094a434a5dc71e8e830717645ef4399f017f6a8050af19b942e125ba84ec88be4c68939", "object_relation": "sha3-384", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150907, "uuid": "718360a6-89d7-40ef-9919-2ec703af4d5c", "value": "T10254ACDB677E3C9A0D473A7CD7926A93AF8A14B00172508FFDED5929F0DB1398070929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150907, "uuid": "3d53876b-f228-4415-94b1-294c31fa4315", "value": "6144:lpBFvTd80khj3Mk40hRwUQvUZsX2J3xwazPvmgC4w4QZDrSfm0X0mMQHN3xuJmCv:KdlcnyfVhp058vWB1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741150907, "uuid": "b735f55c-368b-4510-b85e-289346d386d5", "value": 283197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741150907, "uuid": "0b53ecc3-c042-4a27-a17c-f1539dcd030f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150907, "uuid": "88ccb0d3-3b86-4413-b9ef-d72bf2ae54ef", "value": "debug2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abd441d-f98c-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741156534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156534, "uuid": "93657d0a-6aed-463e-aec8-43d6f7bbeede", "comment": "Malware payload (Formbook)", "value": "12ef9d923963cb9c14919d87447641d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156534, "uuid": "8884b04d-406a-4119-9cad-421d0284491d", "comment": "Malware payload (Formbook)", "value": "1e26f69f063b034aff856a4b9bb1680824e61ebf28867a36fa30e2b3e1727526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156534, "uuid": "b4b5a7d9-1e36-4f92-9188-4c1574eeb3be", "comment": "Malware payload (Formbook)", "value": "54b12cf7d19d01da8235fe59dbfa0a89bc9fd3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156534, "uuid": "35d323c1-996d-4957-ad03-4e50c8d42c7c", "comment": "Malware payload (Formbook)", "value": "14a7dd46a726d8579e4b90b4ec895ae72f851b79afcf41c4ec06ab2b0518b452267979d207d61b72129bd6b61d652bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156534, "uuid": "4e6f8203-39cf-457a-a47f-b2a3ec43bab8", "value": "T123D402685609D027CAC197781922F3B8263C5EDDBC01C3A29FEEFDABF967D145C14252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156534, "uuid": "ff747859-015c-4865-bcd1-0d7b032bafaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156534, "uuid": "dc23b1a9-7461-4c1c-bbce-676342a24e03", "value": "12288:m/fMpm+gvyVltPg2m9LtnvcN+5WJpTVGnlpI4TAM+M:q4PzmFhA+MJTGlygAM+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156534, "uuid": "d6a23553-d6de-44c0-b30c-fca6d48d8a2b", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156534, "uuid": "1e10a228-773c-4bb5-a0d8-49861b80f0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156534, "uuid": "f95956c9-b1c2-4919-a222-2ddad6942b76", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d938476f-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181791, "uuid": "e5465e2a-7391-48ad-adc2-2c3a5c8469e2", "comment": "Malware payload (Mirai)", "value": "5769f01fbae90509ae612006423bbb7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181791, "uuid": "e3995eb6-2dd9-4fab-a128-556b9b6c94e6", "comment": "Malware payload (Mirai)", "value": "1e7bdb97fc2ab237cd6758d7cd949fa0627df4f1e526234cb2923f3f2242a1a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181791, "uuid": "7e918e17-9fec-4e27-8c00-918ec898c691", "comment": "Malware payload (Mirai)", "value": "22462a8a05dcf163d531147fdc4541af805aa10a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181791, "uuid": "4e8d2200-2d04-46b4-b8b2-0431fb412136", "comment": "Malware payload (Mirai)", "value": "6bcdbf08de32c66c6013754a5cce1d323b5fcf21c5574c7757cac67182c5cfab9ad60d1ca2e3b118e2b28c8d080c28a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181791, "uuid": "b49bfb4f-cbe0-47c0-a77c-be9745eb5fb7", "value": "T1C6839D62E9061D31C085827070F9D9793B63D4C492A72EB739A1D6BE9017EDDB109FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181791, "uuid": "fbadf535-a5a6-4de8-ba77-1d606878ec21", "value": "1536:Ga+QNhjnahBpoKUwNk6veJkaw+bWwG3Bt72I799tyqKKYl8zEU9lVCNjr6ioEF3a:GkNnah83UVeTzbWwG3Bt72I799tytKj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181791, "uuid": "dedfef05-1a63-4b3b-852d-6730755fbf4e", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181791, "uuid": "5b55c4b2-be71-4618-8ca8-ba436c6c89ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181791, "uuid": "9ad004b4-4209-4307-8ef0-6ee6de34968a", "value": "5r3fqt67ew531has4231.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3780ca24-f99d-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741163910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163910, "uuid": "cbbe2c40-ff1d-4778-b43d-d98a81b299b6", "comment": "Malware payload", "value": "1b782616f83c7cddc96d4c750148ffb7", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163910, "uuid": "c1244217-402d-4db2-b391-df1f1ebad153", "comment": "Malware payload", "value": "1ecb11b5be9e62be02469f6c294bf00e614acb57d956523452ecec7cba139f1c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163910, "uuid": "9e1ceed9-80bc-427a-a596-9bc69e94e619", "comment": "Malware payload", "value": "ed298a381abfa95676bb0331c414f45b07a36c6e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163910, "uuid": "5b7c664e-7e45-41cf-b9b2-67d2bc439318", "comment": "Malware payload", "value": "796abff4e897530a4aba4759436b4d6e65345e956859103ebe9e8c71ed1a6a371203589b58ecb4acfad1ebf6b83bbb4b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163910, "uuid": "a0d02a61-7644-4b5c-b164-dc7b3d36b04a", "value": "T1BD678D9676E200F6D0A79178CAD20B42E3B1B424177563CF13658269CF7BBD8AE3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163910, "uuid": "29a6c24a-1328-49e3-b940-f9927dd05da3", "value": "96906373012276f2aea0d3b5e34fd209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163910, "uuid": "3a1c14dc-afa0-40f0-9d0c-1f9061596bdd", "value": "3072:62umBOR46/CKQQ4YHPLkqEu1L/vwluvvhRjyCjpdGF+Us9:uP6e/ZvMuvrjynF+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163910, "uuid": "31ab0e6f-c4be-4252-98d5-f210a389bc83", "value": 30873088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163910, "uuid": "7191081c-c956-415a-ac91-2460b982f069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163910, "uuid": "4330a48f-bb24-4014-8c6c-c8cdf945e4d2", "value": "287263487-92873475.04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c16430-f95d-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741136717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741136717, "uuid": "b0ac24f7-699d-4e5d-b44e-ea2126deb0c3", "comment": "Malware payload (DCRat)", "value": "ba5406a838158dfaba199f47dda74695", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741136717, "uuid": "5bc41228-5f75-4760-bc1b-312889351716", "comment": "Malware payload (DCRat)", "value": "1f2589cdb8f52ec0f5afc879661b583b41f43be6e649ff7be8f0485795cad07d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741136717, "uuid": "aa2d71cf-1526-4f50-997e-c266f3cf9ba1", "comment": "Malware payload (DCRat)", "value": "fe95b058c2739d9205b7b55084e66ddf06a0e2f9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741136717, "uuid": "1a2b2af2-1271-41a3-8613-da02e033eb45", "comment": "Malware payload (DCRat)", "value": "964db2999271d43a8e5d1e2ba66d100a151f35536f31945610685461d5b5d84373987432cee679f2e2dea70e91be3402", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741136717, "uuid": "b4a60ed0-7125-4bbd-82e6-b83e01c4b27a", "value": "T14995BF1665924F33C2A0573645A70A3D92E2D7227552EF0B351F14D6AC0BBF19EB32E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741136717, "uuid": "3d806b59-744a-4df7-8d31-4ced598e7904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741136717, "uuid": "6ae6a846-bebc-4bd3-b1d6-12e2840cf317", "value": "24576:9FcKDvnM4oG8fsgeZfeP2S5IN4XsPlbD0MD73+UgRDivAHgE+2n6j9UJk7wHvgra:vnjF8YYPQdPV3DiUgcNbye7SYzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741136717, "uuid": "17e7d5b9-0090-42ce-be8e-7b86157f7dff", "value": 1928192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741136717, "uuid": "14bcd538-1183-4b79-bb7a-b73abca4fce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741136717, "uuid": "7edbed20-be2c-41e5-adaa-5531c93c36d9", "value": "ba5406a838158dfaba199f47dda74695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a87608e-fa0e-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741212395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212395, "uuid": "4b1a492c-1176-4f0c-8191-00e8dc37b769", "comment": "Malware payload", "value": "22b9c3d02a4db16e4beb15251bda9069", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212395, "uuid": "1f774d0d-ace9-4be3-800f-bf92c662fa71", "comment": "Malware payload", "value": "1fa34b5dfb8f50388ac6387aa6ad8672e333b0d5dfa3e725f2ef0308091a10b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212395, "uuid": "0fd2d67b-062b-4858-bbad-edcd5f2025b2", "comment": "Malware payload", "value": "a4d446a37f85b52c162ba5535f7bea90efce44a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212395, "uuid": "3c33c982-093c-4fbc-ab76-bc9f8d11938a", "comment": "Malware payload", "value": "748e05f61818dde32bcad6cde883578ea4f86471a747d27d362c327047a14df3930b369ba94ba58740209861624ca9ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212395, "uuid": "4f4ae242-1a0f-4e49-982b-fdcdb8168509", "value": "T1AC11BCCF12A5F21048ACCD183066C418B669CBCDA8591F88DACC95F2F7C4D08B936F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212395, "uuid": "4a82e4ab-1997-4d5c-bb9f-6a6094bc538d", "value": "24:8MlctHcWAb/cWA3mcJlcWgcD1cWVgcZTcn20tlcrcy8:8MlcpcHb/cH3mcJlcWgcBcRc9cnZtlcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212395, "uuid": "fb067de6-6f85-4300-9765-54ecd0eab3a7", "value": 948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212395, "uuid": "40e3feb4-ef7f-482f-9742-4a85c2e62b3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212395, "uuid": "2ba97801-feec-478e-a094-8b3534425799", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8ffe7a-f98e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741157424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157424, "uuid": "e04aeb90-e628-420f-a9c1-38ecd771b37b", "comment": "Malware payload (Formbook)", "value": "e643c74601ccdfa409a6577191c2dccc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157424, "uuid": "66206d1b-c183-4b5f-a529-d9ec79ca723e", "comment": "Malware payload (Formbook)", "value": "1ff1725bbd606965f0e37f15d60f0979a280bc05ea1a3fbd70cb8ee9d7031bb0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157424, "uuid": "2c2d0403-9971-4b96-83f9-92efeb2a35b3", "comment": "Malware payload (Formbook)", "value": "393be34da9d1edcd25676f4cf97c9e5a95f9970c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157424, "uuid": "9c695536-ea72-42d0-843d-516fb4dbba88", "comment": "Malware payload (Formbook)", "value": "de069cbb590b7d9feeebc249d00e4c6ca3aa388444fca57005fd2647fe9e578cdb3e5a8b35085102eee2b1047fbc2c3d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157424, "uuid": "c763dfa8-c3fa-47a3-ad3b-fd65ba5f172c", "value": "T1F9C42361C8E3FC0210F2E64176B3BF55D159EE82C52C2DAB7F8999A0334D8AD54EA371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157424, "uuid": "e1928c8c-b9ec-4e9a-bfb1-84ed507e6d5d", "value": "12288:MJQbu+hiBz3YArZTEF5bjfcg+C2wqDZuN4ING67TcQe/qdSwQ:MJL8iZ3YArK0g+eGMNPnxeidC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157424, "uuid": "90f017e0-4d11-4209-8258-d29f22089063", "value": 589016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157424, "uuid": "2fe32bc8-5430-4bc3-8ab6-06f2330012f8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157424, "uuid": "7dc1e8db-ab05-4c68-8b3a-64619da3c61b", "value": "PROFORMA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc415732-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199781, "uuid": "8ea72285-7f10-4d12-a693-881f1eab5881", "comment": "Malware payload", "value": "8fa8aba6a3b28503839c7e44fa76f01d", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199781, "uuid": "992144a0-3ab7-4b96-977d-1b580e3c14bb", "comment": "Malware payload", "value": "20edab1b595ee082254b862fbbbcb2ad7090deab8d562813639acf0780e672b2", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199781, "uuid": "234eb032-825b-4a57-bc3e-2cca0b3fad8e", "comment": "Malware payload", "value": "2219aefd90ca997d6b83048719e4f9ccc34ec31f", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199781, "uuid": "be69c0cb-07f9-4df5-8aac-937933f31e07", "comment": "Malware payload", "value": "05c3aa344c27c40c71ebb0c326b4dbed42e6b4f41c7700761737a3faa7e1b5d74764a09a518a8feba2a53a39ce8b7e0a", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199781, "uuid": "d980ad25-f4e0-4481-9944-b83b69d7302d", "value": "T1BED533631EDD01E5E882F730BFE9DB8D82D683718910CF675B74BC695F651223E2A860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199781, "uuid": "f6c7657d-48ba-4d4d-9b9a-c0c6bf0f117a", "value": "49152:hJ07B3vMxUrs/Bb8aEP0uYANvcZsc6TJIftv/XhO8quf+9NmOUfoK18z3gz2/n:DIdaoaEXY+vcycY8tv/4PuG+OUgBrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199781, "uuid": "613ad049-fce9-4328-9eaa-f78d4b8d9923", "value": 2875871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199781, "uuid": "fc798929-eb7d-47b2-8a72-686059550dcf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199781, "uuid": "f6bb2e9b-779b-4e65-997d-e70a719c7faa", "value": "485800CITA_835451487373.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c330bd1-f991-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741158684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158684, "uuid": "26ada14d-e0ad-45d0-8326-1d4821d5f988", "comment": "Malware payload (Formbook)", "value": "4e7662b0fad89a3016c77819e2820c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158684, "uuid": "40564cf8-28b5-4fd3-b5ad-0ae81a971fd8", "comment": "Malware payload (Formbook)", "value": "20f429fee6137f3dc57da2c6e5b68866d73dcbd8fb0be374f58a1532bac412fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158684, "uuid": "efdad6bc-719e-404d-90e3-eca80c97e94a", "comment": "Malware payload (Formbook)", "value": "f3d86bc878fa688063a53df2f5aed8f014f53773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158684, "uuid": "3f770ac6-a637-4741-adfc-0e9b03158dd4", "comment": "Malware payload (Formbook)", "value": "5abe9b250af62f383e4d0a0633dbde89418bca739c20d6a945a2994f4a5d5a36658f5fa96d1043a8ef593d2d57fd76cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158684, "uuid": "1cb11ed0-1186-4792-bc61-a3d6bf537f56", "value": "T1C945CF2273DDC360CB669173BF69B7016EBF7C610630B95B2F880D7DA960162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158684, "uuid": "924a9915-79fc-4fe1-a5c1-41b9933e843a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158684, "uuid": "f3258df7-c30b-4106-9951-70b4b0014e51", "value": "24576:Yu6J33O0c+JY5UZ+XC0kGso6FapCwFgLuXOHyqBRSWY:Su0c++OCvkGs9FapCwWL4OHB3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158684, "uuid": "a97dc636-b891-4268-80d3-e0f6b5211cdf", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158684, "uuid": "e9819efe-3a60-47b6-9d69-38197d652929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158684, "uuid": "6db2e3ad-63d5-4c91-b510-831735df3d67", "value": "Purchase Order No. 300-2212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ac4e56-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160206, "uuid": "5750c7e0-ae84-4893-b3ed-27614bc04fcf", "comment": "Malware payload (Gafgyt)", "value": "03ecd825a645257eae557c815d177748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160206, "uuid": "3e9d467a-1d07-4f43-93ad-59035623b6df", "comment": "Malware payload (Gafgyt)", "value": "217e9be37888e8f1dfc24258133d14486f687930249ee2cdb22ac0ab07a3f04e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160206, "uuid": "39161ce7-4e60-460c-93db-51d432000d08", "comment": "Malware payload (Gafgyt)", "value": "28903c371efc9e322466f4f9e1f445bb7f4594b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160206, "uuid": "3ab4649d-3e3c-4b0e-bfb7-e3fe388958cd", "comment": "Malware payload (Gafgyt)", "value": "008776b5a7549bbcc8bf06d6b06938e9ae81bd88c909a4ab40215fb5d0750f8319f7689f051268e4a9ba9549aada89b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160206, "uuid": "8b7b5ec8-3550-4ed8-bf97-dd476471a429", "value": "T1E8B30801FC404B27C6D22BBBF79E428D77365A58A7D733115A297EB02BC579C2E39224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160206, "uuid": "f15da486-76ff-4daa-af37-9b6b9abf7e3b", "value": "3072:o/1lxkoWAKnzOv6rDdVx549UJ5/GMB4b41qr/vBUQR6zAAgXP:zldVkUJ5/Geg/vBUQR6zAAgXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160206, "uuid": "5f8caea9-7dce-4f2a-b5fc-b5da44135a13", "value": 114600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160206, "uuid": "e17dbd39-a25d-49e4-994b-d44d71711ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160206, "uuid": "e4e8e757-5354-4b0e-a9c6-e96c1e706d84", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1997a2-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185205, "uuid": "137293c6-504a-498d-8dfb-bdacf968fbc7", "comment": "Malware payload (Grandoreiro)", "value": "1493d343fd5b6be0400fcafbe8a97ab4", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185205, "uuid": "c4a09ac8-5711-44e1-a211-a16e6f302413", "comment": "Malware payload (Grandoreiro)", "value": "21d4cece50af99d2d097c5d44066ee9a5fb326d7145362fcedf61153c4e11364", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185205, "uuid": "a0a6383c-c1db-43c8-9e6b-94c205b9323b", "comment": "Malware payload (Grandoreiro)", "value": "caade99469e1fbce050d40b92c7d50f7899572c6", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185205, "uuid": "251c57a2-63e8-4cc2-ab86-8facfb720535", "comment": "Malware payload (Grandoreiro)", "value": "3af145907a214ba857b26bb31e3783cf89500043c9523edba11af5a68793e8142a24115611aa980496646f9ae21591d6", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185205, "uuid": "995f596d-79d8-44bf-a41b-4e816bc6ecd5", "value": "T1EDC533C18BC48108CB94D734FBFD17C8DAF002D8DEC5A7329766F1F4AB605A6E629592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185205, "uuid": "cb23bbdd-8f03-4ca2-affd-7f8f2ed196f6", "value": "49152:SGkqWTGTrSl1GGZml58Eyo3da6a9i3EYLLhLFnbLUlcARX9eaOjxF32/b:S7CgsGZmj46a9i39LhpbISARX+fmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185205, "uuid": "5b5461cf-5473-491d-bb62-641aaee3acc4", "value": 2578504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185205, "uuid": "1ae958c3-e4e2-41c7-9108-80624c202516", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185205, "uuid": "6dd0342e-dcc5-4a58-8d99-8cf64de55861", "value": "087620114816PDLE4810_CITA9500.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394ec61c-f9a5-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741167349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167349, "uuid": "dc38ad04-573c-4f0d-9692-cb7a9b8a1da5", "comment": "Malware payload", "value": "717fed22189b8580187f0614819adef5", "object_relation": "md5", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167349, "uuid": "ec02eb29-e73c-4f13-b115-ac53911b43b1", "comment": "Malware payload", "value": "23b3bb77095bc6a8cda506b0a5ab1c7361370dcedda42403ee01b40365fef91f", "object_relation": "sha256", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167349, "uuid": "95017dc9-57f1-4d39-9ac8-5449a7d6ac14", "comment": "Malware payload", "value": "8e7bbd01db7d15c0e42ce27f996a2a6ae85a3e55", "object_relation": "sha1", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167349, "uuid": "edf20c3e-cd87-4821-8d8c-39956a340732", "comment": "Malware payload", "value": "1c5c323504a524d183b5cd62697ace2c485cd4ada3f2b20bc9d924be04b67d768fed64bdd4c7f48fc1af37d624f4c645", "object_relation": "sha3-384", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167349, "uuid": "fea6bc0d-bcf3-4e5e-b1a7-38e1e70e2853", "value": "T1A226EAE72EEE564A1704375B5B4FAA580F1BCD244BC3AED840C706D8540F66F3AA0D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167349, "uuid": "7c73a2c2-dc4c-4b1a-bc88-2822ffc90bfe", "value": "49152:+ESsaa0ADFY8taaC8XgIGWxG1cJguTszOj8qiGzTNjlNn3K0Ke3mWAqO3r/:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741167349, "uuid": "e4b0f1ed-a50f-4723-bcdc-662c04d598a4", "value": 4665882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741167349, "uuid": "30ea176a-c4e3-406a-8ef1-362cda93c8e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167349, "uuid": "a8d8d4c6-63b1-4cf6-887f-3624224b8a36", "value": "23b3bb77095bc6a8cda506b0a5ab1c7361370dcedda42403ee01b40365fef91f.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19c171c-f9ad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741170987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170987, "uuid": "c428f24f-536e-4369-add7-1c4c6518008b", "comment": "Malware payload (Mirai)", "value": "c6334889a8b43c7aab9806f36b24122d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170987, "uuid": "a1dbe600-4840-47db-9a04-81804e88e433", "comment": "Malware payload (Mirai)", "value": "24007c5a120749d9754428ecf0d468e096ec14c5c1088ec571d6753478e8627d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170987, "uuid": "6841c180-f787-4260-abb9-14936f7cf723", "comment": "Malware payload (Mirai)", "value": "2cfd447088619a5028860edd888feb6650f94bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170987, "uuid": "6d69c8a0-03f7-40d8-9e8b-fa300129ecd8", "comment": "Malware payload (Mirai)", "value": "af2a20488348862777338c301bb0a5121c07d0b548936a4326285ee814e76a6a16de2b00ad7e3f5c379db35b7934eccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170987, "uuid": "8ce60301-5942-44ba-801c-9c4801ac46e1", "value": "T19714B60AAB610EFBDCAFDD3706E9070529CC650722A43B363674D528F55BA4B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170987, "uuid": "d5701a82-e67f-45c3-a4ac-a85b867cfc33", "value": "3072:c88iw6aQiRR8F0WYqZ/HSn8+Qi+SdPAF+vTSuMK:c88B6aQiRR8F0wj+QgdEeWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741170987, "uuid": "39c89ecd-faf2-4899-aea5-4a9e23355dc5", "value": 202792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741170987, "uuid": "90469da7-6fdb-4e71-be83-b922d93ac90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170987, "uuid": "d28e309e-3227-4020-9e76-97d45b7f4c41", "value": "rrrdsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f9b66b-fa11-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741213895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213895, "uuid": "03101ab5-7067-4c00-af93-4498fadccd67", "comment": "Malware payload (Mirai)", "value": "3fc3c196098f74e8e2274267c39c74f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213895, "uuid": "2763faba-2772-4f1c-8d2f-31d89138949b", "comment": "Malware payload (Mirai)", "value": "242ba4aeddc7525d4b76d69131faf97bfb75cccaccfcef964857feb3f5556664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213895, "uuid": "15ebb684-256d-4d8f-b617-388d7709e371", "comment": "Malware payload (Mirai)", "value": "869b4283bf7f1d9d78a3978363fb16b3a298050c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213895, "uuid": "95a8c8e4-533f-4194-933a-1e5e53a0249c", "comment": "Malware payload (Mirai)", "value": "fbb0c8458d2621bf023e4732d017fd89c228d3e2a9180e42e53165a2c6c17076470d13405bf5fb5cd7693decd5542fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213895, "uuid": "1af5de48-95b9-4b41-a8ca-0b33661cba59", "value": "T197F33A46A6418B17C0D6277AFADF424533239B64D3DB33069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213895, "uuid": "a91e1a77-e0fa-41c2-bab0-90e206a99c74", "value": "3072:kVA8v4dkmKO9KaMfzvsRUSpqeBIBiEqMXn1j2XbM/9kErm8Ac:kVA8//O9KaMfzvsRbp9IgEq+1j2rM/95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213895, "uuid": "149c1a4a-ec26-4b65-9089-bcae4b45868b", "value": 168957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213895, "uuid": "6398af9a-ed08-424e-8143-c4561305853a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213895, "uuid": "abba3970-afbb-46e2-9a6d-d458b861cf15", "value": "efefa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433e960d-f9b3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741173379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173379, "uuid": "f42f7269-d8f3-4b17-9b52-271397d9120a", "comment": "Malware payload (Mirai)", "value": "2161a3694f53ba2c95a18651e6d5d1e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173379, "uuid": "fe227426-0856-48c8-acf2-d1e0fae87a01", "comment": "Malware payload (Mirai)", "value": "249865c6cf9790db274069649f19576a427191d928a765a9901b09bedf350880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173379, "uuid": "06fd99ab-e434-47db-93ea-c2e5bc757888", "comment": "Malware payload (Mirai)", "value": "c5093d7d2a8675f47ab8a1118e164220dab23d7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173379, "uuid": "f649b6ab-cdde-498b-ad4b-3c996cd5c301", "comment": "Malware payload (Mirai)", "value": "d377ab6d17018406607bd2bfb6c1052ecb1605f831aa27897d69a095c0fbd14da03d9207fa47249cd304a3b24b02ae80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173379, "uuid": "9a1cacd1-34a8-4b8c-82db-36f4139361e3", "value": "T1AD233D48EBA9932EC7A1F2FEEF98418F33350B9477FE3D268635010923C87796526524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173379, "uuid": "5c3369a3-7f29-4fc6-9c3b-7dc210686d5e", "value": "768:p6Su2BWmTRVHvl2myDH03NaH+a18K0GssdUpEm7ta6nc2vtaM9o6U1FyJt8R0uPn:p6LwAml3NaH0Em70JlZFyEPPSSSSSSSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741173379, "uuid": "fcee7f59-228c-4aa9-92e0-6134ca9c5ea1", "value": 47635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741173379, "uuid": "fcee14a8-d2a4-4557-940b-244a04825835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173379, "uuid": "faef08e9-03ca-4d97-ae45-8627c246a246", "value": "cbr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a851d7a1-f963-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139189, "uuid": "eecfe797-8842-4d80-9196-b9b2001017ae", "comment": "Malware payload (Mirai)", "value": "d897641fa412da191c0bdab06d01779f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139189, "uuid": "6521c5a1-4509-4319-9dff-45185b930276", "comment": "Malware payload (Mirai)", "value": "24b0e101cc000547dea27f5ec9ecb34cc22f00ea3c12d7402bec6593d950e0b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139189, "uuid": "0eac4669-0d1f-44d0-9383-b3871641912c", "comment": "Malware payload (Mirai)", "value": "a4d390aeefd93e5b30b91f79a07408562df1b5ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139189, "uuid": "9a357bd3-5bd5-401b-b66a-ffa7e8fe9658", "comment": "Malware payload (Mirai)", "value": "d4c3e448cd0d398aaa9b9be848d5f1a738270a9538866f47d7a1af480fd751d1eb99334dd50ac7ee92b3ea386c126107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139189, "uuid": "373f9d9d-aaf3-4e3b-9b1a-3a00f6044d3d", "value": "T14363D747AB604FBFC82FEE3705A90745358CA50713A93B353674DC28B65EA4B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139189, "uuid": "32200258-e270-41e1-b391-a7dab313937c", "value": "768:p+9y6JfooX9fBld4iMz3gU5FLlkcFeBaeXPeZ0hyWawzosYZsaZBkEXiiQAz+c5j:qz4iY3g+LvkaePi038NZlZBkmz+cFI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139189, "uuid": "513a9370-216c-4dbb-b641-d136737023c3", "value": 72472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139189, "uuid": "3caef2ea-a3e8-470b-9a84-e278b490bbff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139189, "uuid": "4e1423b2-3297-4999-afcb-ccb6aa009d6a", "value": "cbr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed352c2-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199705, "uuid": "95127f4c-1e6a-4e9e-9ebb-c35bcfcbd68e", "comment": "Malware payload (Grandoreiro)", "value": "0a296d1ef70c609600e478324114e881", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199705, "uuid": "9267b4c7-f0cc-4725-a86d-0368152ba2fc", "comment": "Malware payload (Grandoreiro)", "value": "251190d38f4447c472acc032840c51872f3db37a20c36a74a6a09c04e5e1150c", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199705, "uuid": "27c4b562-37f8-4492-900f-4b525040a082", "comment": "Malware payload (Grandoreiro)", "value": "5e24024906ac022132fb0bdec88cb34d84b8e4f3", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199705, "uuid": "4cf6148f-cab7-48e1-93f8-e7db087557b1", "comment": "Malware payload (Grandoreiro)", "value": "36baff2d7f55839f21efcd1d2b55819f6978cff52e98da00d61f38286b159e76f9398de01756fbed56a0e51048aa53e8", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199705, "uuid": "eabc145c-5601-4e2d-83e6-101c110bb958", "value": "T186D533946F884510D605337C7F9E1BCFE6E946E69A80C653726674EC8F0E04BEB9C8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199705, "uuid": "2ad9b214-a47d-4bff-8e68-c8983113735d", "value": "49152:2Mh96wQmTHTraYkC6FV8j+Oz0uwUz72O/Y8nmCts73cG67YDobNN3v5cEeY8S0lT:l96HmT3aYkC67xOYhO/YbCSzhyKe3Ose", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199705, "uuid": "78f58561-1858-4c70-a741-a9d7275f7573", "value": 2945138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199705, "uuid": "bb36da1f-02e3-4686-b215-ce5c6cd558f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199705, "uuid": "83db6e43-b17d-4967-ba0b-1dd96b7054f9", "value": "584500CITA_492841950464.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efda971-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139495, "uuid": "d4cc8d7d-b96e-4bc2-b485-48918089a99e", "comment": "Malware payload (Mirai)", "value": "bd452e9ba6c9b2bb447419ddd051218e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139495, "uuid": "ae19aa6d-19f7-4083-b6c3-49cf04ee93a3", "comment": "Malware payload (Mirai)", "value": "2557862bfb98c09e77ab303e1c0317878594758065e8c6bbfd894e44b4efc82c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139495, "uuid": "84aa455d-5cd3-487d-8a78-2441f139a497", "comment": "Malware payload (Mirai)", "value": "af73d066ccffd557e47cc1397eac044bc71ca146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139495, "uuid": "0a55b2ed-d431-41de-acda-3355ffd7e350", "comment": "Malware payload (Mirai)", "value": "4e8190fcf19d7bfb4190ce83bcdc9ebd8d019ef84b6cf2807cf74cd78a75cac56db5990a6095c98d297ac319bdbd129f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139495, "uuid": "432e2224-0ab6-45e3-93c7-082b44a5937e", "value": "T17783BE32D1156DA8C0468934B9E88E715B23F2C892932EF7EAD1C2A85047DEDF845FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139495, "uuid": "43b337b9-b7dd-4d1d-a3ff-3f5467ded0d5", "value": "1536:maR/QhWjsu31AVSiHV4LKMcx/s3ds/fCa6Kj16pzfoVCPfTgRO:mIIhiRA8iWG/+d46KjAfoVygRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139495, "uuid": "b15dcb1f-3d95-4e0b-bb8e-b0bbf8618010", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139495, "uuid": "9c41c710-31c4-4942-805c-694eaa9f7681", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139495, "uuid": "ab1dbcbb-89f8-430c-b4fc-c8edca5899f5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97aa2c7-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185281, "uuid": "7c47e86b-0c24-45e8-a7e2-78bd4c23f876", "comment": "Malware payload (Grandoreiro)", "value": "79c8de9a11e4ac46cafdfac307c3c58f", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185281, "uuid": "aea87d7d-e7ad-481b-ab5a-ee49c99b578e", "comment": "Malware payload (Grandoreiro)", "value": "2616a27215e740974ff6fb990860cae9bc550cd00ac23ac3d25ed38a717b1a75", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185281, "uuid": "a23a0d06-be2f-4bd0-b42c-5b1b48c5b7be", "comment": "Malware payload (Grandoreiro)", "value": "6ec6300652eae1713797880a5da5dc0b33b24d99", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185281, "uuid": "25b7144f-4b1f-485a-bee1-80b35ed9951a", "comment": "Malware payload (Grandoreiro)", "value": "a65c8f3625fb7184fa9af149fd11728ee57965716640780f71956953baeea519da545f0cb80c1b9e5e2536de0cf9beea", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185281, "uuid": "f5b95ac1-4e63-4f53-9d8f-3306b8b85fe4", "value": "T11AB533C447DA0445EAA47774BFEB0B9DCADA0BE909D5DF5B2270E4B43F670858832782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185281, "uuid": "23b3195d-3f1d-4e32-aa95-b765fc757d02", "value": "49152:Glo8jNjP7jzjngCvmPRcd7j7XeEONkCQqsDZb2/7:Glo8jNvjn3ePRcdzuuCf6ZST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185281, "uuid": "c362cb6c-6ef9-4224-83b5-ebedaa450a4c", "value": 2361265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185281, "uuid": "54609f67-51fe-48d8-9ad1-27769467f1b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185281, "uuid": "e2d8e491-40a5-4d59-be5e-c15ba974a0a1", "value": "892879451336GKEN7022_CITA7406.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31f9bce-f9b5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741174452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174452, "uuid": "f6a519a0-543a-440d-89b0-300266d18d32", "comment": "Malware payload (Grandoreiro)", "value": "bcdcb82d9378244a0231253f1277232f", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174452, "uuid": "d18ac910-4d0c-40b2-a8fb-a86b49e58819", "comment": "Malware payload (Grandoreiro)", "value": "262b75c19d11b3d8ff4b1812ef3c388037ac24a524afa030906be917cffd9523", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174452, "uuid": "638a64aa-e90f-4cac-81bd-eba8f59b92c2", "comment": "Malware payload (Grandoreiro)", "value": "a18e15666d701725c4ba47d538f48215a4580f1f", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174452, "uuid": "f34c234c-f93f-4246-bd99-87340b9f22bb", "comment": "Malware payload (Grandoreiro)", "value": "7d110fd6716017c54360d0bcda4de264b2af53c1f4dcb8bf29f413268c0b94da85d25a33b88c29eefcaf542e9d7c4bb5", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174452, "uuid": "fe641dc3-ddae-45f1-9324-da08fc761c03", "value": "T16CF533885FE58544FAC92730F3C9AECDA2C60B240AE0D613B24475ADFBB0AC7677D941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174452, "uuid": "e54860f9-ccc5-48ce-beb0-6853e10595f8", "value": "98304:8A3EgufGxzodC2PNqhjzZgTyqhwDtPJIs4FlnLC:8Uo+WBNWlMyuwxJIse+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741174452, "uuid": "094c0703-e669-4f5e-96ae-70219e8a5ff7", "value": 3441094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741174452, "uuid": "75ac655b-927e-41a6-9efd-64adc76173ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174452, "uuid": "b16b8023-9d00-469a-8fd2-b6aa103945e2", "value": "Cita8438-Acta35872565IBVJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4a29c7-f96b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741142737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142737, "uuid": "097ea9f1-b22c-481e-8897-4a107829a213", "comment": "Malware payload (Formbook)", "value": "c6586ac76b40e80b43981aeae420d685", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142737, "uuid": "fbb8f86c-d81f-4ab7-bd7d-b4f67457497b", "comment": "Malware payload (Formbook)", "value": "263d16d8918065e5214c4c16feee62dded32e4db22574f89aa4e439916bd39eb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142737, "uuid": "c551d0e4-eab3-48aa-b319-fb056f0f65bc", "comment": "Malware payload (Formbook)", "value": "85c95fcdeeb4d10a26694c60b2cd7326e70b29c3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142737, "uuid": "e1a7d69c-51d3-45b5-89c0-1d75f8bb687f", "comment": "Malware payload (Formbook)", "value": "95fbc9962b4927a854d009635c9965710c912023ce3ac4053df3414ec9444adf0212f8c6a5773438353f03b30354d860", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142737, "uuid": "bf7b6b41-bd0c-46b0-935a-a7151e58b710", "value": "T1D0E423BBF7B0A717D5CAF1398541AF3399BBE4B4CE1BC7534DE44257228B8544872A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142737, "uuid": "2d27548b-eb51-4ba3-a68a-a1ec9b05c8b0", "value": "12288:3yAgAGSPuCnxYdJkacjdK2t9tyqDJmKDN6m5WlrgK1PTE:3yAtvGCxYdJkacB1t9tTJmKDA+YrgYTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741142737, "uuid": "47b0bfc7-c569-4fdf-8369-3b920b812e35", "value": 693388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741142737, "uuid": "cf7a1a16-a0dc-4cc0-bb00-b12fd1846c48", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142737, "uuid": "a0ab74e1-8472-462c-8a69-0417e5f50e69", "value": "Revised Invoice Vt-1307701765400112977.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7700e500-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199665, "uuid": "284dd157-98a1-40a0-8f3e-c04440ba2951", "comment": "Malware payload (Grandoreiro)", "value": "1f090863bffdbf17c6c4c36397b1713d", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199665, "uuid": "077ee289-6007-47c6-a44a-19c540548669", "comment": "Malware payload (Grandoreiro)", "value": "26960a8fef2956baea732d461373ef53be3f193859ee22e93d84c0cb2652631f", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199665, "uuid": "997171d4-907f-4283-818c-45122a31afeb", "comment": "Malware payload (Grandoreiro)", "value": "5c1e5aabee0ac7464bc9f485341618ddc59f4665", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199665, "uuid": "8290c2db-7067-4650-936f-6ed6d1c298fe", "comment": "Malware payload (Grandoreiro)", "value": "1251db38c021169e6cb28b433ed9aee61cf61a1aac27b17515ae3a323644e294332c86daff56f8fd4a7eda4551679047", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199665, "uuid": "3ce4dc65-b909-4d12-8d52-c5ac48ecec38", "value": "T1D0E533CC97C5CA94E9951370EDEC0B4F92E50FB84F8087371361E0E96FA6352E26C6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199665, "uuid": "a7bf0796-a457-4572-b68b-ebcbd31d3f31", "value": "49152:a4LKP6gg9Qi/D1rVYEl4nWiRL1LriEXP4UU5ezLGwW3g5jQDDH6ny6mjECBm2/P:a4KjiJBYpvL1LuXUU5ezLGwyDDH6wdHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199665, "uuid": "978c71d4-1312-46a3-b6c7-24ca7185709e", "value": 3033205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199665, "uuid": "65859021-2a44-4e52-903e-66fc211bf010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199665, "uuid": "b020cb9a-0399-4855-8540-8108f5da9ed2", "value": "264700CITA_063516921726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249194d0-f9a1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741165597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165597, "uuid": "0260687b-dd64-40e4-a339-92d1fa345e12", "comment": "Malware payload (Mirai)", "value": "cdd6c7ccdd1d19eafaef3f37b53cf6aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165597, "uuid": "3040167c-3012-4514-96a1-371aa2ebf2d0", "comment": "Malware payload (Mirai)", "value": "27d110a41f92b1a00082bc127ce90ac1f36996ec6fd2c75b5fd16c96fdeb2409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165597, "uuid": "215c12a9-2bb6-4176-b0f0-525ab4091a65", "comment": "Malware payload (Mirai)", "value": "9ba6a5dfcee2b219cfc8e1554323a430fdc62bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165597, "uuid": "fc155ada-3b65-46ca-9eb8-527ffc1281e3", "comment": "Malware payload (Mirai)", "value": "a321367149b0694c8c70e1f0fcfd2c0ebda91e3ed00c20f7ae7d6ccc043201c74088697130b7c202b162b287bd6553f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165597, "uuid": "4b6242d5-5701-42b7-b08d-65e645e5edd9", "value": "T15E6395463E228FFEF36DC6344BB74A20A76923D623F0D685D29CD5081E6438D585F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165597, "uuid": "0d983933-29d9-4964-ac72-a06a6c3125e3", "value": "768:9og/rOKbH0yfpGYvNrdjQBEA5PzgaAB7JuBIgMP1SK03yta/WO4NB3icf+nMFfyA:5TOK7QWxNQD0a6ta/rQoGjeMaFWUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741165597, "uuid": "fae89ebc-0289-4c96-9b0a-52a6b7deb5ca", "value": 72480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741165597, "uuid": "93f7801e-ad8b-41c9-b663-c24900b14b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165597, "uuid": "8b0f852e-3883-4671-9598-9aca7a6a7dbf", "value": "cbr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0dcb34-f991-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741159004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159004, "uuid": "60b43651-e769-4ea1-8f4f-000fbd0bf2c2", "comment": "Malware payload (Prometei)", "value": "0ba282d79bccfedb00ec67a802ea2bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159004, "uuid": "2540c9b9-5167-4cbb-885e-13405bdfbfdc", "comment": "Malware payload (Prometei)", "value": "27f90063af3e46b04deb4e4e100d62625f343990d9d3034717089e932b79cce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159004, "uuid": "8ee332a3-86f6-4771-9170-97d538057881", "comment": "Malware payload (Prometei)", "value": "cea6d2ec4041681b010b970d9d134bde29d22164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159004, "uuid": "34db3088-e110-4e5a-993b-42975330e870", "comment": "Malware payload (Prometei)", "value": "60257268495026406fd9a4319ed853cacf03f64421dcdce3a5eac7c6811828373e27f3e4be875f56a4a71da801bf7830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159004, "uuid": "fe5b2744-0352-4854-9c6e-bab8135f33de", "value": "T14B155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159004, "uuid": "472cfe70-917f-46a8-8bc6-1ac6d6204faf", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl+:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159004, "uuid": "d28369d9-20b7-43b1-bf38-69647a2659b5", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159004, "uuid": "4ca0c5ef-7c2e-4eca-af1a-154858a80135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159004, "uuid": "a028205b-8213-439f-9030-522107ce9d90", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b679aec-f98f-11ef-ad17-42010a9c0004", "comment": "Malware payload (PureCrypter)", "timestamp": 1741157823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157823, "uuid": "751d34d2-7861-447f-a83d-4f49b51798a1", "comment": "Malware payload (PureCrypter)", "value": "a2b1766a61d1db66343b1ec2f7e9c59c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157823, "uuid": "ac535d33-71ec-4f31-bd02-b17fe7e48795", "comment": "Malware payload (PureCrypter)", "value": "2852c2dffd46554bf1f3ceede3a30574a52215ee3a311759fdf59d024c82121a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157823, "uuid": "fd62a0c5-4c50-4648-a12b-9295878ce95a", "comment": "Malware payload (PureCrypter)", "value": "519ec1dee4da685587136eea41158b3a786a0bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157823, "uuid": "97f0a6e2-280b-4e7b-b5f0-e7a3611f944d", "comment": "Malware payload (PureCrypter)", "value": "0a1f147dccfd3cef4706cb2a95e2b1ef18f64384ece5d8e6f1c0739cbf49dcb4f6ecbf00cd47b844434fda13d37dad90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157823, "uuid": "144e43b3-f7a2-41a3-b62a-48a3fa4d53c6", "value": "T116049637B68A85B1D2546776C4EB252007B4FA8176E3DB0FFD8A13DA08537AB9C5070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157823, "uuid": "f6ac2ef0-e2b8-49c7-9f9f-d338ba390473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157823, "uuid": "c13f99e1-6811-4405-b9ff-c665b8f325b5", "value": "3072:LMPf6ZE79630T4303O2AaFMM/AgYXMl9iKq35MBhlX8FaJ:LMDm2Amb1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157823, "uuid": "eaca911a-7fd6-40ae-9987-850506b6b251", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157823, "uuid": "7d8743ad-35e6-49db-a928-4a5597798185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157823, "uuid": "aa3d3c17-1029-4212-a52d-8e6f3627027d", "value": "\u00e1raj\u00e1nlatk\u00e9r\u00e9s.mg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ffec35-f9cb-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741183722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183722, "uuid": "dd40e251-0432-42f7-bb38-01fcad6eb4cd", "comment": "Malware payload (MassLogger)", "value": "384c61bc411158afa5aaca61794bcdfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183722, "uuid": "17394ab6-f3d6-416b-9501-4cdbf457257c", "comment": "Malware payload (MassLogger)", "value": "2a55ad3e88306641e6aa9b88c840b384bafe103445c5c5f44cf1f4c1648c894f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183722, "uuid": "c2c3c429-f686-4eb1-b714-6b5c67010f29", "comment": "Malware payload (MassLogger)", "value": "b93cf4b298ce6d6c96a93ffcace7f6cd62c143f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183722, "uuid": "6c6cc8f5-aff6-4f40-836f-0f08a9134fef", "comment": "Malware payload (MassLogger)", "value": "5ec8939b8a68b05f1475f5aa990053d85ffe083637f290060bc5aa563ab35c0c6088cf12f892543a8cf067c1b71ddfd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183722, "uuid": "1e236406-fc50-4a22-a6d1-c078633c31c1", "value": "T1A3D4E06022A9E707DA799BF81931E13157F93DE9B810C21A8FED6CDFB976F001950293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183722, "uuid": "efcb268d-f57d-4d3b-b8c5-bd9f3229a546", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183722, "uuid": "0ac50f96-3dfa-4675-bf36-7fd5e9e0506c", "value": "12288:hlrjMpm+gvyzpHElwM+f2sbelJXRFJpo32ZVDSVM3giIbk88OSUzkR:TrjLopTOs4JXj4ZM3gdk88O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183722, "uuid": "c2c472ac-6c97-42da-a451-52b8415dbc02", "value": 611336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183722, "uuid": "8c7f5ba1-adfa-4614-b2fa-2894d79214fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183722, "uuid": "9c6428de-44c2-4fc7-83e9-ef78f212c9ef", "value": "25031221 Payment.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd145779-f9f4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741201501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201501, "uuid": "1d5079c8-0096-43ee-bbba-a574dece0f9d", "comment": "Malware payload", "value": "0b98d02e97c8567394b3eae6eb8a0c56", "object_relation": "md5", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201501, "uuid": "6bc184c1-7ffc-47b4-bd48-ce16d9ebab03", "comment": "Malware payload", "value": "2b9a1eb968a6ca576c7a87691944113d360bd5ed762f1f1f7e9d3362516b7229", "object_relation": "sha256", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201501, "uuid": "6d8ce305-53cb-466c-bae5-8d014ccae8a4", "comment": "Malware payload", "value": "b090d74db8b8d442c4f21c120b5ee328711ecd35", "object_relation": "sha1", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201501, "uuid": "fdc5cc81-7a76-49f0-87db-39b8770a4fa1", "comment": "Malware payload", "value": "b6de68ce162624d1fd31cc18d5a1d5296e59ba6c616ec16ac99f56b595f88dffad392409c3fd0d7322d9c441cefe5c3e", "object_relation": "sha3-384", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201501, "uuid": "6054018b-7527-4f66-8912-55d4eddbc666", "value": "T1DE47020EEB8ED916CBB7B039D54E0263712A5CD84641C2B76817B218B9B3FD48F257E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201501, "uuid": "fca8d229-693e-491f-9785-d8c4d5e29cac", "value": "393216:43uLc1HErdpB63WZztMjTe1iXM9SnRgmUgw+4Ivtsng9GGj:uuiOdKWmTe1cbnRgP+4CHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741201501, "uuid": "66ed2871-5d16-47fc-8bc9-6e19fdeb4e33", "value": 26890112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741201501, "uuid": "4129b794-d805-40fc-8a20-3b692ca80741", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201501, "uuid": "a75a7876-8470-4776-b7e3-af5ce241ce42", "value": "Dual+Front+Camera_1.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da158ccb-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181792, "uuid": "ae6bc9e4-8c8b-473c-9368-69b4a3593fba", "comment": "Malware payload (Mirai)", "value": "7c99d88d5635fc571acaba6b74ffa058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181792, "uuid": "f5605c5a-28f8-4a55-b640-a0b75abab679", "comment": "Malware payload (Mirai)", "value": "2baeba800bff1da606ad602116502a5e923251cdab360e88b05b990e6475d2fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181792, "uuid": "497d922d-a3b4-4a66-a7ef-425b2f5185cd", "comment": "Malware payload (Mirai)", "value": "e50c07488011c1f0ec33e38948916105bd2c7b84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181792, "uuid": "0df90980-490f-45c3-ba0c-a3f1f603bd15", "comment": "Malware payload (Mirai)", "value": "143f2a4f80d5652064e26379526b6a01970cd5f40a5006d86d53142be81684d4d7ece645b6f5d3c61c7eaa4fc3ee2141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181792, "uuid": "068305fd-487f-4630-b697-5ad0dc920489", "value": "T1A4A34C96F4009EBEF84BD7BA44174909B930A2D44B630F37A3A7BD67EC720996C17D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181792, "uuid": "453878ba-1505-4826-a544-731d53c2344f", "value": "1536:T0vBHshU8H0vxQOWtbp1//jOQoduS8O8zcbUvQfgQUt8E7DbYl3lZiRypiQeTBn+:T0vBHoU00vSOCbjjOFuS8gbcQy86wZig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181792, "uuid": "aac8db9d-9f7d-403d-85e6-df4b37c0ede8", "value": 97692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181792, "uuid": "f05847fd-6241-427a-b167-05bdffc562b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181792, "uuid": "edf48456-3c45-4405-b22b-0b06791388a9", "value": "5r3fqt67ew531has4231.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56e008c-f9bf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741178778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178778, "uuid": "6880532c-7e91-4000-8ea1-94744aad3c49", "comment": "Malware payload (Mirai)", "value": "effaf8f9f353c33a165c6820cb050031", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178778, "uuid": "2dfe0b54-32a0-43cb-9e54-5c6612db8682", "comment": "Malware payload (Mirai)", "value": "2c054d1977d63d087d06e5e505396605d9a37d5168bd730fb3c5dd8decf7a15a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178778, "uuid": "dd31e942-86bf-46e6-9c82-849b000adeb5", "comment": "Malware payload (Mirai)", "value": "2ae33bfb486955372190bb53bde0b112319cbcc3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178778, "uuid": "e9f0fd30-fdda-4a21-98fc-0e86e364e689", "comment": "Malware payload (Mirai)", "value": "579b8fe4c286929e32ba27d4e1ee7da61d5c667d35ff900807d36b802bb74340f17dc1ced5a2e21565ef138d4306f330", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178778, "uuid": "b2d42f9c-7214-404d-aeb5-6a7a54edf3ae", "value": "T1CF01398C53E1F211A56CCD1E7463C08DB121D1CEA95D6E80FADC69B0CAC41C0BC783A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178778, "uuid": "7c0a445e-7a29-4e29-a2c8-dc2e74dfe1a2", "value": "12:3J3jfHaOjftA7OfSjfWAbijfWA3gWDjfkpjfjojfe8X5wfjfWyajfZDuRjfnDS0S:3J3DBtfeWAbuWA3zygDCrWTZin20eayt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741178778, "uuid": "7578c56c-dba1-430b-aadf-d6169d6df335", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741178778, "uuid": "29f6f481-273a-4a7d-a0e7-43950727eb5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178778, "uuid": "8ff96572-9cd1-4f3d-86bb-98f31c6b4456", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f372b2-f9f4-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741201220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201220, "uuid": "d17c20e6-4d00-46ae-86b6-4657929a50e5", "comment": "Malware payload (MassLogger)", "value": "8ddbb7506d175763dce899bb30d6384d", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201220, "uuid": "2d5015bf-b81f-47ec-a5c4-e65680e1a26e", "comment": "Malware payload (MassLogger)", "value": "2ce08a1f5e8978067c6344e2ebde773e40d9e38686190723fa4ed75eb28834ff", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201220, "uuid": "3ed4e033-6cc3-423e-b743-3fe79cf82282", "comment": "Malware payload (MassLogger)", "value": "757efcba0b2bc9ff94f2389ea59f827ad4e549cf", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201220, "uuid": "30c1966f-4472-4798-b72c-bbc00bbcb4ce", "comment": "Malware payload (MassLogger)", "value": "f9aae83ee8dee1321f2c3c8ccc578e0442b9d7bf67e060bc9e35ce98d9407d2a873b1aa60598e9ff58d24b74777ef4f0", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201220, "uuid": "66d1e348-54de-49a5-b772-f6b0295fce15", "value": "T1990533AED8775F0DF576720CB52EB00989222A3EE38DD0ADA26BBF1EF7255D11123444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201220, "uuid": "37e2a4bb-2267-48cf-a267-b3fe19df9b89", "value": "24576:atF4eLWSUufeZpdgqRH1ROSbr+imyjoqOEg:atF4eqBpdbO+ah2bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741201220, "uuid": "6e3d2c3a-f172-4afc-bcd3-55721ef822ed", "value": 849198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741201220, "uuid": "26743ce8-ce65-436f-92b9-b783d5248f4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201220, "uuid": "bfda1193-7444-4373-8ab4-867bb0896f30", "value": "nEstado_de_cuenta_del_cliente.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ababd822-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159381, "uuid": "1be4677b-f0f6-4d70-a8c3-3b2fae8a66d3", "comment": "Malware payload", "value": "36e0c58882ec08abd24ac6cbd2c2fed8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159381, "uuid": "0ac6b23a-bf51-4939-bea3-6cc68c877c89", "comment": "Malware payload", "value": "2d4042d0836d1fede389bae5869fb8a85ca64b3f0fc96b0114ec2d13e5f48893", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159381, "uuid": "4acd6d45-46fa-4075-90f8-64f6e51ae1b1", "comment": "Malware payload", "value": "a9a12286d2ed8ab72dfd31a5ffce106d8f548431", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159381, "uuid": "1f2fbf2b-76d2-4d98-9915-c25320d9049d", "comment": "Malware payload", "value": "41b5223df1b99e529c5740d2a4789b728e288c71f95229b36e8d533f249571742648eee352dbe757925d0a0bf9852230", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159381, "uuid": "91ca209a-125a-4547-afdd-6f4b0fcaca02", "value": "T1D915AD2273DDC360CB669173BF69B7016EBF3C614630B85B2F980D7DA950162262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159381, "uuid": "26f82b9f-ed2b-4ae7-a640-36c9757742b6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159381, "uuid": "7dbd5ae4-bb9e-470e-af70-1ce27dc97b34", "value": "24576:9u6J33O0c+JY5UZ+XC0kGso6FacIgkkWY:Pu0c++OCvkGs9FacIgyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159381, "uuid": "bc823b3f-a9b7-4f18-a024-522459a01a08", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159381, "uuid": "5bff68e6-b5f4-4e1d-b57c-35351159c3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159381, "uuid": "6c642d3b-61ad-4a9f-a427-16ecd591b7fd", "value": "DHL DOC. pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f64143-f9b5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741174219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174219, "uuid": "755ee17a-88e2-4b13-b3f8-06ca3a235408", "comment": "Malware payload (Formbook)", "value": "d9a073ae613c2d5ce0e8baf11ab4be36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174219, "uuid": "fba63636-a801-4cf1-922f-c711c51f76c4", "comment": "Malware payload (Formbook)", "value": "2dbc649f56dbbc3bc0b958929fd993b6a0dc60513c9cf95c9e577bc71534031c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174219, "uuid": "e24afa09-05a9-4a99-b8fe-429f6b2f51b3", "comment": "Malware payload (Formbook)", "value": "5ba2b95efe8c8bc83f2869a95040ebdd087f9aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174219, "uuid": "0034280c-4669-421e-b23f-187c38eaf4c7", "comment": "Malware payload (Formbook)", "value": "82e7401aac9ed16207ccc1cc622a57e1dc09f82cec93159a361dd15b79b344bc6cc363b418f0c00e309407fe39ff7e3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174219, "uuid": "d8e1584a-d8c3-468e-bf07-fb923253db26", "value": "T17FE4E0642368EB07C5769BF91832E07457F97DEDB811C22A8FE96CDB7972B004E50293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174219, "uuid": "0ca9d163-8f5f-4bc2-b6e3-e0c964bc41d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174219, "uuid": "6b7f900a-29e3-4b98-8729-e62d3253a931", "value": "12288:oLtTMpm+gvyxSQoE28fH+b2Lrpr9xTFdU+fDpVUNUGc6xZidXjSSs:+tTL004XxT7LfDpVSUlGsJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741174219, "uuid": "a36a8fb2-8d82-4241-a336-0dea37c9d53d", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741174219, "uuid": "52ced844-6760-40c2-9977-63b094d6e7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174219, "uuid": "47ae79b5-f9be-4d65-9934-2206f7518739", "value": "4FaxVAj4tnLxTFs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bafcef-f9a9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741169187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169187, "uuid": "bc4aa0a0-ddf6-4686-8f8b-7ceb8fdc164a", "comment": "Malware payload (Mirai)", "value": "ef40ffd93343d7df30e197f0877f2ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169187, "uuid": "4dd82f47-e77c-4f10-9105-da9b6b7ee127", "comment": "Malware payload (Mirai)", "value": "2e09aaf41520310e3011408d46d7a9b45519563f7cec841f49c47d40c8fb2693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169187, "uuid": "9131e118-f9c1-45c5-a442-87c4c3d487e3", "comment": "Malware payload (Mirai)", "value": "9570d644f9f3d21b7c6e82f1d33b8408fee9b615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169187, "uuid": "6381c955-529d-4bd1-a20b-0061b55f191e", "comment": "Malware payload (Mirai)", "value": "3b21e28c5f18317a52ee85d29a680934b40a04db0873acdbbc7bcb0c4fcebb75d9090a68cf0194f949b22c0cb1553bee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169187, "uuid": "12263819-af1f-4da3-858e-b457f7223da5", "value": "T1DC63D847AB604FBFC82FEE3705A9060635CCA54713A93B353574D828B65EA4B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169187, "uuid": "dd9b2469-f4bd-47a1-b535-db6176de636b", "value": "1536:zZz4n3NyUkZXRbmcVxmMG5BZ+rmmWUCnw:zZz4n38UkZjmM2BRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741169187, "uuid": "cb1c9080-59e4-4268-bb71-800743752e62", "value": 72480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741169187, "uuid": "c0580b14-8949-4801-8d68-2b9ae09a1ca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169187, "uuid": "65bca55f-0857-4341-a922-4e0f68b1eda3", "value": "cbr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213cf73b-f9cf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185348, "uuid": "02c5b0bf-475d-427a-82f2-16171859223e", "comment": "Malware payload (Grandoreiro)", "value": "841499073ad92c7913ff45179a660aa0", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185348, "uuid": "1d269087-4b83-4e3e-aba0-ce1bd796b874", "comment": "Malware payload (Grandoreiro)", "value": "2e631b459e79d0d75bb4a6e6e25af5907fce327f51fcf5dc87864fe8af68836f", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185348, "uuid": "036fc8ec-2415-4b24-a64a-1fc2abe28764", "comment": "Malware payload (Grandoreiro)", "value": "64b384c0e86a25d53cd365c1b24083bbb88e0be6", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185348, "uuid": "685bbc8a-3722-48ca-8976-41b8007cc1c9", "comment": "Malware payload (Grandoreiro)", "value": "f329493d6daff7f3ae75e30d5acfd6595facddf9bf6d5d5b4030b545b4f303d99a07d484029adaa74121896d6a33bd05", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185348, "uuid": "155adea5-f651-40c3-8cba-2b18d3aebf03", "value": "T14E9533D879C90590FD887774BEEC578FE6E017A588E0C933D721E4E8AFE705289349A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185348, "uuid": "e05f00aa-cec0-4f03-8ab3-9c401dc4810d", "value": "49152:eSiNQmkk5g756ASSHGC9RazaJoVwcdz6eqHJ5kSLgWvUW2/n:eS2Qbk5gTj7azaJ46pL9LgF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185348, "uuid": "d08625b6-9322-4e4e-9ad2-35b41d2dcebb", "value": 2039879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185348, "uuid": "de1b9dcb-2223-40a9-ba8e-2518e29b8da5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185348, "uuid": "56e954f2-120d-4fe2-977a-73565b5efb21", "value": "576485653877BJCE1768_CITA5546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed197aba-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741159491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159491, "uuid": "3794a639-fb79-438b-9cf5-146616300403", "comment": "Malware payload (Formbook)", "value": "7210fc3fe97c0d692f7d9fa0a3665717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159491, "uuid": "8cea46a5-feb9-4b8f-a944-450397c5d30c", "comment": "Malware payload (Formbook)", "value": "2e911f1f12cdbe9e6da0d0c0c7906ccbdd669751c98a75e556890b2a0e5b0af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159491, "uuid": "d75a8ac7-d1c6-453e-b8fe-0f51f569faac", "comment": "Malware payload (Formbook)", "value": "73146a16ee3fb2e1710800e365deaf8fb2953610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159491, "uuid": "0fb06e8e-3393-4606-9e6d-c48d83d69126", "comment": "Malware payload (Formbook)", "value": "0162d319b013b33b18c9a7c37ef9681e6647143ccf6dbf0cba23f1fd685dddddd2b950528d430062e5e4fd850b04b635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159491, "uuid": "f51459ab-96c3-4762-ac71-a727e3e141e7", "value": "T1A345CF2273DDC361CB669273BF2A77016EBF3C610630B85B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159491, "uuid": "e05c2dea-e32c-485b-8aa1-2ef1927c8c55", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159491, "uuid": "7a144487-f88b-47e9-a39a-6c346d4f8ee9", "value": "24576:ju6J33O0c+JY5UZ+XC0kGso6Fa9KNR0K/CixZPhaUqWY:tu0c++OCvkGs9Fa9KNlCix1hakY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159491, "uuid": "3fa28f65-604b-46d8-8444-53831e203c75", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159491, "uuid": "b62b1ac4-d758-4a71-8606-4b155fddfbb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159491, "uuid": "52b6ef65-5f24-4c8e-83dc-e85f2652feae", "value": "Payment copy-8899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda7c324-fa0b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741211487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211487, "uuid": "518a5229-6477-4856-8b9f-4081b77bf612", "comment": "Malware payload (Mirai)", "value": "c5eeca1402dfb28af9db78762eaadb14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211487, "uuid": "31d8798a-aa6f-484d-aeed-a74829ffdb9f", "comment": "Malware payload (Mirai)", "value": "2eb01d6840b22aa0bcae7a7ab0e65a3ecc67a083490eb59e28498acc3a566339", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211487, "uuid": "6ce918ce-0d71-4aa5-ae6a-9aa9dc24c9e6", "comment": "Malware payload (Mirai)", "value": "dfe43db05d6be3ef8b052780748037cddcf43b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211487, "uuid": "af883920-8efa-4ab1-8d0a-4366169489d3", "comment": "Malware payload (Mirai)", "value": "5664af3861932e5d6b1446e2e2d24e8edc67c2c98592df4ba457b954eaee539e644cc582255170c5f5566ba5bc04320b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211487, "uuid": "d3b55257-de69-44b8-ad1b-77047152dd98", "value": "T12DE32A06B31C0A47D1632EF03F3F27E093EFAA9125A4F644255F9B4A9271E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211487, "uuid": "a7200bad-683f-47f0-93a9-3a40e0082271", "value": "1536:JnUeW7QsOA+fMfuey0xo+dcdzvgtNLACPKvxtkXQ9ozqhZvAjW0brqDVUf4Lqcsh:J7t11DN0xyzvgUxxtwQFgjxsiAxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741211487, "uuid": "ea65646e-7c43-4d35-b86d-380b1e258af8", "value": 154544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741211487, "uuid": "150fef0f-e72b-4ff4-b477-a51ff03f4152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211487, "uuid": "6b8c1042-0195-4d0e-8139-86adb8733acb", "value": "efjepc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef172d93-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741156487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156487, "uuid": "d41c14cb-74d0-4495-9419-aa089114fdec", "comment": "Malware payload (AgentTesla)", "value": "85b4824304fc9b7d2bd147704fd66d7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156487, "uuid": "0e237442-2310-4a7f-8cd6-5239889c1031", "comment": "Malware payload (AgentTesla)", "value": "2f2f7c7ccb9e38e011a2470e9ef8dbf34529076d6d73faeddc600c7b891e0a21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156487, "uuid": "27231ce5-544d-4fea-8033-d43c0465158b", "comment": "Malware payload (AgentTesla)", "value": "f1d137f4a72f7f896153679eb26f8ce955e1b7d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156487, "uuid": "0d270bac-b621-4550-ad99-a2c708f1c8d1", "comment": "Malware payload (AgentTesla)", "value": "f9016fda55d3c8b5fed2a9c560da8718e07b0e1206b5c9b88712da331c84f904246be1e05a17c600d2416c277f85eb71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156487, "uuid": "d2326eb9-320f-4c8f-8c88-91872fd702ae", "value": "T19EE412A87619E007CE9097791E72F2B566BD2EDDB915C3534FECACEBBD52E200C44182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156487, "uuid": "d49342e3-d6b7-4f22-b4e9-5ea783a87d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156487, "uuid": "a4e6517b-b83d-4ecd-a1ef-6b9cf505ddf8", "value": "12288:z/fwpm+gvyDZ4E+IruI/D4jfE7j6U+WsY4MH9OsBibc+4JPtEfg45/kR:rEZuebYQkctJPGI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156487, "uuid": "8f8988ac-fae6-47d9-abbd-3d0b22e48590", "value": 713736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156487, "uuid": "5091d5a6-b5ec-43de-8fe7-79bedd5d1af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156487, "uuid": "257564fa-6616-4173-bf9e-621e360a438d", "value": "XHEOe5eXUdwJvXY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da06325-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199730, "uuid": "7876e563-1795-4215-92ef-c844c3413bd5", "comment": "Malware payload (Grandoreiro)", "value": "4ee493997ac942d6b64ea3e96c6a007d", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199730, "uuid": "b40121aa-6948-414e-bfb9-c8a9a7004161", "comment": "Malware payload (Grandoreiro)", "value": "32b28cb344211a009487b91219c5f6484926a46af3deeea0c2a5926087c980cd", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199730, "uuid": "ba789d3e-4c26-4ec9-a26c-615545075f6e", "comment": "Malware payload (Grandoreiro)", "value": "3ab02c5766a5ece3e1cda30e32ddd8a2a4068d76", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199730, "uuid": "b3355327-68e0-492a-be51-979ffcf0cd17", "comment": "Malware payload (Grandoreiro)", "value": "ed6bb89b62e433a80a953c8d53a349c9dd56b3a099f68dc2df68d0da6d78277713b199c9963b311c0a118d8f18d4d4a7", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199730, "uuid": "921d5a83-80e0-4d91-9276-a2a6a49b2ee7", "value": "T132D5338823DD8641EC48AB75BE9E6FCEE4F402BD4A11E712F294F797CF25016DA2D406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199730, "uuid": "01afb891-84da-4df7-ab08-6b2d82dcb20f", "value": "49152:10wIhO5NzNhFGAg3oxuFAsfX14IhwJ8Hlr0HIs7YzrAi5e5TfTuUEOjhkIy2/A:vzNzN/nejX1hhwuGIs7MMKhmCQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199730, "uuid": "cbaf186f-02b2-4e9d-808e-065c860ce507", "value": 2913873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199730, "uuid": "d71a58ca-1432-4e25-81ca-88fe05d1eb9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199730, "uuid": "e5a98141-5475-4a23-a0e3-72e6bb233c41", "value": "700800CITA_257188456411.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ec3032-fa01-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741206970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206970, "uuid": "4be96462-59b9-4eba-b28a-d3d34c7b2b21", "comment": "Malware payload (Formbook)", "value": "a4aee80f10430106028dc30d31bfe92f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206970, "uuid": "34d20f86-1d4f-4329-99f9-5d78672f1ad3", "comment": "Malware payload (Formbook)", "value": "32ebddcba23f81bf687688953ba6e867cc3b325b6da0dfb688983c2d9de8e678", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206970, "uuid": "01b7ac2a-09b0-49fe-8978-e8a38db34340", "comment": "Malware payload (Formbook)", "value": "683e7332d2a9432c6fba47c45ea2dbc907741ae6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741206970, "uuid": "c5b94078-5a15-4883-a872-7292e61c5475", "comment": "Malware payload (Formbook)", "value": "fff9aeb34f76bbca2f3c185f89e6cb7e8dee9eaccf6174a9483213230d1a4d0e0c7fdc374ac1ded0f817eeaa2f1c08ea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741206970, "uuid": "e6935c39-d013-409d-984f-2eb2547971bf", "value": "T1A3D423D7F0A5781E01B0AED7DD589D3D8A9CB9A008714F4239AF24FC2B512D4A3B79B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741206970, "uuid": "29382356-637e-4434-824e-e55a8d749d1c", "value": "12288:TxzLT6p6mIIA6rweTUauBsMy9L95pkzCMJEaWjlKzQtmRSLUHX3BWGFPZoq:Tx8rAaweTUauBsMydSfIiQYR5HHQGFZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741206970, "uuid": "268353fe-bb4b-40b6-b659-52011f517c0d", "value": 603226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741206970, "uuid": "82c05c39-8ceb-41e2-9561-ab37f82c2e6d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741206970, "uuid": "9a6f2b18-e9bb-4598-ae07-55cafcdfa2af", "value": "Shipping Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f7bb7a-f967-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741141007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141007, "uuid": "5e0b0944-1d11-433d-a094-33faebd62471", "comment": "Malware payload (Mirai)", "value": "057e05e8c8d28cdda6963a0e61b4cb5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141007, "uuid": "8891d485-33e4-4fd0-8563-63e33e90ab37", "comment": "Malware payload (Mirai)", "value": "331730139912631d7148036c64a14e9b2ab25601af5128d6cb82418616f2d19b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141007, "uuid": "a9a676da-8061-4f10-a0cb-ee01112ae259", "comment": "Malware payload (Mirai)", "value": "8aa2871f7043bb13fb5ffc09e64ca645c3f0b029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141007, "uuid": "ddb59218-b8d3-4c13-80dc-27a5cc6dcdf7", "comment": "Malware payload (Mirai)", "value": "6bf102bec16d3c2341cdcc5c97d77c553d021f64816c5cc1ea3864ab30fc33f579ff145a31ceb37a01575110f75102fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141007, "uuid": "fa379c07-9fa7-48f7-b7c4-31e11ecb330e", "value": "T1BAB3E706BF610FF7E8ABCC3705E92B0528DD595A22B8BB367A34D418F54B24F15E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141007, "uuid": "7ec356a9-8081-46e1-a891-40eb5dad8cf6", "value": "1536:t7jNQfvnf5wU5sw03TxP3HmbNILO8HIIXZRsvRT1SLBEf:tvefvnf5wU5HT8HIIXaKBEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141007, "uuid": "677b5041-f862-46ec-b1af-a2956d787e62", "value": 113732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141007, "uuid": "978eaa00-ffdd-4389-8259-72937fed603a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141007, "uuid": "895ec0fb-aa1c-4970-957e-5b7c344b2443", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecce6c8-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185129, "uuid": "fc2a9cfc-b1f7-4c0a-afeb-7944164ce802", "comment": "Malware payload (Grandoreiro)", "value": "c7b2307af7c701e76c1b493c9bdfde0c", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185129, "uuid": "ac163c3c-c1ea-42f7-956e-f19cef7d0edd", "comment": "Malware payload (Grandoreiro)", "value": "34193daf1496ead65094330840dbd695b69ee6e7fdfe706e8087d578542a2f80", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185129, "uuid": "0e5d0d32-dfd2-4ac1-9148-277d29e38a0a", "comment": "Malware payload (Grandoreiro)", "value": "72d71843488e6c748a8c24d12cf27a881b9b0928", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185129, "uuid": "8bb3a110-9bfc-43cd-b852-02d0f84c07ae", "comment": "Malware payload (Grandoreiro)", "value": "36903c8d39cc968d9edda4cea8e0f194c516ec479ba488c60e893573c5c0e221394a306530919ed8e9548bd0f8ecf691", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185129, "uuid": "4f608d55-f51d-42e0-8e82-124b535c956e", "value": "T1CFC533895AC65120E88D5B3AFF9E4FCBE0E508AB8F848B1B9721F0D47F750526F79604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185129, "uuid": "484ad24f-33fa-497e-a909-2380883baa05", "value": "49152:TbvOvgyvDaKUzoyCjdJaYn8lpd5za0vldG8yNP0BfFHj808Aw2/4:TzsvD/UzXIdsYn8lpdMOlYOBFHj808Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185129, "uuid": "a9dbaaa5-eba8-47e0-9510-2086172d6c0b", "value": 2654278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185129, "uuid": "15a294b9-8bab-4fe4-860d-5ad94784c004", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185129, "uuid": "6a14289d-5b82-4b88-b9c5-9e92a642326f", "value": "881469354391DNPO4818_CITA5353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c3bc2c-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166753, "uuid": "75bd96ae-0d25-4c0b-b65d-732c51c3ff5d", "comment": "Malware payload", "value": "05d54e78aa3f3203251ab7aedec85fe2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166753, "uuid": "e481c5fa-dff5-480f-995e-a3bfcf18ab25", "comment": "Malware payload", "value": "3458872a96afaa4e7bf499c1a0581abae5c1d53ae31d01a5f10edb0a385662ee", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166753, "uuid": "764aee4b-14e0-4b54-b501-84198cb6c04c", "comment": "Malware payload", "value": "b7c627b3f967af41727b1fc639700bf104a5336a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166753, "uuid": "d72fc836-a36b-4268-9e1b-9548ef37f48f", "comment": "Malware payload", "value": "e559470071e3d3c02c1550efac715f4a3286a84ae07eb7427ae1069194af03c807933011e889992f757c8571418047c3", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166753, "uuid": "9470ffed-3fe6-4c8c-84a4-0aeab7aaa8fb", "value": "T14D562396E5B80DBA46EC61BDB5F8BF4523D8098205DEE8F744EE68C34F0A7530633691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166753, "uuid": "1e61d296-40f1-4d73-b11c-539bfaa3ea6e", "value": "49152:kfivMm5Ft4o38uLEGZnluSb1bPNO2O1LO23xc7+LvpUtMYhAW:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166753, "uuid": "bd216c0a-3a09-4d70-a0e5-aa80897be44f", "value": 6280440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166753, "uuid": "f70c2b5b-b143-4b04-aca0-44f1d91424fe", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166753, "uuid": "f0712340-858f-4c09-a075-72e81e5549da", "value": "3458872a96afaa4e7bf499c1a0581abae5c1d53ae31d01a5f10edb0a385662ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538b4da9-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (MoDiRAT)", "timestamp": 1741160092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160092, "uuid": "aa087498-fa19-41f4-ae0f-6931345cba45", "comment": "Malware payload (MoDiRAT)", "value": "2cf3de49771770551ec30ff34f270840", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160092, "uuid": "667e8406-f3e7-4bfe-a394-ec588c1901e3", "comment": "Malware payload (MoDiRAT)", "value": "352011f27fdcc8e71a7e0171e7b88509b9848254404f8d91ce3c9d790c335d8a", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160092, "uuid": "9e4cffcd-bf50-48e6-a680-1114aca779b2", "comment": "Malware payload (MoDiRAT)", "value": "c80bf196dac5ca3467cda121ad91225e5f707dc8", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160092, "uuid": "d3466735-61fd-495b-a54f-4208d1d2e0f7", "comment": "Malware payload (MoDiRAT)", "value": "96180182cb88bf288d376ba3009ac566727e69a3d76eb9d7aeafcb42ec52882bb89eedbc7de0d6a05f8dd51193a6f2ae", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160092, "uuid": "c5dcd407-65e0-4e2b-8fa4-d8feb8f4a3ae", "value": "T1EF034C4877DC8726E1BD0DB64870921513B8E617EA23E79E1DC6D1FA2E633C04F41EA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160092, "uuid": "244ae41b-29c3-4fd8-b6e7-251b3d6fbc49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160092, "uuid": "e9587f32-07e9-471a-aa39-c073691d5cad", "value": "768:U8zbMDAsNDxPmEzcUCMNpLKoeJeqibOTorjahNXvRbDK:Vo1mrM4JefbOToChNfRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160092, "uuid": "082949c0-5d8b-4664-8bd2-52f675e2e88c", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160092, "uuid": "113af458-b285-4daf-9846-30ffbc5905cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160092, "uuid": "d073a11e-977f-4e02-ad57-da09150586fe", "value": "352011f27fdcc8e71a7e0171e7b88509b9848254404f8d91ce3c9d790c335d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e3ac48-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199871, "uuid": "96909549-3968-4bdb-88e5-3ccda9a2b174", "comment": "Malware payload", "value": "6076695c6676d7e9e405ba03e4b0fcd4", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199871, "uuid": "94e96d17-c8bd-4365-a7fa-5a5e3cee5933", "comment": "Malware payload", "value": "36070170aa311865e69fb319b7bcd5e7cc81a6cde9920931200f85ae278ed6bc", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199871, "uuid": "be2d9a6a-a74a-4c1b-96e7-741f924d6cd6", "comment": "Malware payload", "value": "fcb7516ca59fe7d055389743692f0b6bfa0ad555", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199871, "uuid": "5ed123c0-33d9-4410-ae7d-82e4b29a3a8a", "comment": "Malware payload", "value": "031b3417ac04df49a18452e4ff86ce6cd991be803563147268c7c18f061fb42c471328d2c238317045b3b3cb8b57dc36", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199871, "uuid": "13b244dc-9234-4f67-9dd8-bdb9887b9868", "value": "T1E2D533413BDCE365FDE49BB46FE82BCED1E217569780C56392B1E0ADC740024A76CAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199871, "uuid": "f608ec9b-796c-4b73-8efd-19b482001dff", "value": "49152:ELa+SlfhAJqZg0o579QX/2PMxsCvDGRfD5eMQo1vDdxC994ngHVs9HZrQQystduc:EG/2uJo579QX/2rCiBrRbdo9yuyHZrQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199871, "uuid": "58a1c64b-3aed-4b71-b6af-94b0f610d12d", "value": 2767347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199871, "uuid": "cf582812-69d2-41b8-931e-f034600a5dbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199871, "uuid": "03c69252-7057-4ef8-83eb-fc3b68f3d59c", "value": "959700CITA_903181082743.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3190b4-f9ca-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741183490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183490, "uuid": "30bab3e6-f72f-4741-9690-867ecea4414d", "comment": "Malware payload", "value": "02876d4e437150d1fd0f6db01de7fa29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183490, "uuid": "9b0bfb93-9eeb-4ec6-b42a-fbb6a8218624", "comment": "Malware payload", "value": "3696ab81b358000c099713e2a2976aa244f6ee2f6304878b0663ff2b6cf4b130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183490, "uuid": "80dc6be9-de16-4552-8ead-0972e402f83f", "comment": "Malware payload", "value": "f71c9f8aea83ffbf63477a4a6bcfc04df0fba18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183490, "uuid": "84e9647e-d95f-40ab-9cf7-360706239628", "comment": "Malware payload", "value": "23a9e907f86a48b3e408fddb248f33a99667a0d4d169fe6f43e07c3b7fadd6527dd9071e810a5b8c2e8ed6164b1bf6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183490, "uuid": "b2853fb6-cd14-4bb1-b0f7-58bc30db6781", "value": "T11287331E5356249CCC736AFC8A76C9B1E1FC7C5C2631498E53A36D0E7C3BAE4195B222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183490, "uuid": "5d73019e-59a1-4209-a88b-131b3261d9d5", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183490, "uuid": "522bc439-ac28-4fb0-bd0c-086b057d3b6f", "value": "786432:n2I6vQKxNRcrf4rLx20hc09e6fUlLSCFhfjCX6iYpczfWKeohQ9JIBT:n1YQK0f4PxyQchLLczXZy6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183490, "uuid": "d8cd613d-3e14-4d83-b72b-5507b0157eef", "value": 38126312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183490, "uuid": "56e9f178-b8ad-46f3-80aa-7435e01e40a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183490, "uuid": "5229ac80-3a6f-4002-b6bb-d330c3d57348", "value": "BatonSwitchRelease.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32bda84-f98c-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741156897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156897, "uuid": "df62ee2d-e0bf-4ecc-98d5-002c2f6b9a5a", "comment": "Malware payload (Mirai)", "value": "3a1c84e751f749fb7aa129fada29c388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156897, "uuid": "8039dda9-660d-4eca-81e1-5e40033379e3", "comment": "Malware payload (Mirai)", "value": "36be1b18150d1881d271a5c6f9f750b47712af3a16e98ebd721cb6f51d8f847f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156897, "uuid": "80f54278-93ce-4da4-9edd-beabacbd1f74", "comment": "Malware payload (Mirai)", "value": "8d89aa6af13ad64b0b20408b994b166a1f148620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156897, "uuid": "b5c0baef-543f-40d3-9d06-5fa99dd75af3", "comment": "Malware payload (Mirai)", "value": "4792bf58c0f4d989f74037f1971e1b1d4408c6ebf7ed5c205dc236bb6692f1709cb204916c0a2ecdd868ec192f3d73f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156897, "uuid": "c25d5ac4-cf48-49da-99d1-90a506431b96", "value": "T180334C42F30C094BFAA31DB0363B27D1D39FED8031E4E6C4B61E9A499172A315656EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156897, "uuid": "25dfffa6-316a-4b21-b0ad-a85021d5e91f", "value": "768:tAGRb23Gy1DBcNe/QwC9uGYT+CLDO9ZJffF9StLYSRCIE:t1b22yZBo/w8utTjXkZZbSZYSRC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156897, "uuid": "b22f84e8-a754-4f3c-b20b-dccd9757f430", "value": 53032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156897, "uuid": "b5851a0e-5b27-44f5-a0e0-fcff935a70ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156897, "uuid": "c15dee0a-95b7-49a3-a3b9-0245e9dc1d8d", "value": "cbr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5d74e0-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741139494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139494, "uuid": "3f6d4d57-f830-4d3d-bd9d-ce93e8138f8d", "comment": "Malware payload (Prometei)", "value": "592365e18a75c71c914601b55eb815f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139494, "uuid": "990a1a31-5b9b-472e-bb49-32ac5688ad9e", "comment": "Malware payload (Prometei)", "value": "38c21501d122e017ebb087d5e9f946b4c0b8bf15cbf4d53486da15c7860d4b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139494, "uuid": "dfb9e53b-e291-42c2-baab-2fd5308a131e", "comment": "Malware payload (Prometei)", "value": "e9aecc9c5760a16679074f3e43710fdf0969755c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139494, "uuid": "dbc5dbb3-3c0d-487e-88c7-af403eec135f", "comment": "Malware payload (Prometei)", "value": "b079eeece1011c794b6d32eafbf5c8caa9ae927e663afbd8b952912c5344ddd0cf826a830c459c62bb5fe5f33c774f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139494, "uuid": "65c9f969-b7cb-4566-915d-810b33010b26", "value": "T15A9423F31824B3738A2C3A3EFF609E05D79A573CE55927561A1FDDEB0F2991209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139494, "uuid": "12d11e77-7a58-4c63-a05e-394b405c5295", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSW:W4/y+qaBUZJAdVtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139494, "uuid": "de8d4335-6584-4654-b0dc-d7993677a017", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139494, "uuid": "ed55bada-dd86-463d-b999-e11abf46bee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139494, "uuid": "94b2c0c4-f577-46b3-902e-6371c3303363", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddef3cc2-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181799, "uuid": "b8b28b0a-c793-441e-a835-c4f839bf4d0b", "comment": "Malware payload (Mirai)", "value": "2c29e9d5b0bfd0d7d817a79cd813c3f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181799, "uuid": "055daea9-3b22-4d29-b9f7-c8e721e312c4", "comment": "Malware payload (Mirai)", "value": "399233084a4f362d6f748718575926b13d55a4115d16c28a60698379b774fd69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181799, "uuid": "95242278-b074-4568-8565-960d43537d99", "comment": "Malware payload (Mirai)", "value": "61685967e1b036b0925be464cb66fb288c31babf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181799, "uuid": "b3961819-eeee-4edd-9247-a2c5948c0816", "comment": "Malware payload (Mirai)", "value": "0f89e26e783681f8d93ba8c7994e3828235036cd11d646c2dc55e8ef67a64d428ee680ef014ce214c30048e53c541b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181799, "uuid": "ea105d71-64c7-4824-b535-a7c3152d6de9", "value": "T13903F19ACCAF988BED5C3CFF94850B428444F888354F8B589776CBE0771EA07B418978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181799, "uuid": "9ea9499a-8b89-47c5-8fbd-10ec9574693a", "value": "768:fWwL2y1vGYbuTHtHtoAe02sPo0XuG+EfZPRK9OScT/3WMp:uwL2SuNpZJPov5EfF09OScTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181799, "uuid": "c85f4a53-e9f6-4f9f-a73e-587cd73bd5ab", "value": 41244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181799, "uuid": "5ecd47b6-7356-4fc0-a98e-28a317ad118a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181799, "uuid": "87c5778a-c36b-4fe3-b103-f7c8036dc4bc", "value": "5r3fqt67ew531has4231.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c877b4a3-f99f-11ef-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1741165013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165013, "uuid": "f5397f7a-dc38-4a97-a85f-0fbecc38a547", "comment": "Malware payload (VIPKeylogger)", "value": "561132fd4e322f2bff9d12ec9dc818cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165013, "uuid": "b832b919-bd2f-4f55-bc15-970026812d67", "comment": "Malware payload (VIPKeylogger)", "value": "3a3d3d6ee6c705eb5cd66407edf6a27004dcdc8723994e0424f72eb0fa92c321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165013, "uuid": "cc4e0242-4b6b-4cdf-a2e8-7a94a1536e6f", "comment": "Malware payload (VIPKeylogger)", "value": "8a81db864d3ae60dbc267734328f444b8ee6864a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741165013, "uuid": "49e8983a-799d-42a8-9f0f-3d57d5302064", "comment": "Malware payload (VIPKeylogger)", "value": "fbbb9affbda8c5e7ccef7f2ed8c703bfa16128dbf8f1fbd46b57a8380aab0bd33317c3c725689e4e2fa243853fc85d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165013, "uuid": "86681465-ba35-4b4b-914c-cc8bb35b5c43", "value": "T1E325D02A7A00A02BC9D386F14872F67476282EA96F41DD0B17D49F977971A23B5F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165013, "uuid": "472be5fb-1b58-4e7b-a92b-965fddedb1dd", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165013, "uuid": "b529de98-0595-4950-9266-78cc2648ade1", "value": "12288:GENN+T5xYrllrU7QY67/ftpm+gvyeN30tupm7m5JzwXofJz/BK2FVjTlXuXReUvu:K5xolYQY6yJ30NyPz02FJT9eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741165013, "uuid": "af3c24d3-1f2c-4927-a260-3be1effc6f39", "value": 1016340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741165013, "uuid": "91059cc8-729d-450c-acf5-f0fa5c6b5413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741165013, "uuid": "4fae31a9-360c-4fd5-ba4e-a1266b493adb", "value": "20250301_173245__P20250301_173245__P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0decc3-fa0d-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741212099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212099, "uuid": "041c1c03-5ead-4b7a-81ef-d755e152e673", "comment": "Malware payload (Mirai)", "value": "d4af87a58e2384f5ef2105ebf4dba534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212099, "uuid": "aabf64c9-2163-483f-978b-1d9bca38d456", "comment": "Malware payload (Mirai)", "value": "3b00cb69e9f69c20cb03bb757ed1c1df50ccbe4202bb403aab1a053f9da8d2db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212099, "uuid": "df58e234-852b-43d1-831c-d9e6a9cb5efd", "comment": "Malware payload (Mirai)", "value": "53abb1a1c4b9f0838f4ffee54441a652d4845fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212099, "uuid": "0be248a2-c0a8-4082-ac8a-9dbf767d81b3", "comment": "Malware payload (Mirai)", "value": "3f1bffc5a084b97f4ebc30532bfbb2c91b0970070a28a37aa916a9a91cf84f9a82b6b83577a051a20f65272cc793ab49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212099, "uuid": "935f4e97-0626-4b3b-8a2d-6cf88a3108f9", "value": "T13EF34AC7F800DEBEF80AF7374813091AB130B7A254925B373257796BED3A1990567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212099, "uuid": "81a4dac1-5930-4425-aec4-0a634f5564e5", "value": "3072:03iSpyjlsrM2aPyQQRdojvSvk5JJNCz4oLWpVjjbiWLij9Q0l:UsSQyQMdoj6vgA4oLWhLiq0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212099, "uuid": "5b2e0677-e3f4-4839-9ddb-c3a4bf4072ac", "value": 170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212099, "uuid": "7b0264ef-8449-4c31-91a2-6c95ac68865f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212099, "uuid": "80c03535-da72-46d4-ad00-3d1f4366dde4", "value": "vjwe68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0298267-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185239, "uuid": "5f584819-0009-4bf7-a769-5e18aacb00c2", "comment": "Malware payload (Grandoreiro)", "value": "1d451d1e872c9d49df05b273619670e7", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185239, "uuid": "afe661b0-5d07-444e-9ed2-fc723fc73a54", "comment": "Malware payload (Grandoreiro)", "value": "3ca210852aaf12ffcb89d6f959637bc4d1524e0ecbfd1a42ca4626d142327cf0", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185239, "uuid": "f3d99698-1631-4660-b18e-053a929e5e7c", "comment": "Malware payload (Grandoreiro)", "value": "36e89b2f79c8fc52a5855c30d668569b1a703eef", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185239, "uuid": "ca032d79-f238-45eb-9b44-9f4120043196", "comment": "Malware payload (Grandoreiro)", "value": "826b81773de7463a87899f1565d6fba0fbf49c9bcfab26d6a91d6373034b4919dd1191aadfbb2b92e70fdc70512f8df6", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185239, "uuid": "8bf2e025-f59f-4723-b787-982fd0ddff1f", "value": "T1BEC533CC6DC98120EC9DB73CEEDE078E97D4562506E38B1762B0E098EF7D12664B52B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185239, "uuid": "9e6bf6d0-5ec3-4da9-a7aa-98f3999b9a09", "value": "49152:ey6RBs1SSCrAHa82llW9ZzJZmOAoXK9HQh9lTbv2/U:eyqs1SSNa829Ovsy9Fb+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185239, "uuid": "8bd15210-9e2f-4ac9-8d47-ea8f9446258f", "value": 2509581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185239, "uuid": "ffe662c3-edb6-4eb3-9222-012bee09941f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185239, "uuid": "400a3e2e-6b0d-4237-9cdc-8af0e2f3ee1f", "value": "526556302709TLET5434_CITA6755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffe04ce-f9af-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741171575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741171575, "uuid": "e729a7e4-b8f1-4f38-a8db-8d09b20373be", "comment": "Malware payload (Prometei)", "value": "365654243b5fca81302544832466fc0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741171575, "uuid": "243b98e5-5673-4fb2-9727-5a0cf6eec468", "comment": "Malware payload (Prometei)", "value": "3cc73d603673aba09db844447113426c5b82454f8f2f0e3c29a55bf0c22bfbd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741171575, "uuid": "f44f076f-a0ea-4fcc-b9a5-4e56d599e610", "comment": "Malware payload (Prometei)", "value": "9322cd207128a2821985d279c7bbc02991ee69c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741171575, "uuid": "216129ac-d4bb-4abe-bd86-f29629f6a0bd", "comment": "Malware payload (Prometei)", "value": "4cc15db3b5682a0b1f202a95a6d373ede334e216de7bf958ed1e5122abdf42f277527b6ec532c827e503a25254f1a1c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741171575, "uuid": "e417e468-4644-4202-b3f1-08f64fdc6c62", "value": "T172155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741171575, "uuid": "ecb323ce-b489-47e1-a389-1f5d7db272aa", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplN:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741171575, "uuid": "f4e4d6d8-c72d-4d5e-bca5-cadd40a3370a", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741171575, "uuid": "630602eb-5a4a-49a5-9d36-8d670d480a0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741171575, "uuid": "33f0122f-7c79-48f3-97dc-fd70195462b6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987fd6db-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160208, "uuid": "db4d9576-face-41ef-8988-c95ba4995c9c", "comment": "Malware payload (Gafgyt)", "value": "ddb1b56e4cdf19313bc73396ad632816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160208, "uuid": "ee0b75ed-6a7a-455a-8c0d-14ffde0ded89", "comment": "Malware payload (Gafgyt)", "value": "3cd8f829bcf3c3242a369e5d364de494038cc3a1495c4562aa2179691a63376f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160208, "uuid": "9fcd4e19-14ac-4cf3-abbb-74aedf27513b", "comment": "Malware payload (Gafgyt)", "value": "3737c6481573c76f8df31a02a7e589e97982779f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160208, "uuid": "9253e483-4a6e-4fb5-9e57-4a21fce45351", "comment": "Malware payload (Gafgyt)", "value": "6f689010799c7bef18c65c09336ce9ffe7ebe9835c8fb9fbf35b65fb878cf7e202b6c985f7b82883d17dbeb2256edaa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160208, "uuid": "46426297-2833-4d2c-a343-b966a7c32d74", "value": "T1A09329478D619FB3C0466EB125AB59300727BA220F4F1E98366D9AF4574F4CEB40FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160208, "uuid": "1115265b-9018-47dc-a8ad-f55b27492aec", "value": "1536:wqYvWSfoghyKGhI+fD1wNKGFKBv8cGRtICshbn6eDSeAsC5SczZSbULWZJgP7EQS:J+ffMKGhjBeRtICsVF2XdSwLOJgP7Zm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160208, "uuid": "506c8b77-a83e-47d2-98ab-90537648261b", "value": 94655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160208, "uuid": "b2b490fe-fad7-4cca-860f-04fd59a1e78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160208, "uuid": "a37cfa4a-ae5e-4e0a-848c-b7519cb9138e", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301263e2-f9e8-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741196110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196110, "uuid": "d9064aa9-e5e1-4f19-820c-c148c79e1da6", "comment": "Malware payload (SnakeKeylogger)", "value": "d0f28e6786a25a10c181bd4af4e7202c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196110, "uuid": "1b5e7562-75ae-44d5-aa14-44fd01fb703e", "comment": "Malware payload (SnakeKeylogger)", "value": "3d2fedd2f28e48f4f2088037c85d52fa9fdfcdf94f5352450d7525221766648e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196110, "uuid": "2390651f-25d6-4c17-9075-e51247a8ba5e", "comment": "Malware payload (SnakeKeylogger)", "value": "8aa2a88415ac8b276c28f806462fdf048d37e03c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196110, "uuid": "a4a1b158-202d-4aa1-86e3-3c31d3786ecb", "comment": "Malware payload (SnakeKeylogger)", "value": "5f35bc1607781e823ced5cf9dffd5289e634f2ea36377e66bbda60c773e9aacbe3f67c1e0aaab45b00d328db2f181d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196110, "uuid": "e02d4c32-969e-4566-89fb-95420196197a", "value": "T1FCF40268B718E107C6A15B350A71F3B4226D2EDDA801D31B9FCDAEEFF9326154E85243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196110, "uuid": "0a25acd4-109f-485f-bf3d-d49ac72a6e05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196110, "uuid": "3c884945-8543-4ed1-b34e-33c92f00c787", "value": "24576:+U83ilzaYnu+oteQ5/YGidGAG0lnv0QOfOW/2oiOdAkH:83izaYu+4H5/YGis+xQfO8iW5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741196110, "uuid": "aa8c9afe-c2b6-43b1-8678-f8f5e20524c7", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741196110, "uuid": "f34d4084-59ed-4fdf-84ea-995772f491d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196110, "uuid": "718b268f-dc08-4055-8515-9e412676b453", "value": "SOA_TONG WOH ENTERPRISE SDN BHD.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff4a588-f9f6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741202203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202203, "uuid": "8f294191-dcf8-4fdb-b6a3-ce7d733474c7", "comment": "Malware payload (Prometei)", "value": "d67628e1d3396bd0126337f7ff7b5987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202203, "uuid": "3c2f32b2-96a4-422f-9018-5ea7328f3978", "comment": "Malware payload (Prometei)", "value": "3dd37f094c52d34f14dc1d9cfbe9e2afc6b4a63d3a18b0786226fe169b55a2c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202203, "uuid": "c2fff89b-68f0-4429-9352-b110af956f63", "comment": "Malware payload (Prometei)", "value": "2872d435e64828932f9d5ac0bbc45a94cb74c312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202203, "uuid": "a5aeba10-77f6-4193-8121-c511d20f51ba", "comment": "Malware payload (Prometei)", "value": "53a2f8cbe74463af98a2e9c92223dcd4e0af61da88442b972f5247e8c103eb50e2877cb816f5e37ee2c72bf108c7ac99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202203, "uuid": "cfc3a874-1d8a-4e60-8d4c-c4e541a2feee", "value": "T1DB9423F31824B3738A2C3A3EFF509E05D79A573CF55927561A1FDDEB0F295220988A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202203, "uuid": "e958de5a-0ef8-4183-accc-1cb6934bf966", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSD:W4/y+qaBUZJAdVtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741202203, "uuid": "8a4c5e1f-1c15-4842-8c65-39d1c9fca26a", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741202203, "uuid": "400ab0de-c494-4f2f-aab8-85e6d8aed325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202203, "uuid": "2bd424f8-29b7-423a-9b48-fc0f2d51a3af", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e59cd5-f996-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160879, "uuid": "15f2bb0a-8c95-49a9-b7e4-1591291820b8", "comment": "Malware payload", "value": "95c5bc8a08223de82e466c8f16c91377", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160879, "uuid": "7012e2ef-61ab-4275-ba74-15656e272f3b", "comment": "Malware payload", "value": "3f1c5f7fd42924d7789c008d97c837094e8bb44974aebc5e294e15705f5c591f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160879, "uuid": "9ed8e09b-d8b4-4fad-9f5e-ea7ee589e157", "comment": "Malware payload", "value": "c7fcf3f7458bdf0c935049b1f63845091a798253", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160879, "uuid": "6efe4788-c642-44b0-b771-6e3cf7605df9", "comment": "Malware payload", "value": "2b321fb8d38b034d6057fd0749eb7aedd02cd6cb8c64f0c9985f041ec28341dc431237197ccc87618595fd7f51725ad4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160879, "uuid": "bd6d9ff3-fea7-44aa-bce3-fd01d89e2f27", "value": "T1B8F34B6CD74B80FA329D33D981A07D0D5719472B8C6CE082FBDD27C686E059717E93AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160879, "uuid": "72a39ff4-2e34-47e1-9907-455f3de97801", "value": "1536:yRPcDH6yDt49fEUMwlz4IhYHkeiYlcWWGp8:+cDt42WMIhYHkeiYlcWWGp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160879, "uuid": "9bd613da-96cc-4bda-b2fe-8ca317ffb311", "value": 172366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160879, "uuid": "7c0e00a4-2d10-4ce5-a414-74dc28d8a3b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160879, "uuid": "9895924b-80ff-41be-8ea0-396402b3ac59", "value": "0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c1174-fa04-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741208254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741208254, "uuid": "5d832533-8762-45d3-b6b6-f1802f47ad4b", "comment": "Malware payload", "value": "1fa9c173c6abaae5709ca4b88db07aa5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741208254, "uuid": "5d0dabc3-bd2e-4f3a-a198-eff1c0597de2", "comment": "Malware payload", "value": "3f8fba6c55005a7dc441c57cb7099c0c77d5df62c495e1fcbf17ab06291b4247", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741208254, "uuid": "8fd7e3b1-d50b-4612-9ff9-4df740898a5c", "comment": "Malware payload", "value": "dc77a5b0aeede04510ad4604ff58af13fd377609", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741208254, "uuid": "2df35c69-cdde-403e-8283-d88c0e74084f", "comment": "Malware payload", "value": "4c91e5528e74173a853341d7644a7f0542e1d6f85718f60f658912aff76af743074eefef10cf1b355e40cfca4f143535", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741208254, "uuid": "a769f471-93cb-42c4-91e7-b52b2eb39474", "value": "T177159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741208254, "uuid": "b9843f53-262b-49cb-85f1-d17691b2ea15", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741208254, "uuid": "530cf0b2-b5ed-46d3-af52-8c9804c9c92f", "value": "24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8a09u:OTvC/MTQYxsWR7a09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741208254, "uuid": "1e549f9a-717f-4a89-b3c5-a5b6faecc25d", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741208254, "uuid": "86f85ab8-12d1-44ef-a612-c56a9f39bc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741208254, "uuid": "ad379be7-483c-4995-963a-2e5b564534e6", "value": "5c9465cda4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e07467a-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156298, "uuid": "cd920c34-46a3-41ad-a331-32d9e6cf2c94", "comment": "Malware payload (Gafgyt)", "value": "c20152568d09fd1c4361dca799924137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156298, "uuid": "a6670f87-8642-48db-b0ba-a746e7d48c3c", "comment": "Malware payload (Gafgyt)", "value": "41afafee5f97779438b21d0b2ed5d423e81cea8635b7b543197f506af0529fe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156298, "uuid": "7c5c52f1-30f4-4811-876d-ef4d2b45b0f2", "comment": "Malware payload (Gafgyt)", "value": "729469d430c62035573f1c1a2ce235d868aa173d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156298, "uuid": "c617b612-23cc-4a76-982a-58cbd6a75423", "comment": "Malware payload (Gafgyt)", "value": "64e540dc5bf850078fd1b465168f7d8237b61d045c525200313e06d91f8b60e44418be01e384d4bfdbafe9db3bc9f6b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156298, "uuid": "640be0d7-9ddd-4ec0-9cc7-1cce49426e39", "value": "T1A5833B43B641CA73D08316F6169B5B110632F9BB1E5BAE56F36C3DB4AF110897222FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156298, "uuid": "9e3576cf-8235-4a8d-a9de-2f1bde78cefd", "value": "1536:xNqbqkZ12Ue/Wz/P9ZhxUzi+8F0p32cBN45hlQ6hICMIis3r0OzRPF+jHeN:xgbf12Ue/WDP9xUziB6pmp5hlQiItIis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156298, "uuid": "69040cf2-f2e5-44d9-921f-db980b1a54ae", "value": 82006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156298, "uuid": "432d3a37-de9d-4211-8fc6-903bdd03501a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156298, "uuid": "ec6a5745-f3f7-4b68-9f21-cb6275c37deb", "value": "Okami.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1e68c3-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160214, "uuid": "bcbecc4f-0714-49ec-ba82-3f6eeca9623e", "comment": "Malware payload (Gafgyt)", "value": "6b47d126bfe287902295310f212ca63e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160214, "uuid": "f6667651-4c85-4033-b457-9ac1ed935515", "comment": "Malware payload (Gafgyt)", "value": "4273837b79c6626c5dd81ff49a38ddcc339b08ca5f0e29e04617e1f9457fd01a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160214, "uuid": "303a3833-f0d8-426f-a343-f6d6968d546d", "comment": "Malware payload (Gafgyt)", "value": "a9a0bbabc239def4d9646aa4fdb5b4b90f18a0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160214, "uuid": "1fa498a2-c04e-4347-adc0-ab684845e837", "comment": "Malware payload (Gafgyt)", "value": "e5478a6d76882e7db7bdb71279ebff26a93fdace8ef7f61716225eaffa20d5b11e87ba87c351f6ad9284d0fb0c666874", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160214, "uuid": "9005ef55-4a2d-47b5-a323-2d7edb7d7280", "value": "T13BA35D1B9251C6BFC08756B82BDBA5A15423F83A0B37720A33D4BDB93F168D89E5D305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160214, "uuid": "97cdd6b7-0d87-446a-be3a-f0d73494550a", "value": "3072:ug3CgaWg0rgOcILZHR0BYilMcU01OCBsu9CP:zxcIldilMcU01OCBsu9CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160214, "uuid": "32c9ccc6-3901-4b9d-b0a8-d7f1f83444e3", "value": 99008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160214, "uuid": "fc18cbf2-f50b-494d-ab02-fc187b3e9931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160214, "uuid": "d88fb301-8562-44c9-9999-b20f17b78c63", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f44c885-f9f6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741202202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202202, "uuid": "3fb13bca-26e5-4aa9-9d5a-e476a29a2c47", "comment": "Malware payload (Mirai)", "value": "947247f8b3eb6cdfd9a6e5ffc13fb434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202202, "uuid": "9e6e54bc-3455-496e-a964-bccb3194ede2", "comment": "Malware payload (Mirai)", "value": "443f23a151f31579efd815cd719d8ad46d3ff922a630cad9cb57998b0746b3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202202, "uuid": "b15f31ec-b1bd-44b4-9150-8214e4001da4", "comment": "Malware payload (Mirai)", "value": "4ae216bccf3575c57cfc86199971a3c8e7caeedf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202202, "uuid": "92874bd7-d7f7-4ea4-aaad-4519e17980ed", "comment": "Malware payload (Mirai)", "value": "8373509cee55be38f66bdab39935634fe8a71daab80668c8c66efd099a1e1416daf4e8fc15483e54e9eef4b5e2822452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202202, "uuid": "1f3e9a9a-e800-4e10-bb23-dab4695ce795", "value": "T1E5638E72D41A6D58D1850570A8348F311F23F2C982A36FF72AE582B5844BEBCF909FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202202, "uuid": "09576862-ccfc-4f54-b7a9-0ecd31a29e50", "value": "1536:watr+Vv2K80Dm35tX4LFWKZp0MoxZMdCepNe7410M:wfv2Ko3jXCFpZKZMdRe4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741202202, "uuid": "81784db1-e383-4ac9-a72c-71a44e1ea3b8", "value": 68156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741202202, "uuid": "d59bbea3-089c-4fa5-a1d8-1d7b3964f6bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202202, "uuid": "b8f79ee9-01f2-42fb-a512-c5d48ca5394a", "value": "donk.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6938a9-f9cf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185340, "uuid": "52b15899-2afa-421a-9d8d-8b511884c5ad", "comment": "Malware payload (Grandoreiro)", "value": "a4c66c2b75930beb9890e502a58020dc", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185340, "uuid": "f7364b27-63be-486a-a093-50ae27012fe3", "comment": "Malware payload (Grandoreiro)", "value": "446f74f2616a1e718a615e059aca5f686c9b70d27a4e2b4e4a1b1307361ddbc8", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185340, "uuid": "cc142522-13df-440d-b882-29788f380103", "comment": "Malware payload (Grandoreiro)", "value": "e705dbb19029400911b9f7501a499898d4ed12ab", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185340, "uuid": "36438a19-c30a-468f-ab77-8c60653f2484", "comment": "Malware payload (Grandoreiro)", "value": "f519be91db8c0d20bdb0c936bce7c0add64e11e8d3bc05b1e3711455ebacc2c18fa6b21199cabfed48206e39215405da", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185340, "uuid": "eae10328-5d2c-446d-b072-6c288c9abe3a", "value": "T107A533995EDE0250F994AB30BFEE878ED7C112764CD0EB634F2AF1D59FA104B2A02195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185340, "uuid": "728c82e2-48a5-4f70-b742-4996bb6d394d", "value": "49152:ooioX5d43q/THXVlgHq7bfela0UwxrCY2/t:t43ETHPgmfes0VC5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185340, "uuid": "9ff00e8a-9b52-4c0f-bf0e-e573776e6b24", "value": 2079037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185340, "uuid": "3d776d3f-ba99-4604-a64b-9124f5046f73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185340, "uuid": "d749c1ed-3025-4cd5-88bc-9b84d5c32df3", "value": "399760854686GLMX0555_CITA4050.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c47b63-f9c3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741180284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180284, "uuid": "94911b60-5423-48a7-81f3-0e5a8744510d", "comment": "Malware payload (Mirai)", "value": "82815ac193619dfd291ea72789c9f8e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180284, "uuid": "f41efec1-f466-4fd3-983d-801fc6a07487", "comment": "Malware payload (Mirai)", "value": "44891b0983075ae2003f11fcd1032b84880290c5dc1dd616175ddb8b8e97f201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180284, "uuid": "df498112-feea-4ec5-9b44-19b5071b8a89", "comment": "Malware payload (Mirai)", "value": "e5b86d640f7447799cf47e7fb460947f2707b5bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180284, "uuid": "23dc4b3c-851d-4beb-a0e1-17bb96d1c690", "comment": "Malware payload (Mirai)", "value": "58a6cd35f96382ef158c5cb9e075627fb92230023813c1fbb573fdfec0680d0f2048692f8aff35197f82e70411874bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180284, "uuid": "49a2f358-4b51-42a4-b3d3-917ae4518677", "value": "T17A137C7BE4AE5E54D0460230B4689E341F13F6C493536EFB1DAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180284, "uuid": "b1a12645-b989-48c6-8b64-6d077c83e205", "value": "768:+aRH4ge4hYyFDinQT3yMILrnCmdeLXC3o92nJ8C/ww:+aRYghh/FmnQyMi2mdGXf9C8C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741180284, "uuid": "c8a3c253-a58d-4a28-a45c-bf02ac3acbdc", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741180284, "uuid": "82a371d3-3ab3-44d8-8615-5eb51d2c84ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180284, "uuid": "b960d111-9e1b-48fb-9b1d-d7118ee4a02b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04ab285-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741159442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159442, "uuid": "99963320-4a0d-4bea-8916-49ec78d71bbe", "comment": "Malware payload (RemcosRAT)", "value": "5f94112e6d17a12270c7eaeef79c6163", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159442, "uuid": "73dfa50c-b8f9-46cf-b7ea-8930d914b72b", "comment": "Malware payload (RemcosRAT)", "value": "44ac4e4ce22d6f815fb8f5771b972bf1f98283a045262aa1919066b60fe14c76", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159442, "uuid": "b59fbc81-d073-41cf-b45b-badddba784e3", "comment": "Malware payload (RemcosRAT)", "value": "eeacc3ac523314ac939b06508b3a95f754373869", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159442, "uuid": "e480ed1b-66a7-4f50-bf8f-9539a05d12f7", "comment": "Malware payload (RemcosRAT)", "value": "83f8e852cd4c9e598756672732e35980e649fb689083e465f4b86e54ef8baf9c70b9accbdf370c27c78649244d028e80", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159442, "uuid": "8056e802-6d9c-4c61-8c18-ce937eaf95f3", "value": "T110236DE899150FF42EC737A5B402BD13E567E707C9364060EAB80EC8F505C5DBEA96B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159442, "uuid": "6039d813-175d-49e3-8f6b-9cb2b488e8bd", "value": "768:uKE+GY76FkXzf9K7LjR4r5BS5de3Q3R5JO1cKhhfuZg/1oLjwZ:uKE+Jumb9K7LjeK5MA3RG2K/u+15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159442, "uuid": "0478da26-aa86-4267-8431-c43c1ddd59cf", "value": 45958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159442, "uuid": "4fe545c2-e347-4a38-81f4-0a85198c8e5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159442, "uuid": "3f83d506-5092-4f15-872b-ac3594e6aaea", "value": "T\u018fKL\u0130F SOR\u011eU (ADA 03-05-2025)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ee124c-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160205, "uuid": "a756643a-065e-4c90-aac3-c62422cab593", "comment": "Malware payload (Gafgyt)", "value": "fad0fd8ca948294763c2728023bc951c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160205, "uuid": "45963879-060e-4b8e-b30d-4c39cbd490ed", "comment": "Malware payload (Gafgyt)", "value": "44ac81f6d2930c325820e624cbfcce93a13e6dbc2e9d3b5e4197420786034aeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160205, "uuid": "6c3cf249-d2a6-4a80-80d5-d429e9ccace3", "comment": "Malware payload (Gafgyt)", "value": "90c2e21905b18f406f0f725cb65baba89f3931f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160205, "uuid": "906c93b5-0126-4ec7-899d-f80d60658c03", "comment": "Malware payload (Gafgyt)", "value": "aec9122ee4c42f5103864478fa37fead3c97c4d1560742701424b8a791976377699b8337502e9c4bcda47ec33620dd33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160205, "uuid": "54d4b973-593f-4d49-94b8-75432ddfdbaf", "value": "T1A8A31893F900DFA6F40EAA3605D74B25B630FB610E431A7663173AA69E372C47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160205, "uuid": "7674a33d-2e28-4513-a10e-cde934bd341f", "value": "3072:ATPtRb3+4I88+VysTIEIdmVZgP+BgQUaP:AT1Rb3+49yskEGmVZgP+BgQUaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160205, "uuid": "58582df4-bc8f-494f-8185-bec45d70e866", "value": 105908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160205, "uuid": "39cdec41-08e9-4ccf-93fd-4c14d8ff72b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160205, "uuid": "f097e321-86ca-4ab1-9d79-79a7d168a8d6", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a4d951-f967-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741141008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141008, "uuid": "0ab6578b-37fd-4383-86b5-cb08302e6c34", "comment": "Malware payload", "value": "0cc849a0a3444c71b204949743210cdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141008, "uuid": "1071aa0d-9286-4673-853b-6710e18ac565", "comment": "Malware payload", "value": "4554a860efa03792b32cdfa59df28568bc78ca535c0e53d8a5fe9f45b987e5fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141008, "uuid": "414ac9e8-1a5a-4449-ba9a-fea23acddb4e", "comment": "Malware payload", "value": "4c76084388153c216e839970b4fbb2179f89f22d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141008, "uuid": "bd0e562d-27fc-402a-8dc2-31d1a4c12d31", "comment": "Malware payload", "value": "265455a2ff651855c7e141a85ef68b8726839ab6e5abe4bce058b302284b1475f2872140e101a9523a1f3941d1d348e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141008, "uuid": "1bb02412-11c9-4b27-88f0-a728257c889e", "value": "T1607423E16E1368DE14D34E7F553DD1087344A32BB19FDEAB693B6C6B9C0B8025ACA04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141008, "uuid": "26b16aef-2538-4c68-a857-d719eb3dc2f6", "value": "6144:LGDPOHL071v+gmod0eEIeD3hhk6oW9fBiokFJiH9xZz9oJCBoe2:g0L0J2DoEIe1hk6T9JiokFCdgCBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141008, "uuid": "df774ead-8548-4557-b1db-a2d7f87eed02", "value": 346072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141008, "uuid": "01268e0f-a9ed-44d6-92fb-039a840a1fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141008, "uuid": "5773cfa1-da9b-40ce-8e58-e90baa01981f", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405c17ea-f9a5-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741167361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167361, "uuid": "de2bd493-1cc6-4692-8b63-4974ff47bd1d", "comment": "Malware payload (RemcosRAT)", "value": "d403366a54fa7339381f25f623963cd7", "object_relation": "md5", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167361, "uuid": "fe716104-959c-47cf-a8d2-1df3acb097ff", "comment": "Malware payload (RemcosRAT)", "value": "45a2f3ef4e482129bcb6d5fce3e4dafd084a48491bf86039378220cbaaaf895d", "object_relation": "sha256", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167361, "uuid": "da011563-8d91-4085-947a-767e3737eaaa", "comment": "Malware payload (RemcosRAT)", "value": "3e14f125831ed93d6f9fa503d4dd48707162168f", "object_relation": "sha1", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167361, "uuid": "46b8ead3-dd0e-4709-a037-e0307e938e12", "comment": "Malware payload (RemcosRAT)", "value": "204ead4250ff4e8576cb23e0cb8dbf497cf2abae37e68d5737e54fb18e9a1e4943b1503481dcda57621ae2ff3d326841", "object_relation": "sha3-384", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167361, "uuid": "8b7d4826-0f02-49e2-bd3d-ff76f1cac5e1", "value": "T17026F9A33EEE268617053BAFA74FB5480B1BEC250FD36ED440C709D8540F65B2994DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167361, "uuid": "b699b2ba-7c2c-4e95-9a06-9714e0791652", "value": "49152:3vPkbCQmZOyjazn8TUKqkyMRua5LjIZLARdB7lfBDlsF9n8zLAtAiSdDxuUs8+ZG:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741167361, "uuid": "5405cc52-bfb4-4488-90a5-39eca795cb31", "value": 4696953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741167361, "uuid": "a355ab12-fafa-40f4-81a2-5775f1e2675b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167361, "uuid": "f4b80cf3-7db5-4e01-b1db-e80374c49f47", "value": "45a2f3ef4e482129bcb6d5fce3e4dafd084a48491bf86039378220cbaaaf895d.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93db5d4f-f9d8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1741189406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741189406, "uuid": "10ca738e-3f9c-49f6-a346-64d28b0852b2", "comment": "Malware payload (Cobalt Strike)", "value": "19e1dc05bca07626d2a0a92458c2ca72", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741189406, "uuid": "f980ca12-e880-4798-b0f3-431f37b954de", "comment": "Malware payload (Cobalt Strike)", "value": "45f95bbef93ab991d75e1b9a8b12a76bc806deb513071e98df321897dbe93a8a", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741189406, "uuid": "ce1c78b5-e238-4b57-8004-8e9f2dc88cc8", "comment": "Malware payload (Cobalt Strike)", "value": "91007b3bd2be0881ce91fb20121144a42f916ffe", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741189406, "uuid": "efbf0722-e266-42f5-9562-e1a4d49f2276", "comment": "Malware payload (Cobalt Strike)", "value": "9e3d1c90e6049a9d4318596e128e16633b776747cca70a69ce9c8f003fe1abadc61d650f3b56d6f288b5c3f9874631c1", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741189406, "uuid": "0469ee7c-f306-4e6c-aa73-fdf0965e6da9", "value": "T159C2A146E792DEFCDE2980FEC0E26432E6617E800366A4DB53E5675C29E43E17738643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741189406, "uuid": "766f6567-0005-4954-8054-ebc9c8b7f866", "value": "381caeade95277bd3814b1e36dc34610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741189406, "uuid": "a5eb1f00-9edd-4bde-ac85-c73b29246c00", "value": "384:u79tSLOsGrRT74iBbnnDkqr50OkavIOzZADkwp8:u5tbs6VBbngqtoDkk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741189406, "uuid": "c2a65d51-2386-4bcc-90aa-e224be8f50e1", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741189406, "uuid": "61b0be95-6b52-4bb6-9f4f-8c7aa5af4d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741189406, "uuid": "fe97cdc5-4d5d-4a67-8e2a-96b0e0f89b45", "value": "BUILD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a5ffdf-f9cf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185293, "uuid": "678f45d3-d450-4c14-821c-b894a549c382", "comment": "Malware payload (Grandoreiro)", "value": "69380726ca572ad101afee1c14149377", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185293, "uuid": "7eb9579c-cf7d-4239-b86f-9d9c00747501", "comment": "Malware payload (Grandoreiro)", "value": "49e8b3e4749144d739130d0c5d8b23e6d9ecd390ab0bfa051f9fc5a054581e92", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185293, "uuid": "803a26c0-81ce-480c-8d2c-ba8e7d4f306d", "comment": "Malware payload (Grandoreiro)", "value": "0b907b6fbcad34b61b6a9cc7675ea9b1bef01e27", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185293, "uuid": "fbd41b8d-18bf-40a8-b593-8ada26775f8d", "comment": "Malware payload (Grandoreiro)", "value": "024aa85a843a835cdf8137de0ea0ae96cd894a1e88f468bda9b0410057c2533bb0acb55fe23c4a7dc9a0f5ca7f214c8e", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185293, "uuid": "2901e476-39b2-4479-8e28-444e84f07e05", "value": "T141A5339977E64014F984BF30BFDE1FDEDAF246568980DA2BAC68F0A5AF35058493D340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185293, "uuid": "be8cfc48-45f5-41be-8238-32a2c98e253a", "value": "49152:awGLDKbthDgnd9kJiL+4w5ZxyvasVTBnOKvgOpZY2/E:awG3KXWd945ZkyKNnWi5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185293, "uuid": "8b6fab81-ee60-4604-bbb0-c8b671e72782", "value": 2217492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185293, "uuid": "01356be4-8c68-4d51-83e8-b2393ff1266d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185293, "uuid": "6282e26c-a13b-495f-99d9-ff8bc2cd08cf", "value": "564606754645EVBP6659_CITA7705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5247b9-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741159384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159384, "uuid": "af7522ed-d772-4fd8-8496-c8f901fa14df", "comment": "Malware payload (Formbook)", "value": "498ed21262ed48fac6bbd226ff5d50c4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159384, "uuid": "5e06e283-183e-4ec2-9edf-788f5dca0f1e", "comment": "Malware payload (Formbook)", "value": "4b4df4f0836b340a82667a783e3880952715962ea2e13913098f4e162f8d6b66", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159384, "uuid": "7350f465-7a4e-4e4b-a5fe-7bdd39c48d21", "comment": "Malware payload (Formbook)", "value": "eb90b1898db2d382b3ebfc5c86bf9dbc336ed8f6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159384, "uuid": "c5956de6-c62c-41a6-8a5d-4b11333feabe", "comment": "Malware payload (Formbook)", "value": "dc7f20ffc3f0e6d2181e3950f1967b4cee085c18de2618cfedba792146baadb706b0284c139d02ba499f883a71e1d457", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159384, "uuid": "a54c9f7c-c393-4053-8ac2-31b572103d11", "value": "T10F75F007B76A89B2E2505776C58B480043E7D6CE739BDB1E798F2B9B084B3BADD01147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159384, "uuid": "2d3ffef2-c7b0-48e0-9ae3-311c3fb6bc81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159384, "uuid": "eca8f9eb-1d84-46d4-845c-a0fcbc11ff70", "value": "24576:8pU+BkhuXF8BzNOCSlWIrC8TewP8X27IGjCRBQFoaDFd9AsyrKjv468hf:8FBkhuXwhSdu8TeNWrCRCbdxrQ3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159384, "uuid": "ded78484-990a-43cd-91f6-7edaece7b00c", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159384, "uuid": "bfac095d-ab72-4582-ae27-0583c6fd5239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159384, "uuid": "eb11653e-a8ca-40d8-b5f1-d837a7f1c7f7", "value": "DHL - NINGBO OVERDUE INVOICES- FINAL REMINDER - 456034158.gggg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447665ff-f98e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741157490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157490, "uuid": "ed5a4c66-171f-4d1f-a2bb-bb2a3ce930ba", "comment": "Malware payload (Mirai)", "value": "a73f3a4ea8a33179083c173dc0a1df41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157490, "uuid": "3ddd058d-5920-44ac-9444-116d3382c13a", "comment": "Malware payload (Mirai)", "value": "4b50e892aee32a09aa98a94a2743bd163a792dc3693bc50836568a2ef58469d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157490, "uuid": "8243732f-5706-4484-8eb0-bc6fc6ff060f", "comment": "Malware payload (Mirai)", "value": "3aa86a4daac441a5e1be31575bd877f355823888", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157490, "uuid": "e54226c3-cc79-4079-b69d-6c705eea7e5a", "comment": "Malware payload (Mirai)", "value": "ec8a90d8aa87639b104dca880a2614c032929f1bfa8da3b4a9c93a56029e435bf19fbd083151913e1a434abd36cfd402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157490, "uuid": "832311d6-6606-484a-bee6-6ecf9c55875a", "value": "T187435B03514250FDC8EAD6F8568F6925E533F43823B7B529B3C4792ABE5EE503F9A204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157490, "uuid": "4000ac87-a24f-4693-b938-d18c50b1bbca", "value": "768:2dqd0MfuvxtdqKg0tyCcghcD0L6HJxabWy5iv0DSEFsbta7M3gk+FIP:+MfuxXqKzQC3hcgLS5civ0tsbta4+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157490, "uuid": "17274726-6927-4bba-a64a-3f169994857e", "value": 55280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157490, "uuid": "f7e56464-cf1c-475c-8f70-37a0ec8949eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157490, "uuid": "c71f63c9-b316-4eeb-9e8c-0ce9a062ef56", "value": "cbr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8515d744-f9b4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741173919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173919, "uuid": "9b878582-1020-41e0-8587-8d559507f569", "comment": "Malware payload (Mirai)", "value": "8f96c433152530973573a4a32ddb87b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173919, "uuid": "3955e103-5ab3-4a7b-9108-e3535ffaa377", "comment": "Malware payload (Mirai)", "value": "4b5a3f35ad0b643cc9d4f3c941ef3e2eb538d93bab0ae62c305193701ca5adda", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173919, "uuid": "75ba1b46-14c9-4200-bc38-390648915ae1", "comment": "Malware payload (Mirai)", "value": "eab465417da739d90e9ee7059002c5fa230fb806", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741173919, "uuid": "050beb43-d5f0-4806-92de-b8481d06e21d", "comment": "Malware payload (Mirai)", "value": "b61c8824306909e484cc0a09b0b08dd1b3b649a972163f398b7c41d814da11fea32f778bf9c0b038e3f9ac209606d80d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173919, "uuid": "f98ec944-29d6-4f58-ac46-36ce6d81cd5d", "value": "T1F9931959BC819A53C2C516BBFF5F828C772253E8E3EE3203DD259B21378B55B0A6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173919, "uuid": "d2734547-158f-4271-b242-5d2dc97c9f29", "value": "1536:E0LavqBlg4w1JPTpzOQYP/YKk+v4aUWagHwUQ76GHBGfdnu5:3LavslW1JPtk3YKkE4agFUQrMdnu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741173919, "uuid": "14744a85-a9c6-4a24-8fb0-c1a25424e481", "value": 91572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741173919, "uuid": "d7c808aa-f9ff-46eb-b869-56f8c8375792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741173919, "uuid": "1fcf90e8-754d-4934-be21-2684f4f2f955", "value": "oarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed33bd48-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741176671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176671, "uuid": "a2525298-3599-4590-b1c9-2aa573594e12", "comment": "Malware payload (Prometei)", "value": "591e55dba9169b368dfcbe9eab1c5e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176671, "uuid": "f58e48d4-8709-4a6c-8901-1e1709cb6d54", "comment": "Malware payload (Prometei)", "value": "4c23946d9fe99dcf5214ab6fcbfc70931e05c92534f33d767d450a1af13d2235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176671, "uuid": "1119b1dd-ce10-495d-9c8b-80fdaf45c64d", "comment": "Malware payload (Prometei)", "value": "65cc55045ef100a7e3518ed3d11024913c5aac4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176671, "uuid": "df459d4c-c3ed-4457-a4eb-95da8ca15e13", "comment": "Malware payload (Prometei)", "value": "2176ab3480930888d72dd44478f26bcdfc3daf1a20709c7c690459dd87d37b4c2037fa72e5e167c99232d2b5ee90e30a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176671, "uuid": "8b4e3dc9-2286-45d3-b917-db2c964fe013", "value": "T1BF9423F31424B3738A2C3A3EFF609E15D79A573CE559271A1A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176671, "uuid": "e1242108-807e-4bce-8a81-2b5166a1b3c5", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSl:W4/y+qaBUZJAdVtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176671, "uuid": "e9fcf8c3-3b91-426f-82b4-1dd8d0b8596e", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176671, "uuid": "0ceb6077-5b2d-4858-bf59-f3d9fdb35fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176671, "uuid": "e7cfe00f-4a86-4cbc-87eb-a578bc88a115", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8361fb2-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1741166784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166784, "uuid": "243d23e8-320d-4e7a-a44a-5daf9aa05b3e", "comment": "Malware payload (Gh0stRAT)", "value": "50d41e5ac17ed1a0aa6effa8fccf7268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166784, "uuid": "f790a368-bd5d-437b-b7d2-8b80a3adb74e", "comment": "Malware payload (Gh0stRAT)", "value": "4c6a2a12a157bae05f098616ae3da54ce9f27cee43543a0915c24c066a664fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166784, "uuid": "f65f6416-78b5-4d25-89ed-4b9de050837a", "comment": "Malware payload (Gh0stRAT)", "value": "5dd482658b0a0f6a7b327acdc09660a568cfe6c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166784, "uuid": "0d943c7b-3186-4014-a2c4-e5a954ea5d52", "comment": "Malware payload (Gh0stRAT)", "value": "c799426854131630d7f2cf118a7131abcf0bbb58a20adc3aa4c3ddfc6a63190ab515402497cb678e292d228227ddad1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166784, "uuid": "44458d77-1e7f-4055-a07a-faa8528a57de", "value": "T16E773313FBDBD47EF06A4B364AA3729054FBE5196813AD46DAF4849CCD350A02D3E31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166784, "uuid": "508e9b66-1d1a-4514-9948-748e551fe3dd", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166784, "uuid": "604363b8-e64b-4608-b631-43c009fe3f70", "value": "786432:nHeJN93jnMVdbRmtuo6TN6WpFOjuueY/pWFm/wiOxunK:nHe1jMLdIuoOujuf4pWFeOxqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166784, "uuid": "b4c37709-a2c6-4539-bb31-2ee196d3ead3", "value": 35365414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166784, "uuid": "253770f8-cc3e-4360-b0c2-59caa83ca007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166784, "uuid": "09f650fb-4953-4303-b22e-8f751c7272f6", "value": "4c6a2a12a157bae05f098616ae3da54ce9f27cee43543a0915c24c066a664fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e280ac7-f978-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741148084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148084, "uuid": "ec930bd8-3f2b-4654-a175-a13481b92b99", "comment": "Malware payload (AgentTesla)", "value": "0fffe7072ec8adc43fd77c64f056ce71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148084, "uuid": "e66b86b9-7f97-47f3-ae92-72c23f073866", "comment": "Malware payload (AgentTesla)", "value": "4da351698b0432b56b06b8bdd26fb7103b973a7c70bf666cc1a26e13fd2585bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148084, "uuid": "afbfb276-e1b9-42dd-8617-0f8d45375832", "comment": "Malware payload (AgentTesla)", "value": "064dbcd439b70dd046da2b8e0aeed669b02b6311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148084, "uuid": "f9af0872-99c2-476b-aaa1-48453ac366f7", "comment": "Malware payload (AgentTesla)", "value": "667ef05d61a42e4fd9d74fe4657017184421a215237f5281082999b8374d46820311db07c430dceb1f1aa05e29f7b571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148084, "uuid": "ead5faa6-1381-4aaf-bd31-b0fbd50562ae", "value": "T1EEE412AC6652E017CA8997781D72F670663D1EEAB402D3279FDCECEFBD279205D04182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148084, "uuid": "1003759c-2d9c-4aad-9400-0d16049f5623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148084, "uuid": "8e13f6dd-3ee9-494f-8965-bbe3c28c42c7", "value": "12288:O/fdpm+gvyKJ7UFtyZ5kronMFzpjBUHQcAMdgNwpDEgQyb7dlZ6G5bcLnTttvgsY:rvJXyrxztc0PW7zZL0tvgsWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741148084, "uuid": "bec4e08b-88b6-4cab-a8dd-b2ba11330787", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741148084, "uuid": "d9618e4d-8c52-4319-bc15-9545bc66d0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148084, "uuid": "e08628a0-9edc-4468-88b8-65e191e8b79b", "value": "Cape Legacy short description.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cd1e3e-f969-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741141891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141891, "uuid": "78a90a78-4822-4bd5-a14e-fb7db35a9e6c", "comment": "Malware payload (Mirai)", "value": "52b958e2c5e86489c9dbc56c676723eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141891, "uuid": "4cee0605-d17e-41fd-b72b-ef20faeb827d", "comment": "Malware payload (Mirai)", "value": "4e35ce2e7e7681ef6d21a8ebd5d0162ce40c893492d8c451ea8f43d59241a373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141891, "uuid": "b0c3315b-ed2c-4825-a53c-3b14c5526001", "comment": "Malware payload (Mirai)", "value": "f7ac49774365acb36fd5949386e1b4df20256c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141891, "uuid": "9065bf2e-8b9e-4196-8e60-51b26537173c", "comment": "Malware payload (Mirai)", "value": "d58683846623b748c695b5c40a06b1c3fbe526f96971abbc9842f78ebd8c3a321a50e52f0881d6bd39f964791f2089d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141891, "uuid": "915cc05b-4310-46ca-8fa6-fee83c5a7a7e", "value": "T10F936C8AB4018E7DF88B97BB40174D0AB930A3D152831B3B67ABFD937D731699D02E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141891, "uuid": "80e19cf5-78cf-4819-b412-9fdf331d90b2", "value": "1536:XZv4kZmnxWUaqlYMBdCFTwcn318FNs48ZNahUmrz+EY5GUd4b:XZvka+mhn31N8UgrUd4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141891, "uuid": "641c9a1c-54d6-404b-ba29-7da1a8996249", "value": 89520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141891, "uuid": "33b05332-ece1-4c41-99aa-93a0af7734bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141891, "uuid": "cc87a986-cc35-4f05-bac3-927b37f0d353", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7916ecdd-f9f8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741203105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203105, "uuid": "236fce8d-8eb5-455e-9570-914fa0b62999", "comment": "Malware payload (Mirai)", "value": "a8c642aa2dd4b37246b1f64bedc69b32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203105, "uuid": "92f2e45e-103a-4fe8-b174-5edcc797b86e", "comment": "Malware payload (Mirai)", "value": "4f5f074c9f406fc4a6d26b2c67028f96972ddd2fdab7296545d39cdeb779e8ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203105, "uuid": "2ae2af7a-9a0a-4eab-9396-9afc93cc1bb6", "comment": "Malware payload (Mirai)", "value": "a0e19d722b4b8eab4f0356ff30fa7817a706454b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203105, "uuid": "4237c269-d7b4-4a61-9a11-b542a60bea91", "comment": "Malware payload (Mirai)", "value": "0aa064635b52614584dc4ab71ce98997cd8dc7936e8e2ccb9f2d03b33614da6050c7e81c71155fac366c691edd2e6e46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203105, "uuid": "e9670026-ab30-4356-92d4-7d9c7447290e", "value": "T157930905BF611FB7D86FCC370AAA2B0129CC555B22F57B3A7634C418B64B25B19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203105, "uuid": "d276158d-916c-4f7a-9b29-be6f55f4bf7b", "value": "1536:OwIBiXzNCI0qWAACj9CFre/f32lgaTZRSiH/HXDU/7410qFY:OwIkXz30vAA+j32ljTfDW4PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741203105, "uuid": "11015ed3-c0cf-4bc2-a976-b845171302ca", "value": 94500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741203105, "uuid": "347fd645-0a4d-4d5c-a5b6-051e84ab498e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203105, "uuid": "5ea9b01d-0560-44c5-883b-5fc350b1ea62", "value": "donk.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfc5da3-f98f-11ef-ad17-42010a9c0004", "comment": "Malware payload (PureCrypter)", "timestamp": 1741157905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157905, "uuid": "18cfd00d-141d-4f69-8344-7bfeb23c5f32", "comment": "Malware payload (PureCrypter)", "value": "ed21eadfce1edefe216a98a5af9d67aa", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157905, "uuid": "f12b19d6-4c4d-447d-9737-5fda5accbf1c", "comment": "Malware payload (PureCrypter)", "value": "4f7c1bbdcb720b61add93c7b7370f3b6041276f4cd58a05b69aaa189ba43aa26", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157905, "uuid": "4c59052f-738b-490f-a38d-488cb78cae2d", "comment": "Malware payload (PureCrypter)", "value": "3cbd5036e0a9c345371d50422b621903a7dfc190", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157905, "uuid": "88591b54-3170-4354-b6c3-c6c4b18e8e3e", "comment": "Malware payload (PureCrypter)", "value": "2ff5964aabcb1ed655f2a9469faf7465bf479bf1e13fa6b98d146cea7f82bf1b43f603a8e11a9134072beb1bdb3fb237", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157905, "uuid": "9b2fd5a4-0ee9-460b-a5d7-19bf86de553e", "value": "T154348637B68A85B1D2506736C4E7252007B5FA8166F3DB0FBD8E13DA0A537AB9C5070B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157905, "uuid": "b5824042-add3-4ffc-832c-894f33b27384", "value": "3072:iMPf6ZE79630T4303O2AaFMM/AgYXMl9iKq35MBhlX8FaJ:iMDm2Amb1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157905, "uuid": "0f51b29f-f5b6-4156-b3d4-6b87b0c3ccf6", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157905, "uuid": "dd824406-c248-46d6-b9ab-031d8431f041", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157905, "uuid": "ad02f222-984b-40b2-b7ab-854a55c22738", "value": "\u00e1raj\u00e1nlatk\u00e9r\u00e9s.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b51b78d-fa0b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741211188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211188, "uuid": "3de728d7-4102-489e-88ce-0d74041a9314", "comment": "Malware payload (Mirai)", "value": "23dd48dce2716825b127f632a743353b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211188, "uuid": "f214008a-2cc0-4267-9fdd-d3be363d49b4", "comment": "Malware payload (Mirai)", "value": "519e128c8d6dc8c5394ed99cd086a3643effc643c712508cccb39f526708e865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211188, "uuid": "fcc964e7-1f7f-4def-8ef0-1e8e94629981", "comment": "Malware payload (Mirai)", "value": "ef1a4137f119a19bf00761a6b1a05bc5a438adc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211188, "uuid": "d616f57b-b3f8-4f31-b28d-e875df383ab7", "comment": "Malware payload (Mirai)", "value": "72ec6f53245a2a1feea971a6d3aaabf2650e2351076206a9408e9d5d01d677877e78adcff41a756dc8c07c5847f61510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211188, "uuid": "8662b717-dfef-45cd-a3d4-460bb4aa243b", "value": "T14C14C80AAF620EBBDCAFDD3706E9070125CCA51722A53B363674D928F54B54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211188, "uuid": "ecf535bd-eb11-40c4-9638-69b01e3e0e12", "value": "3072:97x7SJenVXYgsKAnuX23Ie02knQ2Vk6F0s:97x+JenVXYNuQIukdry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741211188, "uuid": "17de7d4c-0898-453a-80b3-0b2150aee506", "value": 201012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741211188, "uuid": "1ba9f0b8-6787-4b06-baa9-7742c53ba9e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211188, "uuid": "5c4bc798-524f-4dde-a0a6-0ad7cef3d848", "value": "rrrdsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4863bfb-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185165, "uuid": "7dfa71f0-4951-4cd6-8b12-70035724139b", "comment": "Malware payload (Grandoreiro)", "value": "72745e07c1ef633c700cc10f89e746fc", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185165, "uuid": "80d19eeb-4384-4284-8fa7-e8d51e71c5c6", "comment": "Malware payload (Grandoreiro)", "value": "51fbbc7d7db79ee204a25893cb855e7e852028655fad7138d833e64afafd3db1", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185165, "uuid": "76aeb1cb-589e-4906-9966-e756d2b71440", "comment": "Malware payload (Grandoreiro)", "value": "5878331bb15306ff36eb02346e5bed307cfb0051", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185165, "uuid": "23645db7-e782-4504-a6a7-2f7b8449e6d9", "comment": "Malware payload (Grandoreiro)", "value": "2110a8f272135bdf9dced38a8b22b70a7e9697686c595941130d6382080fc8232b5908408d1f33ed18bcc537c8685707", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185165, "uuid": "1cd636f2-c0fe-491b-b147-71759570eb60", "value": "T171C53385B7CAD491FF4C7B3BBED90B8EA6D20A258EF4C9174300F0F81B14496676D296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185165, "uuid": "a1b09262-56ef-4f96-9a12-23dc388200f6", "value": "49152:frX93VKagNXEilFwhvs+QN0xTn4tGf4kEXdClhWP0s5yq9bm2/6:frX9FKaGwuWnCGf5+dCl60Pq9rS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185165, "uuid": "d1de1da5-0791-49e3-9b88-302c73532e4f", "value": 2590290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185165, "uuid": "ea99ed68-dac8-4a99-90ad-a55300557d0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185165, "uuid": "add2ed4e-b95a-4fcc-89bc-f86a1a3c9200", "value": "109960314541VNMZ0419_CITA7570.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356ada72-f9b5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741174215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174215, "uuid": "b0eb93f5-f628-44ed-813f-bfe7d7375a38", "comment": "Malware payload (Formbook)", "value": "7a892536b121f9d0952eb98fd340bc78", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174215, "uuid": "5a59f539-348b-4057-b87c-3c0b00a9ea65", "comment": "Malware payload (Formbook)", "value": "535363acfc5186df10bc9c0839f30ff16c62f8637c0d3109925fb5aca4f45091", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174215, "uuid": "d4d4fb9c-71f5-4686-a350-7d15231e76e7", "comment": "Malware payload (Formbook)", "value": "fad6cf95dd3d69da49625206af95ed290d147071", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741174215, "uuid": "a1d6df2f-c333-4b6f-a4c4-a9ee8434d9aa", "comment": "Malware payload (Formbook)", "value": "13becfe24cdb3a6718093060718e94366ac94a01d4cfbf3e2a0d6fa21310b8d6773dc19e5ac83a72f003288502fb7250", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174215, "uuid": "8c26fcbd-1b20-4cf9-8925-95ff4589a4b4", "value": "T1B8D4237ADA0A12BD437AFF05DC9865C3B2C1FD49CA83B56DE9061133A37EF74260425A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174215, "uuid": "81ad3ee3-23b8-468f-8c4a-aebce64c042d", "value": "12288:ZTz05fE4Ha/TGgXYHUk+fsIpeX1PnJdb27rpF9xTFFU+RDj75iDB+V+Dab:t0dKJmB+kHX1PXe9xTHLRDvL+Wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741174215, "uuid": "82ac9a9d-46d8-4af1-903a-8199b99bdccd", "value": 606661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741174215, "uuid": "7789e503-1c8e-457e-a350-3a358636973a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741174215, "uuid": "bf85d41a-99c5-4784-9868-463546bb3b1e", "value": "TTCOPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4555bde-f99b-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741163234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163234, "uuid": "6fb79555-2c8a-4154-9a92-c77704252ecd", "comment": "Malware payload (XWorm)", "value": "d052b435681e5ec1b817de6dbbfe1e1e", "object_relation": "md5", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163234, "uuid": "106584d7-5a2e-4908-a37f-7e70a4011171", "comment": "Malware payload (XWorm)", "value": "53e566dcbba330c8ab80171c8088c90db438f499ad613b55070787b2c4bd2121", "object_relation": "sha256", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163234, "uuid": "8d8944c3-a7df-4ec9-83c4-07fba3ccbd68", "comment": "Malware payload (XWorm)", "value": "d4e21407d032a756e0278ad813512324c371cbd6", "object_relation": "sha1", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163234, "uuid": "d0f2b603-249a-415d-8503-0507cada0628", "comment": "Malware payload (XWorm)", "value": "613c8f2cdc5ea5cfd6e7858d002db2271f03088fd84af096da9886f300fa87df6d7a76d9fdfaae98c5c61a4c34348843", "object_relation": "sha3-384", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163234, "uuid": "c868d909-04ef-4de7-94a0-9a6387232116", "value": "T17435232553A9856BDC6DA7F4E8B9D64117F0AF4AB420C3D82D94F8FE1883FC145213AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163234, "uuid": "987011ac-264c-49c5-8ca6-52690782ffca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163234, "uuid": "de873776-a781-4a0a-8f4b-3a97c1143dd7", "value": "24576:FrVhrEgB3DFw9QwFvslU26864l3tw4Y+2uucgw/:Fr7rEgV8QwFUU26lz5ubx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163234, "uuid": "ca16c801-0604-4e76-9b69-19de3d59c5be", "value": 1097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163234, "uuid": "6df48b94-32e8-484d-afbd-aa0384f67376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163234, "uuid": "322625c9-bd56-45c2-911c-6fffcaae326d", "value": "msedge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8b3380-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741159488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159488, "uuid": "0c499a71-2b9d-4cc3-92cb-5cfdf5de6e55", "comment": "Malware payload (Formbook)", "value": "7571e33b3d242c2a95fc53a58cfdd9f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159488, "uuid": "b1a45974-dcce-4929-bfd1-9b1f4fadfd56", "comment": "Malware payload (Formbook)", "value": "542b483ca926aa71f97e7db19cc42fdb537d103aa7756be623ed922c39c9f112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159488, "uuid": "4e8cf092-8132-49e6-8f2a-106b842eeaef", "comment": "Malware payload (Formbook)", "value": "1b601aab3b80dc53addaa4eb2617596fbf4d395f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159488, "uuid": "af868fee-e09f-485a-8a6b-3dcfe1c9983d", "comment": "Malware payload (Formbook)", "value": "b2e7acc8b1919e90ce8a2fab35a3da057333239a9877ef2c29025c11da3b0cb58f622717669b1a68318afe792504be2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159488, "uuid": "dbd4547c-d503-4682-8ba3-e7a3400979ba", "value": "T10235BE2273DDC360CB669173BF2AB7016EBF7C614630B85B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159488, "uuid": "aa9c5a94-c5ea-4ca3-8dd3-93d4d6c35726", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159488, "uuid": "4a878ada-4b66-43ee-a94f-c8ecbff41d69", "value": "24576:du6J33O0c+JY5UZ+XC0kGso6FaXMjBtfrVWY:vu0c++OCvkGs9FaXMBt8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159488, "uuid": "170f8718-2f89-444e-b80d-e4f26bdb895b", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159488, "uuid": "6edf09bd-ef64-4167-837f-4b832f056d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159488, "uuid": "a05d73bf-2d2e-41d2-aabb-983addd71775", "value": "Purchase order - BV.PO-018124-25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c37e05-f9cb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741183698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183698, "uuid": "ba91fb29-8196-48c3-8653-8e4e658b1659", "comment": "Malware payload (Formbook)", "value": "0e195be20bc715959546a04ee38b1ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183698, "uuid": "10c7daec-eff2-4ef6-91ca-b634a755ce94", "comment": "Malware payload (Formbook)", "value": "54902efb04a961959a6ac354c9c54fa1cd59172ae5f713c3a0bfa30448217af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183698, "uuid": "9e513cb3-f1d2-4e5e-896e-84c077f45795", "comment": "Malware payload (Formbook)", "value": "74d4bcf24e053685428671035ffd3ba38a52d908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183698, "uuid": "024c43db-3360-4d24-a8c2-950611d13316", "comment": "Malware payload (Formbook)", "value": "e3e013647902d1127912cc389dc8dd9283bed337d6923d35d9f13b1ecbd0e1082febdd1b32a929819726cded231258f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183698, "uuid": "51792394-b858-4a25-a09e-a2d05b94edae", "value": "T1DFD4027C2746E42BCE856B351A32F2B4627C1EDDF502C7638FDC7E9BBA25A140D14292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183698, "uuid": "996d34a4-6cf6-48c4-b37b-907242aed447", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183698, "uuid": "b5feb2b9-5526-49b8-a280-631d58a0fe52", "value": "12288:i/f0pm+gvyfvWTZHYSz6zZbHbgvjgwQ8cf9RYA+fJEnfzvpm:aqOTHYLbgvHVcf9OA+Rcrxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183698, "uuid": "0f0d067a-64bb-4438-a786-3ab92531e6be", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183698, "uuid": "31552bb3-7d9a-40e2-af77-bc8a8f25432a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183698, "uuid": "dc65668b-9431-40d2-846d-e1cbbfb62be2", "value": "UkSYZASAwY7B3Kk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28dec07-f9e4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741194692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194692, "uuid": "92cfae00-6e45-46bc-89b9-bbc7bfc8940c", "comment": "Malware payload (Prometei)", "value": "03205f8e1a3d94ff359adcabceef3625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194692, "uuid": "7cedd716-3eea-40be-83ed-4b7f18bd73bd", "comment": "Malware payload (Prometei)", "value": "555a0803979468181710e6d7b6e7614faaba20d581843951e3e3776943ee25ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194692, "uuid": "1c51869e-a408-4991-829b-fce85f5a93f4", "comment": "Malware payload (Prometei)", "value": "cd7ba8916888d4217d15c8958355e2998cca2476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194692, "uuid": "5c969eb1-f285-4c6c-a638-ec078e07f5f4", "comment": "Malware payload (Prometei)", "value": "4d681f000680255bb43e50890c4224dc484fda3f57de4e901dad3065ced2ef382ace60c5ef01fe3d0a1ad6df3ce857fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194692, "uuid": "b995cc7a-29d9-4fbc-bf0a-ed958cb93d70", "value": "T17F9423F31424B3738A2C3A3EFF609E05D69A573CF55A27561A1FDDEB0F2991209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194692, "uuid": "a792f505-3589-4e1e-91f5-1db15bebf77c", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSE:W4/y+qaBUZJAdVt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194692, "uuid": "ef2e7f11-b210-43ca-92b7-df4d951a03a1", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194692, "uuid": "2275e818-9ad9-4733-a9bd-5f88f0ca1942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194692, "uuid": "f1b1a999-9e96-44c5-bc8b-f87c2c67f21f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82127264-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156304, "uuid": "c1989aeb-5922-4039-b159-1a2a1d68760b", "comment": "Malware payload (Gafgyt)", "value": "502abf2e5bf9a39e6e0aa947c2208b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156304, "uuid": "de0f019c-5b23-4f0e-949c-dd5355763f0d", "comment": "Malware payload (Gafgyt)", "value": "55831f344a3f92d522ed2b6a3e31c8d1235d195385d01b27d587fdd4c83662fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156304, "uuid": "752bec29-47cf-4234-a140-9c1e58e4ffe0", "comment": "Malware payload (Gafgyt)", "value": "5e436769f1bb411b51d6e698e0916717e923bb16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156304, "uuid": "93a60379-9b18-42ef-8927-aa2a697ed6e9", "comment": "Malware payload (Gafgyt)", "value": "82f1351d5debce9feaffa520e06bb66e7dd93810c94f29d40da052872e2b14f69283712caea525817a2ada8b8f1e7b3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156304, "uuid": "94958f85-5b0a-43d5-8986-12786068a603", "value": "T126F33B05EA408B57C1D22776F6CF424A33339BA4A3D733159928ABF43FC279A5E32915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156304, "uuid": "51aab4ec-0f27-4157-8201-d1515d70cd08", "value": "3072:00bacctY8a5k0Po8ZDF5Ei45hAN72BDNTBM/9dmVyh9ZmNw3B65QRRi:/bacctYb5k0zZ5c5ha72lnM/9EVyh9Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156304, "uuid": "9bba54f0-f938-44de-a6c6-1a617503c869", "value": 158713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156304, "uuid": "5a12caa4-295c-4b0b-9395-31018404ec0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156304, "uuid": "fdb2525e-2d1b-4ebd-a6cc-4ace1c618900", "value": "Okami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cabecc-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159913, "uuid": "46115284-d199-462a-aadc-00cad1c624ea", "comment": "Malware payload (Mirai)", "value": "6b1f6ea53a2ba704b46fd3f1f0ea9a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159913, "uuid": "2b21ee0b-804c-41d4-840c-177c9fa44dea", "comment": "Malware payload (Mirai)", "value": "56307af999bc104d587942e764d10e960af890343ce1d31e9ac461bde7cf35f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159913, "uuid": "97c103f1-a85b-4b6b-9bec-15b63bcc8e5a", "comment": "Malware payload (Mirai)", "value": "4ddc4ab3be4c81b49e8f1cd872ced080cfb72a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159913, "uuid": "095c0cf5-7ab1-42f7-9486-0abb02b54aca", "comment": "Malware payload (Mirai)", "value": "bfe6dfa8debfc9b9c8c4ac6d0b693bc3f03ca2b5087c80c8aaf638f91618fd288e703be714ae1f868e835cf5a107b22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159913, "uuid": "362ea30b-bb72-4b29-8025-7797faee6208", "value": "T1FFD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378696B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159913, "uuid": "86e0d9a6-b237-4e9b-b70d-227269883e7f", "value": "1536:wKdzElm18uZJYb4ArFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTyO:wKps0UU8e947Lb71izSftBdz6xK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159913, "uuid": "6ceb2d60-50ae-42f6-a9cf-7fe2ea2cd11d", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159913, "uuid": "1fb20b76-35b9-4afc-8261-ab059ad0add6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159913, "uuid": "89097f87-b870-4c14-a04b-6c7821a79747", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d199e21-f968-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741141237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141237, "uuid": "a372cfe9-ba06-41c6-99c6-cc9f0148067a", "comment": "Malware payload", "value": "65569412dc2b7358e52acf7ac7e4bfb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141237, "uuid": "6e9fca4c-2aea-4519-8265-fa72dbe3549b", "comment": "Malware payload", "value": "56752f078bb41c92feb7c4d434277d22e74af8433cf06da71c43dc5d81720b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141237, "uuid": "134d9be9-074a-4c1b-b9db-431b1b68f2a9", "comment": "Malware payload", "value": "983f0ad785963f9035f904b9e09c1075cd2e5aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141237, "uuid": "596a7de5-2d6a-4c13-ae35-89010adcd731", "comment": "Malware payload", "value": "26835e3e9ae0dde700036569c636e0d48604819179235f713a531275e87e7d3776380424beebfb70c97ad7a64279b5ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141237, "uuid": "e0fa28ea-066d-4de2-94b6-b08ed151c91e", "value": "T1B0D3C022192B21F3E44653F813E5CEC76E74957600E5CDF66AE82A4C971864C8F2F92F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141237, "uuid": "87001525-01c9-4215-9b80-1a07cc311263", "value": "3072:CEYl4+iiPHsokSj43PrFHRk5D5uD8ap+PAaXlj:E4+tHsokSjKrFHS5DM86Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141237, "uuid": "731072ff-4b3b-4f32-9fcc-3625a48c14e5", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141237, "uuid": "7c75795d-10f1-4288-b445-5b4b69ed765b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141237, "uuid": "9515bf30-22ff-444e-b75a-914e86816cde", "value": "SecuriteInfo.com.Win32.SuspBehav-B.26538.20910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f068891-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162285, "uuid": "fa717c43-c2eb-46cd-ae23-6e2c0ee3a44a", "comment": "Malware payload (LummaStealer)", "value": "4c7602a935a7b24e6262acd38505eb9a", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162285, "uuid": "7a51b7e9-0291-4e5c-8bbb-1fed570daf28", "comment": "Malware payload (LummaStealer)", "value": "57ccc2313dbc37566c73b42a74283f967d0502a60d276a90afa1dfbee6a74aff", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162285, "uuid": "532f16d0-d358-4e41-8bb5-7c46aa52e22d", "comment": "Malware payload (LummaStealer)", "value": "e1e15c5e8c053eb523ffeb3a24bbe857e41db489", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162285, "uuid": "41a8c39c-51a2-4312-9a0d-18ef4121e274", "comment": "Malware payload (LummaStealer)", "value": "6ac134a245e74bd470473b298a1a3bcc7291ec27fcc6a231b4a488aeba16b91c955738bf0cb974d1df847ae091a1a6a7", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162285, "uuid": "dc0326c2-c94f-49aa-92a4-10c6c35d49d6", "value": "T143853395DBB9C420ED98C37080EA9B8531BCB2D603F891B719C680653117D17A7EADFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162285, "uuid": "032edaf7-c3e7-43b4-b5ef-afb8adf7fb39", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162285, "uuid": "a8224d2c-824f-46ff-96a6-0ecfe60f1815", "value": "24576:auEmWjQCgNbYBeY9j5DV+iUptxjA/eiHVQnTXPZuNDkaThws8tXSbCUBwHiRzasl:auEfQCC0BeYLV4Hse+QTMpko8dwTBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162285, "uuid": "f921e325-231f-48a1-a94e-1024f56a6501", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162285, "uuid": "d2849675-b8a3-415a-ac66-3912423ead73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162285, "uuid": "844f57c1-3d4a-48b4-ae02-ccb80b353cf0", "value": "random(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a061350-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160210, "uuid": "9359cb90-bf12-4e73-ac14-2fff8fd612bc", "comment": "Malware payload (Gafgyt)", "value": "a328b683ab2e102306ce558ac2848bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160210, "uuid": "8644045e-b333-46ff-9d93-70996eebc048", "comment": "Malware payload (Gafgyt)", "value": "596c2174f15304ad6029db214b0f4b5ebb97552be7f9d9a170fe03bbc7c762c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160210, "uuid": "1d89f6b1-22ca-4657-854d-6a7a30ae6645", "comment": "Malware payload (Gafgyt)", "value": "8e4ca556c8ac6483a4f496736cd6efb645732d13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160210, "uuid": "f825d8dc-628b-45ee-a363-6ff1a5e63d00", "comment": "Malware payload (Gafgyt)", "value": "1920f8ebcd79ad5a4838a980623b12c43cc515f04a9c80fcdb9354d1ee473e7b020ee52558f0743e5a1e286aca9d4bb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160210, "uuid": "50621682-50de-44d4-bdad-c3ca05c1b065", "value": "T18ED3942A7E12AFFEE2B8863007F75F70939525D326A19781E26CD6085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160210, "uuid": "e8756557-8659-4a19-b706-3d74a7ba2d09", "value": "3072:rOXCDVt9xbEaSRX84fA6D5773ujQ8y7Hk2R/vKKDoeJZwRGNA4++xQ1IP:atE0qKDpwRGNA4++xQ1IP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160210, "uuid": "377061a6-1922-481b-b5ea-6a3b58a4669b", "value": 136673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160210, "uuid": "be9d1fea-68c6-44a4-bf58-cbbf8bfc7bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160210, "uuid": "d4e85e9a-5dd0-4567-916a-43650416449c", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238fc2a1-f9b8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175473, "uuid": "caa74b1b-785f-4bd1-b252-cce67aa5f50b", "comment": "Malware payload (Mirai)", "value": "95b8707d8fda3344e18ddf67369d47dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175473, "uuid": "3b9f90c5-dfb1-439a-a1b5-909ac363eb87", "comment": "Malware payload (Mirai)", "value": "5a18e57e698166b846be10b35187232c6045eaa9e2aab07faacaa2cb9d23faf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175473, "uuid": "5ddace5f-98bd-46e7-852f-47566df9096e", "comment": "Malware payload (Mirai)", "value": "ead39ee2fb46ec0f59200b3c2037d042bfb862f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175473, "uuid": "9a43f020-1915-4eaa-9635-35223738743a", "comment": "Malware payload (Mirai)", "value": "253238251cd581f67cc4f9dfdef48c4faa39d6e4be26cc54fd24ef704ef3d290e71197ac72112e0e97af5c6c3275f8e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175473, "uuid": "660def35-fdcf-481f-b621-5652c9d5f43b", "value": "T1BDA36CC0A783E5F5F89620751137EB338733E039512ADA87D7A8DD26EC61A41CA1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175473, "uuid": "4dd274cd-a8c0-4937-a07b-521b5fe1e8df", "value": "1536:lj2ItKSemSZ8fj9GCDmhxd+jqTrvBNgK1nysLQXTl8rG3NWdvngPS2B5PnptH:lj3ISemSZ80xxTjBNrAsLelZ3nq0ptH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175473, "uuid": "41b44bca-9fd6-4841-9458-9030f7718bf9", "value": 103912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175473, "uuid": "0d593628-3b95-43f6-8e89-5124b5cc63be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175473, "uuid": "e3f6c5db-277f-4806-a6de-506fd12f5fc0", "value": "bejv86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fff006e-f9c8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741182447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182447, "uuid": "14a1bdce-c1ac-4d65-b0ba-2cdea71532ed", "comment": "Malware payload", "value": "3badeea1b4cc6b42697c3b05e286a5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182447, "uuid": "f7469bf8-1e6a-454d-bf80-c5d18472224b", "comment": "Malware payload", "value": "5a30a99739919ff2ef5be33a1434721d24961a4407d5eb956918f3a378a14ae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182447, "uuid": "6045c07a-6e01-4c8f-a09a-c50675046caf", "comment": "Malware payload", "value": "f84851e49134cc778f8fe72dbf60acb806bb6700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182447, "uuid": "cde44155-0d4f-4d7f-8fd5-c4a643db14a5", "comment": "Malware payload", "value": "3f66dff5aa9ab430bb94d06e37d1b79835eea7e0928b0d499782fa73c9706c415526aab5a8c6abcd47f8f2128034bb6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182447, "uuid": "5bee6557-f1a6-4a2e-9f54-8d481b43e065", "value": "T19FC383539AEC3CCAC038A3B077BB87D5D72EED9960A2C10D96D04296E87D41779237D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182447, "uuid": "21bd35cc-2e10-482f-ab8f-36f8fd54b38a", "value": "94ca0c75f9acc65429c5e36757bbb1a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182447, "uuid": "d9b331ae-0941-458e-862a-c2063e561029", "value": "768:C96ahtaRgg3t2arVZz6Q8VQXyLuk969Sbh9Sb:C96ahtaRggd2arVZz6QuQC/wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182447, "uuid": "e01c6d07-f299-4d32-b35b-cb1d04a51de3", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182447, "uuid": "af9d74a3-374e-4bfe-937f-54924fe5cf18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182447, "uuid": "49150fcd-8f7c-487f-8203-8c6dd4a91432", "value": "EPILEPSYCHOLOGY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0707ac4b-f9cf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185304, "uuid": "8ef2e13b-492d-4c87-a991-cdc75993b2de", "comment": "Malware payload (Grandoreiro)", "value": "c9ca84d8d35718ca6c3657da6908e803", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185304, "uuid": "0de0c9ad-60d9-43d1-8fa7-dacac7cb4752", "comment": "Malware payload (Grandoreiro)", "value": "5ac057c435287de30da92de065d9c8fcf1cf71953e6858042c19e3b512e3f554", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185304, "uuid": "239acb73-965a-46c5-9ba0-e36f0ba79635", "comment": "Malware payload (Grandoreiro)", "value": "a8bfbdb60083282fb715ab86abdb8299defc6b21", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185304, "uuid": "b425e0d0-cdbc-459a-9312-44b631ace9ba", "comment": "Malware payload (Grandoreiro)", "value": "19cf80f351abec9b2cd9ccf987e0296d1c4801c5b48643a9e1bf058c1a5a13cf1ed75f29ac3110bbc409e94362195269", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185304, "uuid": "c2fb47f0-b34b-472f-8872-7ce69b61d071", "value": "T108A5330096C84105E51CBF702EFEAF8FA5FD16C58880CE3377E1B7A8EEA58565939463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185304, "uuid": "0831dab5-f853-40c3-8755-8c4d16cc1f26", "value": "49152:vGX8417ZyEAiMjY3oyBYrmjMQrAiGhhfrI7BLe1GgFZFN2vRKe2/K:vGXL1VyEA7d+MCPm2Ba1XCpKfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185304, "uuid": "727af9d1-90ce-46cf-bda8-c88052333351", "value": 2168673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185304, "uuid": "ab11709d-953a-4574-b712-87c75c328d37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185304, "uuid": "df4a6750-3242-494d-a079-47a9deec0d64", "value": "392071193169NDVO2318_CITA9326.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d5d1c6-f967-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741140691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140691, "uuid": "b4af63f7-b5c4-4154-9c19-6ddbde5d15ac", "comment": "Malware payload (Mirai)", "value": "797d1cab6771dbf7df7061a52fdef5ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140691, "uuid": "34f3944f-6072-4497-9923-33cce60ab63a", "comment": "Malware payload (Mirai)", "value": "5e0e48682b43c308e3622943c1665ad53faecc04401a2e7abd2878531cd46312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140691, "uuid": "b05cd52f-b0dc-466f-8feb-9c1f7597d6b3", "comment": "Malware payload (Mirai)", "value": "37f49f6fa5b0d4ecccfd16ef7bd95f96a5eecdf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140691, "uuid": "57800cac-b41e-42b2-b534-2e8c637870c4", "comment": "Malware payload (Mirai)", "value": "a0a2632ab561bafc2c79fd0ee2954b5201e50df2fa6bb0ef5a84423a0491990d31c533c81cb3306d5393bb063420af46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140691, "uuid": "86115876-f8f0-4f64-85b0-1e98054ae155", "value": "T131833C06F5C185FDC08AD07446AF7A39E822F0FD1379B2A327C8AF253D4AF611A5D949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140691, "uuid": "01902d58-2c31-4ab3-839b-eaf4f1881887", "value": "1536:9GVYSWv/YQSZDboZozkqflxU82ab9QhN4ytnQd+iNamP5Um5rT6EHy:UVYZDSZDboZMkqfl52c9QzTQd+xM55rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741140691, "uuid": "3d39a525-674f-4591-8b54-cf303e2acc23", "value": 85376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741140691, "uuid": "a363250b-5f40-4ad9-94c7-c15503430d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140691, "uuid": "91d46bc9-3763-4bd6-9a30-3f461968bbc9", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846dafe4-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156308, "uuid": "e6b79900-c309-4001-982c-5858d59cc833", "comment": "Malware payload (Gafgyt)", "value": "4b0b477cf84f3584287eb7f73305c482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156308, "uuid": "3513cd45-fb89-43a5-88a2-01fb54b201f1", "comment": "Malware payload (Gafgyt)", "value": "5e9cae4f868c750325c6be5f5f273edc1938e8ea525d049da2ff692c7db7176c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156308, "uuid": "9b90dd2b-bbad-44b3-a057-c6fc77739395", "comment": "Malware payload (Gafgyt)", "value": "ad747b5ae595b2995d8b49448eccffdc54fd66d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156308, "uuid": "d532fa44-04be-4eba-989e-33540e8757b8", "comment": "Malware payload (Gafgyt)", "value": "8eed228ca4e85b18a76884374e9eeee2959c304f42e2155786944e0fbf5b62e1ed48905fbe44aa66ed8fcfe5fce5174d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156308, "uuid": "5d8a03e4-397c-460a-9821-320542747a2b", "value": "T1AE934C03771D0B53C09B9AF129FB27F1876ABAE116E36180B51DAED45B32A703122FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156308, "uuid": "c7e62f11-dd04-4f1c-af75-45ed9bb2d9b4", "value": "1536:9a8ZDXWE3jen6IbRnu7GygoblchOSDX5hXkyFyhZlQ0k0yD2PJojyKn:4+rMn1pu7GyFKZX5hXkyFyZlQ0k0yD2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156308, "uuid": "a16f73aa-eb36-4bf9-8fce-b12f2c4c128d", "value": 94074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156308, "uuid": "fd3350f0-23f3-4dfb-93ce-7abc1fecd8e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156308, "uuid": "900672bc-ddbd-421f-a229-5c258db8b003", "value": "Okami.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11af63d3-f9c2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Nitol)", "timestamp": 1741179738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179738, "uuid": "df7e63d9-7542-460e-9d1f-affc0e554b30", "comment": "Malware payload (Nitol)", "value": "24a7716a490ef5fecae7e7f16df4ab80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179738, "uuid": "b7a8a3f2-a2ae-4ef3-936a-bd4cb6c917e0", "comment": "Malware payload (Nitol)", "value": "5ed8e5d8424c289ff146535c86b21495d682d155ce2e03cdaf24b21d19239481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179738, "uuid": "4052bcc4-7ad1-4d38-8d1b-bdf6eb41c6f6", "comment": "Malware payload (Nitol)", "value": "845b07db3557f436800b9a338ef4ba97ed554297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179738, "uuid": "74a13725-e88e-4c6c-8fca-5378df24feb3", "comment": "Malware payload (Nitol)", "value": "d0219d87a6bd31290c1fee24ef4e8d4117c45f36517504cf63437b132e57e13c5db5868d43eb87e31bd33e7b2008c867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179738, "uuid": "8e557b26-e345-421b-93d6-58795d396ebf", "value": "T10326AF3A8527BD5FF95609BDA40C2C421D687E9783188959EF8C70B7B0CCE50AD6C9F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179738, "uuid": "af464616-5a7a-40ae-bfc3-0f10211ff85e", "value": "7750e578297084bcbba6c356c739cb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179738, "uuid": "1c7aea27-a2d9-4c6d-af1e-72a1f718a402", "value": "49152:kiyl3j7+VkfqNcZ5pQIBHvyENzRsGR7rIKkqkS1//5vFGU9DXIoqJsg:Lsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741179738, "uuid": "9145fe6b-7598-4855-a270-67eedcbdeedb", "value": 4541368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741179738, "uuid": "243649ed-1b70-48d5-996f-94d8b8277e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179738, "uuid": "f8dc733d-0efc-446e-a07e-09a4e8c65030", "value": "\u8ca1\u653f\u90e8 \u00b7 \u570b\u7a05\u5c40\u901a\u77e5\u51fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335c9de0-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1741158320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158320, "uuid": "6b02343f-d675-4b28-bb8c-7c56b4f63fa7", "comment": "Malware payload (Amadey)", "value": "6a003920173a0e43d374a11ea1bf2e2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158320, "uuid": "0283188a-efb5-40a7-bf40-6a16f10910c2", "comment": "Malware payload (Amadey)", "value": "5f151b2d514a198ccadfbf3fb2774389214400dc70a6534849e22e6f605e6f67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158320, "uuid": "ddc6ed71-c0cd-461d-84af-e34a43f82481", "comment": "Malware payload (Amadey)", "value": "49f2a728be9e06b4a61d763adc948917f0c2464c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158320, "uuid": "87fd9c9c-9845-4b31-be6b-8c46fe3e3bce", "comment": "Malware payload (Amadey)", "value": "44e0932b0602fe1c9a6f8bf6b9ef48a50f503895d1b3b2d8c8e410b25c5e5cc391b4af843b8fc3525b5b7e4e68f79f62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158320, "uuid": "0b9ef9d8-fb36-4a90-9e47-e59a7993f5d3", "value": "T11CE55BE1A5D761CBC48B23B45477CF466D2D47BA732408D3EC2CA97A6EA2CC119B7C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158320, "uuid": "0404d1e7-0991-41c7-8238-f658a7d316b0", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158320, "uuid": "68209448-6c76-4698-8358-7aaa7a3796d4", "value": "49152:16CFTiKOr/sALJvHGCV3VEBuiZohJ6MOFv/N3KAUrTqYC6HK+Vn:16CFTiRr/sALJvHz3yBuiZe5qFaAb6H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158320, "uuid": "fdcc392c-e548-477a-860b-e126c368316e", "value": 3126784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158320, "uuid": "83592fad-d409-4a69-a3b0-532299f8f073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158320, "uuid": "10a9fa36-4609-473b-88b8-134225afe1ba", "value": "6a003920173a0e43d374a11ea1bf2e2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d92008-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185119, "uuid": "72740d90-bcf3-4b25-aba2-18232593b9d3", "comment": "Malware payload (Grandoreiro)", "value": "5bc5545fbfd3a91c68c648d883081d54", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185119, "uuid": "30f56cec-7592-4307-aa3f-7e343952e78d", "comment": "Malware payload (Grandoreiro)", "value": "5f1b19557cc285c6db5c762bed71b05df01e6dd44614a28c9e35d1cd9c335262", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185119, "uuid": "caaf3882-d90f-48d9-89f8-f02c298606f9", "comment": "Malware payload (Grandoreiro)", "value": "8d0b64520ccd0d45d49a8b4e7f46f2429320e605", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185119, "uuid": "a59eff82-1212-4187-9374-e110e4c14a59", "comment": "Malware payload (Grandoreiro)", "value": "8c4d6d55f113341d1667585ba6493d8f0b977ba7a156b2bc03ecb3e49437897e45c3f0ea5a82cb2f3221fee642ed0e19", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185119, "uuid": "41490c6b-645c-462f-aa6a-c5e7d31519c3", "value": "T1DCC5338C2FDE8194DFD4AF78BFC947CD05D8496489D0CF93A720F8A49BAA411BA2D135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185119, "uuid": "f448c993-a071-4b3a-a70d-28e29f7b1731", "value": "49152:jKhFBLN0/W6vmZ+AKajFrhNpSb4SYT6veQKCugkcfCIfDX7SPcug9OtKz2/s:O5TSmH3jFrXwES26veQrt7X7SptBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185119, "uuid": "cef6ae7b-8942-44b2-a9c7-2ddbebd133be", "value": 2658623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185119, "uuid": "43294da6-2863-4586-8314-16a66bb991ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185119, "uuid": "eab2634d-4031-46b7-a549-dc0b8115006c", "value": "990884184383GVDV5674_CITA6290.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bae3ac-f9f8-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741202931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202931, "uuid": "fda92899-39b5-4118-86d3-68b39abfd405", "comment": "Malware payload (SnakeKeylogger)", "value": "1cfb3af0c0a9ae61ff6070f6bbcb8a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202931, "uuid": "7ad1e368-9c4e-493d-9aac-c65100924863", "comment": "Malware payload (SnakeKeylogger)", "value": "5f960bae7dc462850bd8acd8e8837be9ba45aa193ea1014bdce45e4b597299f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202931, "uuid": "491c78b5-7b83-477c-b2e9-e8b1c7011ecd", "comment": "Malware payload (SnakeKeylogger)", "value": "50cfe580646b4a33818721f8d128f12a9e062cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202931, "uuid": "5218e971-f4b5-4d79-a0b1-a1859882d967", "comment": "Malware payload (SnakeKeylogger)", "value": "30c10675838970bee26313ce490e49e29c924173d383e8de01583ad34825b9fd5c4947612e4ea88d8ed237cbbdcc000b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202931, "uuid": "c77aa1b4-c49c-4a3d-8da7-4f3046641f1c", "value": "T1BB25AE2273DDC360CB669173BF6AB7016EBF3C614630B95B2F880D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202931, "uuid": "83ffa585-2a34-4754-814b-fb0bc94f9c25", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202931, "uuid": "4ce91b0b-8350-479d-afbe-528099b04161", "value": "24576:1u6J33O0c+JY5UZ+XC0kGso6FaAHW7Fu52EUWY:Xu0c++OCvkGs9FaA27EoCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741202931, "uuid": "4485815c-7c78-49c1-8906-fc0fc9afd5e8", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741202931, "uuid": "32be0dc6-e583-45e1-8f52-6fe22221fae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202931, "uuid": "d3b3ed61-9142-4e50-8666-bc2d2b7ca593", "value": "Order 32389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea9e69e-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156299, "uuid": "cadb7f01-052c-413c-9e27-ad55dbc6780e", "comment": "Malware payload (Gafgyt)", "value": "3c05a320cba598f68971ae5dccb2aeb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156299, "uuid": "d5c457be-289b-4711-93ec-3c8f00734c8b", "comment": "Malware payload (Gafgyt)", "value": "601302b25bf3a7570691164e8a68fc0d210e2b210ab08e623b6db00b30a6c74b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156299, "uuid": "af7e23cf-00f1-4658-909d-5adc5a7459c4", "comment": "Malware payload (Gafgyt)", "value": "a6f038ab1393869cf8eafc13d19b29740ea83627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156299, "uuid": "0c6f68e5-cdd9-47b7-994a-7a9ca4159a35", "comment": "Malware payload (Gafgyt)", "value": "fcf90340c7e2a2f620b1808adfb1acf051b1f397f17cded5d96fa1b09f4140cba91dc43cd77ed1e95e39a6b4586fe748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156299, "uuid": "0647f0ed-e675-4411-ab54-6c51845b3651", "value": "T193C3E917BB518EB3C81FCD3306AA460120CEE59616E56B6BB2B4DA6CF74784F09D3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156299, "uuid": "fea88e25-c64a-407a-ba61-ed6afe40b7df", "value": "3072:lK0Q5Y/cz+oZ5hrqh7BAzRPRx9Fq51uUOypn:lK6/cCoZ5hW12zRPRx9Fq51uUOypn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156299, "uuid": "8ae751d3-2704-4927-bf9b-934a97c5c37f", "value": 123181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156299, "uuid": "9bf3c2da-7c4c-4bf9-bcd7-1f89f65c9234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156299, "uuid": "43f7bd29-8bec-47a4-9d45-a70efbdfbfd7", "value": "Okami.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d14e77-f9f2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Adware.Generic)", "timestamp": 1741200383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200383, "uuid": "b1a5e6f9-6524-45a7-8eb9-5483939d1db9", "comment": "Malware payload (Adware.Generic)", "value": "6aa08052f7265ae4163d4c8f2e9ea1ba", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200383, "uuid": "a7fc577f-0fe9-4285-9f79-a52d7d7cac88", "comment": "Malware payload (Adware.Generic)", "value": "604e3d43902dde5610f2616b4d5bfafc54873a4df239624e551c42c5ace6c797", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200383, "uuid": "3543c92e-48f1-40ba-8f98-7b6c05f3fd29", "comment": "Malware payload (Adware.Generic)", "value": "cb0ed529f5ce9c1ee70b1bc8862620baec09f9e8", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200383, "uuid": "13e37a53-6b36-45b3-a6da-045317dd43da", "comment": "Malware payload (Adware.Generic)", "value": "99ebd9264d4e942cfd8c84793ce28acff7d09dcae87a6ffb8780775df878dbe7caf8cfa674ff551c07446afe59d04239", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200383, "uuid": "90af0686-f305-4c7f-b39c-0b03562102b8", "value": "T19286233FF268A53EC56A0B7245738320997BBA50B81A8C1F47FC744DCF725601E3A65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200383, "uuid": "c2507c3c-4060-4ec6-b5da-3e0c3fd02634", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200383, "uuid": "49f407e0-87c7-47bc-ac07-4aff8b5187af", "value": "196608:TASjy6MTajULISGn+A5cxrUjVtrDp9qZMWEW6u:nyLcGIfnVmqtrN9YMv3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741200383, "uuid": "6e203b85-4012-4f4c-801d-647b03dbab33", "value": 8253264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741200383, "uuid": "693e6728-c8f2-4263-bc4b-1bd16a3b9d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200383, "uuid": "9196237a-90c4-4cd4-9f48-091413201105", "value": "tslpro (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98de9a32-fa0c-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741211748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211748, "uuid": "b5f2edcf-df5c-4d7b-ae44-29c57788a1c3", "comment": "Malware payload", "value": "a45de868e6513d59c4d83c46b26fb8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211748, "uuid": "9038a758-82de-4115-b833-a782765df2e0", "comment": "Malware payload", "value": "60e7008e14d5a964504ea568d4626d32a20f2e68323c04b2eade9e7f1c054463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211748, "uuid": "cb10f0fe-6bf2-45e2-8683-c31d3a0c47d5", "comment": "Malware payload", "value": "45a36b6a231f93d97c56e77a3a51698af6c1fc3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741211748, "uuid": "15f2c3e1-ebb5-4062-8b5d-f5c09098ee51", "comment": "Malware payload", "value": "66d4d05e09eca811ee40ab2585797870b3f696a01024283ca9f8e4d37acb0ea4dcd3eb1b0b3ecc4cd91f911cf241505a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211748, "uuid": "81630011-a714-40dd-af64-a195bef841f2", "value": "T16F047017B6CB85B1DE646B76C4A70500C7F4F981E663DF1E7D8E135A0843BAA989033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211748, "uuid": "d53bac38-3418-459f-b41d-13f0cfb31c41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211748, "uuid": "2c6ef48f-1fa8-4b68-9b8c-f56a77deeeb7", "value": "3072:osgt+u95/Jx1HjICG2bMMu31La5BQRAB1dKU9k2BlZ:oUuj/1HjMMM1La5BQRGfxkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741211748, "uuid": "a298dae2-4f5e-4693-b6df-c7411e73532a", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741211748, "uuid": "9208bfcb-0545-473b-8fb1-4960b2e8ccee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741211748, "uuid": "bf0287af-6188-43ac-a1de-fcd2b20a20cd", "value": "Znilnf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ab80f2-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199769, "uuid": "d82de56b-2f51-40e5-9b9d-8ac576f2e54e", "comment": "Malware payload", "value": "4c7106ae6691564d6e3c30fb9ad92358", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199769, "uuid": "09485e1c-51d7-4640-839d-368cf73a8f74", "comment": "Malware payload", "value": "633fccf77d23c61e804dafc98bb49606e8bb3361b6ea740fc81a09252a2b4590", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199769, "uuid": "594fbcc6-223c-404b-ab98-beebe6523681", "comment": "Malware payload", "value": "5890149e1df6abd28c99316640a5d3630c571dd9", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199769, "uuid": "ba78703a-e14f-42cd-82af-da6c5077698c", "comment": "Malware payload", "value": "23417ae3282f0714cd7548127cfa76a79e2bd1d6d0338f2f690a478fff5c802192d00da2140b8b375cf5e2db1c52c4f5", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199769, "uuid": "fff7b1c9-d4d5-4d30-ac18-1d76a11c8d8c", "value": "T195D533E16FC48240FC482734BF9C87CE92D785E619B4AEB71A91F4AC2F361436768D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199769, "uuid": "08048c29-5eb6-4361-8474-5c58a5df1224", "value": "49152:7Q6nnWlxhjIoDev/AxJuWTzYkXJtu4y1mIHcHGeSGekpylfJ9uU/hiXlH818ZonS:7rnAxlAv/euwsDMGNQclfJf/RlRKI6Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199769, "uuid": "dfdf76df-0274-4d49-b3ca-448f522acf25", "value": 2877669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199769, "uuid": "4e25fae8-92f7-4846-b878-88ea7790d9ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199769, "uuid": "f760740d-60e1-49b1-a6c4-521d8fa7eb0b", "value": "170000CITA_750975738084.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7429f35c-f9b7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175179, "uuid": "2815e0c6-ee41-4ae2-bf57-bbed93ae8afb", "comment": "Malware payload (Mirai)", "value": "48819782a01b2b57ddc437eecae3431a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175179, "uuid": "c25e4b59-c9c1-45df-8f98-b2b75a7b44d7", "comment": "Malware payload (Mirai)", "value": "6346aac64caa717e670ea357d1d7c0dceba1c65e1f871e9930ec8d5752f075f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175179, "uuid": "346ff35b-113b-4617-907f-1a4c87acff99", "comment": "Malware payload (Mirai)", "value": "f39f8483d949349d375132e4ad223373c6f3af8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175179, "uuid": "870d966c-3037-4ba1-a075-c813ecf412aa", "comment": "Malware payload (Mirai)", "value": "c852ddc82bff8bdea6f54d1e8adf925cdb5721f6c7e589104a065091368da4f7bf4e2511f7d8e62eb9199468d7e4eb41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175179, "uuid": "e7f641d4-3e50-4688-bb50-d3789b54d3c2", "value": "T1FD14C70AAB620EFBDCAFDD3706E9070525CCA50722A53B363674D928F54B54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175179, "uuid": "87f0dd12-9fef-41ef-82d5-b41ab947bd6a", "value": "3072:wrSH8anavqSVVqznas5gKz0CpM4pCzGlDU:wrScanavqSVVt6zxMF6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175179, "uuid": "c1bc663b-ab3f-4ebb-8648-a36cc6c70ff7", "value": 200528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175179, "uuid": "3038f3dd-2c45-4fff-ad46-8edad57fa2d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175179, "uuid": "eeb0a495-2caf-4735-85b8-2a4120a98ce9", "value": "rrrdsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55c9f44-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741156471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156471, "uuid": "7966c972-f29e-4455-9d59-1b1480b7e778", "comment": "Malware payload (AgentTesla)", "value": "b8a82b5d1e9d7f3805b7560bd9dfb635", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156471, "uuid": "9bbaa1a0-943e-4a77-9c14-24f0d7515e99", "comment": "Malware payload (AgentTesla)", "value": "64ca4dab230fd602b18e78dd02b4b2fc4f05f2f8a2a636ca8b0c1852b9e92fbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156471, "uuid": "a06740c4-d68a-4895-8d1a-4f8b1f992b49", "comment": "Malware payload (AgentTesla)", "value": "6a139cef123143182bd32fb1717dbaf67fe3e48c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156471, "uuid": "948cd040-7fd7-4887-b6ac-2dc8c168a820", "comment": "Malware payload (AgentTesla)", "value": "b4173da8f090099f624febba3946190111b62ea9e9602edf123e47999ab3db97fe29199a22ed86011520543b01dd6b18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156471, "uuid": "dd8ba6cb-8a5d-4179-9f24-27d167f63866", "value": "T112E412ACA209E01BCA8627752B61F2B96A7C5CDDF801C3175FEDBDDBBE72A101C54142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156471, "uuid": "23e0693e-ca71-4f67-88bf-aa6f0d9c392b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156471, "uuid": "c8a9973b-4dbc-428f-8f7b-3e99812233af", "value": "12288:T/fppm+gvyivMQ0cR9wEsQYxRwFEM0G0La7CR5WlFMeG5WBYU4tfAoHPUxkR:ehNR9w/RwFEFTwCRslGz5WCLhHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156471, "uuid": "66c834a6-ed90-4a16-b517-d7ce59950ab6", "value": 714760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156471, "uuid": "70e179f5-8df6-42b9-bcf7-7e2747dcec15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156471, "uuid": "4753bcb5-9f14-4dd3-a0e7-00eeacb0a4a3", "value": "KwdRvSJrdtq9X5V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f2749d-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199695, "uuid": "3cc4fe8c-0ad9-453f-9c0d-068e53e9cca6", "comment": "Malware payload (Grandoreiro)", "value": "04b745544f64d0aa7073aeb2764b3fa5", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199695, "uuid": "c64c30f1-89ad-4dc1-9d0e-0509cc7601c3", "comment": "Malware payload (Grandoreiro)", "value": "64f4d006b36ee273784cc95b8e51410356f5992e9618aba0c671da20c49be006", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199695, "uuid": "fbd28074-8182-482b-9d9a-b09ab6d9dd2d", "comment": "Malware payload (Grandoreiro)", "value": "fc8ebdb017e82d224c71138c772d3ee0825add36", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199695, "uuid": "dcbb63c0-35ba-4b6d-a7ad-fdb1ee2b315a", "comment": "Malware payload (Grandoreiro)", "value": "fa8a3c4e01192fa6a86c12d8a715c3e354fcdf1cbae14ab40c94142b2fa98bf585a090a3389f06bdaa09fde5ec05e024", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199695, "uuid": "dcd47154-dac3-4c19-9adb-7fff2ed95709", "value": "T1A0D533854ACF1201E8DAAF34FEDF07CFA2550A358C459F736635A9B64F35802962D6C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199695, "uuid": "b6556f67-2632-4c42-86b8-2a2b8c0ac25b", "value": "49152:UhPYkZvnQ6510Z1+JPRn8odsG53Qd5Xb5NJEoL7fLs+wtIATYNEL+NsCkvIwbH04:GgcQ6L0Z0Jpn8WX3qr5NJDDs+weAENEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199695, "uuid": "c3438579-0e30-4e37-99b6-2bb74b7bfcaf", "value": 2971679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199695, "uuid": "2a852c6a-dc1d-435e-841c-ddec89d05cf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199695, "uuid": "13abbed7-e1b2-4662-a02b-aea614ef62eb", "value": "655400CITA_889547990370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96e2214-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741159377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159377, "uuid": "8a212263-f22c-47ac-a933-5d670481d343", "comment": "Malware payload (Formbook)", "value": "c954a4b03c33a981a0c82533f4a9e917", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159377, "uuid": "e9790539-1643-4488-ba38-850db474ecb5", "comment": "Malware payload (Formbook)", "value": "6531397d4b6e69128ea61f5e607f7be5c1fe0564a3676268e086e51e2806de9d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159377, "uuid": "90b8e072-aadc-4858-a954-9c5f2e795366", "comment": "Malware payload (Formbook)", "value": "a8a3dabbc07ca6b2213167ee3b95f132b98b3b58", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159377, "uuid": "8818bc91-c6ea-4c3c-863f-da25c0204820", "comment": "Malware payload (Formbook)", "value": "3eef935c9e4ea8ec62a07dcd06d0233bc4607b511f54d4e67b7f7d28286a2eb900ad465abdb26625e2eeb9514a837c16", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159377, "uuid": "cec976de-0295-4447-b8e0-2a2ae56eb466", "value": "T108F402A85A14E40BCAD247385E32F2B4153D1EDDF911C2179BEDADFBFDA1E200D58292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159377, "uuid": "46dcd25b-ee2f-4d0b-87d8-b833c2650edd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159377, "uuid": "5f1764d0-7dcd-4655-829c-38b81800741d", "value": "12288:G/f8mpm+gvy2AKReR4VP6KQntiPQjiBWr24LW7PKgAGxKMMvVeEMngIa46Y/kR:J7gxtwciBWRLuSFGx9uigIa46h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159377, "uuid": "91ef6711-d7f7-4109-80de-0cb525590f6e", "value": 756232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159377, "uuid": "efe72dc3-0f0a-4fa0-940a-64c7490575a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159377, "uuid": "cbb293fd-a05a-4a3c-8830-0d2421c5ce83", "value": "DHL AWB Receipt_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c9c025-f988-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741154918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154918, "uuid": "b0b429cb-3a4d-400c-930f-0920b9cd3d41", "comment": "Malware payload (RemcosRAT)", "value": "8bb239fb87b043c801faf13f8bba1228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154918, "uuid": "b13c97f7-e640-4581-88c9-41de45c2f08b", "comment": "Malware payload (RemcosRAT)", "value": "65b7cf7ab546e94fad0cbce12c9756dcb2af4aa833943beffdfcc448e00e4449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154918, "uuid": "ec8ea853-8421-4c18-83ca-ecd00403c035", "comment": "Malware payload (RemcosRAT)", "value": "2e5a933bf9ff60c1703560d796e2642a7c9fcef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154918, "uuid": "4e3eb2fb-8729-4035-b238-4d2b9002442a", "comment": "Malware payload (RemcosRAT)", "value": "5dd2a724c1307d73969a49d332ac20ea65e5c26f4e8e7057ef154c52d5a77d538a7543f8459329a4d4ace2752395f9a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154918, "uuid": "252ad1f6-87f7-4c1e-9d86-4cb78c9b4ab5", "value": "T13B2512BC2615F027C59553301A72F2B4263D5EDDB910E3639FEDADEBBB62E540C08292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154918, "uuid": "379f1f68-ac63-477b-be65-47e106f26245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154918, "uuid": "c390aacf-175d-470b-88a8-47e551f7d03d", "value": "24576:FN/ZHRDBnpcGzBPv23rrXB3e6+kQSANXtd4K4b:FN/ZHR3BPae6yTNXtmK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741154918, "uuid": "3309661d-6adc-4e9b-b923-0bc5ba7f9e1d", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741154918, "uuid": "07a12f99-45ea-4d1a-b304-225aa39a6949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154918, "uuid": "ddaf3d85-811a-4be7-aa50-d402519e8a8b", "value": "\u54c8\u5176\u5fb7-ICS 2 House BL filing format.xlsx................................................................................................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bdbbac-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162293, "uuid": "51d58cd5-c432-4e3b-8b7a-44254fdec7ad", "comment": "Malware payload (LummaStealer)", "value": "8d0cbd77e8d4828aa0df4bb88339f6ac", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162293, "uuid": "d37d3340-ee23-4fe9-9005-2ea7df75b0f3", "comment": "Malware payload (LummaStealer)", "value": "665aee3342bfb1b567acb0d3a130b55bd9dac6ffa01e669f410c3d6c47440b38", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162293, "uuid": "36b95481-3a7e-4e82-bd47-6add51aa4250", "comment": "Malware payload (LummaStealer)", "value": "bf2ba197991b59779d1215188ff56deb9b151751", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162293, "uuid": "b6b54c28-cb11-416d-8fe4-990f67cfc076", "comment": "Malware payload (LummaStealer)", "value": "187dec6a0bff436de415a973b71181192d1d729a82098a65b0ec0aa8dbf06f838fa0e948c14e2016cc31d93e294d9036", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162293, "uuid": "9be4fd45-4a93-4f8a-9ce4-49b698178f16", "value": "T1D7E53A92750A72CFD44F16B4857FCD8698BD8AB9472049D3AC2CF0BA6D63CC351B6C68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162293, "uuid": "7a1b3582-3201-4689-8b44-95782cadc271", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162293, "uuid": "ebff63c3-87a4-4d1a-b5d8-2fb6bd4f25df", "value": "49152:9igo3N6nPH/J+kDSm8NCpG1nZO/eqEBPvtW5f/1L2:9sN6nPH/J+kf8NC4nM/YPvtWpR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162293, "uuid": "5340718e-3663-4c25-8656-d317dabb3552", "value": 3042304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162293, "uuid": "898bb474-ada0-459e-a667-818916055120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162293, "uuid": "d0f9f818-a7ee-4ecf-a112-d39df48e764e", "value": "random(3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485f9ac9-f9f4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741201305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201305, "uuid": "55e91790-58e9-453d-9a6c-9ed7bc831d25", "comment": "Malware payload (Mirai)", "value": "5eaa8cb0b3216983c548636ae6e86855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201305, "uuid": "1537aac6-0777-4f41-a402-816e5ba8358f", "comment": "Malware payload (Mirai)", "value": "6673c420588bad2bbfa967f1fd4ad37d4de2a6a2870eadfa2d4312b76f2f320f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201305, "uuid": "86850f85-7547-4001-87e1-5a2350974d57", "comment": "Malware payload (Mirai)", "value": "92eff4c74f255f5f79d38b3ca1c53ae62c8e5607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201305, "uuid": "08d408be-80ec-4a10-831e-18cd9ead2710", "comment": "Malware payload (Mirai)", "value": "25cb4387be638d62bb898cc7e09df19add65bfa3da9dd8e610d10794ee517304d15b9ec134c82a53a6dfefdfdadd8b6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201305, "uuid": "8d1fffd1-4b32-45b0-a82f-d4518fd4ec2a", "value": "T1E8536DC5F283D8F9EC0305701136FB379E36F1F51218DA93D7A49A67B892E11D90AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201305, "uuid": "008d2897-3bf2-418e-bbd9-4a17081fbe58", "value": "1536:Rkkiirjwnh3A1HsyjmIdyYWCQtQQxBNSdnLTt:Oyrjwnh3AdsyjDdDW3ZxBGLTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741201305, "uuid": "6ae7befe-2341-4da1-86a2-a38d747eb9d3", "value": 63828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741201305, "uuid": "808ed320-95df-475f-95ac-c45ae8156c1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201305, "uuid": "f36ce5eb-a36b-4874-b94d-6f2fceb44b6c", "value": "donk.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e030fb3-f96a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741142124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142124, "uuid": "1d1760d0-606f-4b7f-81a4-f1ee9fc3ea15", "comment": "Malware payload (Formbook)", "value": "10cbf5635381c59195bc6933455139a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142124, "uuid": "7d6bda2d-7464-488e-8047-2ce7c9a2d1dc", "comment": "Malware payload (Formbook)", "value": "675b839e05c6cfffc9e3931d542f7c9555758351375b6173bfbcb1512e40d442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142124, "uuid": "8fca15d0-0813-4882-8dd5-a3295c2627c6", "comment": "Malware payload (Formbook)", "value": "5466b8c66e2ff6f95dab248ab0e6c2ccf748ad5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142124, "uuid": "7d87e15f-9bb3-4721-8955-235929664d58", "comment": "Malware payload (Formbook)", "value": "e2dbc85e222b3ae11e365b4944c25ed9e099ce784d67df53ded973ede576a98272c39c352692c7ccd9abb614b7c7aa58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142124, "uuid": "437f0008-c0ef-47b5-8eb2-31f5923931f7", "value": "T1F4E423A59A92ECA0D2686779C539CD901B7538229FC8AB1FC759E11F7C30347BC0B62D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142124, "uuid": "887199e2-cab1-4b1e-9782-abb2711b7e35", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142124, "uuid": "319abba7-0a55-47c9-9cb6-2ab92ffd9b39", "value": "12288:2quErHF6xC9D6DmR1J98w4oknqOOCyQfQStK59gdwfv7it/jw9zsJV8MQh2pqLz:7rl6kD68JmlotQfnndODkLwarDQko3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741142124, "uuid": "a0e04c59-50c5-461f-b6fa-2fe6d81650e5", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741142124, "uuid": "47fd04e5-e7d0-4225-bbc3-54067f80bf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142124, "uuid": "2fd95f36-dfaf-4925-8259-ad736b5892f1", "value": "New order BPD-003666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81672bca-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1741162316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162316, "uuid": "359de792-2001-4a39-886e-b01c3f3248c3", "comment": "Malware payload (GCleaner)", "value": "1f59f823cb567f64b66569604b2be6ef", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162316, "uuid": "6f5d5729-6f1e-4226-8a29-0fc15ae2541a", "comment": "Malware payload (GCleaner)", "value": "687a003fd3d125b452accd657fd0ca30c9df82ede6ef4a314b06977fae905909", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162316, "uuid": "413670ba-e072-471b-9f34-5522a52e55ab", "comment": "Malware payload (GCleaner)", "value": "f01f3035077e1e166f132cca38615639a4d9adee", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162316, "uuid": "af24346a-ae41-4ff4-bf91-bc655b77a85d", "comment": "Malware payload (GCleaner)", "value": "0a529c3ba01914e3fda2b4303eb4975a08542e7e3e19d85ee7ca9081f63955f826458d55a5eede1f19c8f1b0e012104e", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162316, "uuid": "95d318fd-0abd-40f1-89ec-dbfba117346e", "value": "T11A0633AB477B9337D464AC33F70F09FB496C6C0F869A5884EBD4E55C81F6756408AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162316, "uuid": "7663b88d-d705-4573-ad75-e737af71d30f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162316, "uuid": "2e750979-1503-4c11-964b-f13d3991faac", "value": "98304:tOq2oZ89MmWxHsRpPzRd8qYDNI/iFve8Q/uJKH:Qq2P9Mw7Rd8jIqgN2KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162316, "uuid": "5bc46a2a-6f49-4a9d-9f07-b6759eb0ee7d", "value": 3932160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162316, "uuid": "27eee147-ee67-4ebb-9fcb-9b99171f2664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162316, "uuid": "fcf66dff-3320-46da-9b83-96557e9ab6a0", "value": "random(5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53f42dd-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166806, "uuid": "28b4483c-6292-4294-9591-6e1837ed7320", "comment": "Malware payload", "value": "9afaf1ae952bd3df8190e8f30b34d80c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166806, "uuid": "805a76cd-0f38-437c-bba6-83ab360e4d41", "comment": "Malware payload", "value": "696a183a93ed8385b22afc8f428f8bf3eae535b085449d5603cef71658cfa491", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166806, "uuid": "b6638bbd-5d97-48f2-9da8-ff95a4b36a90", "comment": "Malware payload", "value": "c76a4f01f0ea66aaee02823f4af02d5bc3fd88e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166806, "uuid": "0a6156b6-e24f-423c-b321-116920c8f9f7", "comment": "Malware payload", "value": "17f89deeb1f5b2cb3d57c2963e318b9941cc9908196622ae486d38bd18b317d53374a7c213c86fad5c099f437e3341f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166806, "uuid": "eddad3b6-cf24-4cfe-9ba8-1aa5b8e30643", "value": "T1FBE44B54B182D4A7CCE210F12159E3BA7128AA3650A66C2FFFC8DF14BBB47C35B18756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166806, "uuid": "34db5068-cc5e-4468-a481-a48f46094b6b", "value": "0ff7bc5492c5f3ddd1762f6980c5b84f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166806, "uuid": "a0813939-d548-4085-9310-2c08227e781d", "value": "12288:rPiBOaSezq9oer8HW1QGiZiuuteN+QLapjrWsGTkB3+1bLG:zCOnwq9n8HW1QGiXauLWHGTq3QLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166806, "uuid": "5a27140e-d501-4163-8ed0-1307e91841f1", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166806, "uuid": "0f92702c-21f1-4bfb-a3d0-12ed8862364a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166806, "uuid": "31557efe-a113-4e22-bb97-d1ed2546c7d9", "value": "696a183a93ed8385b22afc8f428f8bf3eae535b085449d5603cef71658cfa491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb6c61a-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181795, "uuid": "c795b9fb-17e1-4573-bc20-b1b4e8fdd6be", "comment": "Malware payload (Mirai)", "value": "7d7ddba8440e7ea041652feffe0a7afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181795, "uuid": "4507efd6-62d7-4241-82ea-ebff8285090f", "comment": "Malware payload (Mirai)", "value": "699fc59720a38b194f54ffb5b9b5899c6983803d6e9f535259876a8cb5e9ca2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181795, "uuid": "35ac4cb8-eaa8-433d-90f0-ddbc7b032e0c", "comment": "Malware payload (Mirai)", "value": "7501c3c951c06f21c4c372f3d44a729021d2a8e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181795, "uuid": "12b7a01b-88b8-4f01-a109-104d394ba048", "comment": "Malware payload (Mirai)", "value": "6fa4274697904a35d0295956e9db62c46319195bd92f0b36c2acb652316133c10a16021c44fac5d6bac34fde433c7d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181795, "uuid": "920217ac-aed2-4eb2-aed9-0a90834a22aa", "value": "T17803F260CD851670DAEC997F8EF455C0235216B3470B72A9791A42687BBE8932CFF8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181795, "uuid": "b645c7ff-2663-4285-acb1-05d3598e9b86", "value": "768:W35oFy/HvOCWiKncau2SbLIYkmF4smRpw/pN4NapyEvL3UQ:1Fy/HmN9cau2e0YkmFLfAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181795, "uuid": "f930d9f8-e43a-4e08-9b2b-2cac1ee32098", "value": 38408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181795, "uuid": "fb1c55d5-e436-4ba6-b8a9-8094e8017dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181795, "uuid": "d59fd5a9-ba40-4730-9fa4-4135f5a512c3", "value": "5r3fqt67ew531has4231.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9253a773-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185108, "uuid": "c705bd88-0bc8-439d-a773-6d940bee4b51", "comment": "Malware payload (Grandoreiro)", "value": "a76b8d4944de5311b9f4d96022cf2dfb", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185108, "uuid": "74d12a59-af5d-4a58-8ee2-22abeb984924", "comment": "Malware payload (Grandoreiro)", "value": "6a1c83f18ff9748048cabe166cdc1df16a622a4c155bddfd16a86ef86444dcb2", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185108, "uuid": "7af9a213-f6f1-4d9c-814c-5224cc650adb", "comment": "Malware payload (Grandoreiro)", "value": "0a3309cc46e448f78b7bbf3976f1f9a7cb8e1971", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185108, "uuid": "c98f42e1-f9b4-4b40-8707-3a1e2c1ecb4e", "comment": "Malware payload (Grandoreiro)", "value": "e2ece00706dde25e37091d6f0a04290484ae1e2431ccc298d48f2818c925a3f1df6993bb52a75f3f6bc2bb14d43be067", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185108, "uuid": "0234e377-63a4-483c-9661-ad27f50a2617", "value": "T14BC533846EC4C618DA586B74EEAE1B4F91ED01F70AE8CB57BA00F01CEFB2D13A751594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185108, "uuid": "63284bbd-0ad8-45ee-995a-18543727588e", "value": "49152:3oVZuVVXBzWQXYDXa7fOFQhi0EYKPnxDocpyQep0e64mLGXDYjTjn2/V:3oG3X4Y2W3vKPLBleNmZ/j2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185108, "uuid": "dc59a4ef-8e7b-4833-8602-e823f7b137ac", "value": 2693002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185108, "uuid": "b3b427bf-78f0-4728-a8e7-29b386f239da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185108, "uuid": "c44d520b-7681-4ec6-8311-913ed8c5fd0a", "value": "308828682328PIPJ4247_CITA5923.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27b2760-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741159392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159392, "uuid": "577119f8-40a6-470f-bab5-d86d15bc2c64", "comment": "Malware payload (Formbook)", "value": "4ac714bc29590957bbae6088688f94f8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159392, "uuid": "980aaa16-e36f-496d-b612-9c50e28d224c", "comment": "Malware payload (Formbook)", "value": "6a25af2f54a4ba04d02a4cf1e6f4fcf4a8b794a24a60d3c65273ab94c2700060", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159392, "uuid": "c8acd6b3-4832-440b-a5d6-93d26ddfb065", "comment": "Malware payload (Formbook)", "value": "b6a370fc9924194a66c3287e4bca2bdf458a9cc1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159392, "uuid": "e0818ded-c6d9-4461-9aaf-a787b17a2689", "comment": "Malware payload (Formbook)", "value": "4c346d9b5c8280228957c6e8d4dfc299788b64ed151b4c81307ac5b4e952c7ab84dbd4ac84f06a148f1d23a6c4bd4d41", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159392, "uuid": "fd01aef6-b01a-4ebf-b4cd-129cfb109ca4", "value": "T1EE75F183B94BAAA2E6855736C59B440043F4DD82739FDB1E3D8E23A71C43BBADD01167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159392, "uuid": "b5066b80-b1bc-4836-af24-0ab5d9756e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159392, "uuid": "dfbfd662-b229-43b6-842a-5d1a72922831", "value": "24576:dOe4OaavTb9aBnR5DRTbl8W7SmoFbG1uRVaAhEoY5qo:8QA3VmW7So1uRVZh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159392, "uuid": "67418d1a-c843-4833-a130-29de91ff0da3", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159392, "uuid": "ce952bc0-dfe2-48a0-9ef1-9cfce4c90778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159392, "uuid": "b13f56a5-9f16-473d-bf76-6521fb3d9d3e", "value": "DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168375a0-f9cf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185330, "uuid": "0a030b86-4024-4eca-b256-fec34debc610", "comment": "Malware payload (Grandoreiro)", "value": "3a8c62ebfc9a854217ff16725f1d56d9", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185330, "uuid": "dd610c77-5460-4e45-8ff7-b0b77c44a32d", "comment": "Malware payload (Grandoreiro)", "value": "6ab7b940295dcbe80d765801e73ad19bd8e1d0477380a4174f78017ba9f37b86", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185330, "uuid": "942050db-6d85-4a13-9e68-9a40b60e9627", "comment": "Malware payload (Grandoreiro)", "value": "f669e70ed4ad67d8b4152d21df88fc89702a5ed9", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185330, "uuid": "d1bfa3c8-e647-4c60-9c76-10a56c988df7", "comment": "Malware payload (Grandoreiro)", "value": "874055757e8db6647aa1239548fbf283a603349ef7a53badf05e90e2d881d603917787c3f79e273c05b4f1d44f9f8157", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185330, "uuid": "455c0a3c-fc80-4667-946d-2f45cc668937", "value": "T192A52388BF860924DD98F735AFEC568D91F50AE10CE8E653B710B4D95FB76008B389E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185330, "uuid": "2d75cad0-b0d4-49b6-82ec-4990a92f3f3e", "value": "49152:1IfbA93jQ+hte3TEUq5LMoz4dEPkAuiVhXGF2/Y:AbASnnq5LDX/XGUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185330, "uuid": "7d0c4486-8e0b-4363-8102-d8d369678399", "value": 2122484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185330, "uuid": "a7b732df-05c4-4b78-b90c-715f47bf6d85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185330, "uuid": "fb8b65fe-3f37-4bcf-b35f-a2234aa2e484", "value": "730336667634VCUL4638_CITA3067.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0228154-f9c7-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741182125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182125, "uuid": "6ab6a3af-5539-4547-ae73-5947b5c348f7", "comment": "Malware payload (LummaStealer)", "value": "04eacc602d626eba16224fdc15ef8aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182125, "uuid": "34a928cc-7698-42f9-a8cf-d24ffb641842", "comment": "Malware payload (LummaStealer)", "value": "6ac6fce5dddcd7e72952ba3c2e36e92c5c4aac45e2b5226060421193e882d996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182125, "uuid": "e40b4c26-83ee-4fd2-88c8-b4699e158cab", "comment": "Malware payload (LummaStealer)", "value": "b34ada743e5e4ed6b34ae2894b057f8df75efb71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182125, "uuid": "b50c757a-53d3-441b-aa35-f490f01b938e", "comment": "Malware payload (LummaStealer)", "value": "0ab525224b3d010d683e7c53698ca99922790cd94aa52386a65f3ffd5812bd319bffb4aace1862f0f9227148b6fafe77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182125, "uuid": "d07c50d7-036e-4693-9aee-a75d85463684", "value": "T1729412497BC8AB72C9A056B5C0F3596582F0E1871977F3C53F441E945F827988E743CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182125, "uuid": "c431ceb3-031b-4491-9d48-170cd2e60e24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182125, "uuid": "3d34a610-3586-4bbf-9656-ec797d51014e", "value": "12288:z/8Xg+W5MHFU2Ahl3kk1M/vHixeG0XG9otBlyR0u:zgTlU2Ar4/Pi4K9oteD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182125, "uuid": "ad3a0fad-0373-47fc-94d8-9e0f4f06296f", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182125, "uuid": "a76a5404-4373-4c5c-b669-daefd94aa414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182125, "uuid": "beb85cfa-015b-49a5-891c-add65fe085b8", "value": "Collapse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5403aa8-f967-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741141009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141009, "uuid": "2584089a-2484-417c-a035-09b604600fb8", "comment": "Malware payload (Mirai)", "value": "031bf9576050adf9c6ee0b57c1efda8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141009, "uuid": "241a43bb-7bcd-4ef9-920e-c37dc4af6116", "comment": "Malware payload (Mirai)", "value": "6b47641ece7ed82877c6e5a6f89eccd23073316914d5c75fbd0827b982969a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141009, "uuid": "18e4e4a6-2290-4d6c-9139-f9766b1d39ec", "comment": "Malware payload (Mirai)", "value": "ad7b702200e24207618f866ea0804c8dbf9d2ef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141009, "uuid": "a1a1ced7-06f7-44c9-a701-b680cf318596", "comment": "Malware payload (Mirai)", "value": "2ba9cc8aef102e6bcefad63cebc2f3dd4c623c7bbd31d00829aa6afaac816e34935d5f096f932533fcd425c1ec8fba17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141009, "uuid": "3e616163-cf4e-4177-9659-8ba062691e20", "value": "T1CA239D13DDB62E18E21891F0B4A58F7967B3E95091CB0EA9D462C32DA413EDCF4963F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141009, "uuid": "b1910035-5ec5-48a8-b348-7706d2f5c459", "value": "768:VgUk3hW/w/paI9oHs57KovyqowK/S3BRa9oXzS4z0CH1jJhfizf/sOIl:GMgpJ9oM57DKq3B8yXRz0CHYz3sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141009, "uuid": "04491f09-a9be-4795-bb10-3574008acf99", "value": 46716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141009, "uuid": "45a02238-78b4-4647-889f-6e3f203f4f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141009, "uuid": "86aa4594-3a49-438f-b977-d2ae9b18d387", "value": "cbr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e60e9c-f9b7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741175177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175177, "uuid": "7299d709-969e-4b84-b737-cdd2a502c6a1", "comment": "Malware payload (Prometei)", "value": "c7ddcf1201efbc0152b628401a73acf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175177, "uuid": "69511cec-432f-40c0-a7eb-0b229d0e3401", "comment": "Malware payload (Prometei)", "value": "6bfd46556910b9e99bd51d66f6aeca3880b07653d0be3847a05a6d4fe8f99d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175177, "uuid": "b5d7fc09-d127-4d3c-94d9-92d66f371e60", "comment": "Malware payload (Prometei)", "value": "d7d6bd3576a5be7deac7286b653a85a7b6dd5825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175177, "uuid": "45ec0b02-5b50-4c50-b60f-0abe429d89c4", "comment": "Malware payload (Prometei)", "value": "52e095a2e942f80c79f61cd90c2c08aa2839588f4fd0f10505a6cc149c8ab3fab41f6161cafdf17277ede15c5ceaf588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175177, "uuid": "36e3aa27-7f5d-495a-a0e0-51c94351e58b", "value": "T113155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175177, "uuid": "536d2d55-a8cd-4a99-a380-f925fa0bcbd3", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mple:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175177, "uuid": "85eb83a2-a608-4e5e-969c-dcad9040425c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175177, "uuid": "cf73e8ad-a805-4717-bd45-47ffd62bfe3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175177, "uuid": "e38004b7-6535-4b65-a513-3d599be4eb53", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dfe3b6-f9e4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741194690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194690, "uuid": "7c245ace-e6d0-4282-9d2e-41917fdbe40d", "comment": "Malware payload (Mirai)", "value": "950c1892f64bd8a62c81c2794a8932da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194690, "uuid": "833a153f-0257-48a3-98b9-2d2a13ad9a3e", "comment": "Malware payload (Mirai)", "value": "6e3090a611d816254ce0859d5568d625f62fc77814044adb9e9636791d647ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194690, "uuid": "0ac59f94-b6ab-446d-810c-6760d04037fa", "comment": "Malware payload (Mirai)", "value": "c2b50d1be198b2047e472845276d78e8fdb722fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194690, "uuid": "cd2bdb58-a788-4413-a2ab-8f4513d9d2e4", "comment": "Malware payload (Mirai)", "value": "ae8ba5738355ff314e897817d40ee26d0dd4cecc79b96460e338834eadcabecb2ae7223e9f975449be020c4e26ee1d57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194690, "uuid": "afce534a-2aab-463d-aec7-da0675720d31", "value": "T1585301F0969DEA75E3E58D70FD7DCAD8F34005B6998C7323A7552B58E8848033AE48B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194690, "uuid": "d6c43e22-c161-4e18-8470-6e175c0f3603", "value": "1536:Xy7Pbam9aCwqliN9myt/AT+eoaA/F36u88zLN8Hl0:Qbaqs20oTZsD80Rkl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194690, "uuid": "f85f2ede-172e-413c-b94a-eb6b3d811195", "value": 65424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194690, "uuid": "7424783e-ff9a-4686-afd2-10ea85f5930e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194690, "uuid": "92fb2121-53da-47e0-b14a-d02c7063578e", "value": "5r3fqt67ew531has4231.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6139ab7-f9bf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741178779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178779, "uuid": "b241794f-379c-4f3b-89a6-28719bd6ba3a", "comment": "Malware payload (Mirai)", "value": "895fa5a10dcab3f483befbefc4c18825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178779, "uuid": "50f62419-1927-4022-a18f-7ec63cd54b95", "comment": "Malware payload (Mirai)", "value": "6e5836e18127269b81af669ccd321513b96f6319f4f017da6a2ab539a7daa98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178779, "uuid": "60549d45-0e2e-425e-9749-22c40a9ac574", "comment": "Malware payload (Mirai)", "value": "3de2cebcd96c8988d1395d53c828e3105862b6bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178779, "uuid": "dd422678-3749-44ac-b882-45f8f7df437c", "comment": "Malware payload (Mirai)", "value": "1b2e7a4986eb7ddbf4a7cc1cec7400509124cc7cfd94d0834f6c4297f94623172783648ce601d1ab230f2b6659f84d4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178779, "uuid": "11dc3066-1cc9-412c-ba39-1cf74f7989c2", "value": "T12A631B96B980AB24C6C2557BFE0F114E33138B6CE3DE73129D285B7077C796B0E2A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178779, "uuid": "458c1011-f8b9-47fd-9ce6-ab8fe7003547", "value": "1536:Q/nIrDYfNJSj9da0kQsMIiEro0WeWnn5qYZC:oNJ+daVro0WeWnnMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741178779, "uuid": "882bf14e-5b3a-4563-8150-210296a1fe68", "value": 68508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741178779, "uuid": "7a42e2e1-eef9-462a-abad-17ade012bceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178779, "uuid": "8be128ca-b6d1-41bf-b29b-7611989a09b3", "value": "cbr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33f938e-f9e4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741194693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194693, "uuid": "f77e1ea2-df51-468a-a52a-88c856df06a4", "comment": "Malware payload (Prometei)", "value": "83ed3b8dd3876c576f0b08cd9a4ee2fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194693, "uuid": "2d642381-637f-4c9c-bff3-974aaf00c631", "comment": "Malware payload (Prometei)", "value": "6e7afaf406086af77ba7babecc39da74f5e999df1ba5ff6bd5a02e0b8ff4c0ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194693, "uuid": "8262394b-89cc-4eca-a127-7b0c585806c6", "comment": "Malware payload (Prometei)", "value": "9bb99293310f3f4468ce428477709d61efb7aa3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194693, "uuid": "58a0ca34-268c-407f-972e-ca5c689273f6", "comment": "Malware payload (Prometei)", "value": "b813bef27375e9555a4dd3351518c349581b4d69aa78f28a62d73f46a974b58e8d7db17e5ee436e49556d9b2de17111f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194693, "uuid": "cda8dbdd-c7df-46c3-8744-25007c578348", "value": "T11D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194693, "uuid": "fa7cdcf0-8323-40b5-bbed-f22d1b3cafde", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl4:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194693, "uuid": "6f338d18-72b3-4e85-ab9e-b5e4972f4d96", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194693, "uuid": "d89f7fe0-c2ba-4054-8120-3aa259829d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194693, "uuid": "ac4c81cf-65c5-4894-b47e-065c241f3a08", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d717ce-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload (VenomRAT)", "timestamp": 1741166802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166802, "uuid": "0559f29d-a9fc-43ee-82a2-84593cc301c9", "comment": "Malware payload (VenomRAT)", "value": "1261cfc79b54b6e1e7d8caea0efd69c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166802, "uuid": "7c36f556-ad2b-4607-859c-ca9ba6be1c65", "comment": "Malware payload (VenomRAT)", "value": "6f9d8640168fb34aff3b829d7f08246eb772228c37bcb0f5b2621260704df159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166802, "uuid": "25851508-656d-4fdb-8c86-6b27bac0f455", "comment": "Malware payload (VenomRAT)", "value": "6e20bfa35d34d2691129136cbc7e9e4420b83376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166802, "uuid": "6782e07c-a2ac-40e1-9b39-db942245ddc0", "comment": "Malware payload (VenomRAT)", "value": "ea8302d0d4dadfcaedb718540ef5aa85f7e10fab2383b8b36740dce336d60d5b87948e82e1fd4cdaddb9c383e433342c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166802, "uuid": "e889fce2-6ac2-44c3-93ad-06c93672f30e", "value": "T1887633A07F91B56BDC9C0F763C9472AE32A163416014C233B2DED74CF75A6894AC762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166802, "uuid": "1c07c8cf-72ef-401d-b71e-8279c2c46967", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166802, "uuid": "6a0c144a-7807-48c8-84a8-61b1629255d3", "value": "196608:4Sw00gd43zzUAUvIzrJjtu2PZIqqqdu6BAjeXLQZdD:4jbgd4DzUAGkrVtu2VDYiACXsZdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166802, "uuid": "b5cd3de7-af91-4885-abd9-5be574ffc777", "value": 7688416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166802, "uuid": "01548f3f-6803-4b21-b0f6-b6ffc0c32309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166802, "uuid": "3e535242-555e-495b-ad03-3ea5226f3813", "value": "6f9d8640168fb34aff3b829d7f08246eb772228c37bcb0f5b2621260704df159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae3f9b8-f9e2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741193685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193685, "uuid": "6f219747-aa2a-4517-8d21-10e046fc3a7f", "comment": "Malware payload (Formbook)", "value": "457de1104cf5376ecb1726d4c45cacaa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193685, "uuid": "8a11dad0-1c98-452a-b3d1-47fdf093233c", "comment": "Malware payload (Formbook)", "value": "703a14ae07deba722217bc6837fbc576af67300d2d9e683ad4293f20e9a1e804", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193685, "uuid": "584c2d1e-ec7c-4083-8c1b-ac19ef54aa13", "comment": "Malware payload (Formbook)", "value": "ba827962d4b81d17e4cca245c7de6711fe138661", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193685, "uuid": "1aeef271-619c-4fb4-b369-e88e69d5f610", "comment": "Malware payload (Formbook)", "value": "6aa25eea943cc2eb608a4c11f1f523a4f1bb007c0f0af309f2ca3c010a215075a8bb95a3783ac76d94021d5050428f58", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193685, "uuid": "6c8ab336-09bc-43ce-8c87-9936742f9908", "value": "T19F73126D39C0B937101792AA7E673CADC26550641BAC7C998503651ACFF7222ECBE60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193685, "uuid": "36cd3116-2dbd-467f-95e8-161e69c13873", "value": "1536:N3qq9luHsf+tvfuQS33yH6AJ8CpWw7WPxRDfC1HwL105bYWARaIjRza:pqMlyQg2QOJA3n7WP+OLwFARaItza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193685, "uuid": "247cba0a-2646-4a2a-9a97-7714b13b784e", "value": 79599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193685, "uuid": "f871da3c-e42e-4111-b02a-21c38d3697df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193685, "uuid": "ff60daef-9eb6-4a16-8d58-b30c8c1d7bce", "value": "DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528 XLS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52b7344-f979-11ef-ad17-42010a9c0004", "comment": "Malware payload (Loki)", "timestamp": 1741148713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148713, "uuid": "0900f707-5709-44a6-96a3-07c875353ce6", "comment": "Malware payload (Loki)", "value": "e16a7ce7083c49bbaa6e264c5f38c1ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148713, "uuid": "02f4e7d8-988d-46ea-a77c-721a8c23bbce", "comment": "Malware payload (Loki)", "value": "712b2ac1987715d8f00efee1564134d975790138d938cdd4dade04902db22b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148713, "uuid": "2986b2ea-535a-46fe-ba64-b8b24c498be2", "comment": "Malware payload (Loki)", "value": "e1d4a85d8f45d473e1158cea0f2135e988c82e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741148713, "uuid": "b9e1c3b5-b4bd-4df1-ada3-8e551328bbc2", "comment": "Malware payload (Loki)", "value": "0d3f195fc327bfe367a0bacfee75f4116d51f6cdd31ab8026e3db8e1438e39633ff7333f81bd6fa6eebab7f35c447614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148713, "uuid": "1de032e8-21c1-4655-91ca-f192d908d113", "value": "T18FC401BC6B45E407CA854B741A71F27826795EECF801C3438FEDADEFB9A6B540D44282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148713, "uuid": "1e8031b7-ba96-4b4c-839b-9404860ca364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148713, "uuid": "becc9782-4fc1-4f5b-b744-a30a5bcb4f82", "value": "12288:R/fopm+gvy76FUVxEHiN6fjM1aIWtMxyVY9f6r45X5O3+kR:t+62606LM7IMxSYgrI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741148713, "uuid": "183ead26-1b89-47b3-8ec9-b1a5d4073502", "value": 561672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741148713, "uuid": "0b1f46b1-9f67-4bb5-b305-06771a4295d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741148713, "uuid": "b64814bf-ece4-46a0-bb2d-c5e509dc41b3", "value": "ORDER-000291-XLSX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdf173d-f9ee-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741198841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198841, "uuid": "61770755-1199-4c95-b77d-8d0b88c42727", "comment": "Malware payload (XWorm)", "value": "1acbb16aa4d5da52f8b4fa5d45fd7a64", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198841, "uuid": "4366bda7-22d1-4caf-99e8-6c2924381bf4", "comment": "Malware payload (XWorm)", "value": "71480c4ce0427fd9afe47f0100e04a8716a30ed5d7b4348dedba380e172c3713", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198841, "uuid": "151eb029-09ed-4637-95d7-5cbd520db3a8", "comment": "Malware payload (XWorm)", "value": "03b8ff34fd74ddadb2312fdac0eb12cad283225c", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198841, "uuid": "7422644f-2b4a-46b8-909f-699d828251e2", "comment": "Malware payload (XWorm)", "value": "6e0d6a1f371baf26363e6558c3dd4b411d50ba0749ca7b1e62878982fe80226ba44faf7c04a7840e16813ee69e7e3c57", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198841, "uuid": "798fb1db-6927-4d29-bf8e-a7d0d0d58d02", "value": "T190F25B087F944317CAEDAFF1647361121630E217D913D75E88E88AAA3F37B848D457A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198841, "uuid": "c6dec2d4-203e-407a-9cd1-c68a1eca69a3", "value": "384:f3iSuXGyOjxOpBu7LoSfLWrd7SfFLWAvPeNgJ0wpkFMAfNLT2OZwxcV2v99IkHES:v3uX+vDWJhcQFm9YtzO6hLkG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741198841, "uuid": "970aed54-04fd-4ad8-973a-e75410b6ad9a", "value": 37275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741198841, "uuid": "dedee410-d224-463d-aacb-e31e8c950dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198841, "uuid": "3beaa141-42ab-4b6f-81f6-11c5166027d1", "value": "174119883973b940796e28cd3940db23bbb405d9445d3ab00b918e1f0522700af2f03b2426348.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad100de-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181794, "uuid": "fc593ee9-d123-4b63-891f-7525c9e8840e", "comment": "Malware payload (Mirai)", "value": "a1fbbf6c3cebc40a95c8c892f5d5853d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181794, "uuid": "5fc7bc94-05e3-4ae7-8781-3e92c69c4986", "comment": "Malware payload (Mirai)", "value": "71a989ffc285cc5c5b85b6a764b9e443c70b6c00f0a9a20223caf096ad918e8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181794, "uuid": "47ebd74b-5823-4596-90ec-e077c3fb2d9f", "comment": "Malware payload (Mirai)", "value": "7cd52536e9cac273bb8a6f8a59a84f28c57ebf61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181794, "uuid": "c8a75a4e-2cc1-4047-b3fa-df1b269fbf9d", "comment": "Malware payload (Mirai)", "value": "a8678415b75137f5c75b09f650748cd589b707525bd2b6592f571cea122f363a07bc242c318dc918a5651a19922b7981", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181794, "uuid": "435f5197-0fee-4c94-813b-7630aee4f8a6", "value": "T195F2F13177AE78E7CBF51830F6FDC74BA59E7A2CD205B1E3B150907980D81016AFAA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181794, "uuid": "af98110b-078c-41ed-9fa4-eac163af2a42", "value": "768:YgahCSql2HnfPQfSaVDbvlyIUAaPXHk4EBU3UZ:6hT/Ph+yIUAaPXHTEBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181794, "uuid": "f1b47207-7cab-40f4-98d3-ca80314f3fff", "value": 36948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181794, "uuid": "33c5c38d-e687-4d6b-8631-d879fc0f4e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181794, "uuid": "20ab918e-dd30-4e04-8d70-e702e8801980", "value": "5r3fqt67ew531has4231.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2580e1-f97e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741150661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150661, "uuid": "4e6cb71b-9ad4-4f93-be47-e0cbdb81d961", "comment": "Malware payload (Formbook)", "value": "b40dbe4a44b1adee71c17bbb537ce646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150661, "uuid": "9dfb98e5-e650-4953-afec-d15bb2ad5d39", "comment": "Malware payload (Formbook)", "value": "71d16f11d609531f7a59f8b56013c1696e5b39dd4c9e6ca5ffbcec258032c58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150661, "uuid": "39d56955-93cb-48a3-8028-789b8a26629d", "comment": "Malware payload (Formbook)", "value": "3c5cba85930fdc908448e6a7963d20630ab48795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741150661, "uuid": "11f332dc-55c3-4292-92a7-9f011a008ad5", "comment": "Malware payload (Formbook)", "value": "4da31c3aecc6edc7eb732313eabd167feea5de50e5d0e51908c2e9588063b4cf36368652e4f30d3f87c8215ebe3eee71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150661, "uuid": "076fd534-af59-450b-a5aa-5be63e9c7a42", "value": "T1A0F412A45259F427C9462B781E70F2B422BD1DDDBA01D303DFED6DABFE3AA140D58281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150661, "uuid": "70c91d2e-fdca-4074-b87d-ab9ff7b5d95b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150661, "uuid": "db35ad57-8b3a-4827-8543-9ca68f00d887", "value": "12288:d3/fTpm+gvywB6CnxWPsMEdjN3YBahrGTiCNv2CvDPaT3eWby2UjOaAoMleRhFg2:uvICiT/N+CvD0KHlcleKNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741150661, "uuid": "69c1051f-831b-4ec1-be85-a01665135300", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741150661, "uuid": "1d674b8e-eaa1-4b6a-95e3-36bb5b298fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741150661, "uuid": "9a005bd3-784e-46d6-804e-ebe2736492e3", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda0f06f-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741156002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156002, "uuid": "d2fab4a9-755d-4b51-97d8-2ed42e5ffc52", "comment": "Malware payload (Mirai)", "value": "7863b66854b51ea3ffe5a2f58698eff6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156002, "uuid": "641f16b1-b3a8-4c2d-b123-b0d5292f20c8", "comment": "Malware payload (Mirai)", "value": "71d83cad5776fb771ed93250ab305a46c9bc9a131b4ced5fd71f1231ec5a3e3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156002, "uuid": "b941a938-debf-43a8-bde6-b8fb1d287b60", "comment": "Malware payload (Mirai)", "value": "f5c2b93a31034f89fbb08fac668a5051d87644a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156002, "uuid": "248668d7-bdce-4482-a3e9-d626ce0a6495", "comment": "Malware payload (Mirai)", "value": "7391e7b240f794bacdcc02de0a583dc6f12db5918dc847a8767811c75a50833792f84f0d86ecc821759dd510ac7f3e5e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156002, "uuid": "b3462c1d-4870-4702-b001-4b7d586e8da2", "value": "T1882149FF53D0620781BADFD434A5C558910485D3641E2F3EADCD8D3AA5CAEA8B205F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156002, "uuid": "e46c26e8-f546-4194-b814-828fad4a7dea", "value": "24:8WnXWWnX2nWnXYNI6hWnXtKcmWnX8LWnX2N+gdWnXZCbWnXuFWnXgWnXb0WnXeWo:8kWk+kwhktAk8Lk2N+gdk2kuFkgkb0kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156002, "uuid": "02b2d0d8-7d90-4a51-8a6b-a301fa0eb76d", "value": 1259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156002, "uuid": "564ec5f4-dbf1-4425-9104-93a5686affe8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156002, "uuid": "15b53145-9551-4bad-ab0d-47d38acd7447", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f69fbfd-f9b1-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741172648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172648, "uuid": "872e2bc2-fb9a-47fe-8d45-02668b13ed76", "comment": "Malware payload (XWorm)", "value": "cf57d5eb699a380c9c16a80380ba4430", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172648, "uuid": "6c0e03f0-a6ce-4271-92c1-26292f8c291f", "comment": "Malware payload (XWorm)", "value": "71dfb99a8659fc7f33fb09bda152cc14aa4d42266c3691b61045a7083eaca8d6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172648, "uuid": "689ab226-0bac-4046-b4ba-e66766d9c94d", "comment": "Malware payload (XWorm)", "value": "f619f0e136046b263597254cac874843669b6f5d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172648, "uuid": "f8b00e76-500b-4f0e-b842-4b9ffd1908cc", "comment": "Malware payload (XWorm)", "value": "1be323cef08833979ba66867ed1bf7404a6c2ab12d0e4d14a73535b3a9ccfb947deac89cae87511d24bd089692f0cc43", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172648, "uuid": "b9d081a9-0f63-4a21-861e-e0557ae1be38", "value": "T1FB53D53ED6E8EDD083ABB2C0565F3B4A108CABD3B6F55BECB9D248B45410684EF75148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172648, "uuid": "b3e8760c-7f52-4cd8-b438-b7aad57cbec8", "value": "1536:UM8QNuOVNv9V/AoMwQ0l/ds8RtZkbmEKUgXEXzICKUnFWvjpi:UMnTVNVVqJU/dUHfKjpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741172648, "uuid": "e6068107-0c3c-4633-94f0-aff92f69c660", "value": 66004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741172648, "uuid": "2a36ca6c-3f0d-428a-9745-59273cd1eafd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172648, "uuid": "8d162292-99bd-4774-ad31-e250d5265771", "value": "awb_post_dhl_delivery_documents_05_03_2025_00000000000250.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a8084c-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741159478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159478, "uuid": "46370f9e-96f5-4f38-947f-782a9db96980", "comment": "Malware payload (AgentTesla)", "value": "b4103409ef4dad88a8cdeca497524629", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159478, "uuid": "16d0533f-2bd8-4d09-8ab5-8d84c831f414", "comment": "Malware payload (AgentTesla)", "value": "734221b2182dd5d904f186d40bd3442138479f6d0d0c9336633c8cce754f40bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159478, "uuid": "566fc43a-9dc0-49c9-a2f8-351b505c824d", "comment": "Malware payload (AgentTesla)", "value": "8b30ca007aa92ae5d9e5fb227e707d572df8185b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159478, "uuid": "713aa518-18d0-4f42-b708-709843c396ee", "comment": "Malware payload (AgentTesla)", "value": "53df389441fee0bd03150e9aed818c3155e3fd760ff6b49cfb0b3819be6a5b25e448217f34f8925ae07675eef77705df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159478, "uuid": "de2de799-bb6f-4761-a335-93f3db6c063d", "value": "T19F0502ACBA59D212C59407751B71F6B8232C6EDDF900C61B8FCD6EEFBD32A116E04246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159478, "uuid": "2687862d-837e-4175-940b-53ebf9fd9add", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159478, "uuid": "54ccae75-8818-4d12-8ae5-a6075666535f", "value": "12288:MU83ilzaYV5ScBAjuFlElAUpxqN2zVi4xwEPz/su9HKSxGbKx9M+9u1Z:D83ilzaYVQ2yLvqeJ20T1HvGbB+9u3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159478, "uuid": "8163b5f7-25b1-45da-8a62-62880c91c27c", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159478, "uuid": "d52c2dbf-968a-4ab2-aed5-43945a0f64c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159478, "uuid": "a804c921-4eff-498f-a477-03e0c6618404", "value": ". MV PUMA 7 - FINAL INVOICES - VOY. 16.02.2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c860bebc-f9cd-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741184769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184769, "uuid": "985a40b1-ee51-4899-99cf-68728a12f7ba", "comment": "Malware payload (AgentTesla)", "value": "cefe1828e1e5af2d016eb1d17c57a88e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184769, "uuid": "6a5d8263-5c05-4391-b73a-3e51618f12a2", "comment": "Malware payload (AgentTesla)", "value": "74a794e49ad3d2118eb14395b7fead75084e0a91ea6cfabde8fd684c0f1f8344", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184769, "uuid": "5c407517-fed1-4ed0-b430-8b21d0f22f7f", "comment": "Malware payload (AgentTesla)", "value": "01245cf98bc4bbe9b260ecbf1a02fee938445147", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184769, "uuid": "bdbb2623-9caf-4531-9948-02f1a840c0de", "comment": "Malware payload (AgentTesla)", "value": "40b522ebbc0d2373403f616c78c6f2c38a50e3f0dbb40285dd9b2ced51ace934bfea1bf0cef835a545e9137cd2311681", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184769, "uuid": "ef30271a-96b7-4d2a-92d1-fdf34bba956c", "value": "T1AA74C407FF8B89A2F2955772C58B440073E4E58E739BDB1A398E13EA09437BAED41147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184769, "uuid": "8f59eabf-0f5f-41ae-a8bb-0bdbbf7c90e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184769, "uuid": "582eac6c-1b7c-4a61-a8bc-4c1b423fe2aa", "value": "6144:L9uRL0Rq5hlguTyYDXRJgc0yjYIGUg44fZaZ1/F85f7pJ5JI4b4V9G5:LURLUq58uTNLRJgc1DGJ44f0F85bxb4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741184769, "uuid": "7131677f-41f7-4d5b-a8c8-606b7e9babd6", "value": 338544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741184769, "uuid": "5cf4ba92-e9e5-48b7-aea6-250775654145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184769, "uuid": "1d68bc23-7e7b-4b3a-b269-3e50acc657b4", "value": "Bulk_OrderSheet_KIDO VINH.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ead248-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159416, "uuid": "8c2254e7-b46d-4d67-9e0f-b1a531c97751", "comment": "Malware payload", "value": "344f646104b4b93a0e7244d2ef66c049", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159416, "uuid": "20389722-1c40-41c7-af39-69cb912ca2a3", "comment": "Malware payload", "value": "75b2472b562f8ae20e5ebc2f6c32a8a3eb1883b25c920000db1597ada8961076", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159416, "uuid": "4e93730e-15a2-4e1b-b495-3afc39b88e30", "comment": "Malware payload", "value": "b6fc87f66c8a38a196f690e5b148f05ff80a4392", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159416, "uuid": "1faf97bf-adeb-4413-8c12-215867d2f027", "comment": "Malware payload", "value": "062120271441e753ee517714d934ae00cc7da94ed5431b4474bad18e2a40d20b852e5e0b0222e1ea72cf1999d9f1d88e", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159416, "uuid": "4c656b3a-97c0-4dd5-8887-4cd3c1801932", "value": "T18664C50FB54B89B3E2455776C78B440073E4D942679FDB1A3D8EA3AA0B437BADD0121B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159416, "uuid": "7f42cbfc-f935-4355-b012-6adfcfd8646c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159416, "uuid": "9ab49aa2-a96e-4b68-8d30-6023f780f56b", "value": "6144:kDjlXyifknwlfDqf78aZR+72i66b9IVZCbpH3:+jli3qA+59IVkbB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159416, "uuid": "dcdaeead-9563-4d8c-aeec-0a1e41548ede", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159416, "uuid": "2221f055-bd6d-4054-924a-7f1446e5e074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159416, "uuid": "63471719-249b-485c-a95d-f901c887acd2", "value": "BBVA-P53269 .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247fa359-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741158295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158295, "uuid": "5f701431-0cc7-404e-9aff-e31f026f99d5", "comment": "Malware payload (LummaStealer)", "value": "9b22ff98954baf626f5f2486ff057460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158295, "uuid": "f253f78d-91f6-4139-8e04-4d6985d8b618", "comment": "Malware payload (LummaStealer)", "value": "7640558fa1094c2f67100b0e28fb6cc17952a4249d383bdf746a4a9ed059f582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158295, "uuid": "4acfe1f3-157a-40f3-a246-c69093146313", "comment": "Malware payload (LummaStealer)", "value": "6ac4303aeb8689bb61b0819f853ee10428dc25ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158295, "uuid": "27f3c8cd-c661-4e58-83d8-f6478537eff3", "comment": "Malware payload (LummaStealer)", "value": "0681bb626e93421cba1fd520bd5db2b3c76d9a1592b176e9576793d040ddbf14bc1f1ef111729e70e7c186ce2a107ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158295, "uuid": "372dd5ab-6d04-4506-8b24-29288cd884f9", "value": "T132E53999A909E2CFE48E1278A427CD86585C47F94F2705D39C39A3BE7F63DC421B6C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158295, "uuid": "1bc8aa80-6ec2-45a8-afbf-e2bfb11e1628", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158295, "uuid": "a76479fd-6b6a-4800-89a9-4b10bddd7483", "value": "49152:vIGIqjn7jTPSwqFuUh0MjalaZ3KmT29j:vvIqjn7jGkm0MelaZxT+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158295, "uuid": "e01bc438-cd2e-40f4-aaea-1ae85a4f0146", "value": 3160064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158295, "uuid": "4909bc84-71e3-48af-a1b8-7241ab584027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158295, "uuid": "c3efa7ee-d4ce-4700-8655-6527780374e9", "value": "9b22ff98954baf626f5f2486ff057460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e0f800-f9f3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741201111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201111, "uuid": "11a186a7-cd76-4d4d-8d15-f31a2e88d688", "comment": "Malware payload", "value": "ac672204539d497ebaf257d4558cde94", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201111, "uuid": "22b1324e-0197-43b2-8ad7-4070fe1e0a26", "comment": "Malware payload", "value": "76834a23decdb4a55682a3726b7c89109fea5799ee28476d4b15d334abac7534", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201111, "uuid": "13ef765d-1aa2-4741-9617-0c3bbf7061cc", "comment": "Malware payload", "value": "66ebf8712aeffde92a07fa819e7b6370466f8344", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201111, "uuid": "eb44ebf7-77cb-4b0d-a38e-ee677dcc168f", "comment": "Malware payload", "value": "3b758e90510afad749c25f8a71184165306fe8e691f7a3b11d023057b39979472126034eee57d4322e994bd670b7c59d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201111, "uuid": "e3e3308e-ae8c-4fe4-87ba-2b0656506092", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201111, "uuid": "72f62b2d-79dd-47e5-a061-b1c03cf22e39", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741201111, "uuid": "8b539fcf-1e4c-469e-a6a5-52efc8935702", "value": 233640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741201111, "uuid": "3458bc09-2384-48f5-89ca-50fce5be298b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201111, "uuid": "34badc11-446c-4bd4-80f4-5f5acb14592e", "value": "VolumeID - Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cfdb04-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741162304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162304, "uuid": "7123738d-37e9-4df0-b193-a0bb47b25dd5", "comment": "Malware payload", "value": "0282be73e52cb40d1893413356ecc019", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162304, "uuid": "13801cd8-d520-4455-af6a-5346eca5466d", "comment": "Malware payload", "value": "7696e4e6fb26e0a6c4e320326e784f0d560db8922109a72e04076af0d72b0664", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162304, "uuid": "9d7caec5-84f2-45d5-8c9f-e58a8fc5614f", "comment": "Malware payload", "value": "288fe6f9b2cf7be34a2a2be1cb9be01d56048c49", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162304, "uuid": "ab7ed1f7-466b-4259-aef9-62e98714dd0c", "comment": "Malware payload", "value": "c6c330732c3112c43e629f76944b2fcc58c2255ebf710af8593d58873aef93af44b68f6e3cd853070938bfbcb3455daf", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162304, "uuid": "b3f5b3ea-985f-4916-b14a-ffc2268168ad", "value": "T1DDF4235713C59458F3C99C398F4F7AE40DA9B8378D08B1A06C82DDAF467EDC3E24661A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162304, "uuid": "2488edec-5445-48b1-b215-f9037cb01aa9", "value": "4ae33b8d2061f6c9bcbf55085ca43943", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162304, "uuid": "2acbefda-f719-4cc5-b70f-2c62931ab285", "value": "12288:C7At5mHEDCj/4hm5NFkweBkzwuc2uElCf8l9E46P7nrpDnQEtxiYKa8j+wJ4+:C7AtFDCghmnFk5Bkzw6uI08446P7r5zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162304, "uuid": "0efc32bb-100d-4bd3-8aab-191bd51762cc", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162304, "uuid": "5820e0e1-7602-4cc1-8624-33d094d1276f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162304, "uuid": "21a9aa9e-a2fb-4137-ac21-2b39f789f142", "value": "random(4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac821e0-f9ab-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741170090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170090, "uuid": "48e494b5-ef58-41d0-bc5a-e970763ff603", "comment": "Malware payload (Mirai)", "value": "2b614fe4fa99519170c3615d96c9e35c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170090, "uuid": "d6d7241d-d328-4875-8a3a-b9e51d97ffe8", "comment": "Malware payload (Mirai)", "value": "775f413943233df65be5c7bbd3aad64c050ddc8ef40cf855bf1795f248ef6b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170090, "uuid": "230cf2fa-36b5-47d6-8240-144a65cc2c96", "comment": "Malware payload (Mirai)", "value": "da0822a65f9c12e4337aa8cc35f74396196ecfbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170090, "uuid": "842e8b44-a2ac-4ed1-9697-f103dbd397b6", "comment": "Malware payload (Mirai)", "value": "525d8d0b5f1a38796a68d44d05ce55b3c930f08588044105629d3d8cf10cc59fc1f66b03346cecb4313dad650b0a4403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170090, "uuid": "e8f68502-c6b6-47a5-b576-60691ea2041f", "value": "T101130974381DF2E9E8A82334E4472EF62A9245983DEDE6D3B0564131F9F538CAD45E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170090, "uuid": "5806d16b-f93e-4ba4-8446-5b9425159cea", "value": "768:ATwwbCV9yeN42q7kj6p1vo3/PdH++DljzgYKJm1NnwRIDoEgRaQj+X5y1TRCoSZk:+JAyqZ3/PdHMTmvwb0g+X5y1TRMs+qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741170090, "uuid": "448e3454-e1eb-42be-8c24-2c27c951bed2", "value": 42616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741170090, "uuid": "1115c3ee-bf57-4e34-a792-8016e1af39e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170090, "uuid": "9ad96938-7bc3-475a-926d-4d270a1f1fbe", "value": "cbr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6238a76-f9aa-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741169814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169814, "uuid": "933ef749-8ee9-40bc-b9cf-c974db804fd8", "comment": "Malware payload", "value": "728315f1ceff3e48e3ec9850ab590e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169814, "uuid": "91ac5799-4695-4142-91c2-eb5c95dffcb7", "comment": "Malware payload", "value": "777ae4f88797e2af7fec8e43dbc7c7182d9b9138a785fe6e33efc76a61910943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169814, "uuid": "9b2690ad-8d8c-4e17-b3d4-a303724e6353", "comment": "Malware payload", "value": "68c131bcc541bec1a51fae51df47341fb3c74290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169814, "uuid": "623d07a4-2c5c-420c-85a0-4abd64efc88b", "comment": "Malware payload", "value": "fcb03fb4af10b7121c1b2082dee8670b5ba968234e8492d6a33cdd769d1617faf37d10c6df617d6e3ed0afcb99e5885f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169814, "uuid": "2531e03b-91bd-4258-a0a6-2ebb005eda26", "value": "T140450205265D9D36FF8E8732C1B540193AFBC5C6A3FFE75A6C8B58EA19837C68902143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169814, "uuid": "1f7a77d2-1d0a-418e-b543-acaf2d192b54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169814, "uuid": "5c0ea4c9-9e44-421c-b7ae-dcb430e011b4", "value": "24576:DQiq6D/yKzISu1cOwxZlixB9BJKgq0rgFxQ88o1h+nb+2kO2/:DVcH1oix1J/qc8zEbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741169814, "uuid": "b2f4e59b-7081-4649-92b7-202b01efffb1", "value": 1251328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741169814, "uuid": "40573698-aa3c-4ef9-8e1b-880d3f92657b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169814, "uuid": "b5c92c47-a39c-4beb-8d2b-a68c3114d5a2", "value": "728315f1ceff3e48e3ec9850ab590e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad91ff90-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185154, "uuid": "621fa1fc-e37b-4c42-bcef-dd135523aee3", "comment": "Malware payload (Grandoreiro)", "value": "9a400d38a702bfe2b524c39457e6ea0e", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185154, "uuid": "a9e55213-de7f-4899-9da7-4da5879acf77", "comment": "Malware payload (Grandoreiro)", "value": "7860ad70dbaff111b76f1e31bd4213a4471ab5f8b325d3e9230d2466f1880841", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185154, "uuid": "71a6ce11-deea-4db6-baeb-300d46690410", "comment": "Malware payload (Grandoreiro)", "value": "4b18b0598f24b7ba94bbed379b110e6bd65fc7c5", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185154, "uuid": "ebfd22d2-acd4-49cf-a526-4fe8253bf28b", "comment": "Malware payload (Grandoreiro)", "value": "a34af8d310c297aef3e29b49b9a4591cd7262bfdce1ce1d95b46764871d0e1c9ee12a120bfeb3396144369f2e0ae9b40", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185154, "uuid": "a09c21f8-13b2-4f0f-94a9-de50edbd8eaa", "value": "T101C533850DDA82A0E94CAB36FFD947C9E6D64AE70DA0CE5313E4F0F9DF396406635224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185154, "uuid": "cf2c01d4-3373-4279-bbd2-8350f4fb6338", "value": "49152:9Aa9Gu9oXaNhqXbh4BtOqZMzdBMD6r+JExSPDALo0jNgAc6vL1tj+6u14EovY2/d:9ku9dNhq14BtpZMzdBMWKExKDMoqWAc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185154, "uuid": "c3da4040-1248-4dcc-bcb4-a75d4af78580", "value": 2593223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185154, "uuid": "5520c9b8-2e07-45e7-aa1b-518d4d124c3e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185154, "uuid": "2edfc446-a4b9-446d-ac06-b4943db67747", "value": "478101885810NNTV8126_CITA5442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ff15ec-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162408, "uuid": "ce395892-e7b2-4b66-a484-9ddb974867db", "comment": "Malware payload (LummaStealer)", "value": "3f84f670f0e10ad43bcb6df7c25cdc1a", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162408, "uuid": "bee9275f-d2f8-4d41-81a2-e8de4e24ebbd", "comment": "Malware payload (LummaStealer)", "value": "787490502d51da937007d81c84ae8929ab20e5516f0fa36dec97b30b5f154351", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162408, "uuid": "1df4031a-6b22-4118-8f8f-ca394883b7a1", "comment": "Malware payload (LummaStealer)", "value": "0e04beff1beec91fa9408c0b1e28da8283c9c70e", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162408, "uuid": "caf695a2-ab1f-4116-800d-7a3218f40c2c", "comment": "Malware payload (LummaStealer)", "value": "b9c7b9dbc4930d9660c6026d245094c881ccc00058133192b6739ae57b66601c0443f0e7c7ca0d8fd37e7f0d4483dacf", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162408, "uuid": "b371e54f-0b68-4916-9ffb-5b6e4849dc23", "value": "T12C941249E6D097A3C97948B8D0F3052947F995A33133F3C97EC40EEE4D857E54A28B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162408, "uuid": "e6c07aa8-a994-4d06-a443-b98613a63e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162408, "uuid": "6aae4cd6-749a-4153-8526-808fea1abcab", "value": "12288:r/8FYTSB3tGmyAnI5mla3za4EALdrVWiZ:rAWgdOAWmcjLEApVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162408, "uuid": "f4162939-5794-4438-9566-d910564ecb61", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162408, "uuid": "f529611a-a2e3-4b06-92a5-9dd2b46260b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162408, "uuid": "3ce4e5bd-f6e3-45f5-ac3a-e07c2d03de81", "value": "wBalaPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587338e5-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160100, "uuid": "f92b96f3-f100-4c48-831d-01cf03cf781f", "comment": "Malware payload", "value": "510b93a7bb11a522de3d464be9085f0c", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160100, "uuid": "b52f5b6b-ef58-4d4a-8cde-ad8c7aa697b0", "comment": "Malware payload", "value": "78b96ddeba978f337da5d1f5b2f3602eca6a97ecd6ed1d80291af38f77e092d3", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160100, "uuid": "a8f74f7c-4ca2-473a-b0c2-803414afa6b7", "comment": "Malware payload", "value": "9bc8442f8f0229358891d026d1159993970fda4e", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160100, "uuid": "3bb463b3-c435-480c-8830-9a9fd46326c3", "comment": "Malware payload", "value": "286d61a086453d92f255693b720455ee2433d16b563357eb5e5f214bc699c081aedb8cfb26fdc1a1ac79c12be8ca39e5", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160100, "uuid": "899d0894-3547-4c8a-84fa-7bac74bdd260", "value": "T1DC72292CA7E8E7B5DC6D1E7648B153000332E3568D23EB2F59C4261B5D737A08BA1B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160100, "uuid": "10feb7c9-8145-43e9-abc3-ce494c29ac1a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160100, "uuid": "43cd4394-05d4-45c4-853b-be98d9b4571a", "value": "384:WiJZWNPxYVC7dUEvquhhKZMOm/21fvuYYAYtEXFzYGz:Wi3WNpgwdUEvn6Yk1zYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160100, "uuid": "69456b14-b0fd-4c67-89a1-7d062c96f964", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160100, "uuid": "0aae696d-6999-471e-b0f3-df6d36eb4539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160100, "uuid": "a1c53386-cfc7-4747-809d-af1ddf0e72f9", "value": "r.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109ae58e-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741199493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199493, "uuid": "11ed86c7-6bfd-42dc-9652-e1513ffa0cfc", "comment": "Malware payload (Mirai)", "value": "5c76dc59fb0c8867a443e88d8cafecba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199493, "uuid": "2e7bdaf7-1112-44ef-97e9-1cc0ee220958", "comment": "Malware payload (Mirai)", "value": "78df46d30c892d05df72637f84f094d3dbc85f49ce9bf578ac0d1ba40c1d2ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199493, "uuid": "25e21a63-f7b4-4571-ad08-6f60fc3ae49a", "comment": "Malware payload (Mirai)", "value": "7b0d466066edbae7918e78f951b3483e9102275d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199493, "uuid": "1221f102-4fee-4f2e-bfa9-bf6c9514e72b", "comment": "Malware payload (Mirai)", "value": "d2dbb6464fb07ef831f472f1801fdc6a5bd9a8b06391aa4dbd30aca96ad570c0db9b1906034d6ca37baaa82a31adb888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199493, "uuid": "480dab50-e16d-41ec-8f95-c228a4c97ce8", "value": "T1E9733A55B9815613C6D113BBF6AE428D3B2623E8E2DF3213EE316F1137C682B0D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199493, "uuid": "e5bc09b6-d993-4347-8917-265c365a7209", "value": "1536:Ndrd7rjAOFzZ5+/RjBO48JIy3eflwtzUAFgNva7410mm5:Ndrd6V8JreWtA7a4Pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199493, "uuid": "3b6ae529-dad2-4e7e-8a6e-37ceaf938b55", "value": 76852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199493, "uuid": "fa48ac92-9931-4d11-9f89-6be1a8f23936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199493, "uuid": "3c7f7e84-ee63-4be7-8a62-f6e25296a15d", "value": "donk.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da557b83-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741159459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159459, "uuid": "f9fe7f74-e6f7-4bf9-b4a7-419cbf44eaa1", "comment": "Malware payload (RemcosRAT)", "value": "f6a3a751f32c3359385eb3fda98e7b15", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159459, "uuid": "6a980df7-7e5b-48f1-9cb2-334897d94513", "comment": "Malware payload (RemcosRAT)", "value": "79b1c652688a672ef16ea6848b2b7015aa90b4f2fced255dd55fa40f90a0e4b1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159459, "uuid": "5362760f-349c-419a-a4e0-74c4abfe7649", "comment": "Malware payload (RemcosRAT)", "value": "42afa158b4f1ef1695380ebc3c1ede3ec60bf78f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159459, "uuid": "1dfd960a-7161-468b-a7d6-9e2ffa505795", "comment": "Malware payload (RemcosRAT)", "value": "91808970a0fb50765c693c9a2f8f0efda92ccd9b2f0908ad48dc050cb876295426bb6c4edd895a3f8f83460bffd38bf1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159459, "uuid": "6374fab1-9244-4370-8d4e-1ad80acb8760", "value": "T1FE233960DB112BEF0F472FEE9950F564C678AB40553E40A078AF0388651E995FFAC6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159459, "uuid": "6eb30d41-9dfb-45aa-9168-f6d9f10836e1", "value": "768:uy1i+lIgO4o51hkyDjfyCMRkqABwW9kn5Env5lOqbHLk4K:u8fIFjZHDjfypi9kmvhbHoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159459, "uuid": "fa748de8-b9d9-46b3-9fd1-b7d438321cc6", "value": 48304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159459, "uuid": "b144f993-87c7-49aa-976c-a298f7ba7318", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159459, "uuid": "f7507655-cd04-4dd5-a4c0-2537a7b14df3", "value": "CO894GOV2O25.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56df5aac-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162245, "uuid": "b7c2a6dc-9724-4b47-bfe9-a03468135337", "comment": "Malware payload (LummaStealer)", "value": "641525fe17d5e9d483988eff400ad129", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162245, "uuid": "782cf112-12a9-427c-8d35-fe919eb81c43", "comment": "Malware payload (LummaStealer)", "value": "7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162245, "uuid": "f512d15d-1c6d-4863-9848-11f919c58e1c", "comment": "Malware payload (LummaStealer)", "value": "8104fa08cfcc9066df3d16bfa1ebe119668c9097", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162245, "uuid": "4f62e83b-a4d7-4e15-bbb8-7939155aac4c", "comment": "Malware payload (LummaStealer)", "value": "c0702611b82e978ced3f12340b3f2cd2da620611b8906cbe73e7ca25fa5a248c53e8875b67f080c2cb675e5a7c497978", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162245, "uuid": "73b807c3-5c56-4412-9abb-34d57535d1d8", "value": "T17794124A73C0AA72C6A458B6C1E34D2243F996476537F34E3E850CD90F923B49B367CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162245, "uuid": "eee81b50-32cb-4b8a-a30e-1b8872bcbb01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162245, "uuid": "7443438e-1f77-483f-be85-aec0c598a836", "value": "6144:b/JuB2yKgy6uKbxH9TDbF+ov5H4LX5nviFKXJD+MZaq8FS48UP01PduTIGsVThM9:b/8Z0hKtHBnv5YLIM6MXhrd3M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162245, "uuid": "d17ca61e-0691-4167-9a3e-3697c9360306", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162245, "uuid": "aacfc1e3-0d2b-4c4d-bd16-e7c52e050ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162245, "uuid": "9be6fec5-42f0-417a-8666-8a12cc426cd0", "value": "MCxU5Fj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5dfd03-f9e2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741193693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193693, "uuid": "674f915c-52c4-4425-ba11-fb0075fcfb26", "comment": "Malware payload (Formbook)", "value": "7b646f0b01732bc2c8a47e2709378301", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193693, "uuid": "c819ad11-809c-4e85-b30f-27dca3359b6c", "comment": "Malware payload (Formbook)", "value": "7aabe82adaefd4fe013b563b342ff838479a0e0e2288a478e1ab917d16160e11", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193693, "uuid": "a4a9eacb-ba6f-4adc-8079-f5c365b67e09", "comment": "Malware payload (Formbook)", "value": "0d70d4967eec8e9c9f11dc41153ecbbbbf213469", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193693, "uuid": "d216dedb-b012-482f-938e-165a56e2f233", "comment": "Malware payload (Formbook)", "value": "c9c97b277633cd8d73a3724060260a52f307ccfcb80cb63c5ff4b9526348e086445db41af8049a4b2b9e11d17dffe66a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193693, "uuid": "1d40fc50-fc20-4254-9f30-2827bb085fb1", "value": "T11234DA0E668A75A3C6507F72C4B60B060374E945A6E2DE0B2DBBA35D09737FB6C5120F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193693, "uuid": "5e34a2b7-5e53-49b4-87fb-52c262fbe9a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193693, "uuid": "e140c47f-fc5c-4170-b47d-3923a7dbdf1c", "value": "3072:O7ZmfPx1ZZVqsdXp95i78Iz9xWgylqDfdGjxyHBDnU9hqADhHmO/HTcc:AZmHZHL95DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193693, "uuid": "9e45dc73-0d3d-410f-b753-8ab8c0b533be", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193693, "uuid": "a7df4de5-ef7f-439d-bcb9-76485556b115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193693, "uuid": "d96b8db3-bc6a-48ec-aacf-a26b62e8a928", "value": "DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528 XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b780e135-f9a9-11ef-ad17-42010a9c0004", "comment": "Malware payload (DBatLoader)", "timestamp": 1741169279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169279, "uuid": "17f95776-36f2-4f9e-b9c8-8c66915ad3ce", "comment": "Malware payload (DBatLoader)", "value": "1fede4be782e73bb402f202e355f8e5d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169279, "uuid": "c44e880b-5aa0-498e-bf79-3c69971547e1", "comment": "Malware payload (DBatLoader)", "value": "7b408a4b96dafc7827412d9e9caf5075e0fd398c58d22ea3607399f609d3a88f", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169279, "uuid": "a616eaf3-f759-43ad-b2f0-a9a544e29590", "comment": "Malware payload (DBatLoader)", "value": "a744d7c42b304da92d9ba36c674cb44d4b1cfab8", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741169279, "uuid": "1f87dcbb-71c1-4d16-a37b-3baf2de38132", "comment": "Malware payload (DBatLoader)", "value": "64f894b303ca38099c1cfc08cb729ffe307b5cae095f2d82a627d31af0058cb4dacd0311c99fb067c9470c86278fcc99", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169279, "uuid": "1548eb0e-0b1d-4f38-b0a5-ad192b43f829", "value": "T13675BF13E2A34436C2531F748C1AB3A55825BF632E286D757AF35E8C5EB528338251BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169279, "uuid": "2f81ab80-5475-494f-a96c-3d2bb296a3bf", "value": "e04c455ec557cf932fe904b508741982", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169279, "uuid": "aa2ecdda-d908-4130-b4e3-0d74f4ae4802", "value": "24576:T9J5gc4iG+d3LfseJ6FgvVCZ2DABprtWHTy7pujrbFe+t:JzOFaoZmapJwTIpux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741169279, "uuid": "984cf806-b402-42b5-aed3-0a0a46a78334", "value": 1651712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741169279, "uuid": "654ae90c-476f-41c7-a7ff-e4151a45f92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741169279, "uuid": "26032c4d-7822-423e-8811-d035b90a4d20", "value": "D9876543456780000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dae4add-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160216, "uuid": "2919a345-fe58-476a-829c-0c659bc8f5f7", "comment": "Malware payload (Gafgyt)", "value": "611da92a1516ce506a8b332a093c3297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160216, "uuid": "3048ddb2-6996-44ee-9cc3-07fe22ce4614", "comment": "Malware payload (Gafgyt)", "value": "7baf296fc930c9042e8517fa5e887ff845425a8b268583efec9c03005b52cbe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160216, "uuid": "022be245-3a69-4eb2-8946-4730e7744cf7", "comment": "Malware payload (Gafgyt)", "value": "cee384228d386529c6b4d0f5769c1cb01da82934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160216, "uuid": "cff175dc-50aa-4f61-a87f-0799d11a8ead", "comment": "Malware payload (Gafgyt)", "value": "c76389836a690dd7f8b8dec0a6347448cda72b962cba0c2c08f31d9a5343120347cd2a615bc8c48e4628b649d83db58e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160216, "uuid": "f9ec1b99-2ca5-4908-874b-18ec6c01cb02", "value": "T137834C82A741C6B3D4831AF902DBCB250133FA3F5A2BDE66E31C3DF48B5548472617A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160216, "uuid": "6d345a47-be1d-4375-abf8-0186a2c11839", "value": "1536:AXntBkcR5UUUNU9UCI8k47jfLurvUxbxtgd4ovm4u5/QS/RiLZMgOlsBuQdQR:KtHR5UUUNU9UCINMjfAvmbxayMu5/QSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160216, "uuid": "ecb3b38a-dfe5-4991-acc2-21fcc7baf721", "value": 86325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160216, "uuid": "9ce22ecb-fcb5-429b-a397-7e9b2186168c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160216, "uuid": "49eb82a4-9fe0-4419-a9f7-1b61e898a081", "value": "jew.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70de92f-f9e2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741193786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193786, "uuid": "d26646b2-40eb-4513-9a0b-9bf99b0bd781", "comment": "Malware payload (Mirai)", "value": "852b27ef9504e914a24a21eef796fa17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193786, "uuid": "1385b1fa-db5f-4816-8843-cd9f7cda32a4", "comment": "Malware payload (Mirai)", "value": "7beee9f62d6e4b2beae94220dc1b7c9e18ae0e171dce414ff733596d62774f1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193786, "uuid": "5e257782-4f33-463b-bb40-a6fa7726ad7b", "comment": "Malware payload (Mirai)", "value": "bbf7f7b1b788314f22f30b84eb46b0139e048164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193786, "uuid": "edae3c2d-23d0-4c06-9074-2a32a40af6e1", "comment": "Malware payload (Mirai)", "value": "457d28b7ba1fe1eb90b65c74e15769e40ca4a7f4fc0abf590be2c2b5dc854d5bbf03e43d4058922bffbec16456afe402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193786, "uuid": "24ad3a6f-b765-4057-b3e4-caf587ce8739", "value": "T1A313F2419703F6A0E5906973D07B098373760BACD0D6E45672668C913CF1AD6EBFE847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193786, "uuid": "0918ca9d-fb33-4c72-b818-051085e553d2", "value": "768:80sCkqxCvW8ls5KoQEdBPPRYXDrOH0+5zBA+Yvt8l7/S4q3UIGC:80SseCMEdNPRKnv89XYClbct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193786, "uuid": "8642b916-de71-43c5-b31c-d49a16d0da7d", "value": 42792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193786, "uuid": "17cb91e3-6490-4c9e-aa7c-945c444070db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193786, "uuid": "9acd2ad7-542d-4c25-84f9-ffaf4a33bb6c", "value": "5r3fqt67ew531has4231.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115d8df6-f9cf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185321, "uuid": "61214154-d4e4-4024-ae6a-942753adf09c", "comment": "Malware payload (Grandoreiro)", "value": "bebb34abc2da0aadf604de1fd6bbb640", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185321, "uuid": "13f4a232-146e-4df8-b596-19c1089a922a", "comment": "Malware payload (Grandoreiro)", "value": "7d79f2a54370c557f40147a5ad17b87202c7a2e4285d46ea5f9d694fe0ca7e9a", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185321, "uuid": "390c050f-2cd7-4e06-963e-c7c562e9a2c0", "comment": "Malware payload (Grandoreiro)", "value": "2ad9947a07e0b56ab8afddccb9d42fe7de33468d", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185321, "uuid": "3dba3c82-6781-4e69-92fc-44593187440c", "comment": "Malware payload (Grandoreiro)", "value": "e6914d7232b07c1badaba2c1f6e13f7b6f4f9cdf4475bce1ca9bcf584dadea58446a61a1a7d539d0c09b5b45d74aaa57", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185321, "uuid": "c9656d17-5928-4fda-adff-28728408f627", "value": "T1DDA523A86ADA8150E8C8F730FEEC9BCEE0F0036899E197175624F5F8DF2186C976D445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185321, "uuid": "06ebe2f6-5397-4196-9fff-219f9d996e03", "value": "49152:RQn5cAgLO95zHCTNB7z+jIYjJe0Wi5AA0uspMfWj2/t:RYvT95TCXiMqJew5AA0xp2VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185321, "uuid": "2efcc117-2ab2-42a3-95d6-967c9d1299a5", "value": 2125817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185321, "uuid": "fa22d190-d68e-4d57-8d0b-f31de2f45745", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185321, "uuid": "0425992d-d9b5-417b-9b5d-2d66c38a310f", "value": "270268673938OOJX4159_CITA9867.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debaca91-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741159466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159466, "uuid": "80011d69-61a0-4231-9168-b426c2cda0c7", "comment": "Malware payload (GuLoader)", "value": "407ed7fff100210404c3dc8681f703f3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159466, "uuid": "4c855f20-30b0-4c43-92b8-c96500fbd16f", "comment": "Malware payload (GuLoader)", "value": "7de81709a514ebd9487add0cc67842a612559ba1cde2016cb7fff0d961b785be", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159466, "uuid": "e9db5f40-e746-42f4-9477-b17749a45794", "comment": "Malware payload (GuLoader)", "value": "e5cb6800bacd859650410ac3a7b734ca224968ef", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159466, "uuid": "6ab98def-014f-4846-b4c1-7430234bfa77", "comment": "Malware payload (GuLoader)", "value": "f809c993f409f80d12684997817beb28fa7dd2c0b4a4e97b8b8701bbfda5a381c77d59493cebb5f824cc2b0478138c39", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159466, "uuid": "6125a332-05c3-43b3-afa0-9ba43f2fe88b", "value": "T1AB710D2BED07E33198774869482FD04DC8E00347A61884A4BA6C89E19F387FDE6A41CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159466, "uuid": "61ec1b0e-3e3b-4175-90e0-7653f85a0354", "value": "96:0HzxUrTTIk+Fo2EW2t5KyJpl/0HYNvz/3ow/k5:WinLSy/uYhz/3ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159466, "uuid": "3750b3a1-923c-423c-b797-503d6b3bfbaa", "value": 3670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159466, "uuid": "df4f04bb-b3b0-449e-ba5e-d621b02216cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159466, "uuid": "7e0a018c-13e2-4af5-a73e-dbc796c76340", "value": "Doklad o zaplacen\u00ed_pdf.Vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83733c85-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741156307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "3574475b-8bb6-47ef-8218-d7866cd5e8c1", "comment": "Malware payload", "value": "2ebde2cfb3418b5e5a7406ce7cea35d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "2fef6e98-d0b1-4f8f-8bdb-899f7d2d67b0", "comment": "Malware payload", "value": "7f11bdff982c352d63e22c8216484b75645b176d685901e0a7c5dd72fd41bbe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "c6de4c6e-1c85-4952-a83f-16e8d573be0a", "comment": "Malware payload", "value": "a562559d68d5eb96eb73a22d64070903c28c7f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "a461b7a3-f8fc-4a6c-950b-bf820c747e46", "comment": "Malware payload", "value": "0b17c60668ea91da6fdb04b7194bebb5025a26b20710064e0ce8e66f5f70abbc6cffceab5dd3489b852848785601e414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "5a7a77af-16f7-4d8a-9a09-7c8c0f4048f2", "value": "T11D477E13B385D42FD06B1A768827C6A4953B7F602A25885B3FF43E4C6F35780BD1AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "3692dc36-5463-46f6-9104-df598fb04de5", "value": "d16a823f7e40c23f28b4fd39a1c3237d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "1e6bc070-da29-46f0-b5f5-76706758af2b", "value": "393216:E35Gzw8ySNcO56NksDmHDpN8lewfKELxm4UeoxONPdebhbUc2gJ+JLKZRl9rvqQg:i2wyVlklewfKELxm4UeJYbJzh3rhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156307, "uuid": "425eae23-713a-460a-8423-982dd05554a6", "value": 24836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156307, "uuid": "199e5515-bf5e-4131-a83f-e8e2441def1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "a70e7380-a56a-423b-b06a-c124547010a2", "value": "2ebde2cfb3418b5e5a7406ce7cea35d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9b8293-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741159548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159548, "uuid": "8eb7b0ef-3054-456d-9b3f-7b0305068b63", "comment": "Malware payload (XWorm)", "value": "c9c266737131c566122595220c28e0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159548, "uuid": "4c9c2d30-89aa-44c0-9d60-8069b119edb1", "comment": "Malware payload (XWorm)", "value": "7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159548, "uuid": "27981f16-ce86-4a20-9d4c-6dc97c76d4b9", "comment": "Malware payload (XWorm)", "value": "55a14ae5976cd04ac14e360c3ec0c22022f1d129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159548, "uuid": "2d6c7a0a-572e-46e9-b9dc-7d8f82e5273b", "comment": "Malware payload (XWorm)", "value": "d0cb6fc787584969ba5913ab3f7d7f986817096f380407aaa1be187d2ff05efdbda491362c0473ebe86d9dcf2534bbe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159548, "uuid": "1f400198-0431-4514-8935-f77f8c7a424c", "value": "T194159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159548, "uuid": "a07ab796-2603-4cf8-b85d-b9ee3f8542e3", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159548, "uuid": "28158729-889a-4d22-8dfe-7ffb5638d123", "value": "24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8a06u:zTvC/MTQYxsWR7a06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159548, "uuid": "f0c58619-7774-431a-8b0c-056d7a19170e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159548, "uuid": "4c7662b1-d7f1-41d1-83c8-1b6ba48eadd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159548, "uuid": "4584257e-7a0b-4266-adaf-bb02d34eb881", "value": "c9c266737131c566122595220c28e0bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e67f154-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741176377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176377, "uuid": "0a5d35fd-ac5f-49b4-8eb4-45257dfe3bbd", "comment": "Malware payload (Mirai)", "value": "9fb8076e80d2032b57720be5a48cbadb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176377, "uuid": "b9300173-e751-4dba-8b60-9882b3158797", "comment": "Malware payload (Mirai)", "value": "808bba52be81207e55959485595e1af20cf7a4c6529653aa084696b22b963fba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176377, "uuid": "1c379643-9b6d-42bc-a79b-ea0d1d6a9087", "comment": "Malware payload (Mirai)", "value": "8ea1840f4c585f9476ed1531dfcd4949195e83e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176377, "uuid": "1ceb71b9-f3dc-4ef5-8183-0a69ad73dd3e", "comment": "Malware payload (Mirai)", "value": "9fc28238911550ad45de847b82f448880c539aa65e3e4fb9c67436c20f1f31dd5a23aeea0daa8ef26c99a403dd4953ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176377, "uuid": "bcd03f1e-cf65-492b-a6a1-5df8d1ba780f", "value": "T142B339C0F98BD0F2D45748715067B73FCB32E8295036CA6EEF69AF36DA635428616318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176377, "uuid": "a4987956-238d-430a-a594-4e0d3a176e37", "value": "3072:3FCb8pQnX/uV7Q73WmClra+eF50WkQGx:1Cb8pQnX/uV7QTqMTRPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176377, "uuid": "b36a0e5b-b998-4cc6-b615-91cab9b86d94", "value": 109000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176377, "uuid": "2cc78205-3d6c-484f-a3a4-a40e7e658b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176377, "uuid": "3431007c-63d6-4f38-bbca-1913d880c99f", "value": "rjfe686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e38810-f9c4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741180973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180973, "uuid": "5e212700-3555-45ef-a532-09c61dcbac31", "comment": "Malware payload", "value": "5e1eb1a67d40ccae40dee2a037ca6c64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180973, "uuid": "6bdaeb55-c881-4b9e-8239-9dc1817f3e2f", "comment": "Malware payload", "value": "80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180973, "uuid": "e1e6b10a-e3f9-48d5-b0e0-7d43d54c876c", "comment": "Malware payload", "value": "786b54d3d451ea40faeeb20fd30a38744862eeb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180973, "uuid": "ce7ab4e6-f89e-4039-b070-ce4401d8590c", "comment": "Malware payload", "value": "ffad1c473f8fc53c09204002574d2157d1389bb39022660e65dc9670b58e1a2c6cb10b903b1077a3c4037daa4370eeee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180973, "uuid": "e4a10979-6cd1-4d84-9644-3beabc2b0e00", "value": "T119D4230C0FB1CAB6DB3DDAB608F8AB510B3985961B75072B75EC12513B9EFD07702916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180973, "uuid": "e8132f3c-d456-4204-81d6-1465b7a73c90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180973, "uuid": "701d669d-3c58-4eca-893b-981c70aba9dc", "value": "12288:eKdWQdWiQpqRGivLw64jGr4CJrE4t1dZ9FoWv+ih62Y5tSeek6hGlfNPP/:eAZdWrqRgjC4urB9boy6jTlfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741180973, "uuid": "1a4f1668-35a0-4626-8ae5-e49d42aa9b32", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741180973, "uuid": "f7df3465-4cb0-4936-b9e7-8ca99d41e5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180973, "uuid": "e6d2d706-9862-41c1-8ad5-646154966516", "value": "SecuriteInfo.com.Win32.DropperX-gen.23266.6173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a0786f-f99b-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741163213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163213, "uuid": "e9472614-b173-4458-82d8-a64f2d3bf16f", "comment": "Malware payload (LummaStealer)", "value": "0984009f07548d30f9df551472e5c399", "object_relation": "md5", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163213, "uuid": "a39fddcd-5854-4274-8357-b0222aa77f5b", "comment": "Malware payload (LummaStealer)", "value": "80ec0ec77fb6e4bbb4f01a2d3b8d867ddd0dfe7abdb993ef1401f004c18377be", "object_relation": "sha256", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163213, "uuid": "a6a05140-312e-40f5-b2d0-88f775439972", "comment": "Malware payload (LummaStealer)", "value": "a1339aa7c290a7e6021450d53e589bafa702f08a", "object_relation": "sha1", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163213, "uuid": "ac2d48e3-5a08-40c5-a1c8-0abb0bb09a58", "comment": "Malware payload (LummaStealer)", "value": "54496baaa3074649b6aef2711577bb604f7116f0b273fdf587a1284454faa14c7dff603c5e0e7174590dae3e74792810", "object_relation": "sha3-384", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163213, "uuid": "d62e8ae5-a301-4eb6-a806-990a3266643b", "value": "T1AD45C02155C75067F4A954F339A6B36434A7B332EA7A4FE3D2B4FA5C12902C04BD2D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163213, "uuid": "f9fe3ed7-e5cd-405f-8582-f812da5ed3e5", "value": "599d3604bea5aa3207f563aa21c8e037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163213, "uuid": "99ee7458-c1d8-4a07-aeea-409df8a68b19", "value": "24576:ChE6LP3s7/2Yz96q35BH5cKxnqERzU3++25j2/D+zOLWJqn82xc3++25j2/D+zO3:crT3s7/vBZ35BH5cKxnqERzU3n2hjKqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163213, "uuid": "d394ad34-fe8a-44e4-a26e-33655f21c59a", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163213, "uuid": "5cbf78b2-27f0-4a6e-b204-dd1e770cd7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163213, "uuid": "5fcd5167-04b3-400d-a26e-035e2cdd3123", "value": "alex2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845874ee-fa0f-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741213002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213002, "uuid": "314ed11b-d7b1-4dd9-b9e0-221e3476e5d2", "comment": "Malware payload (Mirai)", "value": "29a02a23c080666b6bfc77ef51e73aa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213002, "uuid": "d2094263-1563-411e-81e8-412ba8099a32", "comment": "Malware payload (Mirai)", "value": "819e7cbd982f916e9464a0f7c3b4365118924b8e8c0835e62a350e341472e8e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213002, "uuid": "fe531b19-007c-445c-9859-4f8d734cd8fd", "comment": "Malware payload (Mirai)", "value": "a804556071df12fd7e73f03bd12ab0e64b05271f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213002, "uuid": "c2f3fd74-80c6-4323-8fab-a07a1f55635f", "comment": "Malware payload (Mirai)", "value": "e345ffad01487dd324a5a4bb8d378ad3a0b3f78eea5160e154e73a5376e5d96ec81ce55058e902ff92f5e56b8c56ec62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213002, "uuid": "aa82dea8-b27a-4085-8bcd-f8222514bbc3", "value": "T15114981E6E228F7DF668C73547B78A35A76823D626E1D684D1ACC2101F6034E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213002, "uuid": "e19267ad-8cfb-452a-a45f-790717966567", "value": "6144:DVV0FFGfEP5l1yx276pQbQzNJPnH0b9kum:LmrbKjpnN6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213002, "uuid": "fefda1bd-5c0e-48a2-afd0-200f1b5e7128", "value": 198484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213002, "uuid": "9820270f-9e90-4e22-9146-8db2dccfa4be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213002, "uuid": "2746f813-1c4b-4bf9-8e17-16910377cd50", "value": "jfeeps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ef11a3-f99b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Stealc)", "timestamp": 1741163050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163050, "uuid": "6b4a51dd-9673-42f6-b743-aa6b19480079", "comment": "Malware payload (Stealc)", "value": "1e95dc10fef7079a5d3fa793732a7cce", "object_relation": "md5", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163050, "uuid": "d55960dc-c0a7-4953-a4df-fb261d445683", "comment": "Malware payload (Stealc)", "value": "81ac77037e15e56a6cdc0ba7e2af38e3e5a9f7a353054276c763e57d03db5ec1", "object_relation": "sha256", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163050, "uuid": "90e3d60a-d771-4c90-aa77-84bcdbfba7e9", "comment": "Malware payload (Stealc)", "value": "8e9ccb511e76c921c6ddf2a2615a2e3c86ea4113", "object_relation": "sha1", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163050, "uuid": "69af01ba-1b8b-4f1e-9666-96de923e6b7c", "comment": "Malware payload (Stealc)", "value": "09260b238482fb893431233ad11b36b977ad1723155f6a5b53aefc6dc5be3b8edb066cfc2ca72d57e569fb34d57c3474", "object_relation": "sha3-384", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163050, "uuid": "190dfa4c-1612-45ba-bf91-fbfec1c9eb9f", "value": "T1E885339B8860B317D7E88933D8DA1FDFC3010B16046E1A2C3DC85967DACC1DA6E6F691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163050, "uuid": "8ef20655-0701-482d-8db2-6aad85caf95d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163050, "uuid": "72caabe5-6db8-47ce-b66a-18e6e9e979ac", "value": "49152:QShNR7nL8ZBF9CuDe7VL4a1PzDaisxBU0Su1bJX+:HR74ZoMeJL4aZXai+BxSu1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163050, "uuid": "68710426-2164-4afc-936a-2f92a0594152", "value": 1833472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163050, "uuid": "0d623aae-61f2-48dd-81bc-d639f1780299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163050, "uuid": "1b606ca5-a823-4cba-8293-65fc409a3289", "value": "random(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e396c532-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159904, "uuid": "3d1a2dc9-439f-4f4d-ae7b-31dcd83bbbf6", "comment": "Malware payload (Mirai)", "value": "f77792643a5aa18e80ae91a474982803", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159904, "uuid": "7916a6b1-e4a0-4894-a47b-d87061c9e828", "comment": "Malware payload (Mirai)", "value": "81f9c2d8247c1d68f0cee5d1e08a2e89f09807963a3e70ce9db0a71331839bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159904, "uuid": "9a8e769d-109b-4e8d-b4ec-b1143b7c6a9a", "comment": "Malware payload (Mirai)", "value": "dfec5770705f9e01ef6f1434187cf5ba78e49a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159904, "uuid": "cbab78d2-4fd3-4e57-acd9-80d5b1f7b211", "comment": "Malware payload (Mirai)", "value": "d6f2a3009ee7c40dea58b7feda26fe971940aae1681e0854e97a0330e10ebde0c36695056227dc7b55cd0fed98fa7246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159904, "uuid": "059cfe83-08a2-470a-9d1d-c1053431ba51", "value": "T1DE937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159904, "uuid": "0225efb6-0c0e-45cc-a5bf-c452c5f9bff9", "value": "1536:W/QCZaxGdvts3i54PhoTIxPu++ALtgUIKqI4FrS4LSI:WYCZa8dvm3o4PhWIxP5htSKfUmDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159904, "uuid": "3f008cd3-1a60-42c5-bc76-44bde679963c", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159904, "uuid": "d181ca08-e50f-45c4-861a-8e093e05c120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159904, "uuid": "85c34c9e-a2bf-425d-9ebd-f105c90b3dbd", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89ba1ec-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185226, "uuid": "a226c1d3-c0d0-46ef-8366-3d57b31b6d6d", "comment": "Malware payload (Grandoreiro)", "value": "8409193417c2d9ca4bcb57026aa6e8fc", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185226, "uuid": "6d0705b2-b5d5-4e0b-a878-aaf6a6987b7b", "comment": "Malware payload (Grandoreiro)", "value": "823fe0c6dae5a242500b062c2a2df309d5f9919d3daf33a8bb5e6642c67bba85", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185226, "uuid": "d1eb299d-9274-42ae-985f-f129bf428e8c", "comment": "Malware payload (Grandoreiro)", "value": "15b3647f835e1d1017e792ca630a77527764400a", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185226, "uuid": "07c2f672-a7bb-4edd-a137-5414a12a40cc", "comment": "Malware payload (Grandoreiro)", "value": "599c2ea24ecd437fd867b245bb9bde4411d6c4e3883f97df88a609503342d7e3dd03e5c6bcb0c4d90da2b726f5068bf8", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185226, "uuid": "2a6ddb58-2840-4a17-bbfa-70b132df70af", "value": "T103C53348AFAEDAA0F9C4EF347FD9138FE1E147D52714C6279426E9FC0E10991A72D0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185226, "uuid": "e6fd5722-b70b-4087-9251-982d5e01ecf6", "value": "49152:5dr2o/h1Hge9hamXUNMlZ+Klu9+S0vH6q4S/PWLaB/3pWB9T2/j:5drLJR/Xd8Mfnu9oJ4SA4Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185226, "uuid": "42f8bd69-c148-48ac-939e-19c301ce1d69", "value": 2523905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185226, "uuid": "db78578f-20ad-4d7b-bc68-051a6643d4d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185226, "uuid": "441da625-ff15-43ba-a74f-85e0fae1eecf", "value": "551355318790RQPU6352_CITA7214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5ab9a3-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1741166769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166769, "uuid": "833630ba-c8dd-4e22-8514-ac407773e5d8", "comment": "Malware payload (Gh0stRAT)", "value": "88fffade0f9c0c977abfeba7afcf4382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166769, "uuid": "2198a760-5040-444b-b819-564f874647b0", "comment": "Malware payload (Gh0stRAT)", "value": "82b44f0050e56f53f97bb95aa4ad9135422ca8948ff6b42b16ddac0bdfc0a6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166769, "uuid": "0ea2c65f-68f6-4bf5-bceb-4868112df736", "comment": "Malware payload (Gh0stRAT)", "value": "497536679ccf37c5f5d1cfec0beac74d6bc77b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166769, "uuid": "5f5e0e4f-56f3-472c-9fae-e25d56a1bb46", "comment": "Malware payload (Gh0stRAT)", "value": "13b09bc9105b2b60566ddd9b5989937deb89e9aeb3869bfa85ef063bec80c2c5289ca88bb500acaa6567b8fc98e1ab2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166769, "uuid": "d88745a3-3a21-45f8-8f1c-d69ece4450ed", "value": "T1BC85CF23B2CBE43EE05E0B3B15B2B25494FB66616523BD67D6E484ACCF250601E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166769, "uuid": "1acfb5be-616c-4659-82b2-0c3039002f9f", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166769, "uuid": "5c84659a-b3ac-4117-98e0-413eef9ab7e3", "value": "24576:DawwKusHwEwSpMnnhZZZ/3a8/3oe576JwmrEO+8opOcjhawiN7/:DwREDpMXZZrXZOwmgl8oqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166769, "uuid": "a6c95c4e-789f-4989-868d-0228c5a9cc58", "value": 1758329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166769, "uuid": "0cbc068b-fc08-4b51-a12e-5015b66e39d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166769, "uuid": "ea5363d8-b498-458a-8ce2-da407893c456", "value": "82b44f0050e56f53f97bb95aa4ad9135422ca8948ff6b42b16ddac0bdfc0a6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9175c2-f969-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741141590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141590, "uuid": "79d50ff1-9a0c-43d1-a27e-589764e1e702", "comment": "Malware payload (Mirai)", "value": "62febbe9d3fc4bfebd63bf05e1ee5c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141590, "uuid": "0b64fa12-770d-4488-9be1-ed2024c2fdb1", "comment": "Malware payload (Mirai)", "value": "83af797471165cc6ca46e6ea1dd54aa8a2f35250e08889af36465c9220a7ecc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141590, "uuid": "0585c8a3-22ef-4b79-86e9-ebbd9c066899", "comment": "Malware payload (Mirai)", "value": "96c82812a4dc171880e244fa27caa3e6f506c867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141590, "uuid": "f69e408e-16fb-4b41-9429-7138432449d0", "comment": "Malware payload (Mirai)", "value": "17d4433b4fe94f629a817d85a4a3526255930adcb1f2fb9d167638ebd9a687c639299cd6c06fdc9e768ae8746dd2abd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141590, "uuid": "d290fc12-b92b-4c9e-a283-01cfef8d6eaa", "value": "T197435B03514250FDC8EAD6F8569F6925E533F43823B7B529B3C0692ABE9DF503F9A204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141590, "uuid": "ab7ecba1-61df-405c-87ac-ad28727813d5", "value": "768:W9qZmMfotLt8mg0VmCkghcj0raHuwx6bWy5iv0DSEFsmNa7M3CkD1IP:QMfaLqmzkC/hcAryucciv0tsmNa6D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141590, "uuid": "7fb3858d-e4f4-42c3-a6ea-8f3013e87847", "value": 55280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141590, "uuid": "fb471ec1-95ff-4a01-b14a-139f918a2fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141590, "uuid": "7e6ab31e-fbaa-4891-a499-c4c8072f6b67", "value": "cbr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c360c7b2-f9cd-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741184761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184761, "uuid": "dc1a7e4c-722f-4c99-98db-9bd2edde8e90", "comment": "Malware payload (AgentTesla)", "value": "54062305bc17c98bf97f737b27b9bbdc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184761, "uuid": "562faf35-5674-4ae2-a7d6-fe472c47e5b3", "comment": "Malware payload (AgentTesla)", "value": "8581baa29191751e2d2b59a0260001c7449166538bed44befc800a96490daaff", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184761, "uuid": "59e35954-dbd8-4d8b-a341-2410c0ccc082", "comment": "Malware payload (AgentTesla)", "value": "11d182092c319d90a23559c730123db83b3ed78f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741184761, "uuid": "caf3e361-024d-42d1-9948-e667df9c8e5f", "comment": "Malware payload (AgentTesla)", "value": "b911bb40e23558c03d2ed2a7db6acb093add364392c6f7f96bbe5fc363d36affb53872cd78bf12e038678a1322093051", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184761, "uuid": "99b4145b-23fa-45bf-9975-702d688def75", "value": "T1C2C3125BD828760D6B88BC8BC7D4441E5110F3B354A79ECEB14E7F898B79B043A7E960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184761, "uuid": "31e5bb04-dec0-4a59-bbc1-121d1b1db2fe", "value": "3072:hhsDaErcELKoEOy1y3RMfolaKUcdftT5gPuuM6mp8vL5d1Sh:hCmo5Xyv+JSM6PL5dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741184761, "uuid": "2f6e096b-503d-42e4-ab3a-c47e7acf164c", "value": 128877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741184761, "uuid": "d1da2d86-deb8-43d4-b3d6-b2d6b5a740e7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741184761, "uuid": "e2311d16-cfe5-46a4-a7db-cfb9befcad3f", "value": "Bulk_OrderSheet_KIDO VINH.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fe7ee2-fa0f-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741213003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213003, "uuid": "f9019bb6-4178-40c7-80eb-6c4605ee1a89", "comment": "Malware payload (Prometei)", "value": "69dfb2037733ec15d6f72f2bc89ccc94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213003, "uuid": "843f915d-2a2f-4843-aa38-1344d0ab0d57", "comment": "Malware payload (Prometei)", "value": "85acd1af542b3e49dbff29b557251d7e4ef44bded91fbfffc2c2311bc947aa39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213003, "uuid": "3dacc552-ac60-446d-bc5e-e43279d957d0", "comment": "Malware payload (Prometei)", "value": "e4eeca636f9798dd24bca04937d743c8e5ab216d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213003, "uuid": "cd822e49-bc15-40a9-a280-1959e2987deb", "comment": "Malware payload (Prometei)", "value": "41216de7768dc6f0ce457d6a9ba3246afc87d74dbf6b4baa9ad37e628577c2f1fa26677cf581f626a38ba5931dce49a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213003, "uuid": "29eb2a53-ffbb-4162-b236-90ff8a0d0699", "value": "T11D9423F31824B3738A2C3A3EFF909E05D799573CF55927161A1FDDEB0F295110988A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213003, "uuid": "18180f1d-fe0b-4827-92b5-fa4cd9f36671", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeS7:W4/y+qaBUZJAdVtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213003, "uuid": "7dfc98dd-e12e-457b-8944-1854537eac7a", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213003, "uuid": "1d65ca0d-d536-4ef0-b146-18cd4e59e9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213003, "uuid": "88934bd7-4855-46a7-9d9c-8d802575b092", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ad51ca-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741159374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159374, "uuid": "711806ae-6320-4944-aa7e-d3fd585b21a9", "comment": "Malware payload (AgentTesla)", "value": "38201a49d39a550eee3c69690882b48b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159374, "uuid": "6fbf0692-02c8-432a-b518-6c1df0554fb4", "comment": "Malware payload (AgentTesla)", "value": "85f930ad776dddefb438f34b214ac49424947ad306affe9dbb3d050fa0f565b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159374, "uuid": "a264724e-729f-4e08-a36a-0ec388783eb9", "comment": "Malware payload (AgentTesla)", "value": "12d3fb6006d0819fffef269660a0b5450013438e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159374, "uuid": "0037a3af-5805-4861-9828-206c0c8050de", "comment": "Malware payload (AgentTesla)", "value": "5f3f184f7643e2909f0cb58efb5dad0d13446618b0dfc04d9e3502fb7ce4d0405b9762059e7b35fd82d813f051b29071", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159374, "uuid": "a67e3b13-91bd-45d2-8d70-2bd6d3f8eeef", "value": "T114F412386249D42BCD9597710E72F7B4227C5FDCB901C2978FEEBDABB966D140D20282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159374, "uuid": "27d853e6-6b54-4aac-b244-836643bd4bc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159374, "uuid": "70ce972d-9a21-4267-ac22-491d83cf54bb", "value": "12288:5/f+7pm+gvyYDFh4ihAbaWR5d/cQREDnI+0sWA1pQA0V2LXeGt5uWOpj0ib:ZFZh4i6baWR3cQRsh0M7QdhGvurj0ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159374, "uuid": "a084574c-0381-4082-ad15-e5f3b18fa690", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159374, "uuid": "165a04e7-a90d-4baf-9ea5-d2e01a31b92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159374, "uuid": "d72edd35-58db-4274-af9f-6cee3030b1a8", "value": "DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d71bf1f-f9fa-11ef-ad17-42010a9c0004", "comment": "Malware payload (MeduzaStealer)", "timestamp": 1741203917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203917, "uuid": "9c71f009-5abc-4183-b734-7732aeb18d26", "comment": "Malware payload (MeduzaStealer)", "value": "a5abb9572a0afc7b782182cba8f54712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203917, "uuid": "649640a0-c525-48e6-89cc-be1f5fee0edb", "comment": "Malware payload (MeduzaStealer)", "value": "8650b11da0e635078913bc5b9b59fa420268a93dbc8747dd2b2d3e96780f2199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203917, "uuid": "a181b4c8-3d0d-4f8b-9775-a16ba811a935", "comment": "Malware payload (MeduzaStealer)", "value": "5c816b2b2547200ef567a1bf62265cb9c8bf94c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203917, "uuid": "d04835d4-618e-40f8-91d4-0d455a3ee3d6", "comment": "Malware payload (MeduzaStealer)", "value": "68d253e487a99a75babcb8a8da9a7e344b3e9592eb3f2c9ade2584232448dfbda7a2e0003140a543072e76e2c7c9caca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203917, "uuid": "3f97b3f2-f70e-49aa-8423-3df13b8a4549", "value": "T1A61633B10820BBABCA5CDD707A17B0ECD1522C29BB947076785280AF091D6F25F5EDE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203917, "uuid": "0579398d-b033-4825-93c9-bb9716787752", "value": "56eb3476e3fb7558ee8c76364d47c943", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203917, "uuid": "5d963062-818d-4f90-979f-d909dc35c1ed", "value": "98304:ne066NkF+JLFB2N+pbpvqbltBBb3QmsZZLJj2lX7sIv7R:d60SQLiibRAhOj2lN7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741203917, "uuid": "6e40a78b-50e2-4333-bc07-1bec019d8016", "value": 4322320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741203917, "uuid": "dd4a6d75-e82f-4657-b086-534c6e3d63f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203917, "uuid": "ea30df09-8c81-48d7-b4e0-757056122377", "value": "a5abb9572a0afc7b782182cba8f54712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2d5aa9-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741155996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155996, "uuid": "c940541f-13e1-4621-bf3c-15a2f05549b9", "comment": "Malware payload (Gafgyt)", "value": "b22d640895851a543cb59cf470755478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155996, "uuid": "c3a8cda9-f8dc-4629-a2c0-340cf6d6143e", "comment": "Malware payload (Gafgyt)", "value": "866c9c04074bd7aabc0ea7512c6aaebd4bc0f4dbd7ec7a953c21824378dced74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155996, "uuid": "c25892ce-0105-422b-852a-993da22ee814", "comment": "Malware payload (Gafgyt)", "value": "9024912d7cd2f8e91b06b6b8417d4bc6667a6cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155996, "uuid": "e48e62c8-5d6e-4bc0-9a3d-d8ad71a4d4a6", "comment": "Malware payload (Gafgyt)", "value": "2ae811a665d546b4f0c8046c1b23f1ae13ce4fe37c3e17d525d2f355da5d334c6e665347ed46bf0596068833e466b33c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155996, "uuid": "5963e943-ba51-421f-8964-c0aad20168f0", "value": "T151C3952A7E21ABFFE169863107F35F3087D522E627A15386F26CDA181F6118D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155996, "uuid": "62de4175-7ab5-42a5-9384-40bd80c1181c", "value": "3072:DLYxtjCSEEVC5hr+xWDOPRx9Fq51uUOypn:vCub+C5hqxWyPRx9Fq51uUOypn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155996, "uuid": "be6767b1-da0d-46dc-8cc5-cfc69131bcde", "value": 123181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155996, "uuid": "fc015a05-db8f-498f-905b-a0a983237102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155996, "uuid": "b4c3517d-485f-4e20-bb9d-83a53aad2a30", "value": "Okami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810afcc9-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741156303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156303, "uuid": "724b525e-d6ba-46e3-8c9c-e80248c2415d", "comment": "Malware payload (Mirai)", "value": "9a91605ca117a5a34caec7e6090c2237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156303, "uuid": "aef83dab-8dda-4c7a-93fb-3361dd736092", "comment": "Malware payload (Mirai)", "value": "8735f7b20511471516c9acb5195bec6ae74efaf695f4fd8d3656a4718a024886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156303, "uuid": "53569a14-e6ee-4298-85d3-205df9dbfa02", "comment": "Malware payload (Mirai)", "value": "1e3e19124db58fc6a175431893a05b1e1273145a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156303, "uuid": "433b1fc4-4c81-4031-b281-a4ede5b06249", "comment": "Malware payload (Mirai)", "value": "246ca5a596939f0e3a520589b97da452b73ed76e37584e34a694712a61bf91c3beb9fc80f06ff988baa3ea2b115d11b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156303, "uuid": "9829f5ac-efb7-4303-85c9-70cbe0e2a09d", "value": "T18D636C41731C0D07C0E31AB0293F17E197BAEAD121E4FA86296F9B469676D331886FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156303, "uuid": "a42e9a0f-7dad-45d2-bd94-d97fad30ddb6", "value": "1536:m8rrPDfNpfL/uTE9XxiNpd4gWRgt3VGIN/0+bS7410kB:bPrHzgWXxiNpd4g8EGIe+W49B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156303, "uuid": "858e9954-5f5a-4a61-a66d-3f219b0f2dcf", "value": 72368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156303, "uuid": "5ed065d4-8117-4196-a65f-729256417a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156303, "uuid": "01d76c47-0ba1-4b8e-877f-d03415c7c4bc", "value": "donk.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756e802e-fa1d-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741218990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218990, "uuid": "d8b8c71d-6a06-45b8-bf80-baf62e25ac92", "comment": "Malware payload (Prometei)", "value": "cde7377a45ad0ec9381664f6a505428e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218990, "uuid": "02c1fe0d-1ce8-49e8-bbbe-1bcfcb2fdcdb", "comment": "Malware payload (Prometei)", "value": "8ad8443ae79a533350ede9fd82b6ac02f5166df812df27e6b5b02facd9a15f69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218990, "uuid": "b4c2186c-de26-41d4-a77b-9b387e55b580", "comment": "Malware payload (Prometei)", "value": "6da79d5b26a318b5adbb8d5c58ec64ece7490516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218990, "uuid": "9ee917b6-8e1b-4fe0-a4e8-df6483efb41d", "comment": "Malware payload (Prometei)", "value": "1704f80a33d60842328da8b5c27e05282655cdc8c5e4f8ea1ad10157c76bba6f4b4fdcdc58858ea3bfe987f8151d0137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741218990, "uuid": "2eaedbb6-8f9c-48cc-9c82-64656bdfc8ba", "value": "T1A39423F31824B3738A2C3A3EFF509E15D69A573CE559271A1A1FDDEF0F2991209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741218990, "uuid": "da60e825-bb0e-4486-8653-ccf66736f051", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSk:W4/y+qaBUZJAdVtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741218990, "uuid": "9e5c0832-7fe8-41b4-bdf3-61d591b60030", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741218990, "uuid": "ecfc5fa7-2bdf-43b1-85aa-77e7a8e06c1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741218990, "uuid": "5f2aca9a-9739-4ae7-8a95-d5691ff84776", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd16b92-fa12-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741214199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214199, "uuid": "43220ff2-5339-4dc5-8fe9-c1c9f5917a02", "comment": "Malware payload (Mirai)", "value": "60740c2feffa6dcc64209a36e4d183cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214199, "uuid": "1356a3b6-839d-42db-95e0-d6e980e63308", "comment": "Malware payload (Mirai)", "value": "8b137bad03c3dadbda4dcebdf7372cf0863f55f33ed7c6f460d7de65fd2a0486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214199, "uuid": "194a5cb9-48d9-4d26-9b73-35395002e54d", "comment": "Malware payload (Mirai)", "value": "6913507e8448d3a8b7add2a8b0f79adb0cd7f906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214199, "uuid": "9927ce3f-f61b-4e3b-8c1e-917766f7280a", "comment": "Malware payload (Mirai)", "value": "ea8710545ff0bd30b14066a030959482fff7ca2ead2ba664143af23e972f41e36c80b80f633583c52c96f45433b2279c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214199, "uuid": "da6d030b-eab2-4732-90b9-a702dd9fe7a7", "value": "T167E31941F9419F13C6D622BBFB5E428D372A17A8D3EE72039D256F21378685B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214199, "uuid": "47ba354f-c590-4c58-867c-04cc0fd19851", "value": "1536:u4GT4eOI5JJRES8dAW5T2hE+o4VFRXTHG1G437DOAzRM8SUyt8l/UKwywG/FVGaD:u4GFKJ5Tl4dXjG1Go59SLyfUXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741214199, "uuid": "83e8eb16-de5f-40c8-9202-cec20873fcd9", "value": 146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741214199, "uuid": "c815450e-b590-424e-8c67-c3382d79f667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214199, "uuid": "dfcea7c9-5127-4ee6-bf59-a14ac3a9cd47", "value": "vejfa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e773a67b-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159911, "uuid": "015bbffd-8601-4c56-8e14-6d4a4e049e39", "comment": "Malware payload (Mirai)", "value": "34fd8eac20cda244cb4a8065ea75012f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159911, "uuid": "6963df33-0e1e-42d4-b1fc-6748168097ea", "comment": "Malware payload (Mirai)", "value": "8b3ba98a3ca2c1c21ae72896ade2272c369c5072ba1b02209d7a59cb9f5a3c19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159911, "uuid": "ee9a7a7a-e1d2-4209-b5cf-4e1c78195b29", "comment": "Malware payload (Mirai)", "value": "72e8ea07c1a7c5a99dfa0b4eb3446d4a36077dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159911, "uuid": "d27999be-d51c-434a-9094-ce8f8e27f5bf", "comment": "Malware payload (Mirai)", "value": "1af3ed8874052b6ff8b242fa04d484f5b8a715906267361bc9b44b423c9e8196e8f230b37ccf5e7d639dfd6508da541e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159911, "uuid": "70fa924b-367d-4ccd-932a-02633dd5d8e1", "value": "T18BB35BB3CC26AF98C655D074B0B48FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159911, "uuid": "f6159cb3-631d-43cf-b948-49028cc48b7f", "value": "1536:WTW/VCxsHZ3sH2Li62C87mKjR5fvPVWARouW8j3W+g4e72:WytCxdHx62NVjzVWxuWM3bM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159911, "uuid": "6b127c4e-5aa4-4092-a0a2-e529be7ce69b", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159911, "uuid": "4fa3cd7b-f977-4c07-9b2f-ae6bb02b27dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159911, "uuid": "b86923ff-3b51-4edc-9301-34d929cadfa7", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debd0bde-f9c6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741181800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181800, "uuid": "f8978b95-0249-441c-bd68-07e91177b0d6", "comment": "Malware payload (Mirai)", "value": "6a7682ccf6b958be691b726c895c5fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181800, "uuid": "060223d1-5848-4cae-8e07-f338a7900994", "comment": "Malware payload (Mirai)", "value": "8bd7b99ebb36f0c958539157aa3615038afba727cd6b6060b44fbd8e89584dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181800, "uuid": "fee375e3-5744-47d8-a81c-28cdb14c05a6", "comment": "Malware payload (Mirai)", "value": "d90635e345221ecf8a92b7baf2ba598ecf8e9c65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181800, "uuid": "c8faa413-02da-4d1b-a733-879038491384", "comment": "Malware payload (Mirai)", "value": "aab9c5dc61ecdb02e1a24be692f134f1907bdccaa354c5f8e556f46c99b5ad20afb13df9769bd972151af4a370330735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181800, "uuid": "2a6eeb4e-4782-4b7b-9cb2-c97a0f01b1ff", "value": "T10653017237C17961C6F0AB25F83FCB4B32271B1A25F42825A038A9BD3EE2584745760D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181800, "uuid": "c2d7d9d9-eee5-4e13-ad0e-f574381de685", "value": "1536:93WdPf4DWtWsLveFldojcltbeallUMJgYkxMp:93OQiWsiFLoje3LGxMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181800, "uuid": "5924736a-8c12-4a51-ac2a-9918cc4193f4", "value": 65496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181800, "uuid": "fb9a0ef9-ac33-4075-9b49-79df86354909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181800, "uuid": "1a61461c-dc3b-4adc-80d7-3b27e527bea5", "value": "5r3fqt67ew531has4231.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e84e85-f9e4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741194395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194395, "uuid": "2b12ab52-bca2-4ae1-b6b4-ee9fffcbf02e", "comment": "Malware payload (Prometei)", "value": "daeeaba1586817048709ea43b546bc9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194395, "uuid": "8c33254f-6db8-4414-b2f2-50920f27baac", "comment": "Malware payload (Prometei)", "value": "8c06c6bfe4e33c53f678ab2eef6d75718463e52bf82d2ad9ae312858b5cc2903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194395, "uuid": "6cd1899c-adfe-46a9-a58b-ef3eded047b3", "comment": "Malware payload (Prometei)", "value": "c4335a0509cb2838697d58eed3ed5120724c1679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194395, "uuid": "39f6763e-b30c-473d-a3e7-a3867184baf7", "comment": "Malware payload (Prometei)", "value": "5cd058714b14da1b23e96446a87c77dfeb3c8bc33d9595661fcefd38a863eade561111f107d276441144dd7ecae4af41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194395, "uuid": "8c7ebc81-5eb6-437c-bb55-c430b992128f", "value": "T10A9423F31824B3738A2C3A3EFF909E05D79A573CE55927161A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194395, "uuid": "b927e3fb-3fed-44b3-8dfe-98e91b94410c", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSY:W4/y+qaBUZJAdVtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194395, "uuid": "c4bc97ef-fcfb-4d33-a4a2-ca20b3236e4e", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194395, "uuid": "b90ff2b0-32f6-474a-be0f-b297a6223cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194395, "uuid": "018f41c8-471a-4929-aa92-28e6378990e4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa25bccc-f956-11ef-ad17-42010a9c0004", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1741133608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741133608, "uuid": "3da67c04-e4eb-4bcd-b0b4-48c473a06b75", "comment": "Malware payload (Rhadamanthys)", "value": "bee36e45b0b3a9395a160b0bd16f015b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741133608, "uuid": "3c6d33c2-14dc-4130-997a-97e86ac96962", "comment": "Malware payload (Rhadamanthys)", "value": "8c5f2286165d3149e8de82dffa86fabc12fdec25a04ed5b6f75508a7d6889fa9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741133608, "uuid": "dcbb1f7d-8543-4e36-ace4-c365b23f513e", "comment": "Malware payload (Rhadamanthys)", "value": "528b376a29d66efef5a965cb2eec983dfe7edc1b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741133608, "uuid": "98b3c73d-922a-408b-bf1d-f2fca12bfe91", "comment": "Malware payload (Rhadamanthys)", "value": "9cc57c07e99974d59761ed33ec03388727392515857fa2b5ad4423378327d41b46464b562e58cb76d1ca197e21b16732", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741133608, "uuid": "b095ba18-8148-4e65-a739-8eaecd8508af", "value": "T129D6ADDB639C07EDAB984DDE420A354765E2C17B2C6F1388A9E24907B43FE11B635B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741133608, "uuid": "7f64d58d-4238-4cf2-b1e2-88edde4251b7", "value": "24576:UtQt6tmtKtJtRt/tct1xt1pt1at1ht1ht1At1It1zt1Bt1Pt1Bt10t1Tt1ht10tY:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741133608, "uuid": "85407549-6588-42c6-b3ed-1495d47a0dd8", "value": 12913294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741133608, "uuid": "c8e76828-9d3a-41af-939d-66b649e8af46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741133608, "uuid": "7ea8336c-b1bf-45cf-855d-8c3e86fc6c25", "value": "f38186770bffa4a12a7170942b9c0d71ac736142924da24a.xlt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78750cab-f9f8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741203103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203103, "uuid": "17e5102c-95b2-4c98-8201-3547445a0042", "comment": "Malware payload (Mirai)", "value": "b07b5d3e895641d2db2a878d03b611d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203103, "uuid": "3e8af781-9cb4-4bcb-b28e-6fb65de88feb", "comment": "Malware payload (Mirai)", "value": "8e3ac749ca35af0397796ad4377ef741c71a2e9bd09588380f3afdd49b8755f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203103, "uuid": "4bdb8f1e-52e9-4b1a-9a4b-0a74ee4c8339", "comment": "Malware payload (Mirai)", "value": "eb49b156c5b865602249281e1f6156786c4d3db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741203103, "uuid": "0c0c15cb-4901-4981-a744-64c2754f3e2a", "comment": "Malware payload (Mirai)", "value": "d2e9d1b6e3791c389735e81900a1b8418b34c237c0955b06b6a3b33181491723aa2ae2cb33be9dc4774c2abdcf5cf21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203103, "uuid": "87e4d61e-5fd1-4346-94db-4c80159c0674", "value": "T13893D71E7E219FBCF799823447B78F119A9833C62BD1D581E2ACD6011E6074E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203103, "uuid": "2ef05e0e-b38d-493a-bd9e-c868f0e880d7", "value": "1536:e85/5VgFU4e3xkkd90zrC8fHyZSP1QLLneeAa7410+t5:T/IFBsx8lHyZSP1QLya4Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741203103, "uuid": "81e9aab8-38ff-4814-a430-79333e32923e", "value": 92084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741203103, "uuid": "5df08fe7-954e-4725-8e4e-dabb186be136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741203103, "uuid": "1b9a97be-efe6-429c-980e-00c33683a3a2", "value": "donk.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf9730e-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199675, "uuid": "94a4e159-3f9b-4ea2-b1d5-41f86858a42d", "comment": "Malware payload (Grandoreiro)", "value": "134539b33a361191c6bd6ebd0c717a8a", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199675, "uuid": "125c66a0-c681-4bdd-b339-1c684ad9df66", "comment": "Malware payload (Grandoreiro)", "value": "8f69834124e69ea880ee797ab0619c959d496f96d60e9869f339781702da4d0a", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199675, "uuid": "b39dbbc7-1408-491f-ab86-d13bd6eddffc", "comment": "Malware payload (Grandoreiro)", "value": "88420b806e725ebf24f601407157266b87bb1e84", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199675, "uuid": "04ab5fa6-9de2-4f75-b25d-079fe23c256f", "comment": "Malware payload (Grandoreiro)", "value": "0210f434d94f3e275bd45ac2f0f7cdf1947adf1dc78ec76a7741f62fc77e769494297e0c62f44ee2a690b1052f02d060", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199675, "uuid": "fac4e7bb-f2ca-4aa0-9b32-481a89a2e5c1", "value": "T10BE53344D7A54201EF8C6B39BFDA1BC9DBD054AD4AB685338920FC2C6ED5CD4AF9C580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199675, "uuid": "c8dc62d5-3d1a-4ddb-8cc5-8d5a17158483", "value": "49152:LPR7PyrByX6GjxY+8UYgbONfzbE1wXLsWWaTPe+j4SixOTbQw+R2J6OUeiWZfORt:jRe0XvVwfgbe81wXLsNaKhRwz0SieONR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199675, "uuid": "02db2c5e-308c-4dde-97d4-318fc78ac45e", "value": 3083518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199675, "uuid": "32fcacd6-d02c-4c07-b19f-52d8ead78289", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199675, "uuid": "777cef01-c169-4c4d-9b08-2f34e3446efc", "value": "713300CITA_540373990954.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9b1fe6-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139496, "uuid": "eb27eec8-57aa-42d9-9904-89cc72fd023b", "comment": "Malware payload (Mirai)", "value": "539ae8c1311c98a0acf93ad800369a5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139496, "uuid": "c3d8ae33-39e2-435a-adf5-0a6e1b978039", "comment": "Malware payload (Mirai)", "value": "8fa0325d6995f06775bb682d532968518c5f71a2acdb5b18166e9216e28e5c52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139496, "uuid": "27315855-d7e2-45de-8893-c8231dcc88f8", "comment": "Malware payload (Mirai)", "value": "6805c1fb5963d3f2410d57b18e0d493316308d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139496, "uuid": "61a30681-d9e9-423c-b1f0-c32d5be36765", "comment": "Malware payload (Mirai)", "value": "07cdba4033fd798b2fe689d335b70eb42f8e5976119545dde5d001be74264b0c9b3b923eaf828ec67ba853fb27acd402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139496, "uuid": "ab4243b4-f522-425a-aa99-88388a53fdbf", "value": "T18D63FA81B881663AC2D1137BEAAF018E3354A7E8D2DB7217CC251B657BC651F0D53F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139496, "uuid": "9afd864b-8c83-4c21-a0a8-58547d4088d2", "value": "1536:6ZjqjDHrHDmYrIG5VT4xJ2Jj+1qrSNymeZW7yrklfOR:6ZjqjLR3GJNdwj44R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139496, "uuid": "ff358071-c979-490d-b42c-5efd6211eb7f", "value": 68324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139496, "uuid": "635b38db-869a-4b52-9fc8-30fa7a08e079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139496, "uuid": "c1ceb305-6eef-442d-9415-e832db619026", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2d549b-f996-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160890, "uuid": "72823d1b-817c-4d28-89b4-459a0ecbba49", "comment": "Malware payload", "value": "17cfc2cecd080ac73bb0f11d9e9c4de0", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "text", "colour": "#59E8E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160890, "uuid": "cb9a6690-abea-471d-acdc-a6357e626907", "comment": "Malware payload", "value": "90e145c180a4e362070d341a73eb8cefe0fea89c8de4f90ec4763a5cc72cd69f", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "text", "colour": "#59E8E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160890, "uuid": "69fc1f4b-0b87-432f-8bbb-e8a5e73150c0", "comment": "Malware payload", "value": "e67ef8758402bbe0a19e555d5452016f20b842b5", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "text", "colour": "#59E8E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160890, "uuid": "50f4f018-5ce2-4759-9005-0a04499f4c13", "comment": "Malware payload", "value": "d4de3abd5142810be6a93ef4060e760478f34eece937752d32b029a594f575a09bb5da74185d63209d32c6090ce6887a", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "text", "colour": "#59E8E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160890, "uuid": "b5a50eef-de1d-40f4-af39-bb24bf865917", "value": "T1F093120D40924E80CDB478F46764A1F78C12B49FBD1E3DCAEA2B4274A366ECD3197D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160890, "uuid": "f579464e-41aa-40b8-af75-43cfe7ef3b25", "value": "1536:mb+eXAH7T2kV6h0JreFmsIzjOsovnja89+zgv55+CeWVL5Z1:mbtQbSkV6h0JreAzjKvcgv5JJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160890, "uuid": "ff0e612c-449a-41e2-af0c-f5775fcd9162", "value": 89595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160890, "uuid": "7d9329ee-9ef7-45ab-b194-c86ceeabcb51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160890, "uuid": "93c11447-cbda-444f-8b99-b0b258366c47", "value": "oV27PMaeF4tDIOxjhPr6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494ed2f4-fa0f-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741212903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212903, "uuid": "c5062fdc-2e30-4e88-9ceb-cb350e74a254", "comment": "Malware payload", "value": "79458fa61b7e5a1d43260d43f1cf6bfd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212903, "uuid": "ac45a63c-f295-4f50-9bcf-1bbee32f7fb2", "comment": "Malware payload", "value": "91d9ddc3ca1de34c47304c6e5490ffcbb8253ab32ba4a1c0c4784bfeed326b50", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212903, "uuid": "e8c812e1-3d9a-4d0f-9c06-445eb2f43f07", "comment": "Malware payload", "value": "ce6311f4d199ebcaac0d6caba34cded115b04461", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212903, "uuid": "e2f934e0-c7f1-4d8d-9966-51dc02ff69b1", "comment": "Malware payload", "value": "72cce0c590468c5ce9e6dc93e47be1d3b003bb29d3bd6640b70188dc859a363c910c3ceee82100bf77f72aea98fb89b6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212903, "uuid": "73b18b54-b9d4-48f0-a147-5effea51e8cb", "value": "T16111EB056A960A6141E18AF1DA852202E50EB04F5A088CA4B28E9070AF68116EFFECF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212903, "uuid": "04387223-1b5f-410a-a761-10109bc50098", "value": "24:Agl9xsFl4iIXivupzHOcyyOW7zax5qxY/+AXM:Agl9xsb4xFpvUc4+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212903, "uuid": "774a7eef-a619-4fd1-8d42-f2b1addb8e43", "value": 1092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212903, "uuid": "4d1df7d0-dc63-4d1f-8e38-0f7997a53d95", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212903, "uuid": "15e4526b-8f1e-497b-b020-f4ae7ca2f4b6", "value": "death.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e28e573-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160110, "uuid": "4695efbb-dcd8-456f-baa4-adf088f9c5c9", "comment": "Malware payload", "value": "a9f356cb8ab8f73dc89ef88c9c9406e2", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160110, "uuid": "11f20266-2ff1-4d22-b110-48dcf2ff6682", "comment": "Malware payload", "value": "92074c98be42a4a2af6b1974922c31da79f546314ea1bfe0f4c551dcb9ee07cf", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160110, "uuid": "9bffb1ef-3ab2-4bd1-91fb-9b8c466d4263", "comment": "Malware payload", "value": "2416ee4f16bef5243eed3413d6089d6411d7cb91", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160110, "uuid": "dc230961-8bc8-412b-a9a3-648c9ec82c9e", "comment": "Malware payload", "value": "c97507f59b1b1786480beeb0e4acda3e6b50d416336a7c70641fb125134079e70e9482cc735fb30c56930d23d25b70d3", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160110, "uuid": "101ea701-5195-4fe1-b6d2-214287bea5bb", "value": "T1C4B1425D3D41027058B34B60DC47802CF521AE6F5376AECA79CC55C14F31BA9B2E798B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160110, "uuid": "34063444-21a1-4e05-8a06-608400ce0d7b", "value": "96:RMVEWxiP/wiMrGlQwJI56rVCwW/THNiMvD8EO1ZQ5xMTnJPfkSnOE:Kpxin8r8QF+VCT/TtTG1Z1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160110, "uuid": "30f0c1d3-0aa8-4c29-8485-bea15cca4db9", "value": 5403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160110, "uuid": "81eaf554-8d91-4d54-8068-89cc472a4ba5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160110, "uuid": "e49f4073-ac35-40e3-8edb-b7ed546c603e", "value": "92074c98be42a4a2af6b1974922c31da79f546314ea1bfe0f4c551dcb9ee07cf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ab3ed0-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199881, "uuid": "e44264ef-b13c-4ab9-a1fe-dbf5a83ce2e9", "comment": "Malware payload", "value": "ef9342efba94d0c374d0ac35d70d9707", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199881, "uuid": "62741285-2759-489f-a4d3-5b25dfb3ee89", "comment": "Malware payload", "value": "92395a6b6978b3efa00deb4075c0b802f551687686ec6ab4df6faba4cb93a304", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199881, "uuid": "03eedad0-3f58-42a9-8c4a-53bf04d0080f", "comment": "Malware payload", "value": "8e4f032edaedfd213c44bdb6bfb65e8ddc96da2f", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199881, "uuid": "2b00218f-36ab-4ee8-a853-cba72754e931", "comment": "Malware payload", "value": "3ead5c10a02c5473f98882608aaa0eb3b5c714230a05bacd41fc766feb0c1888e487a34efa45769924361098d98be7d7", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199881, "uuid": "9cf3af6e-4f64-448f-9abe-b565ecb6adeb", "value": "T118C5334AAED60560FE59AB34FBDB0FCEA29441F507D08A235F74F898BF9B40E1578091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199881, "uuid": "5db2eb62-73f4-4c47-b15a-8a1eddb691c1", "value": "49152:gJxmypgZOtFW5gaJjR/2jPK/vNwMwW5MFO4CrOKiFNN9fJq++h82/H:4xmZw0/JdKLTW5MQZrOnFr9M++hVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199881, "uuid": "b76288d5-4b75-4f77-8ef5-f1b4e1e2b0c3", "value": 2698224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199881, "uuid": "beedfcb7-3707-4e21-9755-63e19bafe500", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199881, "uuid": "5fa89c96-50fe-460e-bc8a-a37fa53c9aa6", "value": "127100CITA_096634783646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6939ae6-f9c9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Loki)", "timestamp": 1741183021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183021, "uuid": "04c20df4-aea1-40fb-bafe-92650867a552", "comment": "Malware payload (Loki)", "value": "5a4fc3780cfc0527d12d8bb5134a81f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183021, "uuid": "636c02db-9bc9-4d34-a898-43b03c812c3d", "comment": "Malware payload (Loki)", "value": "92e6e90dd6fb4cd89fa077cde338876ccab7aea58cd213838be250ed83eb0247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183021, "uuid": "2b40399b-22d7-4469-ab1d-04d061abed02", "comment": "Malware payload (Loki)", "value": "de3a05f3e410bb8b30e0b4d8ee32a3dcccbd2837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183021, "uuid": "b3ee64cc-da59-4520-a140-9335f0a21527", "comment": "Malware payload (Loki)", "value": "ec7e966085b4e710834b84348a47d0e826798953fa57e44601f9f48ec3842e5646ec66cdad0659ca138e1c1009e4d5bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183021, "uuid": "f34d7230-374b-4b78-a703-a53bf60978a7", "value": "T1D1C4027C2605E41BC58163781A31F2F4267C5EECB902D293CFEDADE7F9666241C482E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183021, "uuid": "f79b01e6-bc19-44fd-8050-80570b362bcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183021, "uuid": "9a6769ef-bc84-4310-ae55-e5f222bc84d7", "value": "12288:6/fRpm+gvyyw0zglG47TqrhSFH3GzsqHG9dSdp2gxqTQ:fdvz8ql429YQTz6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183021, "uuid": "431c39f5-8d1a-48c9-b9c1-1faae9f92495", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183021, "uuid": "d64a6a52-0a33-49ef-aabf-c7240ad33ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183021, "uuid": "01260693-c6bf-468f-81ac-61473efdf56a", "value": "Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aadef3b-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160211, "uuid": "2a391d39-1cf4-4914-9f92-8a5ec669efbb", "comment": "Malware payload (Gafgyt)", "value": "13353414f06f0f1265551f8f80fe78c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160211, "uuid": "8eb9cf09-ce5e-49d0-8757-34ad40e0a395", "comment": "Malware payload (Gafgyt)", "value": "92feda0008629fc2031eefc7e940051bbf8fb9b1daf214c6eef033f8211fd688", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160211, "uuid": "bd997595-f536-40eb-ac33-6f6104bc43f3", "comment": "Malware payload (Gafgyt)", "value": "f0913c3e611c75ec74a231260b0fbdbde677f6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160211, "uuid": "27e36eb0-6ea1-404b-9930-c34265b5efd6", "comment": "Malware payload (Gafgyt)", "value": "bbba714ec051b3ab5f2f883b6339dc5dcde6d5fdb76be9118fc87d6801c0c8710db02c123f75cd23ec137811577a93f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160211, "uuid": "140055ad-a1b9-43ff-a487-c9a82206a1f0", "value": "T10B833B86E702C6F3C4430BF6029F9A5E4631BA2A4A2F9FA6F31C7DF49B125C43215765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160211, "uuid": "1bd89aeb-42ad-4485-bc62-0cea6aa28dcc", "value": "1536:Z7fahQo1OAEUK0WUOlvA3E4YK/1M2t1of+1XLZMgOlsBuQdQR:SQqJE/xlvA3EhKVzm+1XdMgOlMuQdQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160211, "uuid": "c7fab628-7c2c-4c08-96c5-aa3fd60abada", "value": 86805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160211, "uuid": "039db3f1-2f07-439c-a00d-0e7cfa58772d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160211, "uuid": "6c11b569-0d6d-4a03-9cd1-59512ce84b73", "value": "jew.x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f70f055-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156300, "uuid": "114325c4-5dd5-4d8b-b4b9-9cc097ae67a4", "comment": "Malware payload (Gafgyt)", "value": "a23e61b3d2822d367944ad0bb171348e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156300, "uuid": "d7475cf1-69f1-45fd-9474-2ffca2ced29e", "comment": "Malware payload (Gafgyt)", "value": "930de83919cf565a5e3779cb284eea971d3787d605cd68b8702e7097c1172d4b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156300, "uuid": "b30c26ec-b51f-45c7-989f-172c628482cb", "comment": "Malware payload (Gafgyt)", "value": "024cfb180037b542aaad41dd8330f0d797d34bc3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156300, "uuid": "20190331-70dc-474f-ac66-9981ececc680", "comment": "Malware payload (Gafgyt)", "value": "40c11ff08622469f4f59e8788772c19211ecfeffa0cdca9683f1c6ff5e9049631d797d2c420b95abffb3c72924361109", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156300, "uuid": "af66fcff-b3db-4b9f-a683-5d336a5d20b2", "value": "T17331DCDA216316F8ACD0FE573279894575E0F1CA54CAAF4CA8EC38F5429CE4C7404B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156300, "uuid": "92470ee6-a74f-40f3-87ab-7739cdc9f18e", "value": "48:vGZTfw+/0ohOJReJi/Nsqy11i7gNsqy1XXUUAJ:vGZ7w+8ohOJRsi/Nsqy11i7gNsqy1XXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156300, "uuid": "56f55c4d-b78d-4a18-b8f7-fc620f7f5bc6", "value": 1648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156300, "uuid": "62e76daa-aaa2-4806-afe5-ebe4e1086c3a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156300, "uuid": "8773a299-9401-43f1-9af7-2a2d09af5cc3", "value": "jew.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebddbaa5-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185258, "uuid": "42b7b604-e241-4e13-9604-77777174c5f6", "comment": "Malware payload (Grandoreiro)", "value": "b7921af2e8915522742bf11a2447398e", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185258, "uuid": "37653f59-4657-41f6-8d01-10f87681091f", "comment": "Malware payload (Grandoreiro)", "value": "955c524e8c8e422200bc571b25aa285b1c6491d65e43861dc9fecec9a97a393a", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185258, "uuid": "a1098ac6-6869-4a6b-926c-4ece4c971b8a", "comment": "Malware payload (Grandoreiro)", "value": "7a90aac663dddbaa367eab1ef98a2911994ae2aa", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185258, "uuid": "0388a76c-e83a-499d-946a-619eb0783d71", "comment": "Malware payload (Grandoreiro)", "value": "d7c667f9d684c0bae9c6fd04ee8525254220b1de686787ddc2e1f892d0fe3e501260bde639f060a58af16b6e254fa315", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185258, "uuid": "b9751f11-8489-4f2b-803a-2bb381b244bb", "value": "T19EB53380FFC54690FD949F34BAD8078E47E61BA60BF0D3135A20F0EAEF69932595D261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185258, "uuid": "9b682a2d-5b08-4a5e-9a10-72f74e50e5fd", "value": "49152:gEYdYJvRuC10JRTnH5I9bLxMbU8/f0osWD9PGqm2/q:YWxMq0JRb5cbLg/fiqHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185258, "uuid": "6148df1d-cb0c-47ea-8519-aea0e6b8fb35", "value": 2396835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185258, "uuid": "a7435058-04be-475a-b1a9-f573ea579942", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185258, "uuid": "5e158c08-85b8-425d-be18-6b62a2d0032e", "value": "847202423815FVHZ5441_CITA9054.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31447e6-f9f7-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741202746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202746, "uuid": "957cb6bf-8bec-4c7f-be34-907768c862b2", "comment": "Malware payload (AgentTesla)", "value": "55a0e81d33f093604bc23ec480a45b69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202746, "uuid": "a99df507-e06a-471b-ae63-10754a2d02e4", "comment": "Malware payload (AgentTesla)", "value": "95d948e77fdb81bdeee51da079e6e6d7625531f9ec9f897a78df51cabf92974a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202746, "uuid": "0fb71a35-cbfb-42a5-924e-531c6b7799b5", "comment": "Malware payload (AgentTesla)", "value": "c533b7efc4e929511cbdfe6435de2cd178cfac4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741202746, "uuid": "b8466bdb-5d8b-4d0c-944e-bf279bc990be", "comment": "Malware payload (AgentTesla)", "value": "1cfe0106b39fcb0b1d01c257331761a717c3006b7fd9823d637380436d9e5e7e6ccc0dc8031fc7384ffec05e09afa35e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202746, "uuid": "866665e6-bc1e-4628-9e77-83caec4e3f4a", "value": "T1EBC422984EE0E962C9649336443ACCA05A797C739EC8A75F8765E95FFC20303991BF1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202746, "uuid": "b17ed49d-24e6-4c10-a24d-21db07ea478c", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202746, "uuid": "9d7667de-1ee9-440a-bb02-47348d178c71", "value": "12288:TquErHF6xC9D6DmR1J98w4oknqOOCyQfF6R+7WIGhV2N5csEFKpdX5Utv:qrl6kD68JmlotQfcR0DGhV2N6JopJ5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741202746, "uuid": "50707ab2-7d2e-4494-a7cc-72743bc0b430", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741202746, "uuid": "791bb6ca-abc2-4979-b38d-ae96c963e938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741202746, "uuid": "1c1986cd-d083-4556-82c2-deb24f2a80b6", "value": "FA76543456780000987601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cca749-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1741166776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166776, "uuid": "40ce699c-b493-42b8-8f8b-6866c9eaf7ee", "comment": "Malware payload (Cobalt Strike)", "value": "735e46dd62e11531bfc1043ee34f5481", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166776, "uuid": "cab3c427-eef5-423f-adab-af2f72b090f7", "comment": "Malware payload (Cobalt Strike)", "value": "966a6c9fd83512c580dfc9f8cf666361ba6f7491d296e707a29c4780e5825f3f", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166776, "uuid": "2cba8233-e618-48ef-9878-3b4fba6cd50e", "comment": "Malware payload (Cobalt Strike)", "value": "1174ffd5ddc91f94c58690f2909a13d92d9750c3", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166776, "uuid": "9bf69108-5290-49b6-b1ea-37dddef766f5", "comment": "Malware payload (Cobalt Strike)", "value": "8cf499760bb5dc8440c049cdbac8178c3ef1ed0d0957bb0d9f48e4947b80553ecf169d76b1353f9c5657455fa2c92442", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166776, "uuid": "5df2f6b3-c7f9-4126-9a58-8ae347b69fa4", "value": "T137C59D42F5E969ECEA97C234868A8731BB7878454232FFAB0565D3312D23DD15F8E318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166776, "uuid": "98aa6560-874b-4ef1-b589-a8272cfd5ebf", "value": "749411fd081628164c62c6e1fff2982f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166776, "uuid": "513ddf3e-2cab-49ea-908a-e7e818ec35c9", "value": "49152:PsdSglk9F+V/v20iebM8CooMrrPR/JNO/TKMM8lBE8lZrlOyOUrWTmOjPHQHP0DE:UdSglk9F+OEMwoMrPVJNO/TKyBE8l/y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166776, "uuid": "669ff196-9674-4cb3-a944-6217d96e289f", "value": 2694938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166776, "uuid": "a09a9180-7dc2-48a4-acc5-15a1a27912e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166776, "uuid": "da2ba006-b258-4f0f-8cdd-4211f5419643", "value": "966a6c9fd83512c580dfc9f8cf666361ba6f7491d296e707a29c4780e5825f3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831dfd6d-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156306, "uuid": "c8798708-7569-43a4-a554-3108cca3e7b1", "comment": "Malware payload (Gafgyt)", "value": "e52e05ee9bab4ff88b3ee74b93cc7d70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156306, "uuid": "c69add89-5dfc-4159-8cef-2228cd28fe4d", "comment": "Malware payload (Gafgyt)", "value": "9672abab573b4770264db09be4672170e8a5ace2beb2997cce1ec31dc1a90831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156306, "uuid": "9682a0a6-c126-4d83-8a4a-3b6b89e77484", "comment": "Malware payload (Gafgyt)", "value": "e710965854b34572cc306c0bac1bed329b1d5eb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156306, "uuid": "f7054b23-f616-41a9-8d6b-33ed69194319", "comment": "Malware payload (Gafgyt)", "value": "d908319eb60ac91729955d90674ae046092a7fc9648d721f5f89bfcb7ecc207d3b12f678e22c25520726a47c81add23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156306, "uuid": "e4587805-c1f8-4116-9fce-4c4919cc4a52", "value": "T1E8A32A05F9008727C2D327B7F79F075D3B3256A897D73312A6297EB02BC27992A39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156306, "uuid": "08ad6e73-cd3d-4592-8a94-c6479c96bd9b", "value": "3072:oROlP82W5t0i0g5hWIxevff8iowWQQkha6Qzadn:dlWTL0g5hVxeHowWQQkha6Qzadn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156306, "uuid": "3ab1f1ba-7c70-4fd5-9a91-213b08dab103", "value": 105578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156306, "uuid": "f47b074d-0463-42f5-95e3-a1a7a3c2106b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156306, "uuid": "c951381e-1eb8-4b50-a694-5a95c1d05f2b", "value": "Okami.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fc6cdb-f9c2-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741179912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179912, "uuid": "4efea703-2431-4e95-8685-e8957affbf66", "comment": "Malware payload (LummaStealer)", "value": "9f11823a5a339c90e4b3537908ffda6c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179912, "uuid": "e12225d5-cb3d-4053-a196-210cdda36677", "comment": "Malware payload (LummaStealer)", "value": "96a08445e1f8d850e9ea973c7da61535f9d71f161c284dc6dc8366b2ca447287", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179912, "uuid": "302ecd15-7a68-4d6a-8d99-8cca863364a0", "comment": "Malware payload (LummaStealer)", "value": "4897f5fee225b064665293c29baa68dfc64cef43", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179912, "uuid": "7c4419c3-1783-4380-8c2c-020c2ff8424e", "comment": "Malware payload (LummaStealer)", "value": "9f0ec6ac0348c1f62886c24e72f3cee0e271b6a242adfe97634efe5ea8931a2abb5de905b97e322809a6429d1de96dae", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179912, "uuid": "8f921ffa-2f53-4424-85c1-48ab088aa207", "value": "T14104024196E9C47BE9B74EF33A3059514AB3FC216475C48FA314CE9D3862981C82EB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179912, "uuid": "95c173a2-58c7-40db-8c6d-1fb5ce038c64", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179912, "uuid": "cf441ea2-1fc9-49c1-a1b9-61d57c28ac4d", "value": "3072:XPC23aJFC0bPn7whaZ7QwjC8bqdwBOv5OmWJIsl4VzbtoWH7keKcini:WC0bsaZ72wa/bt9H75Kcini", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741179912, "uuid": "db199b9e-f35c-4e7f-9189-6cbab6658796", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741179912, "uuid": "9e7173f5-8f52-4d1a-b859-bfd58d2d37f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179912, "uuid": "4868c471-034c-47cf-9d7a-212d608ec79f", "value": "000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88404a8c-f9a2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741166193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166193, "uuid": "5e97929f-1106-44c1-a7b9-ce79f5cad923", "comment": "Malware payload (Mirai)", "value": "b0c6c4b886a462cd10d85a8ce28ffc6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166193, "uuid": "dea58ac8-73b5-496f-b351-6223412157df", "comment": "Malware payload (Mirai)", "value": "97310d5f9ab057103d1ae7825e3ed99f0296d4d7e7e4945107cc9f7b1e12b90c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166193, "uuid": "05a0a296-77cd-4d06-84d6-7cf707a84e12", "comment": "Malware payload (Mirai)", "value": "fc04db9b77c6d5d22f8b9ada473d49cf3211ec87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166193, "uuid": "8d5dce6d-68b6-45f6-b244-c2313532a339", "comment": "Malware payload (Mirai)", "value": "e4c069fdd5a02ab2b4af0c7b284fa08fe629103945446650346bb46a32865ed826021b51d9d15f93476bfc4cd8a75948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166193, "uuid": "2a31350c-4ea6-4229-87bf-63f40e8295b6", "value": "T175531A26ADF52C2BC1CC95BF20F34721F2B6534A24B88A2A3DA50ED97F1875135137A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166193, "uuid": "2af60e10-30b4-4d1c-9e1b-2915cce58419", "value": "768:vjJxbwN2bgyXTLC/V/F6IPdr3mO+T5Vssl7J7cI1tB7pIm:vlxA2bg+LGN6YWT5y2tB7pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166193, "uuid": "d10b95ff-f123-4647-be9b-8c8d59f231ef", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166193, "uuid": "340acc7f-5149-444a-bad9-59c664e188be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166193, "uuid": "4dfdf65a-6ebb-458c-8bbd-afcd9aeffa06", "value": "cbr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437a3774-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (NetSupport)", "timestamp": 1741158347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158347, "uuid": "3af559a5-d282-4ff4-b4be-4c2285dbb33a", "comment": "Malware payload (NetSupport)", "value": "941d14d8accd221f6dd30f0a91ad9e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158347, "uuid": "3c77228b-b7e9-40d7-be26-919e3464d387", "comment": "Malware payload (NetSupport)", "value": "9880f15a49177373695026b4fd87f1338c65e65101af327e98a0e589c891b07f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158347, "uuid": "1f4d6996-048f-40ef-9188-f787da1204e2", "comment": "Malware payload (NetSupport)", "value": "8f92841cfdee362f8713902eaa95682ff5504c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158347, "uuid": "2f304047-af01-429b-9309-759b6e31338d", "comment": "Malware payload (NetSupport)", "value": "e0a0f64d5c95d4c7f20a9b54a64719b1427a68cb152721b39655c9b6f235fdb0885ab4b8f9338a1455dedccaaf130473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158347, "uuid": "e04293e3-feab-4aab-baf1-3062ada0fdbc", "value": "T17975D00377925BA3D32967F2D2A3882887B8C241D287EF5F388EA7755C933365E24547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158347, "uuid": "582d3fd9-a890-4f02-9f2f-b63125b02dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158347, "uuid": "d42bc516-9f58-44f0-98c4-c81a1f5b25c8", "value": "24576:1ls1bt0yC8cEA/D5VMs1oHPqC0Yt0EIkNO9GLiGMv1YkercMa4MKjHz:bs1bt0ycEA/Dv3oHLt0EeGMv1YDfa4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158347, "uuid": "bbf0b8b0-2955-45da-bb3f-00faea9a3ea2", "value": 1620992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158347, "uuid": "bd48e558-56b1-4133-954f-032fbcb3a009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158347, "uuid": "4da8e799-9ba7-498b-993d-87b6b1242cea", "value": "941d14d8accd221f6dd30f0a91ad9e0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447b18f7-fa16-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741215901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215901, "uuid": "ff69868b-7fcb-4c63-9517-dcca12779efc", "comment": "Malware payload", "value": "f9daa42882c1f8c25db35af27d5b857d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215901, "uuid": "49417dee-8d26-4ba1-92bd-60d749ebe731", "comment": "Malware payload", "value": "98e7070033d31ebae47511b263f92f1f10be67ec37bd35b1400114c78283d9e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215901, "uuid": "89d8a7ff-749d-46e1-b81d-d35427ae9461", "comment": "Malware payload", "value": "5d1fea79f92513108023d9c94f6f62be5ce40347", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741215901, "uuid": "54ef0e39-3af6-4434-bb5f-d23c92836cb2", "comment": "Malware payload", "value": "39d61959bfb899449aa083f7e9e30d8c0d5cf14f22ad728bf533dd845e50b506f99bbb363fc7f665fa77f6b05c2a24f2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741215901, "uuid": "039ca36a-f70e-4b97-bbe0-abf851af6773", "value": "T1C11633523A94CB36D69E283784BF8B253527BE601F20D0CB3361692C27356E1FEB1756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741215901, "uuid": "845c24ca-b4ce-48ba-a035-09b7de631146", "value": "98304:FpjD2r6gNfIMhcj52wOqC9JYOqvXq/PUr9Z37zz:z2r6gdIMOjFOn9JYOC6XUZL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741215901, "uuid": "cc712c46-3d75-4793-ab25-684f8c32b3bc", "value": 4023296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741215901, "uuid": "123fde72-1e17-4de4-9bb8-7c20e1647fa5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741215901, "uuid": "11088844-9aa2-4fcf-a586-b2692fd6b4dd", "value": "2setup2847_user_work.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c37955-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741158653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158653, "uuid": "25cfd444-e7a5-4c85-84b5-453b5ece3f22", "comment": "Malware payload (RemcosRAT)", "value": "6af4c39ea6510c06621678998940a664", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158653, "uuid": "92d934a7-6f07-48a0-b360-76d1be1cf477", "comment": "Malware payload (RemcosRAT)", "value": "99059f41eb73fa515f35cbe741c6ed0a4394f6d6f3991c423b37a485af0104f4", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158653, "uuid": "3e774806-4ba8-4a88-9b2e-2ebe33472ad7", "comment": "Malware payload (RemcosRAT)", "value": "ee14d8cb373867653698895b874c20f2a3d3787c", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158653, "uuid": "db65bf6f-b515-4420-8373-18cb576fdfd7", "comment": "Malware payload (RemcosRAT)", "value": "a82bf6e11a62760bbac2a258a8683238465bf92f9ba1b6dd4b15d97baf14a340156a362f2298968a68cf8c4e75d5387e", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158653, "uuid": "2dfc9bc0-07f4-4b04-8e48-c069c7168083", "value": "T101755817B6907027C0162F3758D6B3BCE736E9285A1FA5423EA50A14F927EFF381C256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158653, "uuid": "7a6c7b2b-166c-460c-b2b1-834b722a4c73", "value": "24576:LWQ3NNLCw0RXOraA9S2ibusblTwCoIMidsPjNZuWZAzH2qb+W9JYNINlt2e:LjUuqS5vZIqy+W9JWOloe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158653, "uuid": "573f0aeb-ed93-41b0-a30d-bb20cf7cee08", "value": 1620507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158653, "uuid": "a03de9c9-9c76-4092-993e-d5a10b45a56f", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158653, "uuid": "422289b0-6545-4cb9-8bc9-6fb6f492f439", "value": "uuu.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29468f6-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185216, "uuid": "670989ec-283e-456a-b6b9-da2e396611d3", "comment": "Malware payload (Grandoreiro)", "value": "404053986b2d3ac2767e55826f4f78ec", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185216, "uuid": "5b86b4c0-17fa-4860-88b0-9662ce9f7056", "comment": "Malware payload (Grandoreiro)", "value": "991d5541ef4e07141fa90ab02913f21efd6d7b2c3c81299924cc20abd87af772", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185216, "uuid": "5e51f69e-f8b3-4580-bc32-8739e0194dd2", "comment": "Malware payload (Grandoreiro)", "value": "3a49751e600d359d4acda7ac0494d605603d30d7", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185216, "uuid": "7b8589e3-9cd5-433a-aee4-90395f9b4197", "comment": "Malware payload (Grandoreiro)", "value": "cec5e7869bc11e175d0be3a088dc1780551b1d638f89e69c8c3b1f1de591d194cf010abef5d8ca630568beedbb22d4e3", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185216, "uuid": "38753b11-f152-4172-9cd2-a74a121634ad", "value": "T14BC5338047BE0191FDCC9734BBEE2BCDA5A346E54D84D72713B0E088B726953C9AD9E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185216, "uuid": "0f1fca37-0497-472c-ad83-2b01879e04f5", "value": "49152:fqpKy4o1C00tBjykhBPKnq0MnllDR4Zv2jnBBBrSZdAmPF22/1:iP1V0byArRQujBBB7mt3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185216, "uuid": "54ef2e9f-9a57-440e-919f-22ea10db496b", "value": 2530074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185216, "uuid": "c2f82ebb-aa82-4648-9941-4024fadd758e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185216, "uuid": "db5bdf93-c20d-4365-93da-a5508eefe916", "value": "569670122832GDVV3935_CITA7514.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff2708-f9ca-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741183532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183532, "uuid": "b3568fc9-2c86-4097-ade1-16b7b0775c1a", "comment": "Malware payload (MassLogger)", "value": "d97d8d972fff131b4b3c1a4197d410a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183532, "uuid": "e94e273c-1ed8-4b6a-b1fd-dcdc0731b4a4", "comment": "Malware payload (MassLogger)", "value": "998ecbd6fa2654f86d0daa5fb0edfb63a8a6b19b4469d04dd2b4eb27e34ecd86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183532, "uuid": "6c833911-0d94-4cb9-823c-ffb6cb6f6ee5", "comment": "Malware payload (MassLogger)", "value": "f0b2db4d954b04151671bd6bff82d301f31f5c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183532, "uuid": "c8dd251b-8bf4-4caf-9651-7e886a345930", "comment": "Malware payload (MassLogger)", "value": "5f6c317d9ce0ba98bbe273d1c9e182568b2cc851e61dcd6f676590c4b5a2ef476cbbc0623390545c0039dc4d38118d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183532, "uuid": "886e2650-e37b-4566-85d1-7e44023c9726", "value": "T1F555E08776CB8AB2EA595772C49F050073E5E582779FCF1A3D8A23B609037EADD0114B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183532, "uuid": "206924ee-a9ff-42fc-b04d-2f8d0c1d9bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183532, "uuid": "9149ae6d-3983-49ba-89b9-303366284c19", "value": "24576:Oq1JnNYENNEmnSlK/8lRehInT6Qq1gv9zrtHay4MUd/No:fNbNEmAJmhInT6ziVPdapFtNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183532, "uuid": "37e474a2-ec12-4307-a3f4-6100f4d0403c", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183532, "uuid": "ee1e68e0-9083-441a-a0e9-c0e90c1c027c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183532, "uuid": "4a3622a8-c98a-478d-84e5-7547962ebddf", "value": "90939298323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88cb797-f9b8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175777, "uuid": "b11b5f1a-172e-4ce0-8755-b880e9fd7c64", "comment": "Malware payload (Mirai)", "value": "8b880229a90f5dfd91d6200e56b0fe7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175777, "uuid": "9b05a2bb-39ef-4fbf-8e0c-027be7ffac17", "comment": "Malware payload (Mirai)", "value": "99d4df817e761815850e5a0a66f075159b0e491683cf21328227b01a2a069a97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175777, "uuid": "e6e583dc-aba6-4ef9-aa2b-7cf6895d4c62", "comment": "Malware payload (Mirai)", "value": "41258ee45cea8b92508e79165fd2492fb630379f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175777, "uuid": "3574a13d-6efe-4c79-94a2-5e48ac0f2217", "comment": "Malware payload (Mirai)", "value": "c2c5bbe2a017f00e095d57fd0c7b397a2ee689f4cbf5861a3e13d20f3e400e76d210a67a8ef3aedbb9a725e040994fd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175777, "uuid": "f8bd63fb-c4ad-4f7c-a96b-4834d013ead2", "value": "T1EEE32A06B30C0A47D1632EF03E3F27E193EFAA9125A4F640255F9B4A9272E375585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175777, "uuid": "2b1619c8-1c3f-4ad6-b063-506f8e105a6b", "value": "1536:h7lIORk5h495nxgfMc6tFRvxAOouygtNuBEp2u8xiecm4c0sjvA9ZyboKnWncH4n:h6LK+Etvx1ygcpx7cjsU9HK6UMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175777, "uuid": "ec2773ba-fe8d-4c50-8c9e-094251719fdb", "value": 154576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175777, "uuid": "46de3619-ef34-4cea-999d-63bf29731bfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175777, "uuid": "1cf9309d-ff92-460a-bdb7-c9887ca447ff", "value": "efjepc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab6c626-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166761, "uuid": "c4d0244b-58fb-4abf-8fb7-500fefc41fce", "comment": "Malware payload", "value": "bbc279587a2bda98b72cd9f5501a4419", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166761, "uuid": "cd55309d-6e1a-42be-b407-31a50233c517", "comment": "Malware payload", "value": "9b2a63672f27bd9a9757727bbb1f2e663b4dc358a9c44411174ea3c384c135ac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166761, "uuid": "ffe08294-0dc1-48d1-897e-5f823255539c", "comment": "Malware payload", "value": "b7f6a38ba55f6a880674407cfbaa163d14cea191", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166761, "uuid": "1eb66b5c-089b-47ef-b344-39508be253d9", "comment": "Malware payload", "value": "21f5a53e166586e3c29732f0f5b9e967d924b57159b07d1097b91f53f123fb330cb21a9f4862e05e0c1ff017db1d90c0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166761, "uuid": "c9b722e9-2c03-474e-a7bf-7959328d5160", "value": "T196F39E341AF69115D2EF0B3823358281E26CA90EDA12FB8B9790F5C80865510DF36FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166761, "uuid": "535d2e3c-17bd-4a3f-b6cf-ca6a4366551d", "value": "384:C3hCC56+4NMh1f4zwrZ0LnSnc2oHjmQDQf3HneY4zBs:yhj56QzreScjjPkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166761, "uuid": "9dd748a2-5d81-4c99-a7f1-e27c142cec54", "value": 162013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166761, "uuid": "2e541ddd-4e1f-4f5b-8be6-602e797c4e76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166761, "uuid": "a829ba02-1b4c-4536-93ab-c1493e1fafd7", "value": "9b2a63672f27bd9a9757727bbb1f2e663b4dc358a9c44411174ea3c384c135ac.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45c4912-f9a2-11ef-ad17-42010a9c0004", "comment": "Malware payload (StrelaStealer)", "timestamp": 1741166348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166348, "uuid": "34be8ab8-06ec-4015-9b61-9d0e28f51adf", "comment": "Malware payload (StrelaStealer)", "value": "d083c2b26222174127ff97877937148e", "object_relation": "md5", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166348, "uuid": "63608637-0a15-4b40-a5d7-304929fc245c", "comment": "Malware payload (StrelaStealer)", "value": "9b5aab389e76144585b06720fb08ccbd92450f52f5b13c8bca7b3a53d7aa1a56", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166348, "uuid": "c273bb55-4c0e-4d9c-9a21-f234833924c4", "comment": "Malware payload (StrelaStealer)", "value": "6695b33afb320669e877c7d8ab80301372deb4bd", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166348, "uuid": "43f1f7b7-221f-47cd-b696-76072ad5d935", "comment": "Malware payload (StrelaStealer)", "value": "3707c837958e78567debca80d9c2502f850ca11710c1d48fb86575ff7f9ed669d78dac34a53323c55f621956ce949af2", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166348, "uuid": "c3f9469f-fd82-47dc-a307-02bb065d0b11", "value": "T10F25F2144AC82FF6CEAC6E1890FA161D93F04ADF1467648ABB337D4AAFF7544421B1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166348, "uuid": "60e14950-23a1-429e-b4b5-297bb6b6a218", "value": "12288:916HHV09va+2BumGwHyjpq2+bOdBkUEYcdCs4uoVXzi3SGM0IabLMBdHsCwBSP61:fGu9yt594w/yBkUpuoVDi3S08PELm4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166348, "uuid": "847e240a-0356-4c9f-8f0d-bb3346240e70", "value": 990602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166348, "uuid": "df3f67e5-92ab-48b1-ba6c-d278a889b250", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166348, "uuid": "a997b94d-558e-42ee-a8eb-44ed72368a9a", "value": "email.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562a1187-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159667, "uuid": "c3901f51-594c-4800-ac59-b821cc90f791", "comment": "Malware payload", "value": "20320206420bf219ebd09b5fca3a3cb2", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159667, "uuid": "0891b0a0-4bd4-4cd6-9359-581457a36885", "comment": "Malware payload", "value": "9be842a3ad7559314a3ae443e7309a399bae9e4be960afb815f3408b7856f7d5", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159667, "uuid": "f7ec37fb-d9fd-49bf-b294-8a08bfa48c66", "comment": "Malware payload", "value": "bcf4ec903751109c79b97af34c5f74b8f4baf36d", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159667, "uuid": "dc44fd78-c663-433c-93b7-1bbfc8f0e443", "comment": "Malware payload", "value": "5824842d8d5e253b13e4c70ab32d40d266c40c6b90a1ef428bd077fcb16f45350b5810dcd37ae433d1be328cd48a3ada", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159667, "uuid": "4ed448e7-ef43-4930-8752-a6e44b3adb79", "value": "T159817D7B4B85C210C9E6D3F328CA32B2D46796E6B01966CD150F85692AB0D8B4947FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159667, "uuid": "62f61fc7-30fa-43fc-aa2c-44e2f1f882c0", "value": "96:ZS8To47GPGu8W9pmGW1NfyaF8xn3nrEuLkdBuJTCt1J:XToF7dTmXNfgxnteBeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159667, "uuid": "d60cfcf2-2540-4060-9b74-82b96636d73e", "value": 4003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159667, "uuid": "12c8a376-b3aa-4f19-9e2c-8205e1a47846", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159667, "uuid": "45f7fcdf-dbaf-45d5-8dc6-7bf6494c3e9c", "value": "TOUR PACKAGE 022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287a7b41-f967-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741140692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140692, "uuid": "47e89235-d6ea-4751-8176-f9b5056561cf", "comment": "Malware payload (Mirai)", "value": "0eaabd9a282a7d1d5c20e5847dc9bf46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140692, "uuid": "f1585b74-d012-46f7-b70b-33a2855f34cc", "comment": "Malware payload (Mirai)", "value": "9c97d0a0df959ebff6035ce5a8a165876305abe2bbe91a395ed4b8e8858305ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140692, "uuid": "500f159e-cc5e-405c-9f81-b3bd49c337fc", "comment": "Malware payload (Mirai)", "value": "7369435603c166cfea9c1e605500b58ca88e0778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140692, "uuid": "4006998f-6a14-4c85-89ec-594ecfede26d", "comment": "Malware payload (Mirai)", "value": "d3d8b9538bb3cc2c10c41307752bd57a5d2679d07cfa7e7042942c045c435fd209da35360c8d20d2eeedbe82b3012fa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140692, "uuid": "96c4d68f-3506-4984-b63c-d14701896b53", "value": "T179432997F800DDBAF81AE73B84130406B230ABE506925B7363537577FDB61E45863E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140692, "uuid": "491a994a-a1a8-4868-9da3-c5294eebbc5e", "value": "1536:8B/Cu2ysIWYJF0L84kTILYVTg16x8TnHP1ovaUr:q2bOF0JiTG6OMzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741140692, "uuid": "51afb48b-47c0-48a9-b956-9d23372266c2", "value": 59084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741140692, "uuid": "40977b7f-2352-48f6-9ec2-84f862d55455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140692, "uuid": "2b72599b-ef86-4b64-a025-5a8f2918948f", "value": "cbr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73876365-f9b7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175178, "uuid": "d211e73d-13d2-4b6b-a012-e79fcf9fdfec", "comment": "Malware payload (Mirai)", "value": "3b8e8878ffedd8ecab422c1d85f621e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175178, "uuid": "596a0138-3888-45a0-92c0-4d7b58c539c0", "comment": "Malware payload (Mirai)", "value": "9d87026fc59901ce85311663ef793390f35cccf489fecadfe64a1cfb04f24994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175178, "uuid": "3d6e7ee7-d9e3-46cd-b592-750cde0d5bea", "comment": "Malware payload (Mirai)", "value": "3e2b8e01d2eef7ce57c5c71b89313bbf6909fa85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175178, "uuid": "21a68eb7-67b3-4eac-9948-3756d1fcf2da", "comment": "Malware payload (Mirai)", "value": "fd193992532a4fd2516a4874a58ee66138e7ec2c8dc1ece57c4def6228e5cc18d34e8b356400dc9ec3f6c34dda1a1207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175178, "uuid": "b2186459-f422-4bd3-9ee7-88c31600c29a", "value": "T1FCD36C73C8266F58C566E6B4B0B18FB82B939A1591470FBE5AA7C2704043DCDF6063F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175178, "uuid": "ea175bdb-6c48-488f-91a2-b7bf4646959e", "value": "3072:iFkK/mNJIQ89uULWM27qPQW4+Iu1IeUknno:iFkPF89ZL7554+fnUko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175178, "uuid": "2ad36f65-4fc2-4842-b3c1-5894730ffba1", "value": 134052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175178, "uuid": "318d6bad-94b2-4d7e-bd6d-f35e7d592b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175178, "uuid": "40e86258-07a6-447f-91a6-a085eb4301e3", "value": "eehah4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b03d08-f9c7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741182085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182085, "uuid": "6a6e121c-71d1-443e-acff-c11c1f50fa2a", "comment": "Malware payload (Mirai)", "value": "d40ad7768ccaee81ba2286cd24426092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182085, "uuid": "c6c5d620-a28c-4cbb-8a94-1356cec32f12", "comment": "Malware payload (Mirai)", "value": "9e3d3ba74c8ae6e708eb77f80a7748c69b66ce9ebf5ba90c09dc2123d6d8ddec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182085, "uuid": "256b00a6-918f-4b0d-bfcc-f16a8879a6c1", "comment": "Malware payload (Mirai)", "value": "feab10ba1a01e10d5962336dc34d8f4df468371c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182085, "uuid": "92f3b06e-0dce-4bfb-996a-cfe278fc5820", "comment": "Malware payload (Mirai)", "value": "25629fae9330f94cb3f22c3e56bd83182d64f9e59adb8dbe60c397199efba25e4d51cdfddaa639f024b33d9ae0395e35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182085, "uuid": "24caeb3a-43bb-4d01-a57f-de8a8ab8fc01", "value": "T147130289B920FBA1D8FA0C3247F00453F7015EB9A4D4305E60BA4A7879B27F569985EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182085, "uuid": "dd5d0887-a0ed-40a6-8de3-e3fe6f629f8b", "value": "768:8ApAbiXxNVsrtDE9CmORGHw0HatQ3QlN7D9Scp0yVRqPmoAcq3UIrY:8AkiXxNVCa9CmY0HaS34HScpbo6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182085, "uuid": "76667ed8-df8f-43ae-8051-9abf00a8ff2d", "value": 42828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182085, "uuid": "9cd0ffc6-da6b-4276-8f4b-9d6cbbca9293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182085, "uuid": "706d9d8d-0da4-4677-b461-aee4a24d062f", "value": "5r3fqt67ew531has4231.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce402ca3-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156003, "uuid": "2bba03ac-83c2-4df8-abb5-7374112770b2", "comment": "Malware payload (Gafgyt)", "value": "236008e954eac1fd3de4b0ca14b4e649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156003, "uuid": "36f3d0e1-b6f7-4ecf-a53c-93d2bc24bb7c", "comment": "Malware payload (Gafgyt)", "value": "9f21f5ef62399ae6470a82fa3c99bcb5968fec24690f3010eafec5497358ec80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156003, "uuid": "141c09f2-c044-485c-8180-accb5771e11b", "comment": "Malware payload (Gafgyt)", "value": "5670a0d39900508ac9e036a6894a09226d9d2014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156003, "uuid": "b9dc15fa-8f15-4377-b724-27eebcb2628b", "comment": "Malware payload (Gafgyt)", "value": "c710068102f97a2a285e787be315b6e36fb92d9848900aab2919fca92b3c49ab55bbb9e6e356dfbbbfc20cff48be05ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156003, "uuid": "f9c73a9a-4af5-47db-9691-e463159c5da5", "value": "T15A833C47A8615FB3C14669B531FB1E300763E9910F4B1A8A713DAAF4474B9CE781EFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156003, "uuid": "8bfe5b18-f981-42ab-b31f-8cca218055a7", "value": "1536:QWkDaiqMKJmuRO+4FCqMgTSACp5hrI6eKnUsLzk0y/fKsjy1n:1QGTJF4FvZA5hrI6ksLzk0y/ysjy1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156003, "uuid": "b12f3dba-a232-41a1-a452-f446073ea32f", "value": 85864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156003, "uuid": "501a2e18-4331-4c10-b66c-776411be0ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156003, "uuid": "d9364249-45e3-4e13-8a59-2564e256fe09", "value": "Okami.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b67e3eb-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1741162279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162279, "uuid": "48415ce0-5122-4ae0-a101-9c5f59a7b283", "comment": "Malware payload (GCleaner)", "value": "7881e29c5184c20a8c819d4ff930d70d", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162279, "uuid": "3af1f1bd-1408-43ea-9177-df2b48918114", "comment": "Malware payload (GCleaner)", "value": "9ffc9c79fda80cd0af0c52c1f3cbed8e19d97a5bb7dd838b7c4397dd6fd8d80c", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162279, "uuid": "c18988d9-7e30-4024-992e-019a92b0c4b2", "comment": "Malware payload (GCleaner)", "value": "66a4fc4f053077ba42585cdd24dddaf353f686d3", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162279, "uuid": "bffcede0-c859-4563-aa41-e65dee28c9d7", "comment": "Malware payload (GCleaner)", "value": "3abe23c9c473b666fa605730a49622e456959c24ecc39b6a4696bd27865aca2eb5341a2e4272e7840fc69e2bc2606317", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162279, "uuid": "70645baf-67c7-452f-a322-6af096100578", "value": "T19F26331BE837263AD4AD71B7E75E21CB234E5E0F08BC79297A18B414E6E6714F623344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162279, "uuid": "125435fc-c5e6-49ba-83aa-385cef479e13", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162279, "uuid": "a7ed2862-9db0-422b-ae71-51f12743fe75", "value": "98304:dmZSGTVrbBUds+dGs0mQwFnQbxlp+l0sFV/Hxh9tDoSbH0vEmT:gZlNFUYs0qFQlM1RhwSTO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162279, "uuid": "13c88926-1934-436c-8e38-dc9e29b2367b", "value": 4736512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162279, "uuid": "7df711e7-0ce0-421d-baf9-d3798a812d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162279, "uuid": "85101e31-b348-4a90-a307-2f026b200757", "value": "random(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2e72ed-f9c7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741182284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182284, "uuid": "58344f17-b42f-4275-8d2a-18d29a1b4ce8", "comment": "Malware payload", "value": "3043ea232f6a69cbbcd2c27ecba8de49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182284, "uuid": "1116dfce-ca1c-4a13-a19d-4ff14f4086e1", "comment": "Malware payload", "value": "a00924467cfd3115782d1af1beeeeeb9940533f03b9489ca0e66aa6d3629951f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182284, "uuid": "fe72d5f1-7a1d-4b07-963f-d0b8d39c9ab9", "comment": "Malware payload", "value": "368774c9ecd15a188888ed163a8eaa1d20341b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182284, "uuid": "fd25201d-d790-4649-910c-fc828e621d21", "comment": "Malware payload", "value": "957cf6e106f692bc8f04cd373a3be234006b7c89540390708a0b806704b584e639d0ccb04244b70567dccf7bd5570a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182284, "uuid": "eaf83e38-676c-46b3-b0d6-5face606a07a", "value": "T1F3448D016A03F85EC526827444A3E73767302CC26AB2C75B31E9FE2FB9621817F56DD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182284, "uuid": "28baf6f8-965f-45bb-9c11-2cfdfa296e96", "value": "812a095c588eb676bb58eaf6407b37d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182284, "uuid": "901035d9-44e9-4cbb-803b-5f2dd5a10cde", "value": "3072:P9OzfDWN6PkO+SDudSPT9BEZqUHte7G/dwi8tJL/JgjS8JS8DCm6MfVnsD4ZxYCt:cK6PKSD6zH07GAJrG7S8DcM9kCrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182284, "uuid": "4d5782be-299d-41fa-99f5-702df2c20946", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182284, "uuid": "6df96a5e-7ea9-4431-adf8-0ede12004b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182284, "uuid": "b2ee1488-2e3e-4a11-9563-aa0a2ea0a6aa", "value": "Litronism.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaacd20-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741159387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159387, "uuid": "a5f03ef1-2c64-4758-a47f-e1690337382a", "comment": "Malware payload (AgentTesla)", "value": "b18738ef41f5d17b9827dc2e2d311e06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159387, "uuid": "485b6711-9376-4758-8fde-12ad09f12d5d", "comment": "Malware payload (AgentTesla)", "value": "a0b93473fe0aa4e5df49542aea136c8b037d85e4bae90eb5f55922e18ce6b804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159387, "uuid": "b5996220-dce7-4b76-a197-2ed066383cf8", "comment": "Malware payload (AgentTesla)", "value": "2e009d08324a6a33110ba2b479785df04c64748c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159387, "uuid": "e021b0ce-7367-4792-b3bb-00b728e09667", "comment": "Malware payload (AgentTesla)", "value": "33190c201c99e016178ae2c5a6890329a8e4ba617574a1401a59332d7463259d138b17be3104e9c9a1f90773caf98887", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159387, "uuid": "e598d79d-834a-4840-a05a-61e65670b0f3", "value": "T13865E007B58B8BA1E3455F32E59B440043E4D68E73AFDB1A3D4A239B0B6B3BADD41147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159387, "uuid": "12b558bc-7f75-4012-afca-3750136f9982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159387, "uuid": "8254c120-a91a-4173-a1c8-b17bbf7fb9af", "value": "24576:94U2VkcD4m5umT/6yF6LDrlTThKiCQDgmEPjCi9rZeJ1XA8I0l:QVkcUmMLlTfCQX+WaZebw8I0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159387, "uuid": "2edba421-36fa-4707-82ff-494c7789e7fb", "value": 1425920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159387, "uuid": "0c47d261-2029-4916-94fb-c639a13636e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159387, "uuid": "a883401a-fa14-4ce3-b712-9119bf3ecb2e", "value": "DHL - NINGBO OVERDUE INVOICES- FINAL REMINDER - 456034158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c55790-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741156307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "12e47ab9-4728-434d-b35e-ea7fe14208ed", "comment": "Malware payload (Mirai)", "value": "506bf3808dbc98b96ec1e8a58a8b231d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "1e781794-5a2d-4769-8d2e-20faabd4a6a8", "comment": "Malware payload (Mirai)", "value": "a160a5f0a692b9befa23835877004be451a887bacf5c3f19824132d2200b12b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "3463f4a4-f88f-4c53-822b-4a8bd8d5c2cf", "comment": "Malware payload (Mirai)", "value": "fb1e4f1c612d2d766792b2240e83ef860c14dafc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156307, "uuid": "b2a7bb2c-8418-4b9f-9ec8-085d3031db74", "comment": "Malware payload (Mirai)", "value": "bae016b85b3f5152bdbf031bb29646c293e10f1ada922a07e1ea88273bb6698a97071546caf6e510b930fd45ae978d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "97138ea7-7d0e-459c-8b2d-ecff3c5397e1", "value": "T16A6395463E228FFEF36DC63447B74A20A76923D623F0D685D29CD5081E6438D585F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "c5862a21-13b3-486f-ad00-6deef352aba7", "value": "768:9og/rOKbH0BSHpOYjRrdPQJQA5PzgaABLhuB8gMP1SKkPvSta/WO4NB3icf+nMFb:5TOK7ailhQv0a6JK/rQoGjeMaM+UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156307, "uuid": "9301cf87-d83b-4d75-8cdc-5040b6e69cd7", "value": 72480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156307, "uuid": "9f7ec875-feae-4584-bb2d-4c26923297b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156307, "uuid": "9f55b92b-8a86-4e10-9ebb-c48824036828", "value": "cbr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc773675-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741156000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156000, "uuid": "8217420f-5b55-4f83-872d-ad7535530173", "comment": "Malware payload (Gafgyt)", "value": "db195461530e8bbc66e4c8d985f78cf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156000, "uuid": "edae7870-b413-4fa2-80be-4a54fcb83025", "comment": "Malware payload (Gafgyt)", "value": "a16e5e160a2697fbc1bda01ed0e061671d233ba1e9e718bebdf134bf0938f8b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156000, "uuid": "e455b8b3-b511-443a-a1a0-928362be6b5b", "comment": "Malware payload (Gafgyt)", "value": "2c9c4b2b2e2c3e62c874046673875bc966d208d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156000, "uuid": "85f121a6-1636-4bc6-a4a2-a6eaefba3b00", "comment": "Malware payload (Gafgyt)", "value": "a9307bd2f763533ff92289ea0304d969492a0f70cd88f778666f85f5e8a5a23f29b0658506a7f21b72d7a1b21d84bea5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156000, "uuid": "14ed0e3a-fc52-4dfa-931c-f85f49540f66", "value": "T124A31A05F9018727C2C227B6B7DF475D3B3657A867E73311A6286EF02FC27892E29950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156000, "uuid": "9c6bb0cc-2fce-418b-9435-cbd2a1e4223f", "value": "1536:QOs8fUOsBA+WuS2BJ1wAR13VKYmJjO/w5hYIXUeRVdAxpPdIufWHeoB/DQUDaLd2:QhOMA+Wu0AbwYm55hYIEeR3+pPdoB/Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156000, "uuid": "2d59df38-d01e-4dde-94d6-1f3e07543ca7", "value": 98032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156000, "uuid": "c3e6e8f0-3c5e-4f37-9379-09e412f7480c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156000, "uuid": "5a4d0df8-23cc-43f9-9b6d-e76ecf570972", "value": "Okami.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d418021-f9c2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Nitol)", "timestamp": 1741179811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179811, "uuid": "5d85c975-c36b-4449-96f6-54bed8de1f7a", "comment": "Malware payload (Nitol)", "value": "6ec354dc7f316df429bedb8ff3389a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179811, "uuid": "26fb7713-2c22-470c-af4a-05263a82f6a8", "comment": "Malware payload (Nitol)", "value": "a19fdfc131e8fbe063289c83a3cdefb9fb9fb6f1f92c83b892d3519a381623db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179811, "uuid": "9e135d62-4e8f-408d-8ca3-8dc2806f5977", "comment": "Malware payload (Nitol)", "value": "143cf5a8d48fd8a5d8d0158c60464e08800ee3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179811, "uuid": "0cac1d9d-3d15-4152-9686-c6e82ad48ce7", "comment": "Malware payload (Nitol)", "value": "6cb428a15d6b540785b7ea31a7cb1142a0c70f3a335efa91577479d212be9cd69ac7133a3eb41fd8c1f762dece50c201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179811, "uuid": "1f01296d-8874-4ef2-94cd-15ec5f6bc236", "value": "T19D26AF3A8527BD5FF95609BDA40C2C421D687E9783188959EF8C70B7B0CCE50AD6C9F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179811, "uuid": "82b07344-84a4-4f15-baba-0610505e63ac", "value": "7750e578297084bcbba6c356c739cb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179811, "uuid": "596ef657-2c02-4cad-99a0-5d6d35377070", "value": "49152:luyl3j7+VkfqNcZ5pQIBHvyENzRsGR7rIKkqkS1//J+FGU9DXIoqmgW:MgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741179811, "uuid": "c63ce5eb-a1df-4032-a6d5-406f19e7e32f", "value": 4541368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741179811, "uuid": "47ad5bf4-8f03-45e1-9812-eb3e01b207bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179811, "uuid": "29e6bb4a-ed36-44ba-b029-b5bc65c00585", "value": "??? ??????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20b2d72-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199845, "uuid": "b451f0e6-602c-41f5-8281-cc6f0e41fe28", "comment": "Malware payload", "value": "4e9d4809bade35ed80134c7656d3203b", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199845, "uuid": "41ddf3fb-f10f-40a9-85a9-036e09c0bbc7", "comment": "Malware payload", "value": "a1c53dcd0f4f95612219f728a862f446c7d1f287d1840f623ef44a0cd43e9957", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199845, "uuid": "9ab0fb73-7dc7-48ad-913f-3c81f7de4745", "comment": "Malware payload", "value": "399667f28af76584af0898b305841de80b6a17e7", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199845, "uuid": "1464fed6-642b-4807-a3b5-84304ea6c7f1", "comment": "Malware payload", "value": "5c5cdd576d8ea48152437e8a60c8851b4a1508137ef76ceb70faa4eecefa87f61c78a961d6f893f8d41ddddb3873d878", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199845, "uuid": "1d1a3640-9ce3-4fc2-b746-3a461d6db60a", "value": "T156D533C4AF86C090D99C773173FA47CBE2F82EE68454973B5710E0DD8FA1989E768681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199845, "uuid": "a311415e-6930-453d-9bd2-d2a6e40227ce", "value": "49152:2bTdEgj9dxpVihgxQWRJpHetvQ2SIipCJflSIVQgg1YwjL2MYSEv2/E:8Z9FxQOJp+pSIiQ7VQgYCZ+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199845, "uuid": "00d111a2-f146-452d-b0fd-946507d1d8be", "value": 2802035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199845, "uuid": "313ac6db-0e4d-4f3a-bfb3-a33d33dafe92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199845, "uuid": "112162bb-a117-455c-9346-6d40e3ebff02", "value": "321300CITA_874186082265.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa99e0a-f9e9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741196485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196485, "uuid": "3a1f6a42-4b99-4a16-829e-0c5c3e07798e", "comment": "Malware payload (Mirai)", "value": "a68df8c359d5eda8224c596a86404ff1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196485, "uuid": "c2f7e06f-fe95-4e83-87a9-d96e0cbd313b", "comment": "Malware payload (Mirai)", "value": "a274e4ba2abf7472ea420656acedd4a7c52ca22ff5a756167be3cb78a9c635e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196485, "uuid": "d5b2c520-ca05-4451-a03f-a260bb3c5eab", "comment": "Malware payload (Mirai)", "value": "e7bc9c410665d0beef953c0b8a5923ecb2ba5cfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196485, "uuid": "f28922ac-d3d4-46f5-b4a2-2c2d8b13bc00", "comment": "Malware payload (Mirai)", "value": "01ed558e488f9d46fdcf70035fc162ba3897838816f18120c253da6c8494e03d18ef33f42b6c266ea09c4ba92700f00e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196485, "uuid": "b2ee67ad-4a8e-48cc-a9de-be237d6d4a68", "value": "T19D03E19F646CDFD9E4CD3A39448813BAFD14F1C572AB5B08E6454E147B8E82F7998830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196485, "uuid": "24240c21-44be-4619-ad42-4dd20c0d290c", "value": "768:88D1EcBscTVcqmCMNhb2VAIwBF8Bz1kxHqZ4aJwB/HWbNvvVBTWMs:8OLwNx2OIwgBzyxHqVJwxHWbpfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741196485, "uuid": "b58895a1-05b7-4901-90d1-38c372f8832a", "value": 41132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741196485, "uuid": "d20df925-00f3-473f-a9bf-0ff4a80ed787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196485, "uuid": "bc251390-d738-4ad2-b9f5-e560ca74802a", "value": "5r3fqt67ew531has4231.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8176171-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159912, "uuid": "a3e67cee-14ac-4d6b-abb2-20234fd0c009", "comment": "Malware payload (Mirai)", "value": "7e17fdca1816cdd1b787bafa6f39397a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159912, "uuid": "54903230-2603-4622-87d6-b583be7030d8", "comment": "Malware payload (Mirai)", "value": "a281c6cfe04bf57796ffffb322ee6cb51aefd5b9f6a941b01a767ce3b019dafe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159912, "uuid": "5ae5be0b-7270-4842-b8a0-6798334989a6", "comment": "Malware payload (Mirai)", "value": "9e76ebe0d473da02598a4738b798366c18b6e3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159912, "uuid": "2cdffa40-3b02-4ed2-822d-70db4e2847c9", "comment": "Malware payload (Mirai)", "value": "f8a70c5e5bc94ddb047157c1a6aab2fb160956252604ffdff5af5ad5953b14c6f09a0a8f90f0b1dd9a1fc830d4e7903b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159912, "uuid": "f79607db-e851-4ecb-a89d-87519a06db86", "value": "T17D042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159912, "uuid": "03302cdf-ea0c-41d0-9152-c00a5b88fbbc", "value": "3072:OLe6vh8ZQIvuCeeuaMuTuRez43IVIL0ZQ+38YhTfYo+M/RgDlplLn:ee6vhLIv1ruaMuTuReErL0r38+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159912, "uuid": "cd496e37-5968-4045-8749-96dcf19d97d5", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159912, "uuid": "1e81c9e2-64d4-4f19-87ba-bbb30f871608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159912, "uuid": "f0cb1f17-8914-464f-90dd-c5087dc31186", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ba64e1-fa0e-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741212734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212734, "uuid": "bf841c11-791b-4326-afb1-a8dc1bd9542b", "comment": "Malware payload", "value": "322c7d8a10196bdb32073e2e305b1d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212734, "uuid": "a52e0734-e03c-48e2-aede-ea67513bf856", "comment": "Malware payload", "value": "a29a9bb728f850eee42721859273c14bff6d95e0afd8416cb27204acf558fc7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212734, "uuid": "9ece79fb-f373-4b48-ac10-772170c3a034", "comment": "Malware payload", "value": "8f08978783914387f4304c6110dbf93f9edaa5da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212734, "uuid": "c155b167-2bbf-4930-8e22-d7331c869e63", "comment": "Malware payload", "value": "3f0cb11e89ffdaec8c6a7e75814cbefee7ed1e6705ee38f24a8b707c4f217beabbaf42e3e57c51a759ee5933f45b71d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212734, "uuid": "0d7362da-5fe2-412b-922d-0e2e07bb93fd", "value": "T10CD3120778C716378CA91A3DE15854B21DD4A4F099B7E8BE8ADC9583FB263CB0DB9035", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212734, "uuid": "79b577ab-e47f-4e5d-8805-650ec137ffbf", "value": "3072:7iYUzGx1lpW+BX3iTTcHEb5KU7gZcssTYjHmb/nx+:7HxbpbBXeXKU7gqhTYjGbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212734, "uuid": "8cc80c17-66aa-4905-9e7a-179e484aac1c", "value": 130562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212734, "uuid": "bf490277-d9da-463b-8936-8fab5cfe3b41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212734, "uuid": "1c30eb32-b317-4536-a3ac-cfd5f420d43a", "value": "methamphetamine.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340e5d32-fa10-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741213297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213297, "uuid": "a6aec91c-0197-488e-aaca-ebfe8d9bc6df", "comment": "Malware payload (Mirai)", "value": "b5e8d13878f5977fbcf5c17d077b7fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213297, "uuid": "914dcee3-8f0e-43b4-b14b-ff9fedb27a82", "comment": "Malware payload (Mirai)", "value": "a2a3d78a4c853464c0bdc960bbe43de7dbdbd3fb2209213c1be15770f35adf70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213297, "uuid": "811dc246-4186-49e3-9eea-d0aa752e72ee", "comment": "Malware payload (Mirai)", "value": "f8faa9fa607380f19bd7b017a567561a2f7482e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213297, "uuid": "ee19d709-325c-44e5-80cb-a28f0d3d077c", "comment": "Malware payload (Mirai)", "value": "760271354a5ddb2d1ff60132e9368b39dc53534d91bef84d2ddf0e55d41eccead1aa8753368ad7826731d2e3801eb2c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213297, "uuid": "113f1369-9b5b-43a3-a7f3-6ad27b72b5d6", "value": "T1D7E30845BC419B23C6D722BBFB5E428D772617A8D3EE720399256F20378B95B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213297, "uuid": "34c58f59-14ff-4b56-b016-20178482104c", "value": "1536:EsmwJMyKjZ7XF0IZwepFb2IXM4V5RTYTltjGROfxOtpPiP7tIqilFgwywM/NZeLW:Esmw7E2IhFb64ZsBtjGUxj2fSC/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213297, "uuid": "cdf69519-169b-4648-9a9c-42f934ad723c", "value": 150336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213297, "uuid": "965e896a-ec85-4f3e-b739-b2e2cf8b1657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213297, "uuid": "23652b56-c3f3-4058-b1c6-e8634c9e2107", "value": "drea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a5e681-f9e0-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741192811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741192811, "uuid": "1e3312b2-affb-41b7-be88-a02b2591ff2b", "comment": "Malware payload (DCRat)", "value": "32b1f9d371e703e3365c31a9f4684a1d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741192811, "uuid": "e75fd923-3f8d-470a-84e1-b12e6913313b", "comment": "Malware payload (DCRat)", "value": "a3098d1eb8ab63366875f92f338dab584d274f2ffa993e945a8dcdc1a9918ef3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741192811, "uuid": "82054a88-3cd5-4ab6-a58d-65c66eb9fd95", "comment": "Malware payload (DCRat)", "value": "bc0c0cf553a5f2476c03603a212f8a7b61517519", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741192811, "uuid": "bfb0347a-1a59-45c8-87a8-a26265d06365", "comment": "Malware payload (DCRat)", "value": "5a8d6039d3d65f79d13af8bc8c89e32371a1d60b21e51e576eb3b63cd7c8d99a2cd61f6faf4870ec6ff3132c9e765106", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741192811, "uuid": "13b000e5-fd07-472c-b514-877a07d5e8c1", "value": "T19D95AE0AA5626E3BC2DD3BB584D7001E42B1C6637923FF1B361F61E268066319F925F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741192811, "uuid": "12992c39-7ab9-4bbd-8c80-18884fa10729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741192811, "uuid": "64d6a954-5408-4913-ae2d-cba9402a96d4", "value": "49152:3B3j1FyAyLwJ4L+HmL3YAziz/QPJt9GB6bMDNR+y4FisZZ:3BTjSwJJmLIAz8Qt06SRR4Fik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741192811, "uuid": "3d7569b7-c3e0-453f-a29c-00715026a4cc", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741192811, "uuid": "6e33e10e-e608-40a6-995f-e0f84bf5fdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741192811, "uuid": "fab5370e-2dd2-4dab-900a-a1195b857f71", "value": "32b1f9d371e703e3365c31a9f4684a1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fd2836-f9b7-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741175341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175341, "uuid": "15c33762-1f1c-4752-beb6-33f64b24d2f2", "comment": "Malware payload (AgentTesla)", "value": "3bb17dd59f3e455fb28d409dc653d494", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175341, "uuid": "22438137-45ef-4505-8a6d-d09306c555e1", "comment": "Malware payload (AgentTesla)", "value": "a34665528493acf5eb1162c48fc8847e2921630b9e53e82ce5c5af5572e9aadc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175341, "uuid": "999f638d-ef1c-437a-baaa-db004762f12e", "comment": "Malware payload (AgentTesla)", "value": "003618ffc32d70875ce6f49f0f44f77c4393cb12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175341, "uuid": "83407e1f-1d34-4c8c-acb0-5944224b0b4d", "comment": "Malware payload (AgentTesla)", "value": "e5234fc4a6c20c2f0d15aea3cf46ffe64df2a976ab07bb59c5dfc895787a9da08f31460b9392c0f4b2f46629702d61de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175341, "uuid": "f50e9072-7fa9-4f96-b91a-3db5ab9939c9", "value": "T1F5F3BF3ECAF8BEC0036BBDE0156E374A156D57A3F2344BACF9D219D61825544EF3A188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175341, "uuid": "c836b581-7c26-404e-ae66-3b82d19b8df1", "value": "3072:zDcMwq9SHgUWv72jypTAVIEKIlk5EP37cNoAOnsA6KOHf+:/VqmSjKTAVEcPSops9KOHf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175341, "uuid": "80f12776-0039-4374-80e5-9481a96059f6", "value": 159784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175341, "uuid": "1c71b0e0-631b-4867-9ea3-bb14207f211a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175341, "uuid": "4f51df15-cd56-485e-a2d3-7ac7b681010d", "value": "output.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96a45c3-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741155995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155995, "uuid": "33ed4cf2-a843-45d1-b875-ef59539d1eab", "comment": "Malware payload (Gafgyt)", "value": "1b6539f74be5675cde4b25bfc818f5aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155995, "uuid": "a90c6aa3-fc12-46f9-b994-8cfff9536d60", "comment": "Malware payload (Gafgyt)", "value": "a3541c8b08394c9d549183a029d6bc21dab316a8712d7e77a73fa8663d8151dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155995, "uuid": "b50b0ae6-70c8-462f-8792-363dfc795ed8", "comment": "Malware payload (Gafgyt)", "value": "a3ce5472df2dda107b252c46da7f011aab2bafeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155995, "uuid": "8be142b0-054f-40c4-8145-bf07f4730ea6", "comment": "Malware payload (Gafgyt)", "value": "a01371880c8ea320b76bd6f8c092e8379c047f19d32944c407ce1028f7edb7e1d44581de20c387b049cd2abf0b958927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155995, "uuid": "f3cdf517-744b-4546-9b2e-9941a55d0f3f", "value": "T153A33C377B170E23C0CA547112E30732ABB5D79A38FA5387B9A06DAC6F12A843516FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155995, "uuid": "f0adf67a-479f-419f-9c9b-ff9281bc1ca8", "value": "1536:q3qEa9+N95qWtlPtBphaac8CsqEbFQ/0kEy/UPKqjV83n:K8+NP9PLphaac3sqeFQ/0kEy/Uiqju3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155995, "uuid": "2a46efa4-b6a4-4478-819f-7721bcced53e", "value": 102566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155995, "uuid": "474b4796-bd82-4335-ae85-a18433da7d47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155995, "uuid": "84df5720-a2cb-44f9-823b-17a905a9019f", "value": "Okami.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf5e6d-f9b1-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741172640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172640, "uuid": "17efdf03-4c41-467a-8776-eeed2074ac56", "comment": "Malware payload (XWorm)", "value": "f95fc1276e3dfec7862d35bec284b761", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172640, "uuid": "1758264b-a9f0-4697-905e-9e181d0d3741", "comment": "Malware payload (XWorm)", "value": "a36ff1329f3821aa66247526acf957a0708ce2df96cd61ee52c6513f1742905c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172640, "uuid": "53e34873-d079-43f4-b8e2-8b559b91d229", "comment": "Malware payload (XWorm)", "value": "39a0598570c82a824efd70a834e76d643b957aeb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172640, "uuid": "aefb0f26-4788-4b6e-8cb8-c6232d32e134", "comment": "Malware payload (XWorm)", "value": "b3193ca8c8de67b95cf71288c9aca1b00438b215f2879f0d372532c64f78ea8aace2b26884c103b2f48cb6fb066e5c53", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172640, "uuid": "057e3f58-693e-46b8-ab96-233559494003", "value": "T1D9F2F180F09A4FE6ECF5065C6BC1C4AF0E6668E82219F1DD1A7C15AB2ED1D46CE0F197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172640, "uuid": "c1ca5bc8-e69a-4702-a76a-eafd4ce153b3", "value": "768:Ue3udlG57U7Z2sN7OQXuB3nMkOdxhNal0/Dh8s+90/OzaOjURkXGIRiqKvF:h3uCohJOP3nedxZ18J0/OW22IRiNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741172640, "uuid": "ee296801-3b8d-4f9b-b411-e822f6f9c50f", "value": 35367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741172640, "uuid": "1119abd7-3ee6-4517-82d8-f48f13c02c6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172640, "uuid": "bc594613-0ae9-49f3-aec9-14414e7110d3", "value": "awb_post_dhl_delivery_documents_05_03_2025_00000000000250.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ca329b-f9b7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175180, "uuid": "d48a9c98-fe7a-43be-a2d9-01ab167767a0", "comment": "Malware payload (Mirai)", "value": "dde578018406f1ea3f78a66813188666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175180, "uuid": "045f88ac-2d44-4674-8bd7-8985cf174fbb", "comment": "Malware payload (Mirai)", "value": "a38a66676a08b2c8e99298454ba7b1fa8822218e18af854336eea6309dbad509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175180, "uuid": "f550044e-15ca-460e-ac59-39ef2735daf3", "comment": "Malware payload (Mirai)", "value": "d1051e74e3b009a6c2f3d1786e6d337a265e9a0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175180, "uuid": "da454758-44d7-4e43-a7d8-961328ff0a72", "comment": "Malware payload (Mirai)", "value": "78285511b800579b9fb9ddc62f6313c7471b79c56d61e7566b01d28054b369c497ab7d60d2c7cd8b417e0cf4e150b526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175180, "uuid": "3be6004d-0ce4-4c40-a6d9-df74fb753057", "value": "T171B338C1FA8BD0F2D45748715067B73FCB32D8295036CA6EEF69AF36DA635428216318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175180, "uuid": "fd8d692a-0e7a-4a1d-9419-0f7c99bf8c3c", "value": "3072:3FCb8pQnX/uV7eT7IOmClGhweF58WvOQ:1Cb8pQnX/uV74ECoT5vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175180, "uuid": "8ad1ce19-f10a-4cac-bca8-0df991ac0eb4", "value": 109000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175180, "uuid": "9a8b58b8-d348-47ec-aa2f-36eac4d9356c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175180, "uuid": "48f98236-1957-4b20-99bc-6f5e116baa4f", "value": "rjfe686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81157dbd-f959-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741134828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741134828, "uuid": "ea8b0c27-cbe4-4bb2-a7f5-444b6b8499de", "comment": "Malware payload (Formbook)", "value": "3dc44c60e24e85b291de3302c1441941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741134828, "uuid": "18b184c0-cd29-4686-ab80-bab25fdeecf0", "comment": "Malware payload (Formbook)", "value": "a423eb9280e135ccc75f493b7bcbda41bdc49ecdb58741c0fada0ef482c40989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741134828, "uuid": "8fba23c7-57b8-41fb-b761-d46e9cf71e60", "comment": "Malware payload (Formbook)", "value": "748f48b584ae1adea2d13df0c3bf333e1f09887e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741134828, "uuid": "f59a66c1-3abe-455c-82ff-75caa2c6aba8", "comment": "Malware payload (Formbook)", "value": "21ceec9d7adb0cf2e276c9e7b4e3253f55ff9261a25477994aa8fa8fa3e21b642255b62041ce11e3cfcbc7cff9aa91c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741134828, "uuid": "0f6041a5-0947-4923-b53f-af18d71ae7b0", "value": "T1FF45CF2273DDC360CB669133BF2AB7056EBF3C614630B95B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741134828, "uuid": "dcd40ebd-acc8-48c6-94e0-25bbd8804cd5", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741134828, "uuid": "22143372-0481-47ce-9b31-d174d4f92418", "value": "24576:ru6J33O0c+JY5UZ+XC0kGso6FadYGuvMww2VGIVWY:Fu0c++OCvkGs9FadXuvMwZuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741134828, "uuid": "4ab7e8f7-9837-45b6-938c-d01b01a46943", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741134828, "uuid": "91c01419-44e1-43f8-8e3d-9567a49ed6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741134828, "uuid": "0a47710d-71fc-4519-88e5-7b6012855156", "value": "CV Jennyfer Rojas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfe134e-fa0e-11ef-ad17-42010a9c0004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1741212615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212615, "uuid": "6ca3a002-0434-493b-9ca8-4ad7405c162d", "comment": "Malware payload (ValleyRAT)", "value": "3253d8a12e29cc65ed890ba6a01aceb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212615, "uuid": "3923a141-44f2-4f56-ab59-bb7c4e72f68b", "comment": "Malware payload (ValleyRAT)", "value": "a43b37ad2fc0b91d1c2a008a0794e40ac45cf58e2d23098937bb30f5773b52ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212615, "uuid": "00f406d4-f0f1-4c19-808b-c06b657473bd", "comment": "Malware payload (ValleyRAT)", "value": "4c71685f49cab4da7f354d2f821b0ed152945fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212615, "uuid": "57a6efed-f398-4f4d-97c1-e65488f7241d", "comment": "Malware payload (ValleyRAT)", "value": "a16a97e93f9b987c7c98bdc0b8ae99bada70361dfebeb584d7af888235d6419b3e17fb9afa2638f3d7721446971c611c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212615, "uuid": "c71cf845-624a-4856-a11f-77e41f49d1dd", "value": "T14CE51211B6D3C0F2D616193004A6E736CE35BE424639DFC7A769DE791C33282A72F25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212615, "uuid": "ffc0d1ce-dc41-4ca0-b7af-e88c54fc56c7", "value": "73fcaffcf80955c503a71b9af9fbbb68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212615, "uuid": "b2486699-a774-4e5f-8edb-384c81d5bf59", "value": "49152:2VtOhYlG4EWxActYT62tQyZFEfCEY17yEpg34d0xqPjsb+biuNwx2BESMm:2DOhYlG4NUtQVC97BARssb+bTNwxAESZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212615, "uuid": "e6139a3c-82d7-4637-9dfe-3ff7dd23b3bd", "value": 3158016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212615, "uuid": "a0534519-873c-4b21-bdde-a54c03e0dc41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212615, "uuid": "09c78bca-0e67-49ea-844e-99ae735d69c1", "value": "3253d8a12e29cc65ed890ba6a01aceb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6afc8c3-f98e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741157789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157789, "uuid": "664879d9-001e-4c0b-9b45-b6545459da95", "comment": "Malware payload (Prometei)", "value": "47cfddc002b889884359758b46718a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157789, "uuid": "873f2a96-71f1-4099-8f89-e1ef5fa20df1", "comment": "Malware payload (Prometei)", "value": "a4930ec439de65a0c6bdbcaa904ca54703f84a7153b3432fabd73706715d8592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157789, "uuid": "58d19598-cf6d-4176-a48d-0aad9203aa29", "comment": "Malware payload (Prometei)", "value": "037e527b47c66c00687a6c08a9f50d95d4f675e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157789, "uuid": "cfa9b221-1200-4e65-8720-967dfe3e71a1", "comment": "Malware payload (Prometei)", "value": "1fd022be91b673a8a107d20ed817cbd8775ebd3826bfe60ff8afdafad722b81369a79ee1386b38af37760304eaa85f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157789, "uuid": "75efe4e6-e7d4-4744-8c0d-c06ec21cfe47", "value": "T1689423F31424B3738A2C3A3EFF609E15D79A573CE55927161A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157789, "uuid": "a79381af-0a4e-46ff-b19f-87fc3ef31313", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSq:W4/y+qaBUZJAdVte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157789, "uuid": "871603a3-7706-4cc4-8a2e-4ea09d55b473", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157789, "uuid": "75efeb67-303c-4c83-9c86-e88c4cb80370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157789, "uuid": "5899bc63-35b6-4042-90d6-6039f1a228ad", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52633a60-f989-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741155365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155365, "uuid": "969110bd-9eba-4042-8f60-fc82b1af03a1", "comment": "Malware payload (SnakeKeylogger)", "value": "b05f87132e005d87db7d3aaffeefe482", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155365, "uuid": "022467fb-8370-4419-a6cc-a05ed63f51d2", "comment": "Malware payload (SnakeKeylogger)", "value": "a6358b3706e3eae742fc8d8c3b85b29c7b7b7e11b284aa30876f8321f36db3b5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155365, "uuid": "831048e3-3e98-419a-8819-737aeb737d68", "comment": "Malware payload (SnakeKeylogger)", "value": "5e65fd21229417ebb03d9100878cbfa8467415d2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155365, "uuid": "f704c3c3-3738-4b25-af5b-f635d72d7d4a", "comment": "Malware payload (SnakeKeylogger)", "value": "512cbc4d7e476f8b88af303a353dd6002a7db1b238089de07bec988ec9f11edfb9e01513b454b2258d44e1e64f4f56a3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155365, "uuid": "2759d85f-c16a-43ce-873f-b5048fbb33f2", "value": "T162B4236DFB48E3AC9A62B1D33D47A68A52501F54D2821127E71A7DBFD0C98E35EF3420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155365, "uuid": "895513d2-820f-4cb5-b80c-9de158b2d9bd", "value": "12288:aP9Yo2N5RCQtOj5+8VGqt/D7qYVMd+vCB+vsglZrk:gYtN5Rn8j5zcOJMcvi+scrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155365, "uuid": "f9b9e078-2228-4bd1-b40e-70d17c644080", "value": 533174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155365, "uuid": "566b75af-c72f-48cf-8c6a-7d19a4307288", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155365, "uuid": "69694d14-e83a-47f8-8849-1de7f796476b", "value": "SNKO05B250200012 SNKO05B250200023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104384de-f9e9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741196486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196486, "uuid": "ad02a573-6df3-47db-9321-057aa0623d5f", "comment": "Malware payload (Mirai)", "value": "653c7b3df463e52a7b210c10e7538607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196486, "uuid": "0c00d211-0b06-4792-b294-9f01f05a1b8b", "comment": "Malware payload (Mirai)", "value": "a64a8145fdefd47e5bb024656ecc688db68d48fb855a6f41c105d3a1dcddb806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196486, "uuid": "2cef4e2e-38b3-4a6d-a449-10f7e7dc63c5", "comment": "Malware payload (Mirai)", "value": "63d57f8044e4d0ae3fb376f2de5a40a5bfc32ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196486, "uuid": "97ee0747-2943-4be5-b075-56122c797682", "comment": "Malware payload (Mirai)", "value": "6638b3d9daa1fc05a569ee7942f9309b67ebe8f40ed14de77f13b70f14f38689864357cb8666a247f4eb4bb5144fd9a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196486, "uuid": "4ad281a7-9dcd-4bc4-891a-50353746ec3f", "value": "T1EB934B96F4009DBDF84BD7BA44270A09B530A2D54BA30F37A3A7BDA7AC730947C16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196486, "uuid": "67a4a382-c9b5-47e8-9c65-fee94805e9db", "value": "1536:kbH4A8+GABcSu0/QBnmn1HQGINxhyr18grPIKSSsjgK4SjE7bLk9ziRbpQQeTBnZ:kbH4APGAuSu0/YnmnF7ChyrdPPKJj69s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741196486, "uuid": "7f17598a-ca3b-4d3c-b542-304c805eed87", "value": 97544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741196486, "uuid": "f9559086-f7b9-41bd-91cd-220f01ff3679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196486, "uuid": "59a1f428-f849-4e51-a101-ff59a320764a", "value": "5r3fqt67ew531has4231.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603a6970-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139497, "uuid": "18d72b17-5ff8-4161-88f9-12a4bc81f1f1", "comment": "Malware payload (Mirai)", "value": "df824b90081efe570ed553d63d388c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139497, "uuid": "95310e68-4f52-48aa-9325-58939db8361f", "comment": "Malware payload (Mirai)", "value": "a96f3321201e5cbf4655b1b8c204cbbd8970a7504ca787edd4d70c32bd11a623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139497, "uuid": "ac985c1a-2dc0-449e-bea7-398f99c498cc", "comment": "Malware payload (Mirai)", "value": "b14dfbd74b42bfcb91da71cceea69c6f4995f059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139497, "uuid": "18857bf6-8b28-4b01-ac18-0690bf696773", "comment": "Malware payload (Mirai)", "value": "8fb16f70d79ab5b5953fadcd6969048e5f9dc409eb58c9f541b15e9db50424036081ee71ccb2e24855f57d40f3ef150b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139497, "uuid": "e4dd6d58-86e3-45cf-83bb-94849e3afdbb", "value": "T1D3B3C60E7E218F7DFBA9C23847BB8A15965837C637E1D581D25CDA012E6028E741FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139497, "uuid": "04d6e472-6c61-491e-a56f-cb83dbcc148b", "value": "3072:qz1u8TfSyBFataXSdQ0YCtxGCtgWmHd7BPdt:qxu8TfSyBQ4XSdS2xGEpyVdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139497, "uuid": "f8d50aef-60e4-4d0f-89d6-3b73e749ef1a", "value": 113428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139497, "uuid": "7640678b-7803-4fdb-9d5d-b489ea5e0d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139497, "uuid": "fa066145-275f-46e0-b250-d9d8f5e21cca", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4394baf-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159905, "uuid": "afb018d7-c8dd-4c26-a934-1c7dbff6d442", "comment": "Malware payload (Mirai)", "value": "83370da2d80eb79e9640bf72c1dd8c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159905, "uuid": "df4949f5-1abe-42d7-b52b-f96207edd9c3", "comment": "Malware payload (Mirai)", "value": "a98563480f24c50ec49e27f645ade1cc439232fcad0eaff8271cfd160fd0f84d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159905, "uuid": "158ff8f8-926d-4d52-9c2a-0bfbcefe62e7", "comment": "Malware payload (Mirai)", "value": "8de4f777914aff3dfc2b0808e3b7b3969919d905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159905, "uuid": "9d3129a9-d309-45f6-8ed4-e3f9f7d71fad", "comment": "Malware payload (Mirai)", "value": "cbf851a60d27e942c17a71dc5c2fd941b67da158caefe3bac449d7f0653cccc6808cfaaa7643d33de20bfeadc8c32269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159905, "uuid": "f5f2bc0a-92db-46d9-8342-9ca5e118d83c", "value": "T14A04B71AAB510FBBDCAFDD3702E90B0139CC955B22A53B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159905, "uuid": "6bc5490b-815c-4950-a2a8-c30c061b871b", "value": "3072:nKpzG9eNkSfcQqmav8SqaRVlnYz/Fx7t:nKY9eNYQqmeqavlg/Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159905, "uuid": "d622e8c0-a0f6-4927-9f3b-a11e4f1d130b", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159905, "uuid": "7d37d30d-76e9-4d08-98dc-0b6fcfe34792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159905, "uuid": "43234c0a-4f90-457c-b432-6a01a94508b6", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f112b12-f9e9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741196484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196484, "uuid": "a7ad469f-0c45-425c-8c3c-e927d6752694", "comment": "Malware payload (Mirai)", "value": "8bb7aac6b23c8527f7cf65829ade7f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196484, "uuid": "ada98386-cfab-4675-8095-59996496404e", "comment": "Malware payload (Mirai)", "value": "a993a8890af365238dfca01438a5dd9c5956da9d07677b8a75c19ce49389807d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196484, "uuid": "65745de2-2ae3-4568-94da-0464833baacf", "comment": "Malware payload (Mirai)", "value": "23ac1a5a32d85e0ba56c0e947ec6519a7096920b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741196484, "uuid": "2022b32f-1897-4eb8-9682-03b7689dd7d1", "comment": "Malware payload (Mirai)", "value": "1ed81a8ee695b655a260f4e188e5e0756b6347da70a5f70b40107e2f7a8c01598eeb221ff286e46c1527c7ada6507005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196484, "uuid": "c312db90-18a2-4faf-8e6b-477610b83cea", "value": "T180839E7BE9061C20C184427174F99D793B9395C4A1772EF669A1C6BAD00BDDEB009FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196484, "uuid": "8eea21b4-d32e-4e74-ba3e-552537123dd5", "value": "1536:QakQNhdH9fhSf3riDEjbU+mc2sKkawMY/KBY99K0ZQCNyYCcpiFKwbZn5sv:QSbH9f4beELosCRYiB90ZQFV4wbZn5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741196484, "uuid": "c0878490-b0d1-4854-9f66-28ba0f2ac2b9", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741196484, "uuid": "620208f8-5a38-4643-a5c2-95528298d041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741196484, "uuid": "898c868c-1165-441e-84c0-12c0b7bcbdc7", "value": "5r3fqt67ew531has4231.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8feb03-f97f-11ef-ad17-42010a9c0004", "comment": "Malware payload (Fog)", "timestamp": 1741151334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741151334, "uuid": "fc95d3de-f614-4383-8cd7-66056499eb69", "comment": "Malware payload (Fog)", "value": "7b795e5db82f25b8261d70048b2c3940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741151334, "uuid": "af9c5bbe-597f-43f9-8300-88035ca2bfe8", "comment": "Malware payload (Fog)", "value": "a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741151334, "uuid": "221e87b2-523e-4eaa-a9e5-5fb103123991", "comment": "Malware payload (Fog)", "value": "3e47a924f8100582590b0e92b8342f394f01484f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741151334, "uuid": "9825b9fd-ce6c-4906-98c9-1d8ddad5b5fa", "comment": "Malware payload (Fog)", "value": "23338ad66d34b95d29f39f1629972d2a5a4f873481987787275248c1369e69a9637c843f4ebd9c3682412e502126a95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741151334, "uuid": "6a5463be-a061-4cf2-b403-c0daddfca9b5", "value": "T1D734CF41B4C183F9EA7A96B6A86CCFA46A2EF8740C109F4B53D205761E326D015BDCDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741151334, "uuid": "fa1025fa-cc03-445d-accd-40859a9442fb", "value": "a4bb8643f050fdffe8857a2639b0dc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741151334, "uuid": "c10b2bfd-bdf0-4382-88cf-ab33354a814d", "value": "6144:jZey3YbbI1TQcUy4lxA8ari/dplVkT3kq:jNQI1TyyADar6G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741151334, "uuid": "983976c3-047c-4cb2-80b0-a90a8838ee51", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741151334, "uuid": "4fe5903f-7514-4e73-981c-2af333ff477b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741151334, "uuid": "7951f261-5ee2-4156-ad5e-049b140a4c43", "value": "a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d40310-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185248, "uuid": "4e966da7-0b12-429b-9a7d-8df6b215e7f5", "comment": "Malware payload (Grandoreiro)", "value": "61269899113afa50a9d621634d42ea86", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185248, "uuid": "77afab62-f2f4-48f3-95bf-fa3e0f7eac64", "comment": "Malware payload (Grandoreiro)", "value": "a9c55fafaa691fac31261d53195c2bf2ef351d72eaab166fc060588710de3ebf", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185248, "uuid": "500966c2-9c53-420e-bb89-60a4a44d215e", "comment": "Malware payload (Grandoreiro)", "value": "817a11e646b14d94eddfd0e1c2d7f85ccd7e6e51", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185248, "uuid": "a03a81f3-c640-488e-ae0c-02adc7b7837c", "comment": "Malware payload (Grandoreiro)", "value": "df3966b07a3bf4502dd1f3f59080cdffa4e5fa60457a4118e5d383c5368d7056d6e7c402f4a9add0c903e5ccbc06ce68", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185248, "uuid": "52b897a0-0e09-4404-9720-d59995227256", "value": "T153B533D41FD1C284DE563B34FD5E53CD90E5463B0DA0DB272856B6E8EB2E402EA187E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185248, "uuid": "2c6c9ca1-c54d-4a8c-a49c-9d8476ac550a", "value": "49152:V1ax/6cAHmzN1EP+iXbkWlnaMyKldokQpEPYiaf4E2/8:VcR25ZoxpEPRdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185248, "uuid": "2fe791d1-c260-4238-b0df-153600488caf", "value": 2458884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185248, "uuid": "a1d34cb8-6314-41d3-b5c6-08abb94d27a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185248, "uuid": "bf336a17-240f-4610-83c7-1e4c4f7411b8", "value": "946602614520AIZN6937_CITA6725.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e5e82f-f9a4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166840, "uuid": "e9b5dfc3-f049-49a0-9177-b127b98ae589", "comment": "Malware payload", "value": "181adcec39dea9670b3aebbcf5cad857", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166840, "uuid": "f5949519-ffd0-4501-af49-52c4edc78f98", "comment": "Malware payload", "value": "a9c76b9cbc04771bed00087989d5b837fff5deae57f5ca6b29051e1ed1d800e8", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166840, "uuid": "b71d6f28-801b-4663-8a8f-5222566941a6", "comment": "Malware payload", "value": "62a95dd357f406e21160e3b7d9e41d71a0aca35f", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166840, "uuid": "1b443a70-8919-4c8d-8b74-ff9b8c492273", "comment": "Malware payload", "value": "49e79a42c6923bec41db7fe82bc1bc873c9d8d671ec8b78b31d8b44ec7b47f7d34501dfe023dcccc9bf49cbbdf58bfbf", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166840, "uuid": "e48722d1-adaa-4ab5-9650-42a4f1f5eeb3", "value": "T12C944B3BF650A86CE143C07013EA87F26A61FC7916257A2F23D0BB326E76CD06659717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166840, "uuid": "70e77d70-d6b9-40bb-aafa-e2cbca87ec50", "value": "12288:EEXzSv0XYD8A1KonqD2DvWwmfGUrByPRZNHm8:/XPXXAfnqD2a7fGSsRZNHm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166840, "uuid": "b36c67f7-1b3a-4a40-b48a-a60f3f1f8f40", "value": 436392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166840, "uuid": "61bd9a15-53d9-4c80-ad37-0ebee7a6dc09", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166840, "uuid": "b20c12b9-1468-4e80-86fb-b1c6c261e71e", "value": "a9c76b9cbc04771bed00087989d5b837fff5deae57f5ca6b29051e1ed1d800e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4439a8-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199813, "uuid": "78a18d4b-70da-45f0-840f-75fdff153a62", "comment": "Malware payload", "value": "6e02443a7db317c305878046f8918e36", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199813, "uuid": "9ef89af7-0d4d-4d0e-8b9a-32e07cbf20fa", "comment": "Malware payload", "value": "aa36cd51b21ef592460ec95fc225fa4dca96c3c6f6d7eeee4c4ac83e6787d73b", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199813, "uuid": "7de406a6-b3b5-40b1-aeca-807b3e11670e", "comment": "Malware payload", "value": "130112d8e3ac1f7edd4a08696b83c1332ca1550f", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199813, "uuid": "cb6b44e0-1eea-456a-b7a7-e7428b1b6144", "comment": "Malware payload", "value": "a0afbd2c68c3d1001b2d137eedcb07f1401e3d6ed39f6015c798ee612ebde315525fb8ce51f1350089b9d3a931f33dbe", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199813, "uuid": "44e7ff60-5665-4433-b252-945a4f2bcb05", "value": "T199D533DABBCC9054EA5C3F74F7DF3B8CD5C15D9D84E05337CA20AAECABA519A6524002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199813, "uuid": "32c3fbf8-01a6-464f-ac23-402f723d1678", "value": "49152:hy6p0Jja8v9gH3r3gdWkhVgU9lw6MQnfNW8th5SKomg92/x:w6p0Jja8vykYKVhW6BlWKHdoW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199813, "uuid": "815084a3-c150-4494-bd67-2b378d1136b9", "value": 2828650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199813, "uuid": "90e36a72-c60b-4b0a-95bd-87dca68f299a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199813, "uuid": "8ef88a74-7420-4f67-be01-1c645e9cbf29", "value": "188400CITA_644147227771.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafeea32-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741155997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155997, "uuid": "686537f7-fa8b-489f-a891-c24aa900a849", "comment": "Malware payload (Mirai)", "value": "7af5fc57e2c79ca4b5e7815f27e4e850", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155997, "uuid": "cc586dcf-8999-4ac0-b59e-f55db5d1c2a2", "comment": "Malware payload (Mirai)", "value": "aa83312a02082a6a9b82201392a6718957950ac6f9fb2751894710bfbb967017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155997, "uuid": "addce9e8-9aef-4ccf-acfd-b80f169576a7", "comment": "Malware payload (Mirai)", "value": "6458faa4ce8ec9a84d500dda6335584150ad4d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155997, "uuid": "c3e47f36-d688-44ad-b6b3-64000fa49fcd", "comment": "Malware payload (Mirai)", "value": "6b8b3f52ebeafbdd32cf3c9af694a78901cdf348815e301653d29d7cdae0219e3dd2719a24c04967889a3c2b9f2ee6e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155997, "uuid": "24522253-af67-4de6-9319-d54adeab34d1", "value": "T101D31946E7809B13C5D22B76FADF42423323DB5493AB6306952CABF43F8779A4E13506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155997, "uuid": "e47a2316-71a5-4ff0-b02b-61063398f843", "value": "3072:xFkJJQRa3B+fwy/RJiUAWrT+BNXM/91inBmoV:xFM2Ra3B+fwIReWT+BlM/91Ygi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155997, "uuid": "2f2c90bc-2ceb-4d8c-a11e-5da30fdd4af7", "value": 139636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155997, "uuid": "2e113167-dc4a-4efb-bf75-c7f8a155e1a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155997, "uuid": "925c0cbf-275b-4a9a-85a1-85719c89a545", "value": "cbr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524b6773-f99e-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741164385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164385, "uuid": "787f7a59-d68d-4fea-aa46-cb8f0e2fd71b", "comment": "Malware payload", "value": "b795f0e2f522c05c5a4e1620b5d94303", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164385, "uuid": "e21816b3-5e8c-4873-8447-b504b0fdd62d", "comment": "Malware payload", "value": "ab26aee3ee30a1b02fe3509cf056d5e21602f65cb13fc89a5053389d93f9ec75", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164385, "uuid": "16027cfe-fdba-4d71-ba52-01c9a3068dc4", "comment": "Malware payload", "value": "d411fb389eb390c9540734bd4d3a6561a8fac62c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164385, "uuid": "fed6f478-4bc1-4f96-929c-8cc9dc6182f9", "comment": "Malware payload", "value": "a2472874d3c6bf8cdd9f748ee390bd435c4f8a0c35c596a381edf3a1405e95f7a28d74a48b2bcb6d5f824fa3affac0ff", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164385, "uuid": "a5223a1d-3f60-480d-9904-dfed5cb5a8cc", "value": "T14FF33C9435A2022C9C72AF3E6DDFE880A015CD4E50641F15BEAB53395FDE2CB476C2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164385, "uuid": "0e994667-9cef-43a2-a106-c1d27f6ea15e", "value": "1536:ADE9wDAyDTRPfEMMw0R5lGT1hKpSI8IlSOeuQV:4xTRkLi1hKpSI8IlSOeuQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741164385, "uuid": "b728034d-4b95-4c45-a4c3-d3863223058c", "value": 170893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741164385, "uuid": "3134ee75-7a05-48aa-b20f-d3bdd377a3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164385, "uuid": "1c671fcf-0fbf-45c7-b6b6-0a1cb47855eb", "value": "0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c9e950-f96a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741142194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142194, "uuid": "16b69cc2-e3aa-4a82-abf4-a19769f6cd67", "comment": "Malware payload (Prometei)", "value": "9a708d5a73bc4b62f395d745d11cc71e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142194, "uuid": "7c5e3aec-de7a-43af-ab2f-98354c6277a4", "comment": "Malware payload (Prometei)", "value": "ab73b6e5e3605c1b4e7a265b7c7e2581b3b35298f4cda9c2345e0cba2f3155ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142194, "uuid": "a87d31a1-69b8-4696-9bb2-cf6a165f59b0", "comment": "Malware payload (Prometei)", "value": "4ae523b69f335ef75354d56ec24954edf0afe5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142194, "uuid": "a5cd6709-e178-4ace-bf8e-99e7c31e167a", "comment": "Malware payload (Prometei)", "value": "62a8aa8dcf5027eb722ccb06db4f0b55af15d6b15f7a6ba05b5588c62b164d04535c0ae6473dd2272bb8ca860d4bfcae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142194, "uuid": "965f20ba-76eb-43a1-9de2-917700f786bb", "value": "T19D9423F31824B3738A2C3A3EFF509E15D7A9573CE55927161A1FDDEB0F2952209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142194, "uuid": "01b9f801-f613-4b46-af71-0357654f82a2", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeS3:W4/y+qaBUZJAdVtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741142194, "uuid": "0355193a-d50f-4b47-b29c-34e8291a1df3", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741142194, "uuid": "11b03c94-9bd4-42fd-8ff7-f2e3fab85662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142194, "uuid": "b2d36592-fd69-450d-8ee8-662d16d4f05e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27147870-fa0f-11ef-ad17-42010a9c0004", "comment": "Malware payload (QuasarRAT)", "timestamp": 1741212845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212845, "uuid": "1a0842b5-dc2b-485e-84a5-2fe37f77dc4f", "comment": "Malware payload (QuasarRAT)", "value": "96e8d2f178e54bc8cc326207e7f3a16a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212845, "uuid": "92ccc99a-b6c5-4543-934e-8d4d1f651ea8", "comment": "Malware payload (QuasarRAT)", "value": "ab79c082847351c2af4eade4daf0cd53f05cec53a1be7e08d2d03a092a380698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212845, "uuid": "be80f171-9dfa-4896-af42-485f2a37d6da", "comment": "Malware payload (QuasarRAT)", "value": "11343612f31a1958e7e5ec58859e7e2473dfb819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212845, "uuid": "bcb972ae-9fb2-4dbc-870e-93235c9faf02", "comment": "Malware payload (QuasarRAT)", "value": "8181387801e93bce44d422900852139895d90adf53c0b6bf927b41c1078b5d67b1fd0f8b27e65cf3ec4e202fd51e8fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212845, "uuid": "70ab7b81-cdff-447e-8931-4fb0aa4fa8c8", "value": "T195E522C2F3864CB5F6F74D788C1A80B85E5B786CF9D114192DB8DA8E4A3B8C31C39596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212845, "uuid": "e3f1dd67-edc5-41b3-979e-5d7f35ae66cf", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212845, "uuid": "0b158c1c-6870-4500-a881-4a1e65f23d2f", "value": "49152:v+LLXDYfFw9cGScd7z3f3ChRILjdcEp8L9mhv1bl/RXf85M:eXYfFwWGhd7z3fyhRILjeC8L9sL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212845, "uuid": "7baf272d-9f1e-46e6-92ae-84d15b645f23", "value": 3271437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212845, "uuid": "38eb75c2-9564-4f9d-ab2c-ba3cace51e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212845, "uuid": "c5fc4c16-9b75-4a93-a2d3-bcfe8795d444", "value": "BT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e27637-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159351, "uuid": "eef628a2-9c02-4b42-94dd-c150faae9c7b", "comment": "Malware payload", "value": "a363cbb7e384b2761f88df8110c170d3", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159351, "uuid": "f12adfa4-636d-448f-b798-f81396855b4d", "comment": "Malware payload", "value": "acb167999d9e92d90c37567fe469c81e6b4169c162db04b08df692fbd8e13faf", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159351, "uuid": "f563919f-a25d-44b4-8d6f-69ae09810213", "comment": "Malware payload", "value": "963ab6c63f4aa4feef78b53ced97bae7284b938e", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159351, "uuid": "33717918-5cda-43e7-9f1b-2341cbeb3c02", "comment": "Malware payload", "value": "a36f0f77ede9c815917dd8505a873c60fb61a10c11bd5514ba2c57ba19c60b8eec56ea5b1d660c8d97b6b586551b56b5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159351, "uuid": "34607ad1-92e1-4559-b979-847c3cdf55f3", "value": "T1184523E8ECD0BE07CB128576978AE54D450BFD5F2A58D05732B8B30E4237AED84B462D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159351, "uuid": "305686f9-4d8c-4b07-b56b-0cada67a1de2", "value": "24576:aJJIwgfeFJJMG6mkr62ZKrozFYchxyGy7OT31T:aJzgfWJuG9f2xzafq31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159351, "uuid": "eeb8572a-fa46-4b8e-80a2-6961f632b7ed", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159351, "uuid": "d58419e8-914f-4951-b723-e60286841cd8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159351, "uuid": "30f0ab0e-4638-43ae-9978-1cfa369b2052", "value": "Order Confirmation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5227e04-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185140, "uuid": "ba38ba58-0037-4c4f-8496-64e982f54668", "comment": "Malware payload (Grandoreiro)", "value": "37573a7dd6482375bc0f3324975cfce7", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185140, "uuid": "598852f7-83e5-4d3f-b92e-180e2d5db74e", "comment": "Malware payload (Grandoreiro)", "value": "acfc7f3b97268f110c8865a7e88049acd63fbf6b899d25fee51fb11f96a2fc78", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185140, "uuid": "75a8ba61-ed60-47f4-903f-fa9b555a9131", "comment": "Malware payload (Grandoreiro)", "value": "80aef9f945aae9d64c1707686f6c2dd82a34fcde", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185140, "uuid": "66e6c391-dadf-4b4e-b248-89d7287e545f", "comment": "Malware payload (Grandoreiro)", "value": "70c0b1a9641990b67d89ba9424acca3521b66df5b1794778c9bbc348c0b2c2f7d5bcaa3274ae8adabb0e3eb9c4f02f3f", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185140, "uuid": "eb8bea24-1307-44c6-b6bf-856ec83e83fc", "value": "T1DBC5339C2BFC0060F98DAF30FFE557CFA4E50D698E90C9D79608F4988F62587A925D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185140, "uuid": "fd31be61-03d7-4dc1-beb5-3aaa8004493b", "value": "49152:gwgqGFtK4k+rJfbxrBoswfXcOG9JoFn2qG8aRZ1JqFRknNqoLA6gSN/u4H8v2/n:gRtK7+rJfbxgqg2qnIJk2VLbTN/uD+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185140, "uuid": "4b5c8b0f-960b-4c90-869f-1023faee0213", "value": 2595974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185140, "uuid": "d3f843c3-a490-462b-b1e4-69d170b31dbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185140, "uuid": "d6728e9f-b26e-4ac5-9600-ea3c3f4d14a1", "value": "673303513601JNSQ1269_CITA7016.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224ebc30-f9b8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175471, "uuid": "605aabe0-4e50-4f6f-971d-52dae637e449", "comment": "Malware payload (Mirai)", "value": "0027f128bfe9a6493ebe079f65040490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175471, "uuid": "b50ce94c-aa17-4a60-8222-83eb41c7b514", "comment": "Malware payload (Mirai)", "value": "ad13f6502225e7d33e78597a193ce30e7c7d4de585704a65f7b26eb31f83becf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175471, "uuid": "bc5e86af-4a6f-4728-9130-68a185bf0b28", "comment": "Malware payload (Mirai)", "value": "f9718178c5eb166d7335c72f938f39cb674cf303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175471, "uuid": "6028f402-8554-47f4-9005-8cdc80ba4b83", "comment": "Malware payload (Mirai)", "value": "b77645de401beeb06fa38022494153a1aac80523f38c3c0c1a59e7ad496a33e73e556ed29e8ed7dca5f75f3f700d9a4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175471, "uuid": "3709b84d-7c2f-45c4-947d-a729bebc51a5", "value": "T16CE31945F8419B63C6D722BBFB5E428D772617A8D3EE720399256F20378B85B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175471, "uuid": "914b5f05-5170-4c4e-b153-b55c6ac69a54", "value": "1536:KAp+7reoZVapJdk3bGFUpFQ2o+m4VWKkfTnUuauuvDOkEtJ9uYCtlJPwywW/atlL:KAp++9p3YbLFQB4BULUuaLiH76aYCow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175471, "uuid": "61f798ca-bc34-48ca-9b0b-ffe508a80706", "value": 150336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175471, "uuid": "6c173c7e-8b67-406e-93b7-91a06996660d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175471, "uuid": "118d5845-fa11-4828-b477-91be0a3556e2", "value": "drea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e66ae8-f96b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741142747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142747, "uuid": "a70d0907-9679-4a09-8985-04c626042165", "comment": "Malware payload (Formbook)", "value": "2c664fe09b80a39ad8ee155df91a64e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142747, "uuid": "7a912a20-c8b3-4fc1-aabd-7bbb0e7df797", "comment": "Malware payload (Formbook)", "value": "ad1874721d797538919f8c49fd9f397ffc82d949847e5ab14833dc70806f5012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142747, "uuid": "5202b8cd-6cf4-4d1b-81a7-8f9f45f616e6", "comment": "Malware payload (Formbook)", "value": "c2ec4e9960a35d1d87d727044fc11d7e9c6eae69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741142747, "uuid": "be81d454-63de-4db0-a277-04d3d0762286", "comment": "Malware payload (Formbook)", "value": "fcde679144a7a22cfe7b8afcb6e98ba817cc12b8205bc9bb10d827ae4c8832aba018dd889a8bff1aeaaeecfcba9153ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142747, "uuid": "eeab2886-b5b9-4ce4-992f-a0835601be55", "value": "T16745CF22B3DDC360CB669133BF69B7016EBF7C614A30B95B2F980D7DA950162122D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142747, "uuid": "027ea3c0-2f14-4c7e-a6fb-7e8585fba755", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142747, "uuid": "738d66e2-c39c-46a0-ab2f-440263666c02", "value": "24576:ou6J33O0c+JY5UZ+XC0kGso6FadA+ivUOXuSp1Jrj3WY:Cu0c++OCvkGs9FadAqSp1JmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741142747, "uuid": "24d379c3-beb0-4c0b-aed6-1b4b937da545", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741142747, "uuid": "b7c6d35b-878c-4594-a02a-b21a96dc66e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741142747, "uuid": "d7e2e0ab-ef01-412e-acc4-ff173593bf31", "value": "Revised Invoice Vt-1307701765400112977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e41774-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199685, "uuid": "d51cd7dc-205c-42a7-9715-bdf07e75fe0a", "comment": "Malware payload (Grandoreiro)", "value": "6b3be4b76140e4269357b32048533f18", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199685, "uuid": "c403ffdd-f136-48ca-9754-3052486885d4", "comment": "Malware payload (Grandoreiro)", "value": "ad9cd7d42507a285e465b37bdbec9bffb16b3f5e8a1146133568561a6bfb29b2", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199685, "uuid": "d7513ffb-9ad2-402b-861f-c0fd53d9c43a", "comment": "Malware payload (Grandoreiro)", "value": "7c30907017c0543e05cb10752d4ad6acfde2f225", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199685, "uuid": "cfbe5cf6-8ae8-400c-82d5-faa995ca3912", "comment": "Malware payload (Grandoreiro)", "value": "12865d0a145a80675976bf421ad8d6c90c82388d40f170014bf6f82999caee68e019a50d372c4c260ca30b8125307698", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199685, "uuid": "b1146538-b32c-463e-bf06-397edf585a34", "value": "T152D533965EE98B14F5DCCF31EED80B8DA0E556850961E923E260F4CCBB334837F12992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199685, "uuid": "3959c9b4-4713-456d-b579-37fd9bd1515d", "value": "49152:1UbsYfL758XDlYjU0EyfuXwd23IuFNpcwKV6BIkbjkc56Sl4gxv+miJ2/n:mPDGXmU0N2lXUVaI6jNPvXt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199685, "uuid": "3c34e98d-ce89-45ec-8d12-b39809f1ee90", "value": 2997877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199685, "uuid": "ffe0eeea-3821-499b-80c1-1ce7390c0e9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199685, "uuid": "977b361c-0aa7-4528-8007-fb04fbe57eb0", "value": "611000CITA_632478289902.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6981a9-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160028, "uuid": "11f3653a-bb76-49e1-96b8-0b63df86fd3b", "comment": "Malware payload", "value": "dddabf124a1a35b41ec88a83f0834607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160028, "uuid": "5ed522aa-4e34-4469-a0f1-34f630f46f2d", "comment": "Malware payload", "value": "af616a7f1d8c706e9e5ac3ecfd390675bd2b52bba36366741bfd50264dfd5824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160028, "uuid": "87becaa1-55be-4aaf-b9f7-591846a14a54", "comment": "Malware payload", "value": "a08cf8d7e41a3603f27de898c3d44312c228e1d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160028, "uuid": "d807ac29-d599-4fe1-b89a-7000d171fba4", "comment": "Malware payload", "value": "d19b1995814d87163b66221c420f6055f886e6f65eac3dbcd62c5edc5d1e6b6bfab133b9424873ce042808aef9d6f8fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160028, "uuid": "7909be95-0efa-4df6-923e-22cb87adea47", "value": "T12CD4BF09E7E809F8E0B7E538C9574902F77A7C4A13709A8F13A5566B1F27390DE3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160028, "uuid": "7e951dbd-ca0e-488a-843e-fa8b69161d1c", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160028, "uuid": "8022c61e-bd46-48de-9991-bf8efc54a5ce", "value": "12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4T7NxupWWABvJy:xuDXTIGaPhEYzUzA0/0/NYyv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160028, "uuid": "04440d5e-aa4c-4fda-aa7d-48a0e899761a", "value": 646259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160028, "uuid": "c67c45ea-6ee3-427d-9c79-fd96c23babd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160028, "uuid": "4b141bbb-54d3-42eb-98c5-1410d9a2c966", "value": "SecuriteInfo.com.Trojan.Win64.Agent.27498.31036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b664f8a-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741160212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160212, "uuid": "6c5bda06-f7b4-4ef7-8c58-2269005adb06", "comment": "Malware payload (Gafgyt)", "value": "dd644a8f06efd372aab6a502b76bb03f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160212, "uuid": "d963a41c-0e46-452c-8fc8-408b6acae0d0", "comment": "Malware payload (Gafgyt)", "value": "b01c52cf964f0dc79b47c14cbe995eb8134c1de404ad7205554ea72afc7f9f0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160212, "uuid": "ef6fca5d-2cc6-44e4-835c-4f7b3425d6b6", "comment": "Malware payload (Gafgyt)", "value": "e18efafac28cf6f424b616904f156a74a7b78c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160212, "uuid": "40eb3834-9a36-4517-bff5-887f193074ba", "comment": "Malware payload (Gafgyt)", "value": "e71bbe377246692ef1471e7bb10603a97996b909556a4ee4ddd4663ea2ef605e9de58ff63e7e44c3f95c86df964702ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160212, "uuid": "a86b89b4-7522-44b3-8142-78087a833ae3", "value": "T15DD3B71BBB618FB7D81EDE37069A4502108DE55A12E96F6FB2B4C52CE74B84F09E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160212, "uuid": "82bcb35b-ba11-4377-b43c-0e34f4bfa7d5", "value": "3072:9xCpFKISOag8jSjjjjjjjjjjjjjjkLjjjjjjzjjSjQnijsuN3xwRGNA4++xQ1IP:9xCyI7p8jSjjjjjjjjjjjjjjkLjjjjjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160212, "uuid": "45df36f4-191a-418c-9f95-05321b4ce345", "value": 136673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160212, "uuid": "9af5ad75-b127-4917-93ec-0f83da3447ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160212, "uuid": "82f66412-e785-4099-829b-c739a6735882", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0aa78c1-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741159470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159470, "uuid": "a689971f-7ef8-4aa9-a00f-33aa0b1c3a81", "comment": "Malware payload (Formbook)", "value": "7c542c65ca989acfdfe08ec8453a93df", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159470, "uuid": "89322099-fe20-48fd-8cf6-5c8e275f2dc9", "comment": "Malware payload (Formbook)", "value": "b088a760c4b76e98eba73a14c003804908e59549c035aead600bd617cf6e05fb", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159470, "uuid": "20c94169-4821-449f-9784-4087ce946832", "comment": "Malware payload (Formbook)", "value": "87a6e601c344c3d48bc4db61f4a09b10c6a231da", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159470, "uuid": "c476431f-d3ab-4d57-b6d5-c0bd19522a02", "comment": "Malware payload (Formbook)", "value": "adca028f5143e62db7248d8bf22a878564d4cb5fe4f94a11613e242c5bea18ee805704433d0960b0e8e18f9c70020bec", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159470, "uuid": "11a1c0d4-3ebd-4fca-aa93-e22ccbc5e697", "value": "T19BB4227B69CABE3CD92CE6FB51937439BDA51D928139B285C58BA7CC9C0518D1A000FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159470, "uuid": "128bd425-91a5-4980-aeaa-b93cdfa15209", "value": "12288:pc/WIeXWVRDBWW1TQP8DYmlS+04gliB7Av4/Dhnyl:p7IeGVRDBWWOqxlP0biB7s4/lne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159470, "uuid": "631990a6-e0f6-43e7-b60f-6016b5b51298", "value": 496001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159470, "uuid": "146dbaba-d939-4cc5-a8b5-627abc8ae761", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159470, "uuid": "592dc917-af63-4967-8d7d-a422a575c491", "value": "SO_Ref06233March.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd031ce-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741176672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176672, "uuid": "af4a5a8c-1cea-4d70-bfc2-16aeb9a8c005", "comment": "Malware payload (Mirai)", "value": "23abf35e279e0ad82d5e2a8e69f517b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176672, "uuid": "e21b256a-0b9e-4847-a6d8-92baa2fa7b76", "comment": "Malware payload (Mirai)", "value": "b1c84c538e3bb503b83e56ec36df6b1655121a7c02a9d423f3c5e3c34b457cd8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176672, "uuid": "6e6ed287-5af2-4cfb-b546-a55050d82d26", "comment": "Malware payload (Mirai)", "value": "235e1196d615e150252a271969ab8f930cf0e17f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176672, "uuid": "0527785d-efc4-44f8-9766-0b797106295b", "comment": "Malware payload (Mirai)", "value": "a54bcc23b0138c84547ad72f9481ec8afcc4831b847483ccfc6284a28a6dd1fcc532730a50ffe7230eb27ab33e6b041f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176672, "uuid": "837ad876-faa5-480b-8f68-f22aad91cba8", "value": "T1B4013C8E53A1F210846CED1A30638485A125D3CDA99D5F84FECC59B2CAC4AC0BC78F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176672, "uuid": "0cb6d67a-50b3-4c60-9ea6-70b7db26b78b", "value": "12:+fHaxftA7Of9fWAbNfWA3gWYfk+fjTfe8X5wMfWylfZDuGfnDS0sMfr9ftAPl:qGtfFWAbVWA3wpnDC4WQZZn20FByt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176672, "uuid": "879539c8-d9d0-4531-a55d-23085b7d6592", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176672, "uuid": "0fd4abc6-cef4-406c-aa92-545b8128f02c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176672, "uuid": "62612bf2-e488-4549-a709-2d07390ebdae", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed2d562-f98f-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741158098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158098, "uuid": "c4d24c63-0501-48e6-b1fa-d855ac9b0856", "comment": "Malware payload (Mirai)", "value": "23e440b3cfdd9bc91d552713420393a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158098, "uuid": "2bec91e2-8411-42ef-afc7-ee17e3922b12", "comment": "Malware payload (Mirai)", "value": "b326c94c63a394d3b8a0facef9f1b393e9a7c6c64dc34de5b6578bc19571efbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158098, "uuid": "21f24516-a189-407e-a0ec-deb8597d5e70", "comment": "Malware payload (Mirai)", "value": "1cfce71de81adb6d8483c86a48f4c596491ba85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158098, "uuid": "43bd498c-8444-494a-9992-fa6ed648928a", "comment": "Malware payload (Mirai)", "value": "e5bcc2a9bdb8727a1fe2a752b9c82349153cf90f542fbe4cb0145cc7934f00cd3214e0082bb8db5093f692bc1e96ae0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158098, "uuid": "3214360a-8530-494b-8eab-a9fccb39dd64", "value": "T1B5432BC5B941A626CBC1567BFF0F02493719879CE2EA3303D92D5FA037CB9570E2A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158098, "uuid": "726cb0fe-8c69-4e66-8e64-238a3683a744", "value": "1536:DhnNtwCsWYS8PoJk03EA5RYrP4f4uvGfr:pN4JoC03EA8AvMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158098, "uuid": "cf8f6f85-2c26-4680-9681-8fc17baaac49", "value": 58868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158098, "uuid": "b16f8263-09fd-47c9-b784-a9b28b366fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158098, "uuid": "f7571680-3c6d-4bdd-b0fd-f8732930546f", "value": "cbr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073b4501-f9da-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741190029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741190029, "uuid": "ea83b065-7303-48df-81f5-2ed8bd673d8d", "comment": "Malware payload (Formbook)", "value": "c19b2fa154838e69f4faccd371bc3813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741190029, "uuid": "05bbd0bf-8f19-4616-9761-aaed0f675827", "comment": "Malware payload (Formbook)", "value": "b38a33a07c42110696e629bedbee4f28becb0fae5f77cd9e76818d8ead490c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741190029, "uuid": "e211a3b3-cb1e-4642-b6eb-2465b3988d4a", "comment": "Malware payload (Formbook)", "value": "0b60dcca8a1fb887e4bf2342a08a1380a088ef61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741190029, "uuid": "19d2d206-8867-4820-92cf-861e92ca2c4d", "comment": "Malware payload (Formbook)", "value": "ed38f8d5a09887bd9f774aa7b137af29e0cb1355223c5030fc31a62994133ebe3c00c0ecd716c60e85b0d6b803e90334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741190029, "uuid": "03a5c9ef-2bc9-4f4b-b0e5-7871664c7b68", "value": "T155F4126C6606E423CAC447355E30F27465BD0EEDB911E2538FEDBEEBFE92A150C58182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741190029, "uuid": "e4017e20-9309-4a06-b156-60c3b0dde5db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741190029, "uuid": "1adb9350-0f34-4ba2-bc29-fedf5be56ea9", "value": "12288:1/frpm+gvyH58b1TtxDm7DB64oAufcpFDfVC/VMa4fo/HYS1At8zTLo6J:u2yttxy7DB64akPtC7FYbtyTLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741190029, "uuid": "31cf8805-3558-4389-8169-9830506e86bb", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741190029, "uuid": "4c4ab2a3-2783-4765-ae14-0b9a5041ad94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741190029, "uuid": "384961ec-be4f-4de3-89ed-b4235fbd91cd", "value": "MALTO ELAN-Dry Docking List Specification 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c57c45-f99e-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741164449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164449, "uuid": "fb2667d6-c602-4d79-9445-a1666b37214f", "comment": "Malware payload", "value": "e480086d1e464aa3a82193ad361a3153", "object_relation": "md5", "Tag": [ { "name": "vb", "colour": "#31E39F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164449, "uuid": "94c28e4e-16d3-4327-80ed-959125447c78", "comment": "Malware payload", "value": "b42cb1bc78f3359d82346fdefc2e2d4a38de12604d88feb6df3fb36d40fe6e03", "object_relation": "sha256", "Tag": [ { "name": "vb", "colour": "#31E39F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164449, "uuid": "e7dc9b8f-a5cc-4ec6-8532-fa510858d0f7", "comment": "Malware payload", "value": "6358747cc21418f5a51aa82ec5e77dea0e460781", "object_relation": "sha1", "Tag": [ { "name": "vb", "colour": "#31E39F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741164449, "uuid": "fc4761e1-b882-487f-babe-70ce6cdf4a7a", "comment": "Malware payload", "value": "3b8aebd25e40d746d63ff7b6b97c13462f0e93e15d6c2268ba40977d66f13fb45c599603e87e6d2a4071a4e589b44a2e", "object_relation": "sha3-384", "Tag": [ { "name": "vb", "colour": "#31E39F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164449, "uuid": "9e7bb7d5-aa7e-4252-8be0-83f7c042ce2d", "value": "T142F34CBADB731395DCE071C1DD0E902FA28D131B85E7AE06B008C6C6279672BB459DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164449, "uuid": "8eaec87a-11df-49f8-b88c-441827989f00", "value": "1536:IGWn7pyDvX5fEvMw0RTIpHNXw2Ep6q6CLH:4qvXyUxIpHNXw2Ep6q6CLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741164449, "uuid": "71d4a261-5714-4e61-9560-9ff26ca2a198", "value": 163389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741164449, "uuid": "e225cd1b-31f1-411c-9ae7-c23f62fb9529", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741164449, "uuid": "648c65e1-9934-4b38-a1be-b36f28e7a2dc", "value": "0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990c3e63-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159350, "uuid": "29914249-0eb7-4e2f-abff-aecb49afeebc", "comment": "Malware payload", "value": "825940706a9d2ebc7d9d44e09ef7d41e", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159350, "uuid": "631458c1-8479-4b99-b3a8-1429c150ef17", "comment": "Malware payload", "value": "b52b3e8a01be74679312c9c4916dab5da49890d9efec9a02f21d32db2b8a2e2b", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159350, "uuid": "c285171b-f3e8-474c-9008-0fed9f020237", "comment": "Malware payload", "value": "957ebfc7dccef51066d27af0266bf272f8319e6b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159350, "uuid": "b4cdc9f4-007d-49a7-bdea-015922616578", "comment": "Malware payload", "value": "244c89b981a7e1a9d28f07093a4901fb7e88723cb48101c603a173165cd0243b700171f82ace22b527dac076a9358d81", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159350, "uuid": "7c3b01f1-d801-4bb1-b913-5f7643dc3a22", "value": "T18B4523EA9C94BF02DB09417A87CED1DE484BFE8E365990073171B31E2533BAE847685D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159350, "uuid": "76d5589f-730f-4b10-86fe-59bb6c3119a1", "value": "24576:2JJIwgJeFJJMso3FxESfr+X0JJnIFN5PZbybyZeqF9t:2JzgJWJuso1xPIDrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159350, "uuid": "e12e2424-106f-4e3c-b7b8-eb82efcddefb", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159350, "uuid": "6a0d5a32-b556-4406-a4fc-25d49480a3d5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159350, "uuid": "092d19fc-3a8a-4568-aca0-0719746ac64c", "value": "SWIFT COPY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336848ab-fa10-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741213296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213296, "uuid": "e526056d-0ae7-4bef-9b99-410f5a9858f5", "comment": "Malware payload (Mirai)", "value": "116c0374d50b2134740a3938d96bd0f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213296, "uuid": "bb85d2d7-7803-4980-a022-a220927eb252", "comment": "Malware payload (Mirai)", "value": "b5b1a58ceaefb7f23f7c9968cbc7259846cb6fbb4bc937425e10c44504698d58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213296, "uuid": "008e0950-9cf1-4882-8308-e7324b138e72", "comment": "Malware payload (Mirai)", "value": "801da65b3794dd5bac93f9f6b1d10e2ba023443e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213296, "uuid": "82cfccdc-655f-4d42-9406-d045b7fe8e5a", "comment": "Malware payload (Mirai)", "value": "5cfd31b0cdbdc11e60c00bd42a9204a6a03205eb99ee1687e46c8a5c596539528986bd2613b0c21a8caa786a06e4491d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213296, "uuid": "67d72f36-7c1e-4058-98a8-9cf5307a7d70", "value": "T142F3F946F8819B12D5D112BAFE1E128E73131B78E3DE72129D246F247B8A87F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213296, "uuid": "d3fae2fc-07b0-45c7-9849-ef2b6ba5deec", "value": "3072:BHKTzPn1su+X1swpraIEZIIMmQjzOsqBGeqJh:BHKTz16XywhaplxQjzMBGeqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213296, "uuid": "d73bf204-7d67-40ec-87f0-5f62c3813ab8", "value": 161884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213296, "uuid": "b3f1d980-367a-41f5-b696-fd54c65ca36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213296, "uuid": "16463ba5-5030-41e3-926f-2601dbeadefc", "value": "efea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27701177-f9f2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741200391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200391, "uuid": "1843f023-26b5-4ec4-9cf4-ad7496f554d7", "comment": "Malware payload (Mirai)", "value": "8fb2fa7f63d1f2824ca968503d5469fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200391, "uuid": "9b1e412c-df16-42a7-ad34-22a12f591088", "comment": "Malware payload (Mirai)", "value": "b5f4bd653d231e93d21cb176cbfba2de1d4dbc7d7a88390cbbf00602e4df7d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200391, "uuid": "a1614aa2-5b2b-4859-8de8-dc9559fd9c9b", "comment": "Malware payload (Mirai)", "value": "6aae7569dbc8be653b549ccc4abe8b5f70118443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200391, "uuid": "66bfa2a3-ea36-469f-9a8a-dfb928f022a7", "comment": "Malware payload (Mirai)", "value": "795479b6a9cacaf908f987cd26db7e4726717348329bb53ac76cc0049f18854180a681ad210c0da2f757cfdbc176539e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200391, "uuid": "fef1bf51-7d73-4c64-b20b-209d684d9623", "value": "T181E3831E6E328F2DF7A8873447B78E25975C33D626D1D685E1ACD2011E2029E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200391, "uuid": "d42e9aa6-4d87-4b26-89b0-a3a968f75078", "value": "1536:2B9P7Dxo0N66wSdjcq/B5IxFrLdIqGcuEvdeFx7JFEVPGF92s5viRSQ8dJCa+/FM:SaEvIzLKAwEVPGFXMSQ8dEa+/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741200391, "uuid": "a4986b38-7967-45c4-8907-ba8170b5f271", "value": 144535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741200391, "uuid": "b2f81002-d6da-4e53-bc41-bd69c1cd097e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200391, "uuid": "4f28c27b-3788-4961-a932-25e056501683", "value": "Aqua.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fba731-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1741159485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159485, "uuid": "1f4638cb-df6d-47ce-8f7c-938276a0adb0", "comment": "Malware payload (VIPKeylogger)", "value": "b294137f9559180e8dd17ecf2adb0310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159485, "uuid": "3aa2c2f8-03cd-4439-bbb2-9df1d6bccdc0", "comment": "Malware payload (VIPKeylogger)", "value": "b679d845342b0551a231232c04eda781212b888bc3d1ce50a694e480861f81fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159485, "uuid": "1610b9d7-993b-48d7-9264-58500fd9de0b", "comment": "Malware payload (VIPKeylogger)", "value": "98de846a4efbdef91f9bb9e5ab4a27bd6565c3fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159485, "uuid": "84212dfb-062f-4159-aaae-d7fea1e6812f", "comment": "Malware payload (VIPKeylogger)", "value": "a227c529739d89f862e68b7b36218e3633afd7492d918140c01de67fcfd615ec981d8b045ecfa00827d1c3d205ee7e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159485, "uuid": "a5528166-44bc-4acf-ba98-1a9644cf9ad0", "value": "T15BF412A86206D01BDAD653794A32F2B8267D1EECF90143638FDCACDBFD7AB141D54182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159485, "uuid": "5db767f3-e410-47df-8763-933b339ddea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159485, "uuid": "ae46ddc9-9f71-47bf-aa5c-a91a22177ebc", "value": "12288:7/fSpm+gvyJmTHkA6vugmwOBEXBlSPKF7xmT2G1SirAZYB15jckqsAsB1MnOlp:5+mLkANrBEXbSSy2G1ZWYmbs3MnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159485, "uuid": "fcf30756-0659-4143-9090-168825421935", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159485, "uuid": "8b350979-4e12-4135-ad0a-1c270c706691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159485, "uuid": "57d27707-58d7-4c2c-b3c9-12455c4ad32c", "value": "MARCH SHIPMENT PLAN DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7c3082-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160105, "uuid": "41fa05e3-4cf3-4a8a-a9af-d48fb881d147", "comment": "Malware payload", "value": "20e0bf05257b6b27b111dd98e5950918", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160105, "uuid": "79d52808-b1cd-4e0d-bcb4-22682219bce9", "comment": "Malware payload", "value": "b6b332a73a53a8e36e1d4f7274621011dc4a8bafcec7dfa9134e3138c62ef832", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160105, "uuid": "3024fc8a-e7c2-4f81-abb1-215d5d7f6622", "comment": "Malware payload", "value": "76d74b76cf80af66a094435002c9713b6d7de83a", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160105, "uuid": "901275df-1c34-4d36-9432-6ffd84c451c8", "comment": "Malware payload", "value": "6613b94308f58ab1b19a14ac71b6cb3230dd0fb3adb0c845631edf17544fd20fc6c4a72554f0b3493292cf6fb6b00fef", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160105, "uuid": "3ca50bf8-f566-442d-84a7-335f928253ac", "value": "T10BB1315D3D41027098B34B61DC47802CF521AE6F5372AECA79CC95C04F31BA9B2E798B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160105, "uuid": "06aabec7-0bd2-4462-b283-36616b57c9f7", "value": "96:IVVEWxiP/wiMrGlQbJI56rVCwW/iHNiMvD8EO1QQ5xMTnJPfkSnOE:Kpxin8r8Q6+VCT/itTG1Q1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160105, "uuid": "a40644d0-ad20-4797-a7cc-2f05e9d4bb7d", "value": 5393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160105, "uuid": "40ba6722-3d0c-43b1-9c32-875ef0ceaa47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160105, "uuid": "357c6882-df07-4204-9782-af27b19f1603", "value": "b6b332a73a53a8e36e1d4f7274621011dc4a8bafcec7dfa9134e3138c62ef832.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e4ae06-fa16-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741216018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216018, "uuid": "5ea13e62-6a6e-46ed-ab56-b9b9736c5b31", "comment": "Malware payload", "value": "d95b90e260178d1ff7eb3431bb2e3816", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216018, "uuid": "ddac9628-7fd6-4b9e-96d4-ec453175985c", "comment": "Malware payload", "value": "b6eb6ae6b60aea91f7113e75d38a2e7edd258fa47780a181321847bfb0c6696a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216018, "uuid": "e8430521-708d-48c1-9673-8bcaed58d037", "comment": "Malware payload", "value": "785d1e84c14fe1929154a69accd277ee684999c8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216018, "uuid": "2ba772e6-5ac2-4cf0-acf8-20273defc2b2", "comment": "Malware payload", "value": "fa2e210ae13db4cbe46d010681424c94bd2a7fa1cf74894ed7551d6b4e87d5be4a29c76c53354318c922d8993332f758", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741216018, "uuid": "36669b59-ebad-4660-89f8-fc04ccd8d323", "value": "T16A9502C13784C127E95709354EABD799971DFCA0AE30B08B7760BB5E5B3AAC39E25301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741216018, "uuid": "4a78cc63-dfee-4a00-993c-e02da1a6cfb4", "value": "12288:ytVRQ+gjpjegDro8p1IbGRy6ZDEcf++lvnKS5xBx4T8AQCD+liK8PSW7D7+B4cKU:yt9cpVDhprDnf+4nKg2T816xSWn7+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741216018, "uuid": "84bf4f13-976a-4962-8250-b735fddb0c34", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741216018, "uuid": "4f828894-3623-4ec1-b317-213d3a921c13", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741216018, "uuid": "50ae1829-25b7-42bd-b7d4-94950c448de3", "value": "setup5168.msi_2detect", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb043a44-f995-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741160722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160722, "uuid": "d6524d28-e55c-481f-9c6d-d58ed1210e13", "comment": "Malware payload", "value": "af60ca40c86d79fab4e8ad74e813f4f1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160722, "uuid": "fedbfb07-5d85-4646-90f8-53affd5163a4", "comment": "Malware payload", "value": "b7225812cb0610b1a852abc689a5a16e38cc521e84370e914d84ac243aab6b5d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160722, "uuid": "570938fd-b64f-41c8-9bfa-0ecc95b01458", "comment": "Malware payload", "value": "c4c309c74a7431faf19cd926541923a9dbe9a74a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160722, "uuid": "69321ef5-6a3d-4fc1-8ee3-6c2af36c61a8", "comment": "Malware payload", "value": "e525ab40af835085637b625bb0fbe66b5c2ab649bc94e1bfedbd6a9d8294976df7ef6e2b2927907c1381193f647eb4be", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160722, "uuid": "b94e34d4-5895-4eca-97cb-0ec6f69aae1e", "value": "T1896465F96036ED8AC7370E80E1043F179C299EDF667847F8B68815D1C29C68C99E75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160722, "uuid": "a1149f40-f684-4c77-8fbf-9be2411be97e", "value": "3072:YrneJDE0wooaZtMTeFZoVZch4s14ZaJsbZoU+p62fwjvDENeCX9rkI+n7ykRVE2v:79LFZPaGBrkf/b4/LJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160722, "uuid": "dfa580cb-2d41-4961-a14d-7541a6324365", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160722, "uuid": "c233a099-1d26-4b71-849e-3f45060844f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160722, "uuid": "8dd306f4-abd0-40b9-8e88-30a4a676c85b", "value": "base64444444444444444444444444444.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788bc9bd-f966-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741140397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140397, "uuid": "3df0801d-c23d-4b03-a2fb-b37985772e9a", "comment": "Malware payload (Mirai)", "value": "e1898bf8813157225dc4eb29762d8910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140397, "uuid": "533f603c-5961-43e5-9035-4dbdc3c22102", "comment": "Malware payload (Mirai)", "value": "b7342c33ae3b27e641a2c5ad2550769cfcd55147fb1808572c8102a5af84ed3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140397, "uuid": "07581c64-e70f-42c4-ad78-7a3e75607046", "comment": "Malware payload (Mirai)", "value": "161dac5d95b5de94f17101ec1e08c205fb5b09db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140397, "uuid": "bb162cd3-b9d6-413e-b03a-742a6d9e10a0", "comment": "Malware payload (Mirai)", "value": "33c557dd9f5fb493bec98461305a1594027d458b6acf2d073c48f41337dc7e39c1d6faa259104639f0429b61ab79d286", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140397, "uuid": "0e510666-684f-4f2c-94ea-8fa2f46dff81", "value": "T189043B46EA404B23C0D7177AFAAF41493322D794D3D7730699286FB43FC669E0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140397, "uuid": "4cbc95eb-d94b-44b7-994f-c78f0e847b1e", "value": "3072:nGFYH2qJsdKLr/JVhLXphfGiaUfsKB3rYmWVaEWKR85+LYRM/9jvgE:nGGH2qedKfJXrOiaUfsKBcmANK5+LWMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741140397, "uuid": "727788c7-8ce5-4ad5-ab05-a77109f26900", "value": 173688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741140397, "uuid": "4c79f602-5ae7-4642-a402-90b315e45491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140397, "uuid": "08986e25-a2f3-4f8d-aabe-d7ae89e8f70d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b08455-f9f1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741200091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200091, "uuid": "95ed4c87-1363-4ec3-a11c-0291ad276554", "comment": "Malware payload (Mirai)", "value": "57a8f56d802c246dd0e2896fe34d386d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200091, "uuid": "d6c6e679-0e56-4ac2-b510-25b17ffa1f9a", "comment": "Malware payload (Mirai)", "value": "bb15c3a5fb378f86f49ae12e0682811b60d6614d93a4a2548fd81bfde128bda3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200091, "uuid": "e3a73a79-9102-4b60-b02d-79772763b04c", "comment": "Malware payload (Mirai)", "value": "32be61bfe7a665dec8555ed7be1c0fb0ff3bd474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741200091, "uuid": "4faa3441-93e6-4672-a10a-d56fc2877a0c", "comment": "Malware payload (Mirai)", "value": "4d1d3fa0df7d9e55af1b2ac43429714b885f5b7d7573ebd2938fb77d76d9d93b34ab6067ca8163552cf04cc2c176a93f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200091, "uuid": "0bf7ef10-ddbf-421b-9ae4-5539dbe77448", "value": "T12B636C41731C0D07C0E31AB0293F57E19BBAEAD121E4FA86256F9B469676D331886FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200091, "uuid": "b4e5e58e-c52e-44ed-b183-973fc959efa2", "value": "1536:gxicjLr7svLijnP9XxihlgR4gCNgt3tGIV/0+bR7410yB:gVXYzsnVXxi/gR4gc0GI2+F4vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741200091, "uuid": "ffd9bd7f-2168-4d4c-823e-8acaf257132e", "value": 72368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741200091, "uuid": "94f98481-a7dc-4e79-b162-40cb6d50fde0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741200091, "uuid": "20a5001e-0045-42fc-ac50-5616da85b275", "value": "donk.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2267771c-f9d1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1741186209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186209, "uuid": "703038ec-aeae-4d71-bb7d-5253c05967c7", "comment": "Malware payload (Gh0stRAT)", "value": "5e557c646ae2e0fbd7aa05b4d4004670", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186209, "uuid": "dd3e5748-b119-495c-bdea-e022de305db8", "comment": "Malware payload (Gh0stRAT)", "value": "bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186209, "uuid": "7a16aa78-4b3b-499e-a154-54f3f137d341", "comment": "Malware payload (Gh0stRAT)", "value": "8e2e03baad6a099ee044a78cf0ee0cbe644581ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741186209, "uuid": "27312bd9-7ffd-491c-9a5f-bdae39a87c72", "comment": "Malware payload (Gh0stRAT)", "value": "42f823d16a96202cebf521488e703b1390a10ef97f0d140c448323120cfb90e7b8fe0967a219287af26efd43a507da70", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186209, "uuid": "ca52adf0-9044-43c0-8778-05a8359a3c42", "value": "T1B5047D01F7C901E9E176913C99FA6B36DA3374140B288BCB6754CA991A23AD5FF36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186209, "uuid": "480d2706-5d27-42b4-ac57-89ec2d5ad4da", "value": "b6fe1394ce89e6c21fe5af76775c6e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186209, "uuid": "726850ba-f1f2-42d8-ad4e-12ef2b07803e", "value": "3072:+/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:+LPnc2qrJ51ZkMaJhQCNBU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741186209, "uuid": "34aa51f0-534a-4921-98fb-ed4b71662a1d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741186209, "uuid": "a3c86194-66d8-479c-8c6b-c1aaf7ce5ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741186209, "uuid": "a94530f4-4857-4c8f-86bd-89793f9e4133", "value": "bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff1432a-f9ef-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741199197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199197, "uuid": "632619c2-8d50-46a4-b0ac-f3f83587b1d4", "comment": "Malware payload (Mirai)", "value": "9c0292dbee976831fe26bf4c14777f24", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199197, "uuid": "6aaaef03-7b23-4800-b8d9-1b3408621001", "comment": "Malware payload (Mirai)", "value": "bbeb0de7e030d3f5b5216d7d551e60c62d6e8d7e480ddc32ebb2fd7d53984f73", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199197, "uuid": "f1699973-ab5b-4695-b942-3e27ba2ba13f", "comment": "Malware payload (Mirai)", "value": "9fcb94d9e8f52718940a62d6837bc569cb6c2327", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199197, "uuid": "6f02e267-403c-45dc-aec6-c2c7a957b872", "comment": "Malware payload (Mirai)", "value": "56d7fa6147dc14618cb18c15a950b877a3d9df7c1d9cd4fe87a01856ef1693c1a3f1ef3d8fdfe7b15f0031b2a03538c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199197, "uuid": "80c4f5b6-b775-4d32-a2b2-285f0b04b057", "value": "T13311A1EEC22912360164DD45F05AB610E13BEFB930B8CA39F643B932568C6A07839F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199197, "uuid": "889475b0-16f0-4d31-8249-3449689e534f", "value": "24:KkIzlFIAFmNIqIfSKjI24+F3JwKo73HvGFzNQ:KkolF1GiSsr4+F5wKo73izW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199197, "uuid": "c10a48a5-28d4-4779-880b-21fb2ef07d5f", "value": 895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199197, "uuid": "d418dc29-b038-44c2-b121-4ab3e18f2b8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199197, "uuid": "8371121f-9a1d-4136-9781-f554b6b33d3c", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebc915a-f9cb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741183599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183599, "uuid": "f804b589-b927-42fd-b5da-9a513519a4a4", "comment": "Malware payload (Formbook)", "value": "1001e5987c8f0e021d985d58dbd34b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183599, "uuid": "5a54f619-19f4-4481-94da-85914dcc2155", "comment": "Malware payload (Formbook)", "value": "bd211d6a43f210cdd04cef6132c53362a79d7859570266a37655aafc574415c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183599, "uuid": "262d8f28-190b-4bab-9980-377cf8be5535", "comment": "Malware payload (Formbook)", "value": "c04d5b1b5ed2a74e797965cf70fec560f2a4881b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183599, "uuid": "ff95c1b2-2761-4250-919b-ff71b6cbb9d7", "comment": "Malware payload (Formbook)", "value": "fba28f74507fa0a8c6e0140ec5a1ed0e82d547c4dfdfa060eade13d30967db698e41cd142d8fe9dae03f3cdbad543bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183599, "uuid": "49dd2d96-191b-4bfa-82d1-26aae829da44", "value": "T10A35BE2273DDC360CB669173BF6AB7016EBF3C610630B95B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183599, "uuid": "f44a6895-3881-42c6-b68f-8247c27a596c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183599, "uuid": "560523fa-d6b6-4d9e-ac75-9a5f6bb9f3f0", "value": "24576:vu6J33O0c+JY5UZ+XC0kGso6FarFZUpEdWOBYHWY:Zu0c++OCvkGs9FarMStBvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183599, "uuid": "71a3a9b4-46b9-4b7b-bcc9-f9f5302ccdd4", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183599, "uuid": "1a889362-3d27-45f8-bc73-8b65b4d312fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183599, "uuid": "d3a2a1b3-7e77-4d80-aa96-b2ce83cac8dd", "value": "New order supply.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2c113c-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741159546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159546, "uuid": "cacac8bb-4220-40a1-8cd4-c80afa4fa006", "comment": "Malware payload (XWorm)", "value": "78796a8755ee5cc1c74279bbba9dadd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159546, "uuid": "8aaea91e-022d-4e44-92a0-d036c78daf33", "comment": "Malware payload (XWorm)", "value": "bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159546, "uuid": "09992c13-12fa-4cbd-a396-7eba4cccbbc2", "comment": "Malware payload (XWorm)", "value": "21dd52e48d9e8b0cd2ee2702e2c1353f61ae32f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159546, "uuid": "37e79614-4200-4850-b363-6d6c81032ba7", "comment": "Malware payload (XWorm)", "value": "0a7e7b1179c2688c6f9b59aa52aa023b5c61ca95706d0a15e86c7ac2a1d310bf086dd026198dc4c572456057011a392d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159546, "uuid": "e3978de3-d7a1-4258-9572-a2802e52c76d", "value": "T183159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159546, "uuid": "7e62dcbb-e385-4333-a6fe-77b999819b17", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159546, "uuid": "94d2bfcd-46c3-497a-b8f1-41cd3687355b", "value": "24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8a0qu:cTvC/MTQYxsWR7a0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159546, "uuid": "c9855931-852e-434b-a61e-a6f7958574a1", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159546, "uuid": "e71234fb-f563-4f13-8791-5ef2b3428c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159546, "uuid": "5f8c9e13-420f-4f21-a566-e012cc129a5c", "value": "78796a8755ee5cc1c74279bbba9dadd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d7bbf7-f9a2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166370, "uuid": "b01ad4cd-93d3-4f01-b475-f5fce431a9bb", "comment": "Malware payload", "value": "2925cf059076ba4bbe951817f563dd63", "object_relation": "md5", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166370, "uuid": "da27c14c-32fe-4ef3-9112-89cf6ee1f05f", "comment": "Malware payload", "value": "be1c6edf87f2476fd21d082b2a22f4b84b2d4544313e8d04b1c0d823fc5d52a5", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166370, "uuid": "91e0bd10-8597-4cce-9f76-73cff6003276", "comment": "Malware payload", "value": "f5844d1079dc807d1b6b2871ce44c7c1a18df7a0", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166370, "uuid": "0df22080-bed9-4191-966d-230423bd74e0", "comment": "Malware payload", "value": "0bac25c4d372156a183691f3811a4ee23cfa134b035c8dc84f4c331fa7b30bd9becb1638e88789dcbdd8c366a08c1cc1", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-200", "colour": "#8385CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166370, "uuid": "12f7ebd0-9b90-4b3f-bd61-74efa3b82902", "value": "T1AA85F107B98B89F2E2556B77C69B080043E4D581739FDB1E3D8E23AA49C37BADD0514B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166370, "uuid": "6c9fc251-48b2-44bc-9c3f-558ff7b74f1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166370, "uuid": "bf3cdcd5-fe7e-4d92-bb7e-1337bc2a7a18", "value": "24576:C6443qDIVgtGJBYekupUdmXcqoXtxrLdWQ8VAsiGsHWKmtOaB8ums0GFbrRqO+:hfBBI4UMXcqwnRvUOaa1sNFbN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166370, "uuid": "34ec7267-9421-4c60-81a0-cad6f215db26", "value": 1745408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166370, "uuid": "686a8022-6bbf-4284-acd7-eeaf3ec79c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166370, "uuid": "389eb2d9-b94b-41ab-aed7-ad6a36464045", "value": "f_000258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bbf8a5-fa10-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741213598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213598, "uuid": "825c12c7-a496-4132-afbd-efa72de88943", "comment": "Malware payload (Mirai)", "value": "227bdbc8178019950037e3e09cf0a6a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213598, "uuid": "00f32a39-2191-437b-8875-7de3730f5a3d", "comment": "Malware payload (Mirai)", "value": "bfbad5219465e0c915ad7113aeee5623aa088fb71c0cdf10cc1b3ff142e6c290", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213598, "uuid": "ac220fd1-bad0-43aa-af98-60636e0e45fd", "comment": "Malware payload (Mirai)", "value": "651ef595fab3822b0ef705dd7e6c9c962b4707a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741213598, "uuid": "197e3861-25cd-42b5-aa49-bb531b2926ae", "comment": "Malware payload (Mirai)", "value": "758ceeb06691271ee3714337af6333b7d405fb978514a17f04a78800ea96dcc88358d90aafac377443f111102aa5b5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213598, "uuid": "a19449e5-461e-4392-9fec-4c5bc3dc1a28", "value": "T195F34B0BB4C188FDC5DAC1744BAEB93AD971F11D1138B26B27D4EA222E4DE315F2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213598, "uuid": "60b5dba8-9bfa-4d7e-8949-1253652c4713", "value": "3072:zG0KSkBr3wg5KG5jDQz84jWxn/KJpWUER2pjoDilN+ZMG9o:zG0KSCr3wg5Kl9+wEMpoOG9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741213598, "uuid": "ba1e3259-2647-4100-aeb2-bc346fe9a267", "value": 160136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741213598, "uuid": "efc90000-0ff9-499e-8e39-064c4ec7ea97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741213598, "uuid": "8bf92601-bb4a-4712-b785-551c868b3ab7", "value": "weje64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e275ab-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159906, "uuid": "e84e8666-a57f-49bf-af97-492d6e041f20", "comment": "Malware payload (Mirai)", "value": "d25e7e49667b2f07a6cc42514b0d0540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159906, "uuid": "7386f1d6-d1fe-4e4b-b32e-db56a449f388", "comment": "Malware payload (Mirai)", "value": "bfd67a7409994fb43178144afe356a49217a5248428434a92d94826e8dcf1ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159906, "uuid": "4609cb80-921e-419c-9419-dd89e747d5fb", "comment": "Malware payload (Mirai)", "value": "4c18c94270981cd494a1b66d77709c921f441577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159906, "uuid": "952d163b-0ca5-4875-8a5f-c7ad3590ab72", "comment": "Malware payload (Mirai)", "value": "5b391d791b46c78daffc100fa78505a9f2a797da718ad4dcdd07f37cdc388e8da24bad6abc115210533c5b45439e0b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159906, "uuid": "91746a87-70dd-447a-a2a8-009538e4a2b6", "value": "T14EE32AC7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159906, "uuid": "dedc4797-fa79-45f2-883c-6db3d5fecfc2", "value": "3072:KmuTDH86JA78VCdV5jAti2id2ow9+aVvjbitLLxGyMYEKr:K7TDH86JifjAtiHde9+3L4yMPKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159906, "uuid": "5c0d54d1-4870-4251-9b10-cf07634d513d", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159906, "uuid": "85543635-5877-4c60-af4f-b4d09a8127f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159906, "uuid": "b209a327-eb2c-40ce-92bb-a8abb0ebabc7", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451e8d0c-f98e-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741157491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157491, "uuid": "49bcdc3f-0826-48d0-8f9c-35e294ef626a", "comment": "Malware payload (Prometei)", "value": "9dc90f1570875d1bc2357ae175354011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157491, "uuid": "c02ec436-c4e7-4c09-b727-ed45d347365c", "comment": "Malware payload (Prometei)", "value": "c046112f2e30268bb8cd5d3012cff05c571d4b9720f1ec8144ab7841a7af8600", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157491, "uuid": "8e5db501-5610-4c40-88c8-6fbb0bad9320", "comment": "Malware payload (Prometei)", "value": "a20bcd18d6d2ca5f03b8f44802c17645f3e3a8b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157491, "uuid": "96da3253-423b-4ba8-a8de-1768c5e36270", "comment": "Malware payload (Prometei)", "value": "5a1cef6749f47380eac1ae4ccd4d49d35a115a6193b0e455e962bfb8459227b15bb6bda355d6da7ebd5891e79cf53d2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157491, "uuid": "5ca2c298-a7c2-4db8-ad1d-fa54a3a9d93a", "value": "T1599423F31424B3738A2C3A3EFFA09E15D79A573CE559271A1A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157491, "uuid": "993b7ebf-4be8-4168-b6ca-9d73dff43542", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeS0:W4/y+qaBUZJAdVtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157491, "uuid": "1d8cacec-3199-4832-a629-feae8d878318", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157491, "uuid": "997707f7-2b08-49f3-950c-bfed2a560459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157491, "uuid": "4d350c70-3314-4482-bdd1-7259f6ce75ff", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f53821-f9b8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741175472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175472, "uuid": "026eca90-021a-441c-a3af-983e9bf99c45", "comment": "Malware payload (Prometei)", "value": "a78a8d9a52db9e086856e278b54ab641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175472, "uuid": "fb9b88b8-1f77-427f-b797-f6c484570757", "comment": "Malware payload (Prometei)", "value": "c078f2692d6934ef677523aa354ff3af8409e6b5de58a90031167cad964b3e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175472, "uuid": "47a85c29-1fb8-4926-b5dc-036ef892ce7a", "comment": "Malware payload (Prometei)", "value": "b757f8698c787404091e4c2d8126e1caa1ab8b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175472, "uuid": "fde12414-dad9-40bd-81d9-dae02c390fe4", "comment": "Malware payload (Prometei)", "value": "8c27a28f430e1a4966de3a0d9b3427511ad7e01d9198f491dc6dec6bceaa1316fb4d478a3f343a510e2fc9ee43d77b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175472, "uuid": "02f83407-56d0-40bb-9749-e0066c92d4e8", "value": "T1FE9423F31424B3738A2C3A3EFF509E15D79A573CE559271A1A1FDDEB0F2991209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175472, "uuid": "3bba1ad5-f8cc-469a-b1d6-62c36743ef9f", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSi:W4/y+qaBUZJAdVtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175472, "uuid": "502bcc0c-5b68-4ace-88e2-9f1111b63f19", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175472, "uuid": "71cc4a70-7979-4867-8fa3-ab7116ae0614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175472, "uuid": "bd93347e-4db0-4b5b-acf4-247b83805e2f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6625228c-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (Vidar)", "timestamp": 1741162271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162271, "uuid": "250ecea0-d7ee-4123-81de-d5e3f5ea2968", "comment": "Malware payload (Vidar)", "value": "e300270e705313fcb5287600e5d94645", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162271, "uuid": "cd7c54b8-f5c5-44d7-8296-c4493f9917d4", "comment": "Malware payload (Vidar)", "value": "c0bb74316b66e8ec4e6e76eed303303026765b247f8adb2a92cc1650e4f8eb08", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162271, "uuid": "fb4a6354-60fa-4377-81aa-cf9a6f9c27be", "comment": "Malware payload (Vidar)", "value": "7b2a3ea6f9285ee6ad913d1a3519da864b6234c6", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162271, "uuid": "b734bf9a-c1d0-49d3-ace7-a08962c37b28", "comment": "Malware payload (Vidar)", "value": "59c8c71f3a3590ddb0c8e26583e57572bb18df4b9398ea996fc750f580062599a4a55c4ce77403bf9c4c5c71415a41d1", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162271, "uuid": "18a3c879-7380-4f88-a5e8-89173ad47cce", "value": "T18595232B0C07B56BD15582B7A21A2F3CBB3CD6685F6DE6BB328591F4E3513463408CA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162271, "uuid": "f0ab7e6f-5278-44f9-9194-fea1d0099af6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162271, "uuid": "b90b11e0-72b0-412d-8464-de0027ac06b2", "value": "24576:EvXrbmymmozL1JvM6gVhUeV7qgBq96q9+B/ZLlMfUzwH5RE3bZdzStczjQuvwm0d:Qv6VX3k6SeeV2E4cxMcORErZBSa3QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162271, "uuid": "a425bc84-a1c9-4740-8929-fa02ce3db5bb", "value": 1911808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162271, "uuid": "51662939-ed0f-4c27-b451-094a1b213666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162271, "uuid": "d547f836-4ef4-4a1e-802f-e291a71ab63c", "value": "q3na5Mc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e66e90-f966-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741140396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140396, "uuid": "c0dcbe48-2758-4d19-a288-2ebd7e0a5f72", "comment": "Malware payload (Prometei)", "value": "4ddca448a5f176d1259904d830fbee60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140396, "uuid": "f28daadd-48f1-4eff-a3e7-8738e19026ea", "comment": "Malware payload (Prometei)", "value": "c0d8c7cfa6a47ba8249e8fc4c8ee714dcb10e0ee975a05676ae6bb1412244873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140396, "uuid": "e6adf645-94fa-4ef0-b5a5-4635d58a39cf", "comment": "Malware payload (Prometei)", "value": "6a00f47fca060913b5bb7025c92f401a6881f948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140396, "uuid": "81920a1c-eb60-4c12-82fe-26e14fd84f74", "comment": "Malware payload (Prometei)", "value": "63c978e22f14d1e5b681d00c28a5bdccf567aefb6ee691886dd39d7e3a791dd839f6ae5f7848610903bc5d4910916c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140396, "uuid": "1af96127-b73c-4f31-b6e3-fbdb764be6b3", "value": "T1D5155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140396, "uuid": "8005fb81-ddef-43ef-9093-2f47ad6a0b7d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplZ:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741140396, "uuid": "9d8fac23-1e86-4957-bcc3-27281a422edc", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741140396, "uuid": "7674133b-13f6-4d7a-926b-1ad917038b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140396, "uuid": "d875f83d-a83c-4d26-bf34-5a7b241b5094", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564c3dc5-f9a6-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741167827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167827, "uuid": "731532cd-b149-4e39-bccc-d46e56e5133b", "comment": "Malware payload (RemcosRAT)", "value": "283d895e944e2b1b80689b95cb99d683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167827, "uuid": "00913e10-b687-4f2c-8d34-b8745e8e1597", "comment": "Malware payload (RemcosRAT)", "value": "c0e3043b13b21ab347c7ccd016f92f763a31da997bdf6a617300ebb6c1f32749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167827, "uuid": "a71217d6-8a04-4d49-ba0c-edc8078c03d6", "comment": "Malware payload (RemcosRAT)", "value": "97f86d7ca65e1543db28946c38587dc7b09b0f80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741167827, "uuid": "206649cb-8715-4090-ac59-393daf6b967a", "comment": "Malware payload (RemcosRAT)", "value": "63a476e7bf1182eed16f01ebc25c086ff640b35296c74ca59e653cc7abe292c9309d3a478e7db7fb295d1b6ec28ae73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167827, "uuid": "2065f715-0fb1-453d-baaf-bf4296fbf03f", "value": "T153758B1FB6904427C016E53F5CDAB39C741AEB2C6A1CBA42F7A51AD4CB272F1F42D216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167827, "uuid": "3b7ce555-003a-4787-b4f4-fbed89c69bca", "value": "1c9c8bb033c87f22be527cac631ebe2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167827, "uuid": "01cdd1bf-d3a8-4fa5-9e7b-8d2b9a0201fd", "value": "24576:njiUcLz5CApqtlvva62+bis/lT8V9j/VJcJh6QyRZy8//O1jLMftNHvM:ngv2eL/VmJh6QoyIcLMftdvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741167827, "uuid": "e9b883bb-137e-44c6-bd8a-8db259a5ec9b", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741167827, "uuid": "24ea820f-d49f-48f9-b672-7745b86f1cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741167827, "uuid": "226eb767-5eb8-49ac-ae35-987a7ec68970", "value": "ANYDESK.PIF.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407c591d-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741176381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176381, "uuid": "34318736-916b-48b2-89e7-7fef54ee45d8", "comment": "Malware payload (Mirai)", "value": "cb890dcecc719a679db2440b26c83b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176381, "uuid": "e0dd6723-d210-4f9f-839a-8b84e2f16dd2", "comment": "Malware payload (Mirai)", "value": "c1d77430ce40432bdc186cc387ae129854e39450182045f9617820214e418cca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176381, "uuid": "e8ba85e8-12eb-463c-adfa-8c30d9f59eed", "comment": "Malware payload (Mirai)", "value": "efe19faef39632076704acf50c7459be45174fa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176381, "uuid": "e8f07a30-e7c7-460a-ba72-c069493a1e0e", "comment": "Malware payload (Mirai)", "value": "bd1af1687e02f1b1ff048481ee97abbb610e89e27358b7a469885c6a6b870133837e869785f4fe98748829c6b836d00f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176381, "uuid": "7a44b958-bdce-47b7-bd1d-0b7ab1a27fab", "value": "T1EBF32B46A6418B17C0D61B7AFADF424533239B64D3DB33069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176381, "uuid": "f18fb2d0-8ca6-47c1-a47c-c64b6e8d53c8", "value": "3072:6415EateHLG2a8sErz94jJKVAUsg6qcxj5OmtbPM/9gm9hQ+Ac:6415EXy2a8sErz94lK7sxqcF5OmtDM/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176381, "uuid": "3baee91d-86be-40ca-ba89-a811a16df00e", "value": 168459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176381, "uuid": "d6139b64-30f9-43f4-abc3-811fe7046f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176381, "uuid": "9b0ea430-fb3f-4d0d-aae4-ddb68d89bd7e", "value": "efefa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ccd4a0-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741155994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155994, "uuid": "22a537a3-04ab-4da8-87ed-102ffb4c347a", "comment": "Malware payload (Prometei)", "value": "5b726447f5701c17f74dc41bb94653ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155994, "uuid": "dfc2108b-df6f-45a1-8f85-044b4844ba53", "comment": "Malware payload (Prometei)", "value": "c1e07a01589d952b96f4baa41cae058279cbad6db05bc60d40b49d1964485d3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155994, "uuid": "8c7a5184-ce26-4066-adb9-6060cced5d66", "comment": "Malware payload (Prometei)", "value": "ede6394fa7d44debbd2cb187e6ace6583c68bd45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155994, "uuid": "3d12ba49-43d1-49be-b0bc-bf39ffc44c10", "comment": "Malware payload (Prometei)", "value": "5afd580394c45c4b9c9b983c9afe8e585e4bbfaa1c8729cbc9548a95ba8ae7da9fc86312d486bead98f32f0d24a0c5d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155994, "uuid": "762baec1-6a88-446d-8510-902f887d9a7e", "value": "T1B99423F31824B3738A2C3A3EFF909E05D79A573CE55927561A1FDDEB0F2952209C8605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155994, "uuid": "e75fb8d9-5ae4-4475-81cf-61f77eb87099", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSP:W4/y+qaBUZJAdVtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155994, "uuid": "216fa208-2da9-4841-a1cf-b7e7f11b83a0", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155994, "uuid": "63c9cc03-5d48-47ab-8ee4-a0b86b7cc22a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155994, "uuid": "755c057f-8579-442d-9f73-a45df7dbbacc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e46fee-f991-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741158722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158722, "uuid": "8c638b9a-783e-47c6-88e4-cf558b218ef2", "comment": "Malware payload (SnakeKeylogger)", "value": "af76a973e0592c9cba494b630090a2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158722, "uuid": "c2ad687a-c8e9-4b48-a693-1985b19f335c", "comment": "Malware payload (SnakeKeylogger)", "value": "c22e6cfad4a9c203356da3bf8c0ec5ccb24d5fbe115bc484bfc3dd96c457ff8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158722, "uuid": "cf204303-3c23-4558-b4da-af538dd213a7", "comment": "Malware payload (SnakeKeylogger)", "value": "7c28c80dca567858599bb9ab205aea01b1eae162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158722, "uuid": "8647338d-9897-4c4f-baff-21009aa2fee8", "comment": "Malware payload (SnakeKeylogger)", "value": "54ff84b8c6b37ec79e9c7ad172bc61bd29afd62479f1d23c3cd366dd767cdfb8f310f1855c3e46b84b47af2ddfdccf7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158722, "uuid": "f40109e2-0417-4eec-90e4-1a23a9dcd4e9", "value": "T1CA45AE11BBDD8362CB7751F3BB15AFC0EE7B685107E1B89B5F472E396A00260162C693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158722, "uuid": "a3c18611-6ba4-403d-9f3a-39280cb2b4a4", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158722, "uuid": "f3f9c9e4-02a5-459c-bab7-39f9ffd773a3", "value": "24576:4u6J33O0c+JY5UZ+XC0kGso6FaS5WANQtimhfVzP6hLWY:yu0c++OCvkGs9Fa0NQtiafh6oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158722, "uuid": "5c98f0c5-443b-438c-ac18-4303f48a5efa", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158722, "uuid": "eba59921-7afd-4d75-860c-099206fa2067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158722, "uuid": "a7624800-1d54-4efe-81f9-a20cd78ae2d6", "value": "Purchase-New Order PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c688a7-f9cb-11ef-ad17-42010a9c0004", "comment": "Malware payload (NetSupport)", "timestamp": 1741183720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183720, "uuid": "e9b5e007-3147-4958-9ec3-3bc49d131170", "comment": "Malware payload (NetSupport)", "value": "39bbeea73e0e284b17cbde227e833242", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183720, "uuid": "19400307-e2c7-4afd-a4bb-7131f0f1a4fa", "comment": "Malware payload (NetSupport)", "value": "c2864874382002171f5254dac807acf8eb7a0d7295b3f6ec0a2f7641ac4fa34e", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183720, "uuid": "139615ba-bc4f-4e84-8275-f20ea3924859", "comment": "Malware payload (NetSupport)", "value": "6bfcae07eb8c01bcf885ba34056811454e14d98b", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183720, "uuid": "0df99013-506e-482f-86d3-caaa87796220", "comment": "Malware payload (NetSupport)", "value": "1e720c4f3d9432e02d8a1591453290ff3e4c5fcdce95c95bc8d02d93f0b181f4287bd54a491e3f9d370c1fe2b6d031cf", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183720, "uuid": "8be0fe4a-25fa-49b1-af58-4f5992a2a1ae", "value": "T139A533227592615BDED73DB04D7D1BA6FA8C2CD0DBDB0EFD61069092F901F2A93430A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183720, "uuid": "494165c8-2493-4bf7-bc4c-74ab8ef65722", "value": "49152:sdsJAElEDThXBJOhHELfD52MHy1316AXSkAPoa2oQvWei94hcQ:sRpFXaiDbyv6sLu2opeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183720, "uuid": "90ac7076-a2aa-4247-b71d-e29fba7ddab7", "value": 2109946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183720, "uuid": "05de840e-d727-4d8a-9ff1-d50c65684b52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183720, "uuid": "38b4cf16-b3c3-4336-8d3f-374e7da97eb8", "value": "eula.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84520928-f9ee-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741198828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198828, "uuid": "40869d4a-aede-4dda-bddc-43be7f1e0941", "comment": "Malware payload (LummaStealer)", "value": "df65d28a187a3bbf3245b8bcc18d4854", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198828, "uuid": "6cb4fb82-955c-4429-9ed7-2c17ff9dcc9e", "comment": "Malware payload (LummaStealer)", "value": "c2a0b0368fe0752d2a74f69acae69fa280d770db5631af090a3a1b4d19afd680", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198828, "uuid": "db116010-2da6-492f-ae95-7b7c419b6c3a", "comment": "Malware payload (LummaStealer)", "value": "3c7cc4ed86db7e8aafe6a9aa4d4ff208001fe787", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198828, "uuid": "d841d63e-6cc6-4f8e-b9c2-6b70f9431b63", "comment": "Malware payload (LummaStealer)", "value": "1e5f2c59c6715f8cbbbc524eae547b8ed54581cb55cbcf8b47ffb76034b268e4a093e3db2423887403533e2e68774163", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198828, "uuid": "35295cef-125c-4ca8-aed1-a97d99a41375", "value": "T194848D07EBA784A5D8CB0C39311AB63BAD3666144728DDD7DB8CCEA52873AD13534E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198828, "uuid": "df1f7d8e-c131-449b-8f81-b3e29f9da404", "value": "6144:eLKDT3OrJidZbdCSrle86CXwSogSuFwhHKlYY1mMyVzX52u:eLK2rJiLhCSr9QjeFwAdAMyVjou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741198828, "uuid": "e37d39fe-3448-4234-bfb3-7d18eb2a24cf", "value": 391234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741198828, "uuid": "24e3c81c-c319-434e-b7e9-93168d604244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198828, "uuid": "0a8aa322-a9bb-4582-a2d1-c7f6eade2238", "value": "174119882725416b93914ec3f21cdad12ccd742703bebe9d7d885704bb605fa6d10df2d0a7259.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4905485-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (SocGholish)", "timestamp": 1741185192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185192, "uuid": "0f8a6ebe-245f-4f7d-ae5b-94c09f25d039", "comment": "Malware payload (SocGholish)", "value": "d3bfc1366183780701fea65641ec6c48", "object_relation": "md5", "Tag": [ { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185192, "uuid": "4d28ab69-c1cc-4f5d-a93b-e4098c019408", "comment": "Malware payload (SocGholish)", "value": "c37c0db91ab188c2fe01642e04e0db9186bc5bf54ad8b6b72512ad5aab921a88", "object_relation": "sha256", "Tag": [ { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185192, "uuid": "3886a16c-217d-4c17-80f3-2ded21ab91ba", "comment": "Malware payload (SocGholish)", "value": "0049f785caf9649a36e114ae554812d9caef7cec", "object_relation": "sha1", "Tag": [ { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185192, "uuid": "e2ef17cd-9f1c-4e8b-8159-06906743bcd5", "comment": "Malware payload (SocGholish)", "value": "955f6353e9a508fabef06cc5d5a7294505a69e5da3c649215190288abf1430ab50c97e53f8d2dac6f58e55c49b83fbbd", "object_relation": "sha3-384", "Tag": [ { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185192, "uuid": "0e5be2a6-eeaf-4dbe-b16a-a64734f4d34a", "value": "T167D3C67BB789233508E3A359364D35ED6225D130A276876038DFA12D179603CCB7BBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185192, "uuid": "567df0d9-b8a2-4711-a99a-b85529e5875c", "value": "1536:ktPFbA3xFAV8QyzTHMmgzlXzmUZxFAV8QyzKHMmgzlXzmUwxFAV8QyzC:kfbEjq8jqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185192, "uuid": "c7f0c1f3-56c6-4973-a1ef-c7114045e3a8", "value": 137516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185192, "uuid": "29c40846-40d8-4004-aeea-b37e0f987b42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185192, "uuid": "7da30980-5093-4130-a41c-f559b978e43e", "value": "Canary_Update_133.12.298.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e971f9-f9e5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741194994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194994, "uuid": "b868bf18-caf9-4174-ab0a-ed35690b7b01", "comment": "Malware payload (Mirai)", "value": "2934298896dab8ecfc15035b5739d070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194994, "uuid": "e865b652-f2ba-422b-a8ae-4c5be8cd1c52", "comment": "Malware payload (Mirai)", "value": "c39fb97d74db466bd305b8695d0b0cd0ebc7707462f479f04baeae904d3dc38e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194994, "uuid": "ce4a291d-0310-434e-be15-07c4346aec46", "comment": "Malware payload (Mirai)", "value": "ec02459edf218ff107425a240a52161270fa69a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194994, "uuid": "4c86b239-0cdb-4b1e-a5cd-5a8f3f7a0cbc", "comment": "Malware payload (Mirai)", "value": "2c69874f11b06376f3539519e6bcb0635c3911974b9561ab081b5729cb546403fd2baa3f79ab115e0ab50bf25933fa5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194994, "uuid": "c697a6fd-2b04-4deb-b254-6128f3487aa9", "value": "T17B03F1F2B235EEE1D061EA317595DBC0ED34B86152059B0B16E6B1BF9CE9021AE30733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194994, "uuid": "a5946b4b-0448-4344-9953-b4a40aa5b584", "value": "768:A/HmOY4lDYuaLQjGW0JVxzdUBcBm/c+kotPkv5qyXmaOs/lRv9sPw1:2bYG0TkQxhU5ZlG5JXThFuw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194994, "uuid": "738cd986-100c-415d-9422-4df837fdef94", "value": 39912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194994, "uuid": "e6a0b8c6-245d-4a31-90d7-134e2323ea9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194994, "uuid": "02a9f150-abfd-4af2-b590-96da563f2646", "value": "5r3fqt67ew531has4231.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e614ba2-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159305, "uuid": "8d75fc9d-294e-457d-b3ac-d56d3ce9ca7a", "comment": "Malware payload (Mirai)", "value": "3340db657e126825143961bc3fec5208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159305, "uuid": "a7def86f-088b-4a01-abe6-94527961a003", "comment": "Malware payload (Mirai)", "value": "c53b1f7b9c84f5038fc31038741a715f76cde2010479fa0eaef01821f0e74bb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159305, "uuid": "90b7e968-f53d-4c8e-8688-a7fceecbe409", "comment": "Malware payload (Mirai)", "value": "25fccf28f7c70eeb93289b77d4fda31715e8c950", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159305, "uuid": "e8d82a8d-0047-466a-a31f-09e79fc315cc", "comment": "Malware payload (Mirai)", "value": "1c6a8e0a580bd07bd81a92efbbd2281b283979e65f260bfea2c4991bf8841366db7f0b43e03204d61b50cf0dac4af477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159305, "uuid": "be46c315-9f17-45df-81f1-552081d4e0f7", "value": "T1DC531A26ADF52C2BC1CC95BF20F34721F2B6534A24B88A2A3DA50ED97F1875135137B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159305, "uuid": "49e24656-97b2-4897-9c6e-6d797e98a7c8", "value": "768:v0JxbwN2bgyXTLC/V/F6IPdr3mO+T5Vssl7J7cI1tBOpIm:v0xA2bg+LGN6YWT5y2tBOpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159305, "uuid": "41821289-8e84-4c9a-9bc7-ff8e5400b2a0", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159305, "uuid": "e853cfc8-71a8-4e11-8b8d-a8b940a4b28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159305, "uuid": "175a8eaf-5bb4-4072-ae90-71907397b40b", "value": "cbr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f6a4f6-f99c-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741163480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163480, "uuid": "213203b2-f553-4b2b-b9e3-7d6dc1bbcb04", "comment": "Malware payload (XWorm)", "value": "ba57c75d6c4e2936f6cad4a1ba4c29d1", "object_relation": "md5", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163480, "uuid": "20fb49e1-2ff0-47d2-9ee3-b353cae9804d", "comment": "Malware payload (XWorm)", "value": "c54714fec4a8cab57d0f0304210fc2f4f50f6fbcee80fc2d3db9cf30a31853d2", "object_relation": "sha256", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163480, "uuid": "bfa0cef8-268d-466a-9f3d-f25352e73a5e", "comment": "Malware payload (XWorm)", "value": "8299498803759fbb63a323b0ad64694d72d0c352", "object_relation": "sha1", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163480, "uuid": "eba259a1-2af6-4ead-b6f2-6b4ce406f2f4", "comment": "Malware payload (XWorm)", "value": "8768261eedff21abcb126c5b51bff80dad2171fd128201d3d99c1e49ec52f6adacaf87dd3e061b38cbf10b3fcf636ac8", "object_relation": "sha3-384", "Tag": [ { "name": "185-215-113-209", "colour": "#D44EA7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163480, "uuid": "ef306c01-fd5b-4482-b4c2-334d54adbee6", "value": "T1CDE30285F3DA96D3C63A3DF458F1F6D7E090E0430930C6B478A88D68D89519E23E5F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163480, "uuid": "6c0bb56d-ab78-4b3d-9800-282e6094799f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163480, "uuid": "0ab99361-c8e1-4927-8dd6-c9caa8af7096", "value": "3072:sFZbBnzDocMDOhTxVpK4x3ZlhNxB2S+T0Wu4wvAaqifHulgOw:SBnrMDuR95HjxBT+T0zk4Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163480, "uuid": "cd06d8e4-a481-4b03-856d-916608a68be5", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163480, "uuid": "d3d6f036-bdcd-4afb-94df-4af48d7bffd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163480, "uuid": "f33cf4ff-eeeb-4bea-87c4-0f5df2e8a643", "value": "ohtie89k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fc5343-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199793, "uuid": "d2e18213-f959-4053-829b-baf4839c5f1d", "comment": "Malware payload", "value": "6ca1fe5572656f35e3aa04e35f84cf2c", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199793, "uuid": "860b6807-f1e3-4aa4-8070-40901591f07e", "comment": "Malware payload", "value": "c5b5861c9ea8aee2f2e98f207a133e23acb6ef55599b1c44684ef42561bd6883", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199793, "uuid": "831d0d6d-0ef5-493c-bb89-d80e31009e7b", "comment": "Malware payload", "value": "b96edb6d39129b2a890d8b01de7aa20cb64ddf59", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199793, "uuid": "51186719-bfb8-4b6e-b8ca-745edd1dd10b", "comment": "Malware payload", "value": "e4d64c829beda6caea046eb2aca7f761b7a44fe0282aff16b35ca5f5ad913aa5bae9c5a4684246280eaf2c13e0a5b518", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199793, "uuid": "06c9960d-7040-4f3f-bb90-9546ce0cb00d", "value": "T140D533D05ADCD510FE58AF34AEDF878EE2EB11600AD185238736F4CADF34546AC6C8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199793, "uuid": "63f91022-2f67-4bfa-b91b-910e3adc87e1", "value": "49152:5O4nTMO+8BZIgU5eqJrZ/VcgJqkg9kag8BTP5Hm+Unr/klyG1MTmzq592/r:1oO+GZg1JP9JqhzbFLUn7yy4MTmm5Mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199793, "uuid": "98968436-f44e-4efd-aee6-b0cb818adbe3", "value": 2856622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199793, "uuid": "fd7dc6cb-c0f5-4739-87e9-c78f58f59dcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199793, "uuid": "812e68af-8c48-4df9-ae34-10179d8d3e86", "value": "502900CITA_575589625257.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934177e4-f968-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741141301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141301, "uuid": "c36d9b55-f671-4bbb-9f93-adc139bfb58d", "comment": "Malware payload (Mirai)", "value": "b14917e4131300b33e2e128ade0afc67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141301, "uuid": "9f5fb865-52d8-4f3e-acd3-425ce130ea11", "comment": "Malware payload (Mirai)", "value": "c6de79f0138cfced5031099822177ca4651304107d3e9b220d910fcaeffa466e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141301, "uuid": "c18b678b-10bd-46f6-a4bc-13c206ca5153", "comment": "Malware payload (Mirai)", "value": "4034c5511f5044c1867f6078baf762338b96ce39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141301, "uuid": "bd2f686c-d04e-4c0d-8acd-4ab29ec1fb72", "comment": "Malware payload (Mirai)", "value": "bc47bd229afcd8de6c6fb106188df44ca6d7904146b6d78f98f930ba5602e2679ade2366ba5a23a3d7e91cc6411f1c89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141301, "uuid": "4c236d80-c1f8-49d8-871c-fcfafa1f9069", "value": "T16D834A02B3180E4BF4E31AB0253F1BE187BEE9D021E4B689691FD7564671E33558AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141301, "uuid": "4dc0b26d-b1e2-469e-b70b-c22c729c5035", "value": "1536:ZFKc7JTi6SEY+eSG14pDaO7OJw3FktnS/PHN6SXZJxQRkF:ZFLjHpDaOOw3FmQN6OJSRkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141301, "uuid": "1533ca49-ed20-4e81-b43a-c038c8b7ff11", "value": 83924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141301, "uuid": "458bfa75-dbf8-4802-ae67-b8a29c17ef1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141301, "uuid": "c5be0368-c943-4257-ab6b-872c0f125f97", "value": "star.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3b08b5-f9d4-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741187811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187811, "uuid": "146100df-a989-446f-9664-fd88ab515e91", "comment": "Malware payload (SnakeKeylogger)", "value": "4a6cb4d561d3f60557afb8bc4382e6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187811, "uuid": "0a8931de-19b1-411d-a702-bc8d7d5842b1", "comment": "Malware payload (SnakeKeylogger)", "value": "c79e4f7195a1682416ec7e9289de08bde3a3a6ecf4d215a8f3df93e6a9115a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187811, "uuid": "3805929f-0a48-42e6-87cd-ba7011cc35e4", "comment": "Malware payload (SnakeKeylogger)", "value": "2d84c692f9ce4c9a714bf6be20fc4530e8492b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187811, "uuid": "5ce209cd-8b61-4cda-aab5-8c99667fef1b", "comment": "Malware payload (SnakeKeylogger)", "value": "05762818304827ebe623c50c2261f732ee14efbc715e98225a9f92a102705e627c7f7fc53e377568fc773bbcb9d2f45a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187811, "uuid": "b483210f-aa28-4c77-a169-ce12b1534aa8", "value": "T1C4052376B242C1CEF9738F72CEF29678D9B6DC01ABA04A8207137F9F353244AA9155D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187811, "uuid": "7dccfaef-ca29-41f1-b6f7-cadd1c0c9826", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187811, "uuid": "96756205-a036-4689-9644-9434c862c268", "value": "24576:qs5lChQMVlZkAAZt0Fi9yDRyrfjgVBUAQU+a3dOauGQHnY:dehRyFyt4a6ALQa+HnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741187811, "uuid": "56d65ce5-4b69-4d46-87fd-5cafa1f6205d", "value": 853720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741187811, "uuid": "13005c33-5e8e-47c6-ab03-ad7ba63da36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187811, "uuid": "bef9f857-c09f-4e22-925e-8738d4fb3ea9", "value": "doc2024PO20122024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc309dd-f99c-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741163785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163785, "uuid": "6715bed6-1f6f-4451-b78c-9101b18c301b", "comment": "Malware payload (AgentTesla)", "value": "93795073767b4b4e472b1d8dd15eed72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163785, "uuid": "779e313b-afa3-4cde-b6b3-ca412ad114ea", "comment": "Malware payload (AgentTesla)", "value": "c7c79df7ca0765c338b171cad9450b9d0b84122ff88e3720d9f6002e247902f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163785, "uuid": "39b9fd4f-fc78-40a2-9299-0935b713d234", "comment": "Malware payload (AgentTesla)", "value": "b2b1594fb2b3421043006a79853b5634c3a7f4cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741163785, "uuid": "77dd5819-4e05-40eb-a31b-1f84aadb1c5a", "comment": "Malware payload (AgentTesla)", "value": "fdf0115cb1d7db019b445a6feeb7f88e868cbd4b09c280bfda7beebed127ec202e5e2c1d96c0abc877bd2e917421ebcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163785, "uuid": "b3212645-80e0-474c-bba4-7f823545fb63", "value": "T15435BF2273DDC360CB669173BF6AB7016EBF7C614630B95B2F880D7DA950162162C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163785, "uuid": "e2c35b35-fe2c-4b67-bea4-46cdd9a2c1ba", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163785, "uuid": "a7249e11-00f4-4b53-9c5b-35744022053a", "value": "24576:7u6J33O0c+JY5UZ+XC0kGso6FazgTKAw/91JWY:1u0c++OCvkGs9FazgTS4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741163785, "uuid": "eae7fb61-74a3-4057-b63a-2bd9992b08dc", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741163785, "uuid": "6310c470-db62-41e8-9a62-c652b533408c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741163785, "uuid": "8c6a185b-92c4-41cf-9eda-fd84ce08c7ac", "value": "sales contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fadc76-f9b9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741176090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176090, "uuid": "7452e645-0af5-4f5c-bc4a-1fc386ec2731", "comment": "Malware payload (Prometei)", "value": "7aa4ec3a9ac3ba0650459cc214125b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176090, "uuid": "cf422b3a-1cb2-4ecd-8f9c-4237e9b499d2", "comment": "Malware payload (Prometei)", "value": "c89a8e31b1efe6769e84f479f07ca465d25e910b33a57bf1a126403cfa74ff14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176090, "uuid": "d672eb78-ad66-4d93-b364-3e87a5fa1b0a", "comment": "Malware payload (Prometei)", "value": "b05b8f259fb6055dba2f389d3c1a38bd21b0a572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176090, "uuid": "9e161396-6acb-40ee-a11f-88abffc83a3d", "comment": "Malware payload (Prometei)", "value": "761aadf64e42c2f597d0858d501d3cefb8f6e1a40229b06e042bd88783fb63a5ee77c9616e62c1cc933a76905308c701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176090, "uuid": "94ca0169-6b50-4a39-9a7c-626392d300ed", "value": "T14C9423F31424B3738A2C3A3EFFA09E05D69A573CE55927161A1FDDEB0F295220988A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176090, "uuid": "c541337c-9dc4-4682-b4f0-eabbffe3d3fc", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSW:W4/y+qaBUZJAdVt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176090, "uuid": "4e09888a-c03b-41d7-beb8-86b109446c5a", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176090, "uuid": "7b1f6f4b-13bf-43e1-b64e-00ab6421655f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176090, "uuid": "a1b2e30e-5a44-48dd-9bde-41b52c40fff3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4737f89-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741159449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159449, "uuid": "613d4eab-004d-489d-8179-08bf2bf3c9a6", "comment": "Malware payload (RemcosRAT)", "value": "e68182facbd237cee02cf3ac3c02146c", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159449, "uuid": "bad60175-f1ce-4e20-928a-369f6f0fc3e8", "comment": "Malware payload (RemcosRAT)", "value": "c979f01ca42a26c5644446d64a092c0b3a41202d1dc41d177cf6ecc80368cf66", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159449, "uuid": "e1224267-263c-4eec-af5d-bf6ef982b866", "comment": "Malware payload (RemcosRAT)", "value": "8e06f5b3614c44c8723b510e0ef10c91aa17101c", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159449, "uuid": "8086d58a-ffda-4d9f-8907-c1065f58205a", "comment": "Malware payload (RemcosRAT)", "value": "d4657ad949bdd408ffedcc9c5fef70e1197291d15eb779656be3de0487356cd46d9550d72543b9ee7c74543fd04eb08f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159449, "uuid": "98eeb57d-eae8-4f5a-9bd5-5426534fe222", "value": "T127136B20891F0FF92E7B2FB49801EC4485B74E4757325FA0A97A07C8F71665D9EA93C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159449, "uuid": "fd6f6cb4-9185-4df7-9125-92a847b5313c", "value": "768:uuoSt5iFBJCHtLM7IBri+RZ5jw1EorPIcZPO+2iP01Mggy:uuxKK2IB2++lPIYONuIM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159449, "uuid": "deb9f293-bb7c-4e86-93ac-487a738cea0a", "value": 45209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159449, "uuid": "4bd4b259-7f34-424a-a1f9-4e3f1a124db1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159449, "uuid": "39745b61-5d0c-4551-b2c3-568cb9d1f9d9", "value": "22835271_5115055035.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd00dac6-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166765, "uuid": "65fb95ff-5290-4370-8714-f0120b2c4245", "comment": "Malware payload", "value": "3237013882bcf3a3240e37d7236d5a8f", "object_relation": "md5", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166765, "uuid": "d02d8706-3789-4b15-be0d-8c08c47361a4", "comment": "Malware payload", "value": "c999f22918026ac125f994e2552bc1d44d8ad24a22749f8d4bf350f565d3cf89", "object_relation": "sha256", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166765, "uuid": "be862fbe-900f-4c58-a2b4-328cd0140382", "comment": "Malware payload", "value": "3ae701ba7c56380c02e06159efeca5934dfa8e25", "object_relation": "sha1", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166765, "uuid": "a031d8eb-686c-4ff4-8d39-a69652385c01", "comment": "Malware payload", "value": "cb83b975e2519a168d3188a33dbb50a58b8395f0250e34497461dd59bd8581990fa8a9c6bb9977fa56a556f12178e043", "object_relation": "sha3-384", "Tag": [ { "name": "baddieszn-duckdns-org", "colour": "#F0D2F9", "exportable": true, "hide_tag": false }, { "name": "bahadii-duckdns-org", "colour": "#868052", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166765, "uuid": "ed98dce1-59f5-4e05-8bb3-47d2ecae3db8", "value": "T18926C9E339FE67891B0533AB574BFD480F5BCC341BC3AED450DA06C8544A65B2A90E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166765, "uuid": "8f87e5bf-9a9a-4cc8-8d0d-2a375178bf41", "value": "49152:6RBbPFUj2aP+7LURdKNgtJuceMKwn00f6qhMSTo5wimRbXlOIqCZzgZMbInPSvEt:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166765, "uuid": "aae7143b-e9cc-455b-aae2-87d8fda52243", "value": 4487068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166765, "uuid": "1e6e98d8-3b77-4a56-9442-5b39e5735a65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166765, "uuid": "8a1b2b1e-9ec5-474d-8b8b-3e5ded848025", "value": "c999f22918026ac125f994e2552bc1d44d8ad24a22749f8d4bf350f565d3cf89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce08f71-fa12-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741214493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214493, "uuid": "7517a01d-ea7e-4679-b843-0c7da82cc2a7", "comment": "Malware payload (Mirai)", "value": "cb6cbec917fc2ebcf2ac8c6fda57235d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214493, "uuid": "381106df-927a-40f4-a6ef-f43ae658e30e", "comment": "Malware payload (Mirai)", "value": "ca858d47f348e68a8ef7f562e6942a14822e4d014e131b103f10ad3dd87adc2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214493, "uuid": "fbed8c79-90a0-4798-a1a1-a2195d638d41", "comment": "Malware payload (Mirai)", "value": "c7e4c19b8930d1ddb43d3ba9e36259abf8bc1e16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214493, "uuid": "f4fac055-4fd4-41cd-ad8c-2b18def78a40", "comment": "Malware payload (Mirai)", "value": "da99cb8a632c60b0c4f726e38926a8b042bf574d1b96f7c16678f4d07e0a40b477613a143168b22f01565829e2ab80e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214493, "uuid": "a0d69ac1-e0ca-4071-b266-272d158c8818", "value": "T111A36BC4F683D4F9F89604B61137A7338733E43A5029DA87D3ADD936AC62950DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214493, "uuid": "f5512d49-2219-4e91-a35b-6dd3fd618b9a", "value": "3072:20+z7UIRZs33Krvqozl13m0A6DdJvMr5C8:l+z7d7snKrvqozl0mtQ5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741214493, "uuid": "6e2e8381-62ce-49d0-aa52-be6db057dec7", "value": 104456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741214493, "uuid": "016553e1-d43e-4e53-9b60-889a7bb0722d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214493, "uuid": "5a72ccc4-8ac2-4bc1-94cd-f0d3ff13bc07", "value": "bejv86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65e5e91-f9ee-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741198886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198886, "uuid": "f1ab9ff8-f00c-416e-89b3-ca67112ef308", "comment": "Malware payload (LummaStealer)", "value": "a2dfe7ac14e447fcee97e65ca1370c47", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198886, "uuid": "fc13d65f-60a1-4709-bd67-3a3af2f950ff", "comment": "Malware payload (LummaStealer)", "value": "cb45723d40ef3d1fddb2316469f62a5842b620e466198eac2e971ee5e540b2aa", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198886, "uuid": "f022a8cb-be7a-42ca-aa44-2fb588716ee0", "comment": "Malware payload (LummaStealer)", "value": "a41475cb1edad94c89eb251cb692b1ebec1836ef", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198886, "uuid": "a21396a7-a7c1-41b0-8047-fd1c61a8f312", "comment": "Malware payload (LummaStealer)", "value": "285df809cb949926e8f31b030b3b84a5b89deedc62f4b3d574d6a20f231672b4c5c26651934d2fc98005e2e1c3d44553", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198886, "uuid": "e88e0b79-8f5a-4933-b59e-bac831c1896d", "value": "T120848E0AEBB794A1D8CB0D76214AB23B6E3766145734CDD7DB8CDEA07463AE17434E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198886, "uuid": "cc53eebb-70d8-4cd9-b912-7c604652ce64", "value": "6144:rt58h+N4qebOtHj/w3JKM/Qx5pjF3GbfJfOjvKXvpyuikP3Yf+oBO:rt5kbGHj/gJKgAFGVfOj2yww2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741198886, "uuid": "5e6be2c2-668c-468d-9ba9-8d9ef5a12e9f", "value": 388967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741198886, "uuid": "68856764-7094-43fa-96c1-77c69cad674e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198886, "uuid": "ef3ac7ca-11b9-4c2e-83af-e1a51661307f", "value": "1741198884692201c55078d57f479ddbb3c7042519dafd3a0d9424e1fefbdcf3da4b23b1c0119.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c59e1b0-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139491, "uuid": "fa9f790f-3d7d-4818-bdb6-dd7aed9da43e", "comment": "Malware payload (Mirai)", "value": "e6abc5655a1ff42065aa3a22292c48d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139491, "uuid": "ee10aee9-b08e-4f4e-91e8-2c9b9ada2436", "comment": "Malware payload (Mirai)", "value": "cb68ec4f7530780dd5a00d479bf9755ea89067cc495eaf6c9cc292ff21b7a8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139491, "uuid": "33391684-f469-42da-b65e-6eab8f371957", "comment": "Malware payload (Mirai)", "value": "63dd40522702254de480272553cf90b33f21aa86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139491, "uuid": "0ccd0f6e-aaab-46af-b4e4-3e1c33767ee7", "comment": "Malware payload (Mirai)", "value": "da478da48e13d9db1f15dced824657c342f846cca3d13e312456ff4c0833d205ee1e14cf5184f908d95dcfe36830c120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139491, "uuid": "5aff8401-71fb-4f80-be0a-ec9b6fbead0b", "value": "T14A335C42F31C0A4BF5631DB036372BD1D39EED8031E4E6C4B60DAA499272E319656ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139491, "uuid": "921e594e-4dad-4f65-8895-0a19b3b692c4", "value": "768:JpHCk/RRaARpyndYWcNe/Z3v9mXqPT+ay66NZovOLF9StHPKRCIT:XHpZRaALitou3FmXeT7y6AZnfSNKRCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139491, "uuid": "5a636bd0-9dd4-4c37-abb9-31b803ca01f8", "value": 52896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139491, "uuid": "be54e694-437f-4888-9287-ca458648ddba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139491, "uuid": "cbbd03ab-bcc5-4671-80b7-be0e3d6cb5db", "value": "cbr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595acbcb-f9a4-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741166974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166974, "uuid": "e44fb2dd-6105-420c-a7e6-9007c5039076", "comment": "Malware payload (SnakeKeylogger)", "value": "57fcf82b297a17241a20f50654f1044f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166974, "uuid": "4efceb58-1a0f-4513-9e7f-731ddf6f5b64", "comment": "Malware payload (SnakeKeylogger)", "value": "cb69b45a2c7dc153a144f46f96f55a8283e76d1689009a8cce18cc1b49aebcd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166974, "uuid": "84f67bd6-853a-4040-8773-34249b574c65", "comment": "Malware payload (SnakeKeylogger)", "value": "9bdac61c6f8a6d9d0892f6e208619ebb3fe83068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166974, "uuid": "7b468239-554e-410d-8918-bb4ab034c2f2", "comment": "Malware payload (SnakeKeylogger)", "value": "0da6fcc6ceee75b4e289ec0f75b9c7f45b01872401e0f612b5ad9fbdf714b87e7abeb545a329336b57d65c14263b0286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166974, "uuid": "c660ef50-41d7-4fa2-8602-81245428f98c", "value": "T108C401A8A20AD827CE9657742E31F2F8627C0EDDF500D2178BFDEDE7BD22A551E44142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166974, "uuid": "e0eb5e11-b07b-4cf8-94c9-ae8ffa6d15a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166974, "uuid": "d72ebf50-d46c-4769-b888-4ade60ddacbd", "value": "12288:t/fT3pm+gvyqiitX6bwywMS2g9L1cqVVLL3Cr7Fu7odrkOSzW+Tk6MmTUJvT3s5F:WdiitqbwywMS59L1cqV5cxDFkndUJba1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166974, "uuid": "717ffb91-5f6d-4d00-8b19-cba60bc714f4", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166974, "uuid": "28de158b-32e8-40fa-9e4d-48cc58687689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166974, "uuid": "4c9934c1-1afe-4398-ac10-b49e95f7eecf", "value": "Payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfaa238-f9d4-11ef-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741187785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187785, "uuid": "ce3f91bd-d894-4dd2-8169-8f1ca224aa6a", "comment": "Malware payload (GuLoader)", "value": "56fd59fb4c55cf74638eadb0ea186f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187785, "uuid": "12ca8d01-159f-4cef-acde-a4ddda0dc143", "comment": "Malware payload (GuLoader)", "value": "cbb94f21a796fe498e0056159da874b48f52121b83e0814b3846d9efd3ff038a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187785, "uuid": "82240e40-650e-4a6c-bf63-7cfbcf8b191b", "comment": "Malware payload (GuLoader)", "value": "ebaa6a37c45790c2027728c60b1e5ec4ff5f5a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741187785, "uuid": "a2666f8f-13ec-4ed0-b3b2-ca74272825a5", "comment": "Malware payload (GuLoader)", "value": "f34a5e71cb4c2389cefcce0151428f6d0afe3bf577f414de740ee1c33007e7a237611d5c71711de4c21d50dda46e2517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187785, "uuid": "dc2f159e-59c5-45b3-8626-4d9c8f1c2809", "value": "T1E305333A77FBCCB0D9192374E5B5B66983382902232888E37F95F6670155107CA2F7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187785, "uuid": "622d71cf-d32d-4d0a-ba53-3414981f3988", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187785, "uuid": "8271703c-5e0a-4b51-a3af-7d7c07c885ec", "value": "24576:uAprd2JPsZYgBywu6mRXoWho992AXI9i:8OZfIw4uxUAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741187785, "uuid": "8fb4640b-504d-4828-8c11-175311522916", "value": 825464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741187785, "uuid": "609a9a0d-c31f-4b4f-9547-0eee45b935b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741187785, "uuid": "63568968-77a5-4395-bdec-8c5eb1d07b42", "value": "30241696_001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbafc81-f9bb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1741177126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177126, "uuid": "c8d39e38-5a7c-4713-9b6b-1db2ed793dda", "comment": "Malware payload (Gh0stRAT)", "value": "f06fb3ceb39d4d73db997478e8669759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177126, "uuid": "550532c8-bf43-4655-a12e-87b6fcd154bf", "comment": "Malware payload (Gh0stRAT)", "value": "cdeaf30d2ec5a71919abbeea210aad22056e6e5c10a0d80672269a81e65c3f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177126, "uuid": "4b3aaa63-2e41-4aac-9a03-01c135168d05", "comment": "Malware payload (Gh0stRAT)", "value": "4c6a4c9d0ec418344f0b2bb16d24396281dd1f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177126, "uuid": "ca665fb7-38df-44fb-8fb8-29192e3ade2b", "comment": "Malware payload (Gh0stRAT)", "value": "d56012013d649994566abcf5535165b4d476cd0516682fc92a52aefcd93fca306aa40e17a1f791bd389dac6993b3e62d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177126, "uuid": "ed7e8d8e-44a1-4718-ba6a-b4ed7e716397", "value": "T1A7E73352E1CBE43EF08B0B334662A22444FFF7A196229D4397E486DCCF258A41E7D756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177126, "uuid": "4e740864-2aee-4ecd-8092-313832096934", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177126, "uuid": "5456ca74-b761-4326-aaad-70884d1cc018", "value": "786432:7lc8un9Lvq7y5Is+014nvteNLEV9SFLVhHcV+Tgq3CzO93JnD8wr6bnQL8fglhgD:7lcfwCrMVOLETILVhHco26D8DQ0Khk4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741177126, "uuid": "3d98fb1d-a51e-4439-b5b4-bffe8801b049", "value": 65736868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741177126, "uuid": "2c44ddbc-ffdb-4f6f-bb17-e9e6ee74dcdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177126, "uuid": "e1674ccf-fa7f-40d6-b2b1-5f23aa0a111d", "value": "cdeaf30d2ec5a71919abbeea210aad22056e6e5c10a0d80672269a81e65c3f6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaad66e-f9f4-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741201208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201208, "uuid": "20b506d3-3f7c-4ca9-a1e8-007687f825f2", "comment": "Malware payload (MassLogger)", "value": "ce06ffe31ff561f8c8036bd6d2320b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201208, "uuid": "8fa09159-85bd-489e-93fa-a3545d8cf1ca", "comment": "Malware payload (MassLogger)", "value": "ce274c08c15204a7168689d039f94e7c96a7e4a079b48cb2cbb10ec5bbf25ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201208, "uuid": "dee49b93-ac22-4240-b0ab-57665b765e67", "comment": "Malware payload (MassLogger)", "value": "bc691326107a4cdd18dd000d56a30fb394f7da92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741201208, "uuid": "899b7ef4-42f4-4b6e-a67f-bb550908281e", "comment": "Malware payload (MassLogger)", "value": "75c09455dcfdfb77c17481d5f0fbb769033d4b6fa23b9f0fdd92fef56fff71abb74012f442520d8682b753f411ca076c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201208, "uuid": "e65d4251-52fb-4fb9-8f3e-01b99e29de8a", "value": "T1EE25BFAC7250B5DEC957C172CA68AC75EA653D7B530B820380A349EFBE0DA57DF140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201208, "uuid": "ec678126-df05-42f3-8296-e8d124d8e2e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201208, "uuid": "e290c97b-43bd-487a-80d0-c29b78b3dd08", "value": "24576:MZGTkHROFAUBsQqoeQ5zj6KQpFcIJy2ZM9DRgBWKQDqdOz:M0wHRJUBPjH5znQpF/JyUM9sfQD+Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741201208, "uuid": "c83d0417-aa14-4a9b-b11d-ae9aace38bbc", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741201208, "uuid": "0505e836-0d14-46c5-b3f7-96aa68ab0110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741201208, "uuid": "35c081c2-9652-4074-b219-e3ab15dd4b35", "value": "z1Estadodecuentadelcliente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924bb68a-f9b9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741176089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176089, "uuid": "a10d3111-3d0a-4ce2-a339-815a707ebf67", "comment": "Malware payload (Mirai)", "value": "2ef370ce79155bb0a2218959986bde65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176089, "uuid": "f4edbc3a-7d81-4194-a7fc-bcf5a6201e5a", "comment": "Malware payload (Mirai)", "value": "d03382599f0c2c57fedeb106abc86e4eb045a285cf9d67de8b72091c367f71bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176089, "uuid": "82642dde-37f0-4111-b8e3-0fb7a19e1f19", "comment": "Malware payload (Mirai)", "value": "1fdfb72af5d5e6471619a059c517da0f9d48deba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176089, "uuid": "60d41883-d414-4966-8ebb-e995f5bd10cb", "comment": "Malware payload (Mirai)", "value": "7da6c53f294cb8bc9b630fb4e6305e89a64c4d889aa93fa8732456a36c24d5c36ae35a698b09d7e2fa30a9227acad252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176089, "uuid": "45a47442-1cfe-4df7-bd91-e5a73e076bf8", "value": "T16514981E6E228F7DF668873447B78A25976C23D626E1D684D1ACC2141F6038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176089, "uuid": "aca8d6b5-5f73-49ff-93ef-4c6dfc38b969", "value": "3072:ehmbfIIx6z3Vi5AbdUDfsN0qAmIB9KSpO+EL6GxhwKaLwgY:eh+fII8z3Vi5AbdKsN0qxU9VEbxh9uFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176089, "uuid": "236268e0-ac38-4c64-94bb-a2a794a57ce2", "value": 197936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176089, "uuid": "1839a7f7-ebb8-4e4b-8adc-b43f8982594d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176089, "uuid": "b1202ee1-7aae-4757-93e9-1b8752c411d0", "value": "jfeeps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4d7381-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741158412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158412, "uuid": "611bf45a-2460-4cd9-b3df-8779895d987f", "comment": "Malware payload (Prometei)", "value": "c671bd5da1497da0169e59c27cb400a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158412, "uuid": "d15b09c9-5c36-4e8b-b33f-3d9f852e6f7c", "comment": "Malware payload (Prometei)", "value": "d12b39013868e2df380d043fcc925d5a3bbb102bb2e3ca2bb2ff0fbc7590e1ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158412, "uuid": "4b9ca2dc-3abe-42d3-b96f-5e3da549a9dd", "comment": "Malware payload (Prometei)", "value": "6c2c2d867345ee4a7405e8d2a08380abe742f450", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158412, "uuid": "8096394d-77c8-4b47-82b9-1a3ae4478ef0", "comment": "Malware payload (Prometei)", "value": "69862cf730bfce181e4ac1e3570b6876906ca2fc26006454317e517800810e953d86ad4d1e475cf9b51b7c43928d7350", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158412, "uuid": "5477d570-6b60-4e28-aa44-aa93559ab89e", "value": "T1C39423F31824B3738A2C3A3EFFA09E15D79A573CF55927161A1FDDEB0F295120988A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158412, "uuid": "512ae5d0-f359-4cf2-9d35-707ec23559be", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSt:W4/y+qaBUZJAdVtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158412, "uuid": "53ee6710-2b22-4850-902c-5ddde3d2c840", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158412, "uuid": "27c767ee-1770-4d0f-b286-7861e7df7c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158412, "uuid": "2e877632-9be1-4b29-bde5-91c20cfe5e82", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3ff495-f9ca-11ef-ad17-42010a9c0004", "comment": "Malware payload (PureLogStealer)", "timestamp": 1741183272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183272, "uuid": "734b2e86-eab8-4e1a-9d39-fbe32bdf8fd5", "comment": "Malware payload (PureLogStealer)", "value": "bd9e89adfa931ddc86b1649ed9cebf07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183272, "uuid": "87221aff-cfb1-4aec-8920-34846985d7b7", "comment": "Malware payload (PureLogStealer)", "value": "d21c4fc180588e6c6efb204651b471eee7f36fe003ce38cc33c635f94b73d282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183272, "uuid": "5c6a14aa-2061-4d0e-9598-1dfb6a3070c0", "comment": "Malware payload (PureLogStealer)", "value": "44e8a4ff56c0219d3be92f421935cc5eea95bf74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183272, "uuid": "832bc7c7-0d86-4075-aa0d-ed940c609074", "comment": "Malware payload (PureLogStealer)", "value": "ba1c43b3d6b93bc69b44319e2e55c9f96f6507f7538fdaaed21fde34efc22359c2d453b86b12192fe1067c53443b4b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183272, "uuid": "60611667-b9e3-4e1e-8fb1-dfa894d52622", "value": "T17D36231BFE41CE90C2885733C4DB810493B4DB917397D64B789933D61A833BB9E4A69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183272, "uuid": "d90fa257-8cf9-4a03-a9ca-822794bfd57a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183272, "uuid": "d811bbbd-ad86-4e34-8a5a-727aa3efc28f", "value": "98304:F+Z11S2LAobmOVUlMbeKXWBzg9yU/pW4fCWJuEOAZcH1rcwBX8d:EZ1fLAobmO+2beKXWBs9BoWJuid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183272, "uuid": "f1d9d1e6-b94b-4fb0-b979-18822e6d9766", "value": 5068308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183272, "uuid": "8f463da7-1475-4db4-9b95-688898cee13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183272, "uuid": "3294e99e-af90-48e9-88ef-28cf8de21779", "value": "FusionLoaader v2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e3f582-f968-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741141379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141379, "uuid": "5de6a361-a59d-4c2b-ae2a-7b5c85280b6b", "comment": "Malware payload (AgentTesla)", "value": "3ccce6c6b274bc7813a2abee7f4a1f49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141379, "uuid": "e41e90ae-9c03-413f-bc72-f27076596674", "comment": "Malware payload (AgentTesla)", "value": "d2cab43a622ed80a2a79ff9266a25fe00175692204a5b022ad34787e39b578c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141379, "uuid": "edb95f86-5e3c-47f7-a7be-28c00d88c271", "comment": "Malware payload (AgentTesla)", "value": "5701c34d8f71a04844232ea93324eeeff8ddc3c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741141379, "uuid": "3bcebc16-1318-4539-a2ca-42d4c002e9a7", "comment": "Malware payload (AgentTesla)", "value": "49b690f180871da1dd6a36b2c0ae16be504af290d2ada3cac944448f9b564b25f4f46524dd3d3f62dcb66f721ebd3eae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141379, "uuid": "ae95d10d-7805-41c4-b429-0d21d969fa6c", "value": "T18D359E22B3DD8360D666C533BF197705EEAB7C211530BF4B2E881D7AB9D1161272CA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141379, "uuid": "05c929c7-8b1b-47d9-a99d-f83a36591618", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141379, "uuid": "7a34dca7-294a-4590-91c0-3f00d24752e7", "value": "24576:lu6J33O0c+JY5UZ+XC0kGso6FavRg1yooqZC4qWY:nu0c++OCvkGs9Fav21lLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741141379, "uuid": "a7e81f8a-c8ab-4c5f-a256-06b165456e89", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741141379, "uuid": "4abd095e-efe8-4a16-a7f8-5972265771a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741141379, "uuid": "789309a7-cf93-4f8e-9477-d7e374c43c71", "value": "harga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7ad294-f9bd-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741177877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177877, "uuid": "27728f72-31eb-46e6-b4c6-41db6b5d7b09", "comment": "Malware payload (Mirai)", "value": "443584f033c8eb07178622d7dc018cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177877, "uuid": "94396823-9f4b-4641-87e9-1eff95b34852", "comment": "Malware payload (Mirai)", "value": "d392b63426a3a8b9c574b7ffbd3d80ff24ad2b5922f731d54d9368ac5f09459a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177877, "uuid": "f19cf78a-8177-4729-9b1f-6547a46ab630", "comment": "Malware payload (Mirai)", "value": "44ab450b71b7b05cfa433e3e87f0e1e769fd5fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741177877, "uuid": "069b5eab-fa06-472d-93e0-f39b3cfaa53e", "comment": "Malware payload (Mirai)", "value": "dd844165a5aaefdba8aff7a6e68bb0f162080f6fcd99638f5834aeffe3a73af5b1ef1881858fc6a3512a4b60501ed0d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177877, "uuid": "6d312caa-cea2-4c73-afca-87e921ffa1c8", "value": "T1F5F3F946B8819B16D5D112BEFE1E128E33131B78E3DE72129D246F247B8A87F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177877, "uuid": "9cc5e297-3d27-4272-9f2a-e8cd8989d821", "value": "3072:oSejsGCrjFPOXAFmTz4aupNDyBcvkH1s9EWSLcBd:oSejMjAXemTkaYGckH15WSLcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741177877, "uuid": "b69706a8-8a7a-448e-b922-25df2fd8d0c3", "value": 161532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741177877, "uuid": "147afd3e-7bd1-4328-bf61-86383c1430f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741177877, "uuid": "e4988678-227a-41a8-9944-21fb4e032cb7", "value": "efea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7a4545-f991-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741158738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158738, "uuid": "8c6dfe9c-8eec-4679-b83d-b4d1d2a641eb", "comment": "Malware payload (Mirai)", "value": "6254e5ad7fe2f518c6824bdd6721bd9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158738, "uuid": "e7310edf-5908-4a5d-af10-2a02e3917833", "comment": "Malware payload (Mirai)", "value": "d3e65830bcdedd7b90cde836db22600d14808155cfece56688ca2e3311d7c674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158738, "uuid": "b511c4c8-d914-464c-a78d-d7b915cfdcba", "comment": "Malware payload (Mirai)", "value": "768e9c93669a1f7e03bf8a8b1a2b07174a31352f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158738, "uuid": "a4682c8b-ba05-4787-8187-8ff6aee00a3a", "comment": "Malware payload (Mirai)", "value": "3593f7c8adc9db44e59c4205e0b7254f755ecd59d2eccf8d12ccfc375cd92fdbfc6b8255b34d3646cf4bae1f6dc5d25b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158738, "uuid": "87c8b3f9-6a18-414f-862e-452e2c779834", "value": "T104239D13DDB62E18E21891F0B4A58F7967B3E95091CB0EA9D462C32DA413EDCF4963F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158738, "uuid": "b02a603a-949f-4e77-864b-983c48df4bf2", "value": "768:Vgok3hW/w/paI9oHs57KovyqowK/S3BRa9oXzS4z0CH1jJhfizfqsOIl:mMgpJ9oM57DKq3B8yXRz0CHYzSsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158738, "uuid": "309134d4-b3e5-4ecf-8cc5-bc010aee0301", "value": 46716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158738, "uuid": "6aed844e-828e-482d-b069-c3a95c3c024c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158738, "uuid": "c32d993e-5aee-42ad-b778-23203a5c0de8", "value": "cbr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e977ce27-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159914, "uuid": "185eadc9-ca76-4703-bf9a-046e6277b07d", "comment": "Malware payload (Mirai)", "value": "e128abe85c26b10ae498e7505d1f62a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159914, "uuid": "223d3493-c411-4011-8dc9-fd69df68a229", "comment": "Malware payload (Mirai)", "value": "d444b76ef69c3eefb18f4558217f8a7c6b1ab1204896331455ad0521c859c986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159914, "uuid": "d4aae1ca-9323-4be2-85c8-09cbe734d49c", "comment": "Malware payload (Mirai)", "value": "3674814d18a6c0caeb963e6073b52ed75d4d3c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159914, "uuid": "fd4f42b0-9348-4c8e-95c4-9266f11acbb0", "comment": "Malware payload (Mirai)", "value": "7ba9f90c165febb067bd18dae90ae091d6dfd8883345dffa4129bd6fccfcb13cc5805af92249058b651bd09ba9a4e167", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159914, "uuid": "d6b52e92-450b-4167-a70d-c40d47459695", "value": "T111E30B46F8814B12D5D111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159914, "uuid": "b0dd2c9b-a265-4f53-9576-92d283b5a848", "value": "3072:DHea4CXRUjnwJIXMb6kzz5aTHACdYV8P4eL1:zePCXRQ6IXu7zdaM38P4eL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159914, "uuid": "7a960b55-7371-4d5a-a688-47540fe6c4b2", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159914, "uuid": "944e1ef9-616f-44e2-ba5a-142f10770f43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159914, "uuid": "2bb95a32-ad0e-4112-8f2f-992fedddf310", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcc3de2-f9bb-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741176776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176776, "uuid": "1fc1022e-d3c5-43e7-aba1-0fcd065a91f3", "comment": "Malware payload (XWorm)", "value": "2caded0dda6fb2e3eac9591ab15dcb6d", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176776, "uuid": "cdf66d7f-93e4-422c-bbb8-eabdca99990a", "comment": "Malware payload (XWorm)", "value": "d49c722e1131ba0f485329ace558071e28b797672d2a80e98dd3c52afe36268e", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176776, "uuid": "2a780401-ef6a-4d68-b895-b32df8c4a13c", "comment": "Malware payload (XWorm)", "value": "57411055cc6f06c3e212ce77c7b19dea2a351003", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176776, "uuid": "bd82d8de-dc5b-42e0-ba5f-adba2b23a423", "comment": "Malware payload (XWorm)", "value": "82371a313519c9e683f0bd065ad0619e4c698bfd8a0d8d958c90e69a9fc82da868d7112f3c94fd8d1a16a8321f12dd9b", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176776, "uuid": "9187b98a-1996-461e-85d5-7ac5a075b5fc", "value": "T1EDF2F180B8DE3B7ACA08DA3F2847C5D5425B4F9B60C8FB40E98B975812445CE61DA61F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176776, "uuid": "92d57716-0370-40c2-b105-cb1f8f14eedc", "value": "768:PRJQqiC29mKQqMXJCFd7a90W/im9JdKruYmBF5pnak/mO2d0:P4qZ2gKQqKmd71OnJ+u5BF5pak/PO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176776, "uuid": "e9b77fe4-7674-43d3-bd15-bf19feb4856a", "value": 37080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176776, "uuid": "bfa18826-29ca-486e-9c43-1e48321af673", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176776, "uuid": "addb91cd-650b-44a7-83b7-a8a6c49db023", "value": "Account_Access_Alert_March05_2025_Report.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74ce1bc-f9b8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175775, "uuid": "adc6cc25-2afe-4444-b91c-7a4704c9f330", "comment": "Malware payload (Mirai)", "value": "c5b92bbef3fcb0c83f5af16dfea756e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175775, "uuid": "ccc9beda-1eb8-4590-8e56-7a0b81f7bf08", "comment": "Malware payload (Mirai)", "value": "d49f99665fb0ae4a84352085e3d805f6664c9fb0e1ea2047dade0d94f6ca647d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175775, "uuid": "aa91449a-7de5-40a7-995d-f151dfeb6361", "comment": "Malware payload (Mirai)", "value": "e2a9fb7112ec12cd4a27a0d917f5616c05bd60d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175775, "uuid": "48af9630-1f6c-448c-912a-e4ec3b9907af", "comment": "Malware payload (Mirai)", "value": "60e8cfff5d00ba70fbcc4b832958e200a5e922a86971fcdf02dc835a2123b33cfa095503e8b67bc4806a4a58f11d1500", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175775, "uuid": "2cf19b60-ecd1-4066-ab24-5f5201ae5492", "value": "T124432BC5B941A626CBC1567BFF0F02493719879CE2EA3303D92D5FA037CB9570E2A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175775, "uuid": "f4a2e7b6-0ca3-4098-9c91-a179a965af01", "value": "1536:5hnNtwCsWYS8PoJk03EA5RYrP4f4uvjfr:XN4JoC03EA8Avjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175775, "uuid": "a42a72c4-722a-473f-a1e6-6845e03770ba", "value": 58868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175775, "uuid": "cd9abf59-f55b-4685-bd9f-d69696aa90db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175775, "uuid": "66f8b2ec-fc11-47d6-b210-7adb2da4df48", "value": "cbr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb18883-f991-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159005, "uuid": "bf546aaa-c13f-4eb8-9456-911bb324f563", "comment": "Malware payload (Mirai)", "value": "23af7748e61f248dc4d6cd0aa2f45a9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159005, "uuid": "4c0fe9f8-e62c-4082-af00-d3eec0ef176d", "comment": "Malware payload (Mirai)", "value": "d50db63b3d6a764e96c48bc00f1b28d3752c616da82d72203acf7b7cdb817c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159005, "uuid": "3b616028-888c-4e78-87a2-3bac2934f5dc", "comment": "Malware payload (Mirai)", "value": "477e2e13edccf9f145126d66b6710affd8f8f456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159005, "uuid": "00b22efb-cbb6-48aa-b50c-ebb2a315d6ab", "comment": "Malware payload (Mirai)", "value": "17300280fca1adf2cac9c6b3de108e899768f09691270c55120bd2a74920df7d92c5dcdf7ea136abf91957f0e7beed43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159005, "uuid": "62ab20c2-9f23-49f8-af3a-c3c9a6236f87", "value": "T178331BC5F981A725C7C15677FF0F02493719878CE2EA3343A92D1FA077CB95A0E2A606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159005, "uuid": "b526a485-3830-4bbd-8b8c-883a1d4a6d7c", "value": "768:1Utx4xuCWQnr5belCA7SvDpPNDpHeGXfO+ybDgVNIhIxeC+rs+4cqbJ6lftm6bE4:Dhnt6CA7S7PoJk0/Ef8Ix79+PjCmt4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159005, "uuid": "741ad0e6-fbdd-4dcb-b83b-eac8c68e7b61", "value": 54772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159005, "uuid": "d030ef26-7fba-4681-a878-ee1ca2d15fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159005, "uuid": "0cc18a05-e5b0-45ea-bd77-1e11b72f36fd", "value": "cbr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f18912-f9c4-11ef-ad17-42010a9c0004", "comment": "Malware payload (DarkTortilla)", "timestamp": 1741180742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180742, "uuid": "c7ad7873-b5d6-41f7-a08d-0d97da7e47fe", "comment": "Malware payload (DarkTortilla)", "value": "d295276f4a2efd1326bfe50caab29d29", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180742, "uuid": "334d3a9c-a11a-46b5-a250-b74104faa5d8", "comment": "Malware payload (DarkTortilla)", "value": "d5af2fae3fdb00419da1366931735cbc9e8c64ea8e00a8761df717747b351477", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180742, "uuid": "95f1e6c1-e27e-4783-8a01-1eca0a3f17c1", "comment": "Malware payload (DarkTortilla)", "value": "d7a4d11a664f557e3ca5816c5b966f8ad174ddf4", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180742, "uuid": "0b20cb00-8af7-4421-99c7-5cda22a7ce9d", "comment": "Malware payload (DarkTortilla)", "value": "a818c8c8b2381688d106011db942e816156c941e09b4323ff096467b65b0689a83efbf45c767ca1af1c99136814afaba", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180742, "uuid": "70cdb750-1193-4aaf-b48b-cf2ec7d7a924", "value": "T15E656A265A8D8755DCAF3A72E23604AAC1737E2B6CE5F2B930C579B4CFF23814503652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180742, "uuid": "751922e1-5171-44ec-8f7d-3f8804edad9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180742, "uuid": "cdd25553-459b-4f7d-af9a-6f53637a9050", "value": "24576:uM1lES5uOU6PPbCowi/BpaaMl2OZcQbiRLM1pF:JVsSPbHrDNMsOKQue/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741180742, "uuid": "69e4530a-7cce-44aa-b24a-ad83a89075af", "value": 1483128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741180742, "uuid": "cc65ca35-a4c3-4cec-9b8c-8f32a8a4355d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180742, "uuid": "8d9198c3-c8fc-41e0-94f4-e9a82478ca64", "value": "PKO,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9f7b12-f9cb-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741183646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183646, "uuid": "f63d638d-1549-49f0-9b5a-e393d02f5306", "comment": "Malware payload (AgentTesla)", "value": "dbe778ccba069cd69187ebe891409dde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183646, "uuid": "1b96d904-3646-4bf4-a271-da2cbc38e409", "comment": "Malware payload (AgentTesla)", "value": "d5b49d6ed00ac319705490c3ee54d911875669f90f80f5b131e49acd9ea6b0e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183646, "uuid": "a23ebfcc-6b6d-4222-a8b4-dfbf63748258", "comment": "Malware payload (AgentTesla)", "value": "d3528eaf73e923baac4062f307ffb778aa94bc80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183646, "uuid": "591ecc99-9044-4286-9ced-8dda0453e0ed", "comment": "Malware payload (AgentTesla)", "value": "ba3c66ba26a7e4950e335601bc0ab43dce89fa1f0da6858f936dd93858b86e046085eb9844bd01799d99f974e011d34e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183646, "uuid": "24f1a521-929c-4026-b986-f166ed85a21a", "value": "T13785DF027685CFA0C21F1676C4AA85F80367ED42DE93D7DB3A897F1938B33AA5D40647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183646, "uuid": "23910024-02f0-47b8-8232-ef6813306c1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183646, "uuid": "cd612c28-ad20-4f04-843b-98714d5515a8", "value": "24576:z2+P3X3mhS+VzXq3tOf5uAJguc7Kw3BshQ+4H3YhLDIrYDu4NjcR:JPH2sEj2mp4xR+4XYikpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183646, "uuid": "f32e37ef-a23f-43b1-bd97-09f33c27e752", "value": 1828768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183646, "uuid": "56980e06-598e-47d1-ad71-d5c465fbae1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183646, "uuid": "a5d8a00a-2736-47bf-9a36-b90682ac39e2", "value": "I24560875423784426VTL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9dd5d8-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139493, "uuid": "81445ca7-577d-4a59-9e41-c18781da7fc2", "comment": "Malware payload (Mirai)", "value": "a67d88db3049dd462dadb9736aeefebf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139493, "uuid": "b9085ade-c115-4ab1-a57a-e02182a82bef", "comment": "Malware payload (Mirai)", "value": "d61185956a1c752ce6cd70a8330fce6eb29c2ea309186c5b5195e44ee5fffeab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139493, "uuid": "ad43e4a5-049b-4697-ab39-05fd7f73f6b1", "comment": "Malware payload (Mirai)", "value": "e5a32d21de90e6a8a682593c5472d6b9e3ceb305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139493, "uuid": "d1bd90a6-24b7-41e4-a6ad-4f430f37b581", "comment": "Malware payload (Mirai)", "value": "e32eb64bd73b27e179e2570a262994af33bea36854134ec6c56ae851b920d16586acb699e45eea468cd0921d1cc08eea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139493, "uuid": "3fd50e1b-ac26-449e-8448-fe1029c79f88", "value": "T12F631A96B980AB25C6C1157BFE0F114E33138B6CE3DE73129D285B7077CB96B0E2A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139493, "uuid": "f6ea849e-f9ec-44a6-b00d-865adef5f9a9", "value": "1536:wendvjfiJjC+aALmQF6MviB/Q/WjRnL5jYKmNG:TiJe+a4S/Q/WjRnLxuNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139493, "uuid": "02c98de9-159b-4fb2-bc19-75c3660542ac", "value": 68396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139493, "uuid": "f4a2194c-dd95-4d63-a440-3e86d9e28fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139493, "uuid": "24c28df6-f1f4-4f78-9033-79b63b2341a6", "value": "cbr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3136e1b9-f9e4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741194394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194394, "uuid": "29fd48bd-65e1-4bed-95b7-6a389c7aaf47", "comment": "Malware payload (Mirai)", "value": "22a52ad7ce8f1cfbf7a832dc9970efe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194394, "uuid": "d1c661bf-58b8-4de3-9ad4-89d5c60367ff", "comment": "Malware payload (Mirai)", "value": "d641aff3b80837fdf9e15510241e3baec65ea2f8d544143ac8c73dd96b007fa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194394, "uuid": "618f039f-bc96-4e36-87f3-d8508c3a4ff2", "comment": "Malware payload (Mirai)", "value": "70377ad7d5cf4ebbf6f8f4b0bde269e062290bef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194394, "uuid": "0e3d518d-c726-40d6-a4e1-9339a9e0c7f3", "comment": "Malware payload (Mirai)", "value": "ffb6ad0d78ab67b19ce0f99c82f74d979e3d396d0baa09d262001d17197a3e8e754a8d958a34b4308ea1ebe08d1430ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194394, "uuid": "82823a6b-d8f3-48db-841c-084f34927d57", "value": "T1E303F1532D56EC50A0F02C33E3FA9417539B1E6DDDDB23A627308234BD4B952797A8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194394, "uuid": "09573213-5617-4039-82d9-f0c78b798797", "value": "768:H+3txiLhPVopS/R0I8p+NSJMXuESWi4kerWKCzOqWVX1oR5Y3Up:H+3riP2SyIfNUxES9eBkOxoR5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194394, "uuid": "98c7f253-dd99-4836-af7c-0be3081bcdb2", "value": 38388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194394, "uuid": "9d3c9991-e1ee-4282-89bd-e5afd88f9776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194394, "uuid": "61c6047a-b67a-4b08-a702-b94ff732a726", "value": "5r3fqt67ew531has4231.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d894855c-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741166758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166758, "uuid": "5e424353-6d55-4bd4-88dd-7704f1261d88", "comment": "Malware payload", "value": "e722d29b2455e055193b6c65bdf3d34f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166758, "uuid": "b66809f9-2972-45fb-8259-c1de58b57063", "comment": "Malware payload", "value": "d65d55d91ae45b0ce1657b5ec1e1b142fa39e575233f8a9a7e05fa1b43c51397", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166758, "uuid": "a3c6a7c2-aaac-49fe-af8a-2f70653e8b90", "comment": "Malware payload", "value": "65ba00306e9179ff5c58ad6b98aec6fd40926258", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166758, "uuid": "e0d0bbe5-0fe6-4008-b49d-bf28301db2ab", "comment": "Malware payload", "value": "31837182c7ceb99a52fc9247dc6541be280fee7e8e9a5c82da81f4b74ef1c07e8df7554bebe53f026f514168f1084947", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166758, "uuid": "961cf67c-80a5-46be-9272-5793cf91c394", "value": "T122562364819D967E0F6C46D7E22F2EABBFCD475018AF20CB96E03596431F609A4B3D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166758, "uuid": "8b674815-c0bd-4c3a-b350-666b7a67156e", "value": "49152:3ckTCVDX8iZ4T4H7QIbUJC8u775h9x7mUtzPP5yJqS+PpVXF:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166758, "uuid": "fcef09d6-6510-455e-a5dd-e6c94483a3f6", "value": 6270809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166758, "uuid": "880ed2a5-755a-42e2-85ee-c48b4bae2278", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166758, "uuid": "99be3708-ed6e-41e4-9765-6700a04443a7", "value": "d65d55d91ae45b0ce1657b5ec1e1b142fa39e575233f8a9a7e05fa1b43c51397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702594e5-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741199654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199654, "uuid": "22058509-2a4d-4c4c-b9c6-71d0051fed15", "comment": "Malware payload (Grandoreiro)", "value": "831395d8925133fa433f25c7dd22640f", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199654, "uuid": "76aae577-f68c-4c80-a6aa-60364786a3ee", "comment": "Malware payload (Grandoreiro)", "value": "d6994d498d5c8a8e9b8b835b72ae644a3c8f213548d86f5788d728c96add0538", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199654, "uuid": "c21554ab-4e7c-4b71-9b49-9f2e5eb60d0f", "comment": "Malware payload (Grandoreiro)", "value": "380bcb0afcce18c1a7f97f90fd2f523a17ede6cd", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199654, "uuid": "c5302082-ec4e-4ebc-8669-4daf8543e16a", "comment": "Malware payload (Grandoreiro)", "value": "3192150c59c6d3d2bf732bdd340291c6b95ea43395ecbd40fef3dca26109ada92e77e3e5ecd3ea18f54367c18f9025a2", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199654, "uuid": "5313d41e-5869-4ace-813a-b104709f19b2", "value": "T15BE533146FE90329EE84D339F9DDD7DE92D188A68AA14303A701A0E5CFA5881777D1B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199654, "uuid": "d7e9bfc6-3a21-4fca-949e-ec94c7162986", "value": "49152:c0ErROGbJRc0P6mNOuCxyRjrKgoHDl1U3QVQ3i24/4pLdI2//:cdrl7W43K5HR1xQ3i2ZdJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199654, "uuid": "836b3549-757a-4cbb-b3ec-af59b5d63029", "value": 3039918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199654, "uuid": "227323b0-cddb-46dd-9ddf-daa72fa93d14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199654, "uuid": "eb9c25b0-eee0-4d45-9d1d-de250d1d62fa", "value": "017700CITA_367485688563.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab978c9-fa0d-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741212100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212100, "uuid": "2edc2a23-d6f5-40c2-b4cf-406ccbba82ee", "comment": "Malware payload (Prometei)", "value": "da98715e490ded008869f3d8e063e132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212100, "uuid": "cf34782a-1415-46dc-91f6-1b9f6c20a4e6", "comment": "Malware payload (Prometei)", "value": "d787280ec81c901502602b587918fa286605b952787158cb4575c8ea1934b89b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212100, "uuid": "42a04952-02db-4eef-8359-e5d356969867", "comment": "Malware payload (Prometei)", "value": "354f03d99c284e3bf16535714e3144d57cfa7f6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212100, "uuid": "a01a60ce-e247-48fd-a3f6-e4ce5f2b618a", "comment": "Malware payload (Prometei)", "value": "98b606ee66f416c934961e831722ffd515aae62030c7f5110134ca159ab523ef72dbcc04339b2ddf74a81e5879bd1495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212100, "uuid": "b7c227bc-30cc-4168-bee1-f07b37fe0002", "value": "T1009423F31824B3738A2C3A3EFF609E05D799573CE55927561A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212100, "uuid": "22298d80-717a-4b41-a23a-97f1a82b5258", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSa:W4/y+qaBUZJAdVt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212100, "uuid": "e9c6c516-8923-4732-bcc5-b663839b3b67", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212100, "uuid": "a1184ff2-b08f-4825-85a0-a267556948d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212100, "uuid": "185e8521-b1c1-4552-85cc-a03e947eef59", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df5c509-fa1c-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741218387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218387, "uuid": "9185d8e5-ecf9-41b5-bca1-50bfc4b12991", "comment": "Malware payload (Mirai)", "value": "2cef218e47a0a5074b6d5a8207702194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218387, "uuid": "8510b7ae-b56f-4bbf-9044-a451db63c027", "comment": "Malware payload (Mirai)", "value": "d900fc15141bf6e426c1ea25ed85de40f84c30335468cf2fe98f7d3bd381637b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218387, "uuid": "6ce03b31-f886-480b-af55-b71d3532c94b", "comment": "Malware payload (Mirai)", "value": "421b9d00310096f2b9de262fdcc4b79fd0e7c288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741218387, "uuid": "19011ab5-f115-453a-a19a-ff47b7a66d3a", "comment": "Malware payload (Mirai)", "value": "820c10c8aeed433aeb4a57544e583b01477c14c7c18878fe4f206649aed52d07b4d028c9618ddb690ff21da4d8b07059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741218387, "uuid": "6d762f47-97b0-4fff-88ac-8b2fbcc43aa7", "value": "T18C831A56F8815B21D5D5027AF92E018D332327F8E3DEB213AE205F61778A96B0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741218387, "uuid": "35b2cad5-181c-47a9-ab0a-3ace524739d2", "value": "1536:2onGmaqwTeNs3DnnKlzR52hDBAaiCDMwQmM4iDY84cak06Z5FYM74101:yqmeNszn8zRuAadcYbcak06ZH14Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741218387, "uuid": "39acdf73-cec8-439e-81f7-3359873bc14b", "value": 88640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741218387, "uuid": "3fad3ea3-5f73-446d-9f81-4609820db626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741218387, "uuid": "b8e3c503-5435-4b78-8fa6-5e14cb8581b8", "value": "donk.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f67095-f9ca-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741183510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183510, "uuid": "0b978d2d-f4ce-456a-8b0a-5c0436310877", "comment": "Malware payload (RemcosRAT)", "value": "4e50e8da0f46df334c393a334f3c19a9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183510, "uuid": "047a00e3-bbb3-474c-bcdd-659a3a714504", "comment": "Malware payload (RemcosRAT)", "value": "d9015194f6a3d0f5b47447924127b970690bb1ea0d957ce412e0c83ba604c9aa", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183510, "uuid": "b6cc19ab-323b-4dbd-94c1-84d337e1f093", "comment": "Malware payload (RemcosRAT)", "value": "7f5678f2771d99fee87d30f50b0e4060f5196710", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183510, "uuid": "afc26ebe-fca3-4e72-a456-d0f2e85bda29", "comment": "Malware payload (RemcosRAT)", "value": "f77337484d3f02957e72729462ef83ca929af47fc99ac05191e5f7843075aacd0d0e8243f037d10876a81a578fc4aee1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183510, "uuid": "1b3e9177-a1cd-4d0d-8b17-062acdac7d96", "value": "T16FF4123CCFA5BED8871EB1D4116E3F4E419E2F83B969AB4CB2D204954904B85EFB644C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183510, "uuid": "ba5c32dc-71ef-49c1-a55d-6881241ad928", "value": "12288:cuHf9uj95g5ZtEEB/sIL/XJ+5Hkc+RWhln0JjNAbKtOSJErycb80GTqJcDOSen78:g95g5ZtEEB/sS2k0l+jNRbErycbUDdUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183510, "uuid": "d3d1ff3c-0f3f-43a7-8627-d26820587914", "value": 726568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183510, "uuid": "4185432b-a1f2-40f2-a4aa-9a51a5cb2ab1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183510, "uuid": "8d1c9dad-1e8b-47a9-a3e5-d50faa924a36", "value": "DHM6454.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f75d08-f970-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741144715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741144715, "uuid": "1775616e-1c3c-4efc-886e-48ab1b456b7c", "comment": "Malware payload (RemcosRAT)", "value": "c5b417deb918f4465550e39adb29d6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741144715, "uuid": "31388b66-6dbd-4228-bc95-0229712ddf1b", "comment": "Malware payload (RemcosRAT)", "value": "d982188914a208819d6c3333b65ffa4c9cf55f0c72f420305ef9d2faad5b03c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741144715, "uuid": "1bdfa6a4-3b50-4c29-8f06-42cd87d79c92", "comment": "Malware payload (RemcosRAT)", "value": "28f8cd07a58ed47c758339cdc48ef195e1b36ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741144715, "uuid": "b6cfca91-d9df-4439-8cc3-14745fbb348e", "comment": "Malware payload (RemcosRAT)", "value": "a9936f80901ecb5e67ad10d08472c7e28fffe6d70d5e97f6140d06950d88042e24de91ae0c844eecc1e07216ec5375a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741144715, "uuid": "153617d1-4899-4db6-b933-a2ee28596881", "value": "T114C4235429D18417E69248B82AEAAFB7C9B6FF001D20728773207F5F5E34AE3574818B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741144715, "uuid": "7b73972f-3a98-4e1a-82a7-e58f3d88714b", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741144715, "uuid": "6a170b82-d889-4c98-844a-d1f7d2b8b45e", "value": "12288:NnlCj8+4GLxFJVdPOklFE9bA5HAYYH1ZGiy8DX7Y7v:HCj94GLxBg+FE9bA7QkiymXE7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741144715, "uuid": "292cb071-5efa-40a8-8340-61b7d8efac5c", "value": 586608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741144715, "uuid": "bad7f15b-a058-470a-9f34-ed96025d6c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741144715, "uuid": "5a0b6a5e-053b-4510-bc55-f00373a9e968", "value": "staff record or employee record_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7a2202-f997-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741161608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161608, "uuid": "28f80a62-142b-46e4-9ec2-c77e1edd9078", "comment": "Malware payload", "value": "b078190937ad264273efdd557d13b9b3", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161608, "uuid": "ce9ef3d0-f107-4ab5-bc6a-cb8a74fc3127", "comment": "Malware payload", "value": "d9994c7654c6b3f2078621a2f8175e695d2f15f4ce265980a3605c09750beb5e", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161608, "uuid": "4467e6fe-c2d6-4d6b-913f-f1090430164c", "comment": "Malware payload", "value": "53240cc5c864c1a22ffee9286127222f16127950", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741161608, "uuid": "9bf87dc8-8372-4925-b275-d8e63e885cc8", "comment": "Malware payload", "value": "646abf425f41c7229271af722dccdf76bb5d8cb51617233101b4e18c97851d86e59daaa84abcec6b634d6d162f5a0f7d", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161608, "uuid": "e8bca986-001e-4da9-858e-4a6545b3238a", "value": "T17E85F107758A8AA3E6515773C59B440043E5E68173ABDB1A3CCE23EA1A437FACD2D347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161608, "uuid": "621c8271-7b32-454d-80af-11888415a191", "value": "24576:0ODLJes8W3IQ5X/kmFekT+kPEpnk2a3nyfXRHnabY7xCG/faR8/gHviIE:0i3IGX/ekKkcpnZa34Ha6xCN8/Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741161608, "uuid": "806f6d63-b354-460c-bf3d-ef62707e1253", "value": 1755136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741161608, "uuid": "a131bb2f-873c-48d2-9341-5b88ae4b9341", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741161608, "uuid": "18fe5c3a-3ccd-421f-95a1-e45f7d873033", "value": "rRFQlatestProductlist.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b656e6b-fa0d-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741212101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212101, "uuid": "1253a660-3375-4883-9dc6-64f92de988f1", "comment": "Malware payload (Prometei)", "value": "3808ff83f63aa096f19423c80e5497d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212101, "uuid": "5cba1579-db2c-462c-a8c3-b4e5780e00c2", "comment": "Malware payload (Prometei)", "value": "d9c777fc9a8c3c0cd94a21e52e6f285ad5a5178cb605b392596687866a89f05d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212101, "uuid": "5ab3566e-6726-4d8f-bdb4-ffa571a644cf", "comment": "Malware payload (Prometei)", "value": "aab1c0b9f2764b0a514b80464083dd9c25c18e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741212101, "uuid": "06bcbcf0-c3fd-4919-9b84-86ce02157c5e", "comment": "Malware payload (Prometei)", "value": "17a3284dc5221beba713b216eac90ce8430231d2d2de02424470292cd2d300229bafb867e5227b11affbcd797a77b252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212101, "uuid": "b4285bde-43d3-4a86-b495-387033f8d9b4", "value": "T1F5155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212101, "uuid": "42aab785-af62-4e8b-8c13-7f83bcc6e677", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplI:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741212101, "uuid": "408edeb7-3d29-4941-a3be-fb2525052c5f", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741212101, "uuid": "6f791e68-ea17-441a-9f1d-6a6c74c97112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741212101, "uuid": "09b28fbe-4577-401e-85f2-8399a79e5811", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3be3244-f9ce-11ef-ad17-42010a9c0004", "comment": "Malware payload (Grandoreiro)", "timestamp": 1741185191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185191, "uuid": "648e7eb3-fee6-421b-abdb-12c229f3f150", "comment": "Malware payload (Grandoreiro)", "value": "c9251b87a38cf73de05dbaa6fbd8c4ea", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185191, "uuid": "e9ef5f3e-bb45-48b8-92b2-655fb07ab0d0", "comment": "Malware payload (Grandoreiro)", "value": "da1a6a8777480fd9f31993144f860b37ace141785a7440e8d77b6a6299cd9786", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185191, "uuid": "6d958819-ee7d-485e-b355-b767fd39d88f", "comment": "Malware payload (Grandoreiro)", "value": "8c7e99a71a80258b0ec7d6670da9d1ea433fe143", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741185191, "uuid": "4f1f4c31-56d9-435b-bca9-8d169dd8b559", "comment": "Malware payload (Grandoreiro)", "value": "df3a72bfb30d4341a94da271b1126e59902d092396c8e75e41c63ae9e6ceff5c25d7a58704ef84f4383f9ef96f65bdac", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185191, "uuid": "2e0508b5-abd0-45f4-a0da-3d86a8df5e64", "value": "T15BC533586F990350DE947734FFD9A7CCD6FB09C986504E13A021F6E88F2952A8BBF481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185191, "uuid": "bd0a0809-5807-4c48-919d-738d6839f50d", "value": "49152:pwfxwD5W/X/VA7wF0gzmTthj9P9+NVpZDq8TUVq2SL87xJuRw5RWqxrIr7QaRe2T:GSD5C63/Tth0pNUVq87v72qrIrzfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741185191, "uuid": "8bb61e44-5fe8-4a78-94ff-1a092132db8f", "value": 2578676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741185191, "uuid": "38f2e91e-ef7d-4a82-9c28-74be4fa47a23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741185191, "uuid": "376522fc-7c8f-4c59-9438-e354037d3d5d", "value": "313781711551KCXR1346_CITA4627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceb055b-f9e3-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741194306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194306, "uuid": "f1ed49da-5662-4549-8321-4e9fa07808b2", "comment": "Malware payload (RemcosRAT)", "value": "7a796f285af3626fcb465e41e083989a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194306, "uuid": "d8950029-d474-4266-84ea-aec323949982", "comment": "Malware payload (RemcosRAT)", "value": "db0957f9d8a95431403d63b33f7c424a5593424ceaf6aefb25694557a2e558b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194306, "uuid": "0403a034-7f3f-484c-b657-84ac610d3401", "comment": "Malware payload (RemcosRAT)", "value": "9db67a7829be4a802e1343c8864ba79718335075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194306, "uuid": "7b2423f4-ba58-4509-bd9d-5524517675f1", "comment": "Malware payload (RemcosRAT)", "value": "ab8fdf40894126f4a820bcc731674d8e19cb04d3dd322bf7a9daeeb0b760d662e1e07d2474ac6a2901d9872eb5ef799f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194306, "uuid": "1d36a515-55fc-40e1-864d-f586a5d5cff7", "value": "T1CA048417B6CA85B1C2706B76C4AB053047B4F982EF63D73E3D8A235A0D437AA9855337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194306, "uuid": "0c1c25f1-83cf-49f4-a416-a3e048769d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194306, "uuid": "21beb0ae-2358-4a58-b64e-d697319b2d09", "value": "3072:pdXWtE7JepUP6k21XY+hroFmSHAl9z1muxARkhacdxr3x:pEvhonHAlZ1pARkEcz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194306, "uuid": "b9cb67f7-7154-473b-97c3-cb640609999f", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194306, "uuid": "38db83bb-cd00-4f94-8e35-549b2cc64d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194306, "uuid": "97c76772-8b70-4488-9d30-85a2c3351c12", "value": "CCS-202503123.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8d705f-f999-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741162229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162229, "uuid": "dfb1e827-13c5-41cd-8bb3-f27226c4cb6b", "comment": "Malware payload (LummaStealer)", "value": "30c1a6337089e68b975438caebc8f497", "object_relation": "md5", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162229, "uuid": "91ec43af-67fe-491c-b94b-eef0bb7cf5c0", "comment": "Malware payload (LummaStealer)", "value": "db15e9537c66a283d59f45e262018c45ef3fc5416b292b2c5269f4f9a4f10017", "object_relation": "sha256", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162229, "uuid": "26d29e29-c033-4354-9b59-3e55406f7840", "comment": "Malware payload (LummaStealer)", "value": "2cf2324672cf72b9bc1869633f3bf6904bb61011", "object_relation": "sha1", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741162229, "uuid": "948dc6df-ab61-4506-ba9b-a33055f35352", "comment": "Malware payload (LummaStealer)", "value": "4d08a1d1812ebbe8f934fe7bf0191d9891404511f24fbcf0c18ba0f7313de6d5fb3d8775073a6d6723e801eca741a4c8", "object_relation": "sha3-384", "Tag": [ { "name": "176-113-115-7", "colour": "#DC06B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162229, "uuid": "2645f762-263f-4c05-86aa-f12938dbd51e", "value": "T11CD54AA2A50A61CFD6CE17B89467CDC2682D42F5072469C3E86DF1BE7E63EC025B5C34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162229, "uuid": "43563b46-af4f-4ddb-9532-dbe21597672c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162229, "uuid": "c5841ba0-8694-411c-bdf8-ea753c15a042", "value": "49152:z8LHkXVgTDqB4QcGbVYljrnFL9gVysR2JwrZlhSMetwfX:I6VgTDM4tGbVujrnFL9WHDei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741162229, "uuid": "8b710065-19b0-4a53-b14c-e36bbf8c0b0b", "value": 2996224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741162229, "uuid": "bb44a58b-e836-4df7-ae1c-befe022efec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741162229, "uuid": "0453aadd-3ec6-41fc-9ebb-403aa734cb98", "value": "JqGBbm7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cd5832-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159909, "uuid": "e54ffc8d-0eaa-4cbc-9ac8-09ed82d10e54", "comment": "Malware payload (Mirai)", "value": "dfa2c4a3d25eeab911eaa216ba4303e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159909, "uuid": "0011e2fb-4c9f-4b60-b34d-fe1022d53a9f", "comment": "Malware payload (Mirai)", "value": "dc00cf8020ba7134efb103c9d30637793ed981804589bf2b081efde3ed61d9c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159909, "uuid": "f05170e1-c96e-4023-8334-cf031f4aeeae", "comment": "Malware payload (Mirai)", "value": "1e0f8c6ad0f58ef580c208ce23a77f753877b001", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159909, "uuid": "51ee3cbe-4bab-4ee7-a238-a62196f01449", "comment": "Malware payload (Mirai)", "value": "31e0dfe15452d709f1d49d965a6e5708fac281d009c90bf40666553b91761b724e2c117da09c12c6b571e1c4139294b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159909, "uuid": "79996e32-fec9-47ad-afcb-984496084e75", "value": "T16604881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159909, "uuid": "c4073126-2382-4d3e-a60c-14299c11cb24", "value": "3072:jg57kp7LHZwbq1YSBan1yvbysxr1uVSD2:jglkp7LHZ0Bqyy1CSD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159909, "uuid": "306f1ff7-d63f-452f-953f-f95034f384b4", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159909, "uuid": "eb0df6ce-b264-4c51-ac09-2b60df226340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159909, "uuid": "352a9b5e-dd49-4878-94a4-3bfa40807df4", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bc2e1b-f9c4-11ef-ad17-42010a9c0004", "comment": "Malware payload (SystemBC)", "timestamp": 1741180971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180971, "uuid": "c76c6c4d-fda3-4ce5-bb3a-a62778fcbdae", "comment": "Malware payload (SystemBC)", "value": "8c767708c9a9554c0afb504629e75ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180971, "uuid": "943e0813-40b5-4d95-a891-e09979663235", "comment": "Malware payload (SystemBC)", "value": "dcb373f73cc5e29881b6c97f753da1db91becee01b5eade03b0fd217d10b4e7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180971, "uuid": "11f6b072-a38f-4046-89a8-e9a80894c218", "comment": "Malware payload (SystemBC)", "value": "c65394806c0f77af880c7ff8a021bd4222ca3f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180971, "uuid": "b2ec65c8-e413-44e5-b38d-60d2e732817b", "comment": "Malware payload (SystemBC)", "value": "92c7e86fdd76022e259249c9f29780c0edf4535ceee1d695573aac3bb09b0ee3561f75e300a2006a83483847219a896f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180971, "uuid": "8af5a80b-bc21-4f4f-a554-939ce5670a08", "value": "T1C8753302BEF794B4E65F8DB8E2DB1570B374CF8C9168643AA88CB05D145B1CA9C948AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180971, "uuid": "4c06ed67-5c3b-49fa-99b1-696aa21923af", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180971, "uuid": "cb316211-25c6-48f2-91e3-1bc1c5a85aed", "value": "49152:R1aqCQ3KKia9icS8P80nPIIXQocVHmir6QmEGmNyRzs3Xn:R1aA37ia9iJ800QIXQocVHoEGV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741180971, "uuid": "6b8c52bb-6b2a-4acf-8cd2-0347159348af", "value": 1692768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741180971, "uuid": "b56ae385-4b8b-48f4-bbc6-69b2db762e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180971, "uuid": "a0041678-8438-4a98-a778-853595fbc6fd", "value": "SecuriteInfo.com.Trojan.MulDrop29.15967.25640.16156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b720e8b-f9e3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741194089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194089, "uuid": "1dfdf432-529a-4f62-93d8-529158a3d74d", "comment": "Malware payload (Mirai)", "value": "1ad15ef0367df3920f415c4c750793e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194089, "uuid": "3605c7dd-e1bd-4845-b351-5fb519e5dbe7", "comment": "Malware payload (Mirai)", "value": "dd29103a857ef59ef918ffd0886d55166cf7efaf7e0794339a2e2f3fc27d9aed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194089, "uuid": "01d11970-b199-47b7-84bc-ba4cf7d99954", "comment": "Malware payload (Mirai)", "value": "e7ce99727bfddeb6a8b477d0845075f17a9d795a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194089, "uuid": "8d0b851b-65c8-4f99-b56a-abdbc2c25fc4", "comment": "Malware payload (Mirai)", "value": "339567c486ef689a999f6cbfb064d2076fe099e1cd09d2c6a1fe53e91897673db914dca2767c949a1eae11c137f8cae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194089, "uuid": "313283fe-e443-4e9e-a8c9-982322ff22eb", "value": "T133F2F2B0EA4660F2C584AC30E21D425237569171F6DF37374AF901BCE4C58AE9ABCBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194089, "uuid": "9773d585-4517-43b4-ae03-d439e0308554", "value": "768:SYCBDLPeYqVRkF3jmQjsQH+Y86ucvtgWqaGof2WYR03U9:hWD7+VeF6MoMtgWtf2dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194089, "uuid": "ae300919-1b26-4f6f-a81e-c784d245ae60", "value": 36916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194089, "uuid": "41c7d810-e7b4-449a-8854-f17612b46236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194089, "uuid": "6fa21b48-92e7-4e79-bca8-28846e42391a", "value": "5r3fqt67ew531has4231.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cf9d98-f9c5-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741181354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181354, "uuid": "0704a6ae-09f0-45eb-a524-1c9fef43b59a", "comment": "Malware payload (SnakeKeylogger)", "value": "d37d06f3e369e4630dd7685fdc7aee2e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181354, "uuid": "47c51dec-cfa3-4622-a9c7-6641ed398d0b", "comment": "Malware payload (SnakeKeylogger)", "value": "ddf835dc80b3c1d43ec91588e94a80252a706b1fd8d3239855b43db0feb3319a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181354, "uuid": "86107406-76d8-4ac8-b3df-ae3b2b3dbd33", "comment": "Malware payload (SnakeKeylogger)", "value": "6505f75cc707f0f09da84a404c5fe8c983a47e49", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741181354, "uuid": "16b437d4-a040-4ced-9364-de90be1cbeba", "comment": "Malware payload (SnakeKeylogger)", "value": "2f88aa58cd3652877f375612e483f959d3000037911d47a44d62ee5824c43ad5958250cd9d18370ee0585fc54f4b60e5", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181354, "uuid": "b0e1215b-5267-4ae4-a0ea-f271ddac6ba6", "value": "T1CDB4236DFB48E3AC8A66B1D33D46A68A52501F54D2821127E71A7DBFD0C98E35EF3420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181354, "uuid": "2887ab58-13d8-4329-878d-4975cc79fa73", "value": "12288:WP9Yo2N5RCQtOj5+8VGqt/D7qYVMd+vCB+vsglZrI:cYtN5Rn8j5zcOJMcvi+scrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741181354, "uuid": "54c98b1d-dd5b-44f9-aba3-3f63663d6897", "value": 533168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741181354, "uuid": "9d89f8d7-24f1-456c-bfaa-203454f89b74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741181354, "uuid": "069379c0-0321-4bb1-a9c5-a03d41edd4c2", "value": "HBL ASNLRU-20241001 & 20241002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9648e3d7-f9e5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741194993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194993, "uuid": "254a2c61-a116-4a1a-97d4-de7b6d874049", "comment": "Malware payload (Mirai)", "value": "8614810cddb182e95aa2087a1c458e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194993, "uuid": "401cba45-efb0-428e-be9c-158319ddcac4", "comment": "Malware payload (Mirai)", "value": "def99e9242a13ed1150298e97ea04b411d8d7896e0857f516ed23fe6cfb43e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194993, "uuid": "71134f65-cb68-4cff-9765-7d04d71843e8", "comment": "Malware payload (Mirai)", "value": "d34382fe9d156d9b937ece9fa661d453239ac2c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741194993, "uuid": "a15c39ed-02b9-4333-8f7a-0ab33d29b785", "comment": "Malware payload (Mirai)", "value": "99bd49da07f299e2e701b519899efa24c48ce3dcad1d8ba6c0041673a6f7780dd505a2d36aa5dfe2525274bfe9dd1083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194993, "uuid": "88397d61-7d07-44c1-8de5-028043ce97d6", "value": "T155934B32BE712D23C0C6647B21B70761B5F253CA25F8C62A7EB20E49EF646403557AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194993, "uuid": "a75c5eee-9247-4f20-bcf6-3eb75dd4803c", "value": "1536:aPYSL9bbNe1A07PFZdaPfYaO2W7hLylM5CklKtRJlqxwbZnaC:Y9T/MdNVFLyl8CkaQwbZnaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741194993, "uuid": "9c159f5f-8c03-4f66-8113-1b685087ecca", "value": 97648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741194993, "uuid": "b1fec495-35be-4aeb-9a8e-6455a61fc31a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741194993, "uuid": "e870f265-f94c-4ec6-a0e9-c65240c3edf4", "value": "5r3fqt67ew531has4231.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd39f8-f964-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741139492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139492, "uuid": "c05340aa-2235-4558-b4c3-3d5a858f816a", "comment": "Malware payload (Mirai)", "value": "25abc444b2aa18567b2a3d17d66d9915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139492, "uuid": "00e516ba-8f1c-49f7-b0ea-539682d7a50d", "comment": "Malware payload (Mirai)", "value": "defba1a7e75e5a6f545b49215e641bfe8908992ce82d1c746ed10b0dfa025194", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139492, "uuid": "6fe1183d-efcb-4ab9-9f62-439644029ea1", "comment": "Malware payload (Mirai)", "value": "1e6600944cf961e1d44b986556297c2c88d3f2d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741139492, "uuid": "5aeaff28-8d21-4732-8035-397be6a51705", "comment": "Malware payload (Mirai)", "value": "eb8f65e8323bafc0a06a5964d061a40a1c5402605d565061a11f8f1b2b492069b8ac0aae71eadea5921f2aa8952c8287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139492, "uuid": "7bbfb3f7-d78d-40f5-9a94-4167eb5ffcb5", "value": "T18E332BC5F985A725C7C15677FF0F02493719878CE2EA3343A92D1FA177CB95A0E2A206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139492, "uuid": "56769570-c513-49ea-8874-66b97b66439a", "value": "768:hkwxzhdii3nr/7uGB2TqgFprNDpHeGXfO+ybDgVNIhIxeC+rs+4cqbJ6lftm6bE3:8yn3n2TqsboJ4s1RXgx6g+Iyx4+pDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741139492, "uuid": "658ab753-5cad-4dcd-86b2-6ab233b3ba78", "value": 54772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741139492, "uuid": "4b28e45e-a64a-472a-b269-6b55f870fcd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741139492, "uuid": "5bae1701-97b3-45ea-bb3e-16854ef1a957", "value": "cbr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf811c8-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199833, "uuid": "9b8e1927-1271-4512-a4ec-8175e39a6d46", "comment": "Malware payload", "value": "7117ef4e12fe0ca884eccd756bff2c76", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199833, "uuid": "16844644-620a-4782-88d6-fbe179283cb9", "comment": "Malware payload", "value": "df0537d551016d39bfc91d436ddc26307809cb658df1bbc563f86e72689ea553", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199833, "uuid": "56f6fbab-0e2b-4344-b088-85caae883759", "comment": "Malware payload", "value": "bb752d724c1fd5d1351ea52399d2013819f1668a", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199833, "uuid": "e5930068-fdfe-440e-99d4-5f506e78ba35", "comment": "Malware payload", "value": "3c23a1ab2da48de575ba61fbdab753e9478b4c172a7b395a9ddf5913da2a904601def38a8ef2cfb06c3f1006c7378374", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199833, "uuid": "8952e877-f32f-4422-b954-807096e80778", "value": "T11BD533C10BC80040FA8DB739BFAD5BBDD3F38A1A56D0C6277A88E0DD2F75E219965151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199833, "uuid": "02ec8bc3-b98d-411d-a67b-647e3f19f81e", "value": "49152:qjQBC72DtHnv57CE7hB+aJhWa2lhEv+dbF1XHmjHdfYc/UEM2/W:s72DhnvJ7maJh4Ev+hPEHdvUEFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199833, "uuid": "3b509da8-ad83-484b-a769-214040cf2d69", "value": 2820842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199833, "uuid": "31be8e37-c1c2-4d18-8689-8aecdbb75d96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199833, "uuid": "b172ebd7-3c90-44b1-8319-f136edce0c51", "value": "634400CITA_596386089487.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0df379-f9ac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741170686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170686, "uuid": "32d597a9-a987-48b1-be59-53a91817f89a", "comment": "Malware payload (Prometei)", "value": "b890c4f6477743038dd5f8dafbbf0275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170686, "uuid": "dbee1bc7-feec-40ee-a220-f82fc32c214d", "comment": "Malware payload (Prometei)", "value": "dfe415e6f22bde7c23929ef0d76d280baba2495c347a18fd1fcd7d2e290515a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170686, "uuid": "aa9d110b-46a8-44bd-9ac2-a2352ba08ba1", "comment": "Malware payload (Prometei)", "value": "d8662ce9bac7703af3249377dce686ce95c56528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741170686, "uuid": "71a398e6-147b-486b-8861-46e9cd9b348c", "comment": "Malware payload (Prometei)", "value": "cee8f93a6445395eda497a9b91df777587636e927106d0341c4ba256ea1ed85c34f111b10e83950df9de56c4ebc456c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170686, "uuid": "f359eabb-af2d-4a6a-9aa3-4b46c3487137", "value": "T1A29423F31824B3738A2C3A3EFF609E05D6A9573CE55927161A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170686, "uuid": "ac97d975-ed4b-4668-ab9b-85f6d0feae4b", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSV:W4/y+qaBUZJAdVtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741170686, "uuid": "69ad3e6d-faf8-4516-bd7c-8f6aa781bf4d", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741170686, "uuid": "5de6a960-9200-4be5-857e-56b8e1eb1e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741170686, "uuid": "9df1a4b4-ad71-4d5d-99f9-150e1e54b8d3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba1d7bf-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741155998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155998, "uuid": "910fbbc5-71a3-4ee3-b965-0a6e8662480b", "comment": "Malware payload (Gafgyt)", "value": "c7224d4d44d0d09fb4b2c35c1bbde479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155998, "uuid": "22d12f8c-78bb-4200-8cdb-0b5e661e9730", "comment": "Malware payload (Gafgyt)", "value": "e3586d92ddbe3e4b1c8bef71906dca60d693c8bdc231c041231292b6d08ce054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155998, "uuid": "efab2783-92e2-43d0-bf12-ce7c9c801f60", "comment": "Malware payload (Gafgyt)", "value": "beea72eaa2e8ab26df217fccffbfcb4bdb8485fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155998, "uuid": "9a570201-c1b6-4c9e-ac6f-a990938dca9d", "comment": "Malware payload (Gafgyt)", "value": "ea4c8b8bd7e921cfd7cfd7e7684cfdbdcb42b7eb80d6ec9d43603d09b792ea5006d4d15d06d09f7759123dfadd56b66b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155998, "uuid": "a68a6c07-8d28-4668-a1e7-d4d4dc4442bf", "value": "T11B832B42E652C6B3C4830AB602AF6B160A32F9AA4E179F55F31D3DF49F124C97127F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155998, "uuid": "f205f567-6590-4191-979e-4f37506a18d5", "value": "1536:3BfDbge/Bexx+4WiM3wuvsCH+qCuGH2PeJi75hqu975Xs3r0OzRPF+jHeN:NDbXBeKlVAdCH+qHE2D75hquvXmr0Ozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155998, "uuid": "bb4f4427-0fda-4490-ad7f-71aab4440d97", "value": 82006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155998, "uuid": "5a7b0872-daff-4d5d-9b1d-941420046b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155998, "uuid": "5b0acdcb-7c98-4800-b25d-927a556c2681", "value": "Okami.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e588c5d4-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159907, "uuid": "17c7f01b-4a22-4f94-89ca-e62d9fa88480", "comment": "Malware payload (Mirai)", "value": "06518e953788f26065fdcba1fe175420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159907, "uuid": "7e6e669a-61c5-4e8c-b810-1e5f4937f988", "comment": "Malware payload (Mirai)", "value": "e3772d42fcaf36bab152c036f9d9f298b1d8fcb485500ea4bc890aaa4499d1d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159907, "uuid": "9c89aa55-3264-461d-92f0-a2f4823f5635", "comment": "Malware payload (Mirai)", "value": "b05360031df7de951c536b93ce8fa0356b1f6bdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159907, "uuid": "bfe25530-0999-4e97-8d6e-924fe9ef400e", "comment": "Malware payload (Mirai)", "value": "53e9602d0bfc31a79ec5ef154bc685ff628b9219b0b61a80f648796634b3f0fe8c56b340373862359243d0edc45ce808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159907, "uuid": "a98c2efa-5f67-4e32-b952-1eb6269d703b", "value": "T117D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159907, "uuid": "cfab04c2-e0ad-475b-a149-8847b9ce7a0a", "value": "3072:79eSuygEPjt6qkWj6dKmDnYMb0gBd/gQyVGsdqml6Taj:79eSuygEPjt6qkWjpeH2laTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159907, "uuid": "cf2c8846-1895-43ae-ab51-6f7f94155d73", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159907, "uuid": "38a05d60-fd73-4c3b-b996-a6f94e2fdc0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159907, "uuid": "05032e86-41b9-49ab-bfac-6a6ebf082495", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98d9710-fa16-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741216071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216071, "uuid": "c358e261-1582-4262-a171-ff27becb30cf", "comment": "Malware payload", "value": "c84a44b5677d8ecb023cab6b1d16727b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216071, "uuid": "04876b0b-d9fc-4ae4-90d6-ae2370be66ba", "comment": "Malware payload", "value": "e39cc93bdb0308e81b039adff08f984e5a8ca9cbe9f20adf424aa8bf31d57c1c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216071, "uuid": "d4d4672c-85f0-4abb-a5e2-3063cbe3b415", "comment": "Malware payload", "value": "12beb1b85db362b553f820f72cb34296a9cc6c4d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741216071, "uuid": "a63f096f-46bf-4af9-8d11-c0caf29c61af", "comment": "Malware payload", "value": "0bd21e69add393445961d8840ce3df16d135eb9ee1358e7413cc4b3716bef5857e18dcf561af0385b163131a01cd865d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741216071, "uuid": "b9024ddd-2afc-4540-af38-f2ddae3ba054", "value": "T1CB3612D03785C627D94719764F5BC7A92628FDD1AE31B08B3B60B72E4B38EC35928741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741216071, "uuid": "088ecc0b-8e2a-4133-a77b-2c22385a43bc", "value": "98304:cplNnaGcD/Eaqlkb86yoovTbi27g/zP86HzPiSCfR:JD/Zqlf6YLe27g/zPNPiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741216071, "uuid": "d7a89258-4803-4dd8-85e4-28d99a8b3eed", "value": 5238784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741216071, "uuid": "8c5d4de1-9fa4-48fc-a03a-4857c96b78a7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741216071, "uuid": "cc78f289-8212-4d0c-8617-9499d33cfb6a", "value": "setup6541.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15199e9d-f9ed-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741198212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198212, "uuid": "db0a9eb6-e857-4ceb-ae5c-ff7a85883022", "comment": "Malware payload (DCRat)", "value": "4f1781660062aa5a19dcd587ceb713a6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198212, "uuid": "9a1da882-9053-40fb-96f8-4fdfcd2d9c99", "comment": "Malware payload (DCRat)", "value": "e47bfb3f98ec0fd10cde8bb0f1488771f6aaf8e0c8168db4bab6da73060cf726", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198212, "uuid": "5ff706e7-08a7-4496-955b-00f2bc13b65b", "comment": "Malware payload (DCRat)", "value": "83765bf6f00ab999ce57c0a23c5e8a08727dd150", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198212, "uuid": "596b60c0-68c7-452d-97cd-96e91936087d", "comment": "Malware payload (DCRat)", "value": "615ea9b03f2c80fae7942678c7e08d412515e8da15a73eeb07ade379c90f3c3496fef7fe9e7c1bcc4c7aca8743163ac6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198212, "uuid": "c215e01a-79b3-4cdc-be3e-0fcf30bf9275", "value": "T1A416333152F0CD47D8E28E3616467EBAEAC5395D7E0B11013CA4FEE889308671BB664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198212, "uuid": "a7ee037c-0bf7-4886-9229-7872ddbfa5fc", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198212, "uuid": "e5363683-c719-4145-9a31-a20f21df7192", "value": "98304:SmObPHBLY58D1xxlkPP9JVC75KgcqXOlbrXBFhoS2:nOb/BxDjkHI75TXOlbrR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741198212, "uuid": "c147a4c2-4a7a-45f7-93fe-e1a4834dea2e", "value": 4094464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741198212, "uuid": "8b3d297c-7b23-471e-b430-9efcf9cc92ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198212, "uuid": "a320e934-be50-48dd-a374-3e8a027a43b9", "value": "4f1781660062aa5a19dcd587ceb713a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042fe624-f9bf-11ef-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741178427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178427, "uuid": "75f99bc2-c8a8-4e27-af56-6156e19b1076", "comment": "Malware payload (GuLoader)", "value": "6907177f927c1938c734040d386da280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178427, "uuid": "d3aef0d9-e596-4427-8a16-986b7873f87c", "comment": "Malware payload (GuLoader)", "value": "e4da98104281d7be4d50895dd76d5aeefa7bf7f25514a1581c7466bc694c3ea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178427, "uuid": "6581b230-21ac-4114-98c6-8481fb85f12f", "comment": "Malware payload (GuLoader)", "value": "70fe16c259d1ff1b9dac5c35696229d200052c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741178427, "uuid": "68c3041e-32d0-4577-b359-2760d0c40c33", "comment": "Malware payload (GuLoader)", "value": "18a36c045e4cff08432a00742647d141944650bb85874d60453e7e55155e003e2ab8ff7263d9b4c2055b2e19898bb0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178427, "uuid": "5f7adf65-2c8a-46f8-8abe-71a4ed3c778c", "value": "T1C9D40241B641D6E2E19A4A710927CF3A0BF67C7997102A7B374DBBEE29B3170410B91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178427, "uuid": "f9a3c14b-5044-4b0f-bb50-bacee88eea70", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178427, "uuid": "ab11c3f6-01a7-4152-b2be-f89b98c39c75", "value": "12288:X7BlUtUcVx0hQOrrteRy3WvHw8kSZtW8l0/jpQG8V:X7k7r0hltQc2Q8TZZ0FQG8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741178427, "uuid": "968b0fbd-7087-431c-8c31-46ea6ed52dca", "value": 618286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741178427, "uuid": "616c4680-bfa2-44f2-9f87-eb08795464e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741178427, "uuid": "2f529d93-7b4e-44e9-bfb6-1cff740feb9c", "value": "Zamowienie_522025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806af1df-f98b-11ef-ad17-42010a9c0004", "comment": "Malware payload (Sliver)", "timestamp": 1741156302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156302, "uuid": "71a00ecb-4db1-4e0a-8993-f9dde56d86dd", "comment": "Malware payload (Sliver)", "value": "85a07a4ea1c3f4bcedd0faf8cca9282f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156302, "uuid": "065f8a2b-46fc-4a8c-8699-fe58a325bb41", "comment": "Malware payload (Sliver)", "value": "e5bd337f48965ef3f1e8dae2cb625c01b6fb9e196f8c77af6fc1613273456aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156302, "uuid": "6d71404f-7adf-4776-9b71-570a8c20f6b7", "comment": "Malware payload (Sliver)", "value": "bc9e3bdf7003bf54641b92f567308144ce7c2df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741156302, "uuid": "d6b7adaa-92bc-4e34-a955-d7602c816b56", "comment": "Malware payload (Sliver)", "value": "96272835f868f994d33fe52126c2796af91c10d77439c52286ba7e8def6674d543c1810998f24e7238a58bb84cace7e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156302, "uuid": "b0317a2a-84fc-4ccc-a5f2-1efd05421754", "value": "T19C26330701403AB9D9F63E04F4B627969EA3D50A70ECE315F36AD149B3B8EF32911679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156302, "uuid": "a41fb9e0-f9c7-463a-aed4-7c894d32e227", "value": "98304:hzNZP/HJxTmLEtY78hGYRrTMo9TAtD2vnsILyy3bZCcwuWaWhe+QN/kuTNz0cRmE:LdHjTPFGU/MuNfrgif+VIjDFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741156302, "uuid": "81267cba-e54b-4820-8d8d-aebad207b684", "value": 4741036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741156302, "uuid": "cdb5dce5-66ca-464f-9af9-e9119e6adae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741156302, "uuid": "150a70f4-f6ba-4f6f-8526-a275555fd19e", "value": "har", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a564c02f-f992-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741159370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159370, "uuid": "493d8947-08a5-4d73-a9a0-d43e30cc2d10", "comment": "Malware payload (MassLogger)", "value": "d45fff48d75acf82385ac74580662c30", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159370, "uuid": "c4a6c68b-d5b5-44ee-803f-54de029e8069", "comment": "Malware payload (MassLogger)", "value": "e6a62cde2fa594e289dfdd4247f068ae5dc523174646615b312a20af28e90487", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159370, "uuid": "d53ca180-28ec-414a-904c-24f0db0db0a9", "comment": "Malware payload (MassLogger)", "value": "98da0ec9c1e4704ca3fe62b9d29396b874f8fa30", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159370, "uuid": "bbcd6452-9570-4225-9811-201163a5aefa", "comment": "Malware payload (MassLogger)", "value": "1f69217bf42ec87ed7405c42cc061d71f1ce9db977030c6520353e134fd9f3892396a2b1a25be44ff99611bcc6363add", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159370, "uuid": "f5acf21f-c1cf-459b-a408-0ccb2ab62c48", "value": "T12FB401AC6B19D02BCA905B795E32F378257D0EDCB802D217CFDDADABB966E144D40183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159370, "uuid": "e0f945ef-ce5b-485e-bc5e-1b9669923925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159370, "uuid": "a0eb7075-2ce7-49c8-b022-7e64a9f2865e", "value": "12288:Q/f4pm+gvydCj1vtBky9FEKY/MKNH0byzCd/:cM6vtBpEL/MKNHWd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159370, "uuid": "1683b2b8-0fd4-49c1-9631-550bed060ad7", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159370, "uuid": "00efdb40-4847-4196-b810-e60f38121f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159370, "uuid": "23cc9689-f8b8-4f6a-81fc-b81cdf141d42", "value": "DHL Shipping Details Ref ID 446331798008765975594-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dcf7b0-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741158277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158277, "uuid": "76db4ede-ec8d-46b2-bc12-b80f20898a7f", "comment": "Malware payload (RemcosRAT)", "value": "2c33f36340ba47eee4357ad621a5d49b", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158277, "uuid": "5e6bd7e5-3715-47ae-9df2-650f565652a4", "comment": "Malware payload (RemcosRAT)", "value": "e6ef05978d159874c5094d981b4243233c592f91468bfa7a3eb2341d57e8c203", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158277, "uuid": "307b4503-2383-4333-881b-4f092655d05a", "comment": "Malware payload (RemcosRAT)", "value": "abf8d2e3ce8842a993170d2772dd5fa696c03e73", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158277, "uuid": "e925cadf-f2e4-44ea-971e-1ad5d756c3d5", "comment": "Malware payload (RemcosRAT)", "value": "dbdacebab3b980736b42148bb537b21dd13c61b34f469628c307c5bedf8995691647e26c75901b9ece0193ae3d8e7602", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158277, "uuid": "af55c2b1-b145-4c10-a945-b00961c31c14", "value": "T16D235DB8C5160BE42D7737E48460B418C264CDB9293268FFF9FC0A5A7507C5C6EE639A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158277, "uuid": "62a3a37a-9a51-476e-a6b4-5b84eeb6f533", "value": "768:uqibh86jpnTM6jWAW1R7uzXe2udjRsW8+nqht8vHMmkDy:uqIKIYmWAW1gEj38+6t8MJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158277, "uuid": "6ef76fc1-4b84-4fee-b2d8-33bd0a0279aa", "value": 49691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158277, "uuid": "ff394203-4448-4fba-bdae-919d75829daa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158277, "uuid": "01772940-208e-4924-aca4-3c60e0005b8f", "value": "PEDIDO DE OR\u00c7AMENTO (Universidade NOVA de Lisboa)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fec3b95-f9e1-11ef-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1741193184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193184, "uuid": "3fc61b02-b31b-4d7e-967f-bf7d3310c2ec", "comment": "Malware payload (SSHdKit)", "value": "83af5e2cd784ef09877fc0d4f819edba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193184, "uuid": "92dfc1c6-763b-42a0-8900-3d94ec08cdb1", "comment": "Malware payload (SSHdKit)", "value": "e814e0f634e38c742e5b54d1a01d830f3b7801472c34a04342a36e14abf8a504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193184, "uuid": "bf6b4692-891d-4a64-b196-abf106445783", "comment": "Malware payload (SSHdKit)", "value": "3132c771e9ac80be1c7704b084187d67400b081f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193184, "uuid": "5413bbdc-9f71-436d-8954-4bac201851fc", "comment": "Malware payload (SSHdKit)", "value": "40e44783667efac4f027b06f942fd104f3bfc78f739d5bf7eb1ac924f5af66132d07b79ee712aab6e5802e2ebab4f460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193184, "uuid": "f98a928e-5f88-4501-84c4-ed87a2a45ec7", "value": "T148356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193184, "uuid": "163e7fa2-83d5-4512-a0f1-88b3f8e5a089", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUx45TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO38GTfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193184, "uuid": "47274ca0-22fe-4caf-a3cd-94d5fee35625", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193184, "uuid": "c1480914-bcc2-49f1-a9a4-5f7a22df1d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193184, "uuid": "bfd163c0-98b1-492f-a9cd-02c8c7c619b5", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eb3ee2-f9b8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741175776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175776, "uuid": "ffa87228-f9a6-493c-9138-7904670478ed", "comment": "Malware payload (Mirai)", "value": "23b1623fbc26785d39470c28d460f5a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175776, "uuid": "09b030a3-b610-48a2-84fd-1de98f97e1f3", "comment": "Malware payload (Mirai)", "value": "e8a6e88760c40cc1ee0735a062d4bc0fe923b9735f8e8d953d3b34615abf1f7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175776, "uuid": "f79cfdee-7fa0-45a5-86b8-ad611057aad5", "comment": "Malware payload (Mirai)", "value": "6bac7b784c247136dffc7231a3fff2dfb83b0790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741175776, "uuid": "1ce12a84-2c9c-400e-b3b9-a59cfda911b0", "comment": "Malware payload (Mirai)", "value": "cd2cde25e007a9abc919039411bd5cb3c8df79c3d7f54591c8f233ec7a8e5a84348aeaff21b4a1eff2c809abfb166391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175776, "uuid": "109a38ab-9543-41cf-a40d-37869741a2a9", "value": "T1C4F339D7F800DEBDF80AF73B08130919B130B7A154924B3772577A6BED3A1990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175776, "uuid": "a61e39ee-de17-4955-a043-10eb6501bb78", "value": "3072:g+Fwj6TkTdR9s8FE2IyM7jtxR5/Ut4yITYrsYRVTjbi2LPqQzgT:EG4ZrIyMPtxR5UtEksYtLPhgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741175776, "uuid": "d59ad112-02fc-4b9e-9e67-ec29c8140433", "value": 170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741175776, "uuid": "baef2641-d667-443b-9151-0e040d8bcb0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741175776, "uuid": "f81f2a56-58f3-4167-b6b0-b1b430772bf2", "value": "vjwe68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1856ae-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741159678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159678, "uuid": "5190d78c-7ed2-45c6-9162-87b5fc548a65", "comment": "Malware payload", "value": "cebe75cdaf2271e30a0c9d87e1ea9d78", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159678, "uuid": "28e60f29-7917-4c4e-9a07-e798affc8c36", "comment": "Malware payload", "value": "ea9664afee312ab850bbfa5e00c545d40fcb77b40eccd408562c96829b2a2097", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159678, "uuid": "1dcee0ac-7077-4f15-aa49-9163f1f08b32", "comment": "Malware payload", "value": "a94b32d4a0a445968d6e77de78b04d9127b5b43f", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159678, "uuid": "25aeb339-75db-4463-98ae-ab8c08ecf522", "comment": "Malware payload", "value": "56e21c61fb7dc80e9e4441e8fc627855ccbf1660dabe739ed5f839775cd151601a639c0ad551189c13a7da92a649948f", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159678, "uuid": "d76a0c93-8dd6-4703-b153-e7175cf22bd4", "value": "T1173241CCCE9B40C6E71DAB895B86D7925B9F6A1C270F46C30D50C247276FA89D829F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159678, "uuid": "26b67eae-a806-488d-9ba5-298bb968c470", "value": "192:kh1qAIWI4smVbVUwsmxvoTsRiCHayWV1yK:Bt7gbzxvoTA5HfK13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159678, "uuid": "ee0f8907-a504-4367-851e-c310569d2722", "value": 11414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159678, "uuid": "d3093e7a-6d28-4988-84d4-21127006ee98", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159678, "uuid": "1c624d62-9756-4131-a7dd-4cc0763daed8", "value": "TOUR PACKAGE 022.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49830fa7-f9ba-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741176396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176396, "uuid": "c357b4cc-60cd-46b7-b139-bc26523d3f2a", "comment": "Malware payload (MassLogger)", "value": "78ec5a1e11ee68c95a5e339fd492c90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176396, "uuid": "af0028a6-94a5-4d27-82e9-2150db818615", "comment": "Malware payload (MassLogger)", "value": "eb43ef748d41451eb6cbbf8ca967116280e754d24122b2961472f90c8c00aa9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176396, "uuid": "67d900ca-d9d0-4736-bfc2-54960d5b5d35", "comment": "Malware payload (MassLogger)", "value": "8423eca2ecf74c50f6f688d0555adf9b0a5ace2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741176396, "uuid": "780c19c9-1bb4-478d-b449-618e912205f1", "comment": "Malware payload (MassLogger)", "value": "d830b495d10299bc6cc6e2b6273ead55e8c3c1f296f62d63c01f89d2d994c0d5046896e0f63942222c607fa20292ebc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176396, "uuid": "5fc61447-afea-4a70-8e40-04a01ae7ea54", "value": "T17BC4E0642269EB17D97A5BF80931E17453F92DED7811C21A8FEE6CEFB862F044D10263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176396, "uuid": "2f356a79-7dfe-4c64-89f8-519c8cb7ab33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176396, "uuid": "d825c8d5-0091-484a-b5e1-318093481990", "value": "12288:ejz9Mpm+gvyDcOE4R2629epTtir94JDGFlxPT:4z9LwoyKkpTc5MDGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741176396, "uuid": "bb8e6fe0-21ab-4d41-9c0b-a060b144277c", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741176396, "uuid": "0ccf3c3c-438a-43d8-887f-fdbd745b6dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741176396, "uuid": "8aaea8d8-8099-4dad-bda8-bfca2ba8adb2", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d500758a-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199823, "uuid": "9643da3e-697a-4d8c-a0b7-a4e5eb822d0c", "comment": "Malware payload", "value": "fa0c8f356ce969849f8787c26d10a9df", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199823, "uuid": "3e056435-f5ea-4ee7-ac76-931bb9e48140", "comment": "Malware payload", "value": "ef23cd725282f4621a29ed4695d7099b892ecf5ab2e597ba0df4cdb9dc184654", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199823, "uuid": "1d3e9c44-424d-4d3a-a1e2-8adad781dbf3", "comment": "Malware payload", "value": "fd4da6a4b3fb56c58ef095552108498218c79f8a", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199823, "uuid": "c90e4244-8a1c-497f-9f8c-07f7aa28148b", "comment": "Malware payload", "value": "6dadf6c50d711e8723709997adcf767aeacef58d5d2ea139f3a24adeacad648e47f55fb0a240d7c73006d39c5ed985f0", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199823, "uuid": "45c36db3-27de-4e4f-90b6-a759232fd3c0", "value": "T15CC533913FC47856E2C47738FED98FCFD2E251965F519263E6D0A9288F02281F33864A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199823, "uuid": "bedc7e04-5444-4eb8-b79c-f3476e29644b", "value": "49152:OtuRH9TXxMX7EE2tyA7EpYE5BWcMUDna/3Kdd4pI0wOMB3uJcL2/y:OtodTXx22tf7LE5hMUDa/3KcpVu3uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199823, "uuid": "03f86fa9-67a9-4099-a806-fea9d79eddda", "value": 2702580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199823, "uuid": "aae79533-086d-48dd-b24d-ce387fad29a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199823, "uuid": "f336490b-0b8b-4a33-8e16-6e32dd374209", "value": "565300CITA_024811038596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db9c503-f9c4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741180752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180752, "uuid": "48570f85-64bd-47f6-b415-f13bf10384b1", "comment": "Malware payload (Formbook)", "value": "80d4e5cc570a2d4ba2b2f238a8837db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180752, "uuid": "b655286b-c4f2-4c4a-8a58-f9014c026050", "comment": "Malware payload (Formbook)", "value": "f2042d162f33fa6527abd2dc4e593a6f89215f903b6a4afe9b57da3f6da7c6d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180752, "uuid": "28540894-953d-4d39-bb13-bd0bf831e4e7", "comment": "Malware payload (Formbook)", "value": "1ffbab3b4dd1e7ad91248bf97662c153e7a98a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741180752, "uuid": "cf2e530a-c1af-4d46-bf80-94dc80814134", "comment": "Malware payload (Formbook)", "value": "47bee7cc491a7dcd981f81b54194866513d09fc3e0b0dd57516ee173889976b7ff1854bfe77bca8ee28021c1e8fd482a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180752, "uuid": "a674a164-9f83-448d-b621-ea40e2924665", "value": "T18E65E007FF8B89F2E2815772C59B491073E4D58A77ABDA0E3C8A23E648437BADD40157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180752, "uuid": "9d941d25-5653-4b45-aa51-050131e8030d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180752, "uuid": "8944d136-5558-4d83-9bd1-572ec896305f", "value": "24576:lsB3WD/hMiOkmtHwOemxd45eNv6j9HRlGFehdTuzMBzPXpjLTgqvAxM2APpy5TDO:lsB3WD/hMiOkmpwqxuU56xhdTvBzXpPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741180752, "uuid": "01b2d9c6-78c8-4fa4-b0ad-895bb1696ff9", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741180752, "uuid": "67643a7e-2995-4507-8fa4-99d968576b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741180752, "uuid": "b99304f1-4ba3-4cf5-b206-4ec2ddeb6184", "value": "SWIFT00983928932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f721d2-f989-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741155373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155373, "uuid": "05c1cffb-88df-437a-aa29-2858aa26cede", "comment": "Malware payload (SnakeKeylogger)", "value": "f3ec574cc166a04b656fa558fe045007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155373, "uuid": "da696212-9a67-44de-af75-5c0f5ab8c206", "comment": "Malware payload (SnakeKeylogger)", "value": "f2204233cd8e2c7590c07fb3d468c25dfa7a31597d650352f352be21ac652ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155373, "uuid": "17e25ebb-7877-4f48-8459-758185be663b", "comment": "Malware payload (SnakeKeylogger)", "value": "3b926517587432ce7d6d175bf76869b2f547d934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155373, "uuid": "6118dff5-32d7-4148-b1b0-f7f2e767e570", "comment": "Malware payload (SnakeKeylogger)", "value": "e80aaa135778c4e3a7b17ed6e865121d548693380dec0575a5687c0f4078171ebcf27a62cfe22c417e800f08ef82f13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155373, "uuid": "95d2ecf2-9d58-4cc0-a90c-ccca22b62a3e", "value": "T130C401BCA609E01BCA9593740E31F2B4267C0EECF802D223DFDDBDABFAA69515D14151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155373, "uuid": "235fdb96-2e6d-47ce-aeea-10fc4bd3c122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155373, "uuid": "161a7e6c-23df-4098-a174-6af28d8ce133", "value": "12288:o/fHpm+gvyPdn5RwQti9l+80oqt/D72YVMn+HC//eBjX:fOn5RJc9lz03tM+HyW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155373, "uuid": "cac558fb-81a1-4973-a14d-2ae5e76d4b84", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155373, "uuid": "753fe0ed-9a06-4360-8839-9685a9c49814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155373, "uuid": "77867be6-5d92-48bc-90ff-12cda10036f7", "value": "SNKO05B250200012 SNKO05B250200023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea18fbfd-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741159915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159915, "uuid": "7902f77b-ced7-4474-a47a-7ca8c91b3efa", "comment": "Malware payload (Mirai)", "value": "1327ccce7d088185cb71987f1ace68dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159915, "uuid": "04a741ad-219e-4469-a664-23b172a016f5", "comment": "Malware payload (Mirai)", "value": "f3280586ce97dda47ef415f2f9f9640ed15f520c1d752e4ad1fd829b0951bb5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159915, "uuid": "f420979a-79d9-40f6-aee1-da6bb3f32f71", "comment": "Malware payload (Mirai)", "value": "866b3a34a816ffd0fc5b808952b2446ecf788e6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159915, "uuid": "edce68a7-c25a-4503-8e4b-14f5fddf3790", "comment": "Malware payload (Mirai)", "value": "41b39518d929b3410c7622788fda9c4450ca1a278e0d0480dc1580736fe70e4f4ff6d709356b8c292ae3f4b1d26d0eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159915, "uuid": "498abc6e-f630-49cc-9e29-0eb42368313a", "value": "T1E0D32A06730C0A47D2632EB03A3F67E197AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159915, "uuid": "c45ace2b-0a4f-48eb-8686-fa5ebf287b96", "value": "1536:hnroGHNTnZNJlIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqANz7b3v:HNkUiCxttqCwZ7lLhr0/3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159915, "uuid": "6dd768a9-ce93-4d77-b175-39e6d4ef3406", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159915, "uuid": "fb161c6e-567c-45c8-9c68-74921b163988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159915, "uuid": "0939cadd-0898-42a4-9347-8c1c8d802dc5", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4890f893-f988-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741154920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154920, "uuid": "fc4d8b2d-bfed-452b-8c4e-2848db58a861", "comment": "Malware payload (RemcosRAT)", "value": "efa99a14cc37d38f81657dc8205e0a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154920, "uuid": "b1c44f10-fde6-413d-92f7-8efb0f025f22", "comment": "Malware payload (RemcosRAT)", "value": "f4048c147a758eb5413a885a12c69fa5cd1b61668ae668942bcb7892e7f62584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154920, "uuid": "bcbff293-37da-438f-aae4-eb729073bdad", "comment": "Malware payload (RemcosRAT)", "value": "d488f73af3fc96272ed24d44a8d74f8198d1ca5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741154920, "uuid": "dafa49ec-95ab-4361-8789-09e172f4b4a8", "comment": "Malware payload (RemcosRAT)", "value": "ab10e7190889219e97f252473676835433a7ff77592ab3d967189227f5b51ad2135ce2132776f222c55d1be6bfc98140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154920, "uuid": "9bc0c406-48b9-4247-a94c-874fc6acc823", "value": "T1E62512685B86E017CE959B780961F3B417BC4DDCBA15D2139FECBCAFFA22E140C58192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154920, "uuid": "55df208c-c4d8-443a-967f-6171e47be7c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154920, "uuid": "7bc9ff17-8022-4cc3-9c41-6891866cba8e", "value": "24576:T75sVn7R+HyQLi4flhOrIF2BX9zXKeg6AxytCG3rh7vdm:TaFwHyQLiSeqwx6eskxbh7vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741154920, "uuid": "63a3249e-d4dd-43dc-a9d5-f9a3fc66d911", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741154920, "uuid": "86ee4e75-9182-488a-bd8f-d30500c75827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741154920, "uuid": "1b70b633-dc90-46f3-89db-7874d903efd1", "value": "\u54c8\u5176\u5fb7-ICS2\u516c\u544a (00000002).pdf.................................................................................................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919f57d-f967-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741140693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140693, "uuid": "01562c0e-d566-4689-8366-4ed71dfd9ba9", "comment": "Malware payload (Mirai)", "value": "facd9101ca534d8dd4253dda31ceef2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140693, "uuid": "c2ac43d0-9ecc-43ea-985c-930d5b27367a", "comment": "Malware payload (Mirai)", "value": "f485ce7aa486d25b5514ece85c32bd854e9d11402aece94f2a0ce150f067ab20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140693, "uuid": "5fec05c3-5ba3-4055-8e07-88b5d2022ccb", "comment": "Malware payload (Mirai)", "value": "84ba68f6fbea6c48fb3fe57555c61932bedd0a0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741140693, "uuid": "c25ab8bf-423d-41ed-bc87-911071b1f57a", "comment": "Malware payload (Mirai)", "value": "a44f0c502e3e3987102323fd3b29b30437321a44a8b1cd58c838d8f851cb1831b3e64670b3facf10c465b7c976facc83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140693, "uuid": "44e7b048-0afb-414b-a4d1-23feeb9c22e5", "value": "T1B9A32985B8415B21C6C612BBFD2F008E331297ACE2DE73229D245F6077CA95F0E67E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140693, "uuid": "03ed5036-9579-4397-a89d-5712ea6c3a07", "value": "3072:vcpSFcL3NPw4BC2gxhLJf8a5pZyUSgQ+zsRt:vcp+cL3tw4ATJkaXZyusz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741140693, "uuid": "2e3daf91-29e4-40bf-b1d2-e56563487621", "value": 103728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741140693, "uuid": "452e7c23-c611-4bb3-9270-716ea22451dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741140693, "uuid": "c09619c4-7917-45b1-b3a7-6555cbbe7e97", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc8fdbb-f9a3-11ef-ad17-42010a9c0004", "comment": "Malware payload (CobaltStrike)", "timestamp": 1741166820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166820, "uuid": "8eff271b-6b52-427f-9abb-93c5828376c4", "comment": "Malware payload (CobaltStrike)", "value": "af5be1f9a52c5602b3d6ac587a6ff8c5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166820, "uuid": "60a375f6-fe79-4215-8b6d-a78190e3ffb6", "comment": "Malware payload (CobaltStrike)", "value": "f5b780fa3a4c36a7856253ffa998c95a295b70a233c4d803c5fbed043f56f645", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166820, "uuid": "6926b8d8-c54a-42d4-9bf1-cfa07766634a", "comment": "Malware payload (CobaltStrike)", "value": "3dc32073f709bfb5ef3c08e8c7bc50c6ace3f641", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741166820, "uuid": "dd0c9776-7a74-481c-b31d-dbf0a029c264", "comment": "Malware payload (CobaltStrike)", "value": "99a9810f9f8179f385fc0a3ae676134a06d73679ec370a258fd4ac131c1bbd4e7a07cb17bf7094152915b4157b9a16c5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166820, "uuid": "fa934c70-bcc4-4de7-9739-0f491c82e301", "value": "T1F3A45CF2D4EB5BA9F488687BBBE9C613793145FB70764422F2B7510E6031A6DE34120B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166820, "uuid": "b2987d18-a32e-47cd-8181-fc243a73a805", "value": "af14f532602a45e1da5645390bf3deb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166820, "uuid": "5ba443e2-c48d-433b-a915-3f71e33f3eb5", "value": "12288:iGgcN57a8LObbgLDnLIJBSNLbbQgzi+bU5Np:XT51sSjs2S9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741166820, "uuid": "6eee66b8-ba0e-4161-a852-a07c576b128b", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741166820, "uuid": "1cf64bf4-3cdf-4af9-9aff-5e74d0e64cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741166820, "uuid": "c2142090-2abc-4ebc-930d-c8fe1c930216", "value": "f5b780fa3a4c36a7856253ffa998c95a295b70a233c4d803c5fbed043f56f645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a594c0ee-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741199743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199743, "uuid": "2c12e9b9-09be-4917-8890-4746fe2bcfc8", "comment": "Malware payload", "value": "db79fbc0fe1f7ded9bd8cc9cdcb6e891", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199743, "uuid": "e160652b-13be-4673-a4c9-c6867f5fd770", "comment": "Malware payload", "value": "f6246505c035a24bea097687b9be917411494ce3c3b78009e76e590f4f93aa54", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199743, "uuid": "e1b682c8-b3df-4af9-a110-50a014dce1b7", "comment": "Malware payload", "value": "2205e7306e0c273deb8fde2260f0a00bfffcd33b", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199743, "uuid": "ddb227d8-3460-4eac-9664-e50c5abe0efe", "comment": "Malware payload", "value": "8c76d50dcfd888f8d22e7af03e67dfbca80587af7aa92fa1ba0c3c61efbda51e38f820e0f8690b9fde490460f52cf4de", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199743, "uuid": "8d554291-a84a-4b95-94d6-85d3a64c6e2d", "value": "T129D53386F7C981D0F805BB347FBE63DFE3D904858E91890B4251E4A4EF35B22B2AD465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199743, "uuid": "8ee12fba-69ce-4e5b-b7cf-b043650059d6", "value": "49152:iTpAgIlp3rEUutw2Y4GilFFjxL6zZZxIxCvZbf2/v:0AVp3Qjtw2YivXIHxIZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199743, "uuid": "0601fe30-452b-43a8-a103-09fa46ae64ed", "value": 2908132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199743, "uuid": "b0107339-1c28-4a03-8520-1c73122f2452", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199743, "uuid": "0a3725b1-1748-46c4-9e4c-c4369f55ec2b", "value": "699900CITA_785320248556.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74a724c-f98a-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741155991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155991, "uuid": "f196ee49-18c9-41a0-aa98-09c65cdf6175", "comment": "Malware payload (Mirai)", "value": "02dcc0edb9c5d45d571c0cb0647da24a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155991, "uuid": "777e066a-5631-44b2-affd-9ee666dc0e60", "comment": "Malware payload (Mirai)", "value": "f6a75d533539820f246905e310c1c4e415451858d04e7d7517555e97f4c5caf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155991, "uuid": "1aba8a0e-77a0-4b3b-bbbd-90a74a3ac3ef", "comment": "Malware payload (Mirai)", "value": "78fcc54b6d633d36d9fcd51b29de92ed69291812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741155991, "uuid": "a697c016-73c6-4c3a-aa26-f8abefea3a1a", "comment": "Malware payload (Mirai)", "value": "94ad0934cd3c07e37e5edcdc081732b9bd4268e51374e14ab135fc37d1c543b4bfc78a0bf16e01651e753e7caef632b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155991, "uuid": "77013e26-c854-488c-ae44-2dc045c84e2b", "value": "T1A563D847AB604FBFC82FEE3705A9060635CCA54713A93B353574D828F65EA4B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155991, "uuid": "afa61295-450e-4df2-96de-ba8e2142f9df", "value": "1536:ztz4n3puUY1LRbmcVxmMG5BZ+rmmWUDqw:ztz4n3UUY13mM2BRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741155991, "uuid": "0b0d726d-14ed-4085-8aef-5e5070065d2a", "value": 72480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741155991, "uuid": "17c31800-4cd8-43a3-bd63-0cf910549be3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741155991, "uuid": "9a5bec03-a5ca-4679-a368-d19cc3491129", "value": "cbr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a274b8fb-f9ed-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741198449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198449, "uuid": "4fd44ad7-c45d-4a88-b39f-890ae1e3ef42", "comment": "Malware payload (Formbook)", "value": "b499888f468ee95273da0460ec18a435", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198449, "uuid": "b7d91892-692c-4045-9961-306324e75dc4", "comment": "Malware payload (Formbook)", "value": "f6cc28cba0cae1f7d156b04fa32709fa76217b53f11521de3898c69812c32d39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198449, "uuid": "7e23b49f-6721-45f3-8236-1b4b56ae77a0", "comment": "Malware payload (Formbook)", "value": "864bd06fe05337eeebbcfc72041513957313fde7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741198449, "uuid": "775a309f-c530-49db-aa7f-ae4133e8cd0a", "comment": "Malware payload (Formbook)", "value": "9809555cc4eed9b92e30ee19a5e5ed0950917629ebdde1175955697886d13568a28a3c5d0707b012d99106540033763d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198449, "uuid": "fe512f5e-10f5-41eb-9c8b-2c18da6beaba", "value": "T16AD423D7F0A5781E01B0AE97DD589D3D8A9CB9B008714F4239AF24FC2B512D4A3779B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198449, "uuid": "8a34ed77-18fb-470a-82b6-3c97e7ed1bf1", "value": "12288:ExzLT6p6mIIA6rweTUauBsMy9L95pkzCMJEaWjlKzQtmRSLUHX3BWGFPZom:Ex8rAaweTUauBsMydSfIiQYR5HHQGFZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741198449, "uuid": "9521a3e6-11a6-4127-9ca2-a2e47e6905dc", "value": 603222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741198449, "uuid": "43b6e408-7240-4f37-aca6-7f177bbb8b03", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741198449, "uuid": "42e1f801-4c42-4394-b5cc-a377dd2e6667", "value": "New order supply.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff520dc-f9f0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741199492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199492, "uuid": "61c6309c-1768-471d-a4cc-ccde07ce4333", "comment": "Malware payload (Prometei)", "value": "97a39e31acd3babc1e2ab935b8c8601e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199492, "uuid": "87ea28aa-261d-4e77-94ba-7b7f7fdfb8a7", "comment": "Malware payload (Prometei)", "value": "f79283d07fdee97a6b212d68117bd9887ec16fd66489a16015c8fd358da8c3f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199492, "uuid": "68343c36-8342-4295-b782-4a9da28ca94a", "comment": "Malware payload (Prometei)", "value": "0675aac406532f56b265955ee1011cc730c48039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741199492, "uuid": "5beaff99-52f2-4bfb-bbb1-f1ef992cb299", "comment": "Malware payload (Prometei)", "value": "dd949df23198fd65f7a1859f88948f305c8ccf38fad37b0ab5a1b60a5550caa7f66234ca1259cb123e0f5de060a2dcce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199492, "uuid": "2d84387f-563f-4daa-8b27-696f67693dae", "value": "T1129422F31824B3738A2C3A3EFFA09E05D69A573CF55927561A1FDDEF0F295120988A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199492, "uuid": "7665c232-a510-411c-8a8f-50ead082a016", "value": "12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSu:W4/y+qaBUZJAdVti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741199492, "uuid": "ea22fdcd-bbdb-4856-b655-5edf05fbc94d", "value": 428272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741199492, "uuid": "232289b2-11d2-4b93-9dd5-bebb03fa885f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741199492, "uuid": "7bdc5fa7-7fa7-4ff2-b0a2-461f68c5441f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920f8c7e-f98d-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741157190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157190, "uuid": "a8a77b16-69ac-4db1-a588-aac8915f25fe", "comment": "Malware payload", "value": "bc0af0fe63ebd6764e2daee27b7bd7dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157190, "uuid": "adc0195a-7762-47e6-8ae9-30b22e1ee7d3", "comment": "Malware payload", "value": "f931c8265cbac0be9f645cad83be86d386469471d9bfc64c6c149782093ea0e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157190, "uuid": "dd920020-eff3-49bc-8b24-694aca370c18", "comment": "Malware payload", "value": "7b38f2915de0b511a089e6e5970ed5d8d26b14ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741157190, "uuid": "1b6b6322-487e-4351-97c2-d185df92b86d", "comment": "Malware payload", "value": "5ff638727598e72422315339eb6dc2bb24af1f5c982270ba34ea9898f429efcf93f58e900d1a4203e3278804594a8437", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157190, "uuid": "87afe370-7612-4284-9810-1e7a8e852c63", "value": "T1F4A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157190, "uuid": "33a2635e-8a08-4d73-9333-879e95c1690b", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPj3Nu:FOuhPHCKsqZ9YfM6g23ZJL3Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741157190, "uuid": "9be48f17-d4df-40ea-940b-80f047c25ff1", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741157190, "uuid": "dfcab4e3-3ea7-4f72-8a89-2000c7a37dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741157190, "uuid": "860f87e0-7e2f-46e8-8a35-c157189ca452", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b96aae6-f9c8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741182547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182547, "uuid": "31deb171-497c-4d7b-b11f-92ae2d27eb82", "comment": "Malware payload", "value": "dc39d79c4b8aa6e4303605c01cb135e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182547, "uuid": "e2df393d-8e8d-495b-93f5-3e1c201aa422", "comment": "Malware payload", "value": "f93962ea5b24baab606ffc5af74eceaef0e8834b7451a067a5a7b811e46cc325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182547, "uuid": "957ed080-da05-4ceb-9379-8482191fb461", "comment": "Malware payload", "value": "4659e6079632b47603cc664633b36e17a3a69a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741182547, "uuid": "f88d9483-5ef6-44c9-9a73-df23e2d4cc4b", "comment": "Malware payload", "value": "86daacc206b872c0b2c8ce0741295e73dd2d0ee0c4a8b108ee237b1e27373daded3fe72edfabe89560a6ff5b2384ed9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "mbrkiller", "colour": "#F4CA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182547, "uuid": "f0e36836-37ee-463a-839f-e7feba74d959", "value": "T1ACC3D843A6EC3CCBD039A3B077BB93D5C72EED9551A2C00E96D04286E97D4177A227D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182547, "uuid": "6bbe00c6-65d2-4f6e-866c-5cf8ebad298c", "value": "484f62336b230743d654280fd7fa0d9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182547, "uuid": "e3268246-84f9-4934-9c2b-ec2ddff216fe", "value": "768:zBcatN3rbrKpuKX8/FNzGNcwwk9Sbh9Sb:tcatN3rbrKpVM/F0NcaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741182547, "uuid": "ac752686-2f60-41d5-821a-0ca7d3a76796", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741182547, "uuid": "d86d6627-0b6e-4e08-8cc4-e1edb81ec983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741182547, "uuid": "79651b13-9d50-4256-9c23-73c83fbdc5d0", "value": "Chioxide.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a95c7b6-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741160023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160023, "uuid": "579bb7b7-a936-47f3-8b95-9d072975b355", "comment": "Malware payload (AgentTesla)", "value": "93d37f5a18d5be139cede0a04674e795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160023, "uuid": "0c75532d-79fb-4e6f-9837-667f088dbb3d", "comment": "Malware payload (AgentTesla)", "value": "f9ca74812f6e79bc012751d94c1bb1f60b112a00141b2b161cd44de447a52aaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160023, "uuid": "c789bc1f-91a1-45fd-90bd-ff7d098119cf", "comment": "Malware payload (AgentTesla)", "value": "b4a18a3c65f4154c6ba8c3599d8d48f8e7c260e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160023, "uuid": "0e1606a9-0d2f-4df4-afc4-c179ed4830a8", "comment": "Malware payload (AgentTesla)", "value": "99fc69d9dc8163de2f4c2093c44864ab08a94a2d9ab3a25d062759a5edd2da299d17dabc3b96317657074eaa6464846b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160023, "uuid": "968af5dd-7aa9-480e-b838-bc82936e8f3c", "value": "T170F412A8A619F427CA8457780D72F3B4263D5CEDF400C7274FEDADE7F92AA584C18192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160023, "uuid": "85c415ce-2969-452b-ad84-4fad42185121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160023, "uuid": "2333e9c1-19f9-4a45-bee0-a2f948aa92f2", "value": "12288:z/fUpm+gvyv+V08a9CS4ttEAptbF4Ht8yMEVP9htJk5s/bCZ/b4BEvFCgermfgDo:vWq08LSkyHt8yBt/qCEvkgeSfao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160023, "uuid": "479c25d9-0b52-4260-9aea-d90facadf9b0", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160023, "uuid": "ffeaa89f-bcae-48b1-9694-87ce2d2262a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160023, "uuid": "d9bf95bc-41b9-4138-9473-28fd49ae18c7", "value": "SecuriteInfo.com.Win32.MalwareX-gen.30508.25588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a08127-fa13-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741214672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214672, "uuid": "260b2c32-5d70-43ae-9feb-23ad95a5a684", "comment": "Malware payload", "value": "977bfb57b0c235c8c70222824a59a629", "object_relation": "md5", "Tag": [ { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214672, "uuid": "1df19b35-0929-4c08-88ff-bd0a6c99ad6f", "comment": "Malware payload", "value": "fa0f8f2150a17dc98c99f44e25419ed4e68010a5ad8a6418627e8a061854e477", "object_relation": "sha256", "Tag": [ { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214672, "uuid": "6857f018-18a0-41e6-bd43-0a46520fb23c", "comment": "Malware payload", "value": "b2567a6a98f9287b4dbc604e98898ec07d31ede2", "object_relation": "sha1", "Tag": [ { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741214672, "uuid": "a53d41df-1d8c-43fa-bcd1-7a5f2e8a8e0f", "comment": "Malware payload", "value": "130325f5c49a71bf789303108566dc7536ef2ba38783422dfbfa022ca8bdfdec7fd51170f35a8f1637582d12e7fd3a30", "object_relation": "sha3-384", "Tag": [ { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214672, "uuid": "88e7410a-2507-48f7-9e6a-2a4b4e35a223", "value": "T11D21535EF84548354798D1621997D18D2B37861C0B865BC5910CD87C701AEF889FB2E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214672, "uuid": "01ede591-a32c-40d0-9fb3-25235b449cae", "value": "24:2diO4ptl9F8mV4FJkNL3yNrNxRxbloMPQwJlNAIWVOzAoRRNWVOziiCM/mKRQP:c3CzGvNr9hlOwJlNjWVFoxWVDi13uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741214672, "uuid": "52f857e9-efab-4f57-b716-1e5acf4f0013", "value": 1307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741214672, "uuid": "45801a23-b82e-4a78-940d-6a909ef68331", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741214672, "uuid": "e6d10d15-a16e-490f-aca7-650c7d0fed7d", "value": "Receipt_.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cf33e6-f994-11ef-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1741160257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160257, "uuid": "9cc93ce2-6f44-472e-9468-91c97cb2fb66", "comment": "Malware payload (DarkCloud)", "value": "9f6610b7f362319fe51369213f18cf40", "object_relation": "md5", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160257, "uuid": "631c9adf-8fc2-411e-8d69-8d1f39f54753", "comment": "Malware payload (DarkCloud)", "value": "fa1dbfb0f234eb04893d9473ab107ee50e4073b0d6bfdd6c54b168c5f5388867", "object_relation": "sha256", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160257, "uuid": "dcc6f75c-cb41-4ebe-93c7-98b483e2d779", "comment": "Malware payload (DarkCloud)", "value": "d5d9f5052488e78b7324765592f26f85ab32b780", "object_relation": "sha1", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741160257, "uuid": "628d06ac-f895-45bd-842e-5f28ddf37695", "comment": "Malware payload (DarkCloud)", "value": "0415c678e4c2e510474b8988f07a3677e9e22bb2fe10ab1b97df42bd5cdbfab576e975f5de0e374288cfc9258f93a2a9", "object_relation": "sha3-384", "Tag": [ { "name": "144-91-92-251", "colour": "#9BCA80", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160257, "uuid": "ecdc3425-ab71-4522-bcef-0ec00190d920", "value": "T1083220CCCE8B50CAEB1D978A5B86D7936B9F421C271F45C30D14C283676FA88A965F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160257, "uuid": "85fc97e2-3211-4c5b-9684-400a1ec3c29d", "value": "192:Lh1qXSnEgAyK31ldY2nX3V0JlaUfnR1QCgsfpF3cK:qCnEMK31l2MXK7LfnsCgG9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741160257, "uuid": "29285d27-0a03-42c1-aae9-bb8a3fdd49d3", "value": 11728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741160257, "uuid": "79059083-0f57-4b71-a8d9-2daa612a7ad6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741160257, "uuid": "301d1ae4-de06-489c-9996-bebd901712ea", "value": "Pro_Details_17256.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7c57c5-f9b1-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741172749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172749, "uuid": "f98a48a6-5100-4d7e-bba2-a612515de993", "comment": "Malware payload", "value": "0b2b29da88955be8ace17072e380a188", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172749, "uuid": "984a6599-9105-4143-bc0c-6c1f9e9fa076", "comment": "Malware payload", "value": "fb8bf40fb68c5d4cd58d39b2e91a498e6856850cd9acccbd9e61e69e73748f3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172749, "uuid": "fe219581-a854-43b8-a667-164b1870d630", "comment": "Malware payload", "value": "4e71308b04dcca10bb278c6b3bd8c1d244003a55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741172749, "uuid": "0c00d8dd-471a-4017-93a4-dbd92b2df79d", "comment": "Malware payload", "value": "09bdc48699250a175ea40f10a8d68b45f78342efb0832ff0d08fa4fd17c2403cfde88bb6c87805330a19a30cae9808a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172749, "uuid": "569cbc13-3ee7-4ddf-b70f-1fd537a7039e", "value": "T10725D147B2F08F01DB8D2F36E4A7501097A1BA432573F39D1624A1A67C0B6FACD57AE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172749, "uuid": "72d73130-d14c-47a2-bd21-0693be7efc66", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172749, "uuid": "bf14ff89-427c-4ed7-9574-b0ece08a7471", "value": "24576:6Cc7tZq1AzYB9777OKjersEWoHu/iedIPE91Y:8+qzENOyer2Ou/Pdau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741172749, "uuid": "977e373e-74b1-4a0a-a937-6c13f1011f2e", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741172749, "uuid": "43937c14-3730-4c9a-8f6b-05bc020ac23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741172749, "uuid": "ca975886-123f-419c-8043-35863f763cd2", "value": "fb8bf40fb68c5d4cd58d39b2e91a498e6856850cd9acccbd9e61e69e73748f3e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d747b5-f9cb-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741183747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183747, "uuid": "52471e34-a1b7-48a5-b9ac-a443cf6fc8f6", "comment": "Malware payload (MassLogger)", "value": "1c08f52f9560cf0b1cdce37643e548f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183747, "uuid": "5f120183-aff3-4c81-9ce7-3c0f5fbdd005", "comment": "Malware payload (MassLogger)", "value": "fbb23eda9bc927cc72810831dde3e28ef4baffddc7f28ee016c1e6ccc133a275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183747, "uuid": "1671e9a8-9d13-4396-9403-d531c9eb8229", "comment": "Malware payload (MassLogger)", "value": "9fa5eaa6b7f002ca2e7b776564087082399eb842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741183747, "uuid": "f6f217a1-5e3f-4b9e-b4d2-73a83415b662", "comment": "Malware payload (MassLogger)", "value": "34885073bf463d16287acceb5e927ca4d0ab583c638c3c3a4552f035dfde29f8529ef2c9dfd226f3c2677c69105d6f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183747, "uuid": "17bf0cda-13e7-4629-b5b5-b3c97e131c8b", "value": "T187D4E0A426A8EB13D6799BF41932E13413FA3DE97811D2165FE9ACDFB8B2F001D50253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183747, "uuid": "68b31394-cde3-4755-97f8-2279085465f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183747, "uuid": "cbb52b7d-85cb-4126-b040-e60ecd6c59ea", "value": "12288:Ox15Mpm+gvy04Jcd6+fIRyUdv5EJ6V3uKCIYXlQKtqz3kR:m15LXycdBf6v2J6V3NCIOlQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741183747, "uuid": "0f4344de-48ee-415a-a487-f906289bb291", "value": 610312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741183747, "uuid": "54c0e796-8ad7-4571-88eb-ac49eb34c68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741183747, "uuid": "5bf13480-fa44-4bb5-8917-b0b9ae5110ab", "value": "Original Documents 091822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11649e92-f993-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741159551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159551, "uuid": "6af989c4-1cd8-4b03-933a-f097e68f6c2c", "comment": "Malware payload (XWorm)", "value": "f6860e04c99e9e38430b00d86e75bb2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159551, "uuid": "3cac6dee-3714-4049-b1a4-f0b7da22531f", "comment": "Malware payload (XWorm)", "value": "fc8add9758dbcc75ede35c3523929552359ff353921d79a299a0abc339c8a1ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159551, "uuid": "479829bf-ca46-4a74-8fd3-2ffc3de173ef", "comment": "Malware payload (XWorm)", "value": "074ed995aabe1d0c65658eb9eeab39ec3ca975dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741159551, "uuid": "ce0f56c4-448d-4257-9edf-f05c6998fece", "comment": "Malware payload (XWorm)", "value": "ffeace6f5299628f35617648644751d8be7e14d2c9785885d61b78d379c23e6422f81556ca9a39e96bf3a49a7c58a735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159551, "uuid": "26935651-876a-4fb1-83e9-b094ef8148b6", "value": "T1A5159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159551, "uuid": "1de68521-534f-4090-bc55-38928e08eb83", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159551, "uuid": "de6a26bc-ce5d-48f9-9b7f-cc212b1e2404", "value": "24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8a0F7u:LTvC/MTQYxsWR7a0F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741159551, "uuid": "7f2067b3-4f48-41c5-a4f0-26ba5c005318", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741159551, "uuid": "a341143f-da67-4f1e-bd84-5fe08eb18f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741159551, "uuid": "6b97d747-6c23-49f7-8082-4c1b80f07787", "value": "f6860e04c99e9e38430b00d86e75bb2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1524ac7e-f9c2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Nitol)", "timestamp": 1741179744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179744, "uuid": "eb15fdde-cb68-4aaf-84d0-7d095825cd11", "comment": "Malware payload (Nitol)", "value": "876cfd04e138f3efcd4eb5c3659f7a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179744, "uuid": "8e9b6321-b26b-4729-aba8-456e4789bd86", "comment": "Malware payload (Nitol)", "value": "fd8865db47c4a9bd0c708e44a95d79ce986edc640ed47ae428de5ac8542d04bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179744, "uuid": "73a517f6-7e20-42ec-9876-776cba05b797", "comment": "Malware payload (Nitol)", "value": "b10d8dbe653ece00b83c778a2cc9d9fe0080241c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741179744, "uuid": "42abb931-f76c-4131-9750-fb90e624ed44", "comment": "Malware payload (Nitol)", "value": "3e04029853a99f4ef8400ff1c6cbee74b105c0e36e11fe39600591a3cfbd94daa4ea8052a168f0a6446760fb3f1fbe7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOKESEC LLC", "colour": "#69D532", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179744, "uuid": "549ec63a-3356-468d-a389-d6181a75a8a3", "value": "T1C8E59E313B91C03AC2B33671C50EE3B96AEDA9720D3502979A945F3D2F785C29A1C65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179744, "uuid": "ee011572-b430-4afc-b570-95437313a7e2", "value": "c708ac798b9b080f07a422d76be1fcf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179744, "uuid": "9a49e099-7085-44bf-ab16-76566b72b663", "value": "98304:juaD42wquOvNxedGwuWmbS8FSYdxWCp7+hxcP0+X20qE6SZ0jW4J8Eo4wvaFrbkt:hvwqu0z7BSSA9JOKnkht4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741179744, "uuid": "e521c14d-8015-46ff-a352-e9dddf5cc6ac", "value": 3178432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741179744, "uuid": "bcf3f4d6-89a4-4395-9173-1446c78f6ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741179744, "uuid": "ca02a32f-ac6a-47a8-8699-c2ed6c708b39", "value": "help.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f161f4d-f990-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741158340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158340, "uuid": "53df7a09-7d3f-4e47-aaab-216487167114", "comment": "Malware payload (Formbook)", "value": "560297694fdfa9152e07a9961ddc3abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158340, "uuid": "d4b0ee9a-3974-4931-9911-52e81d92d261", "comment": "Malware payload (Formbook)", "value": "fe290aa1e7d15fe57535dc61d027008d209eea93d48656a2f0022e921d0419a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158340, "uuid": "a071c5be-ab24-4135-8c37-fc0c6bffbde5", "comment": "Malware payload (Formbook)", "value": "c1e70913954ee51762ba0d6361a08ad467517f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741158340, "uuid": "34ea29dc-82de-4f0a-83eb-4b85005a8dbb", "comment": "Malware payload (Formbook)", "value": "6d0e0bebf4bc3c9f5bb69cfb73b062202f0ed39632553a0d358f200506dd419c3beedd6882beb703bd2f465a245d9dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158340, "uuid": "f3a9b9fb-9cb5-4c3c-b7ca-7f0d4fadff77", "value": "T1B745CF2273DDC360CB669133BF69B7056EBF3C214630B95B2F980D7DA950162262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158340, "uuid": "c2cdd26d-fcce-4f5c-b742-e853f9612e49", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158340, "uuid": "a58ded5d-1196-4b4a-83b9-5e06f04162d8", "value": "24576:vu6J33O0c+JY5UZ+XC0kGso6FazXevo82IwrAWY:Zu0c++OCvkGs9Faz5XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741158340, "uuid": "4170a17d-ebb1-443f-90ba-a3815689ed4a", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741158340, "uuid": "7f804bf5-8ad4-4330-aea8-8c71712a258b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741158340, "uuid": "7ad39140-b858-4be9-b98d-e9fb60197581", "value": "560297694fdfa9152e07a9961ddc3abe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66f3869-f9e2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741193785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193785, "uuid": "01490ee0-d2ab-4dac-ba47-04d4b92ccdf1", "comment": "Malware payload (Mirai)", "value": "cb90387cdcfe0f0a6d32400531555b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193785, "uuid": "a4aa92d8-1a14-4974-81f8-287ae8e702de", "comment": "Malware payload (Mirai)", "value": "fe801f7bf0b44afe6a099837c1ed2639db8292bf4c6111c229721afe19aa0272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193785, "uuid": "720f7898-7a0b-4d00-a581-5965c5700daa", "comment": "Malware payload (Mirai)", "value": "97c06c97babb6c40a11e10e54fff8395f6b52bb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741193785, "uuid": "4b2bccb7-3d3a-4582-90b5-be532cfd0270", "comment": "Malware payload (Mirai)", "value": "20773e17e5bd83961a2921c61c1a5e792081d09207838be6f8aa005e97912f74d3c066b90bae6a1b40bce43b5ffa2b24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193785, "uuid": "74b00da9-8e1a-4ea9-a6ae-c4b3337843a1", "value": "T1CCD37C63C8396F58C526E2B0F1708F782B93A65581474FBE5AA7C2B44047D9DF60A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193785, "uuid": "4a7e18aa-f62e-43fd-8855-21374663ab59", "value": "3072:MOJULRmU0jxVpYKQ1U4DNVNglWgWA7YoW2Znm4:MOJUpoxVpYK6GQgOX2ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741193785, "uuid": "54b9d458-c81a-4f5e-92c0-e0c5b2857977", "value": 138116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741193785, "uuid": "e66cb1ed-e4b2-4268-8112-5ab3be53621a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741193785, "uuid": "08bf1cb7-9979-4a14-bda7-790b804076e8", "value": "eehah4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }