{ "Event": { "published": true, "date": "2025-11-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-04", "timestamp": 1762300981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7da86b48-3952-40b1-b860-5910cef18a69", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dea208-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217512, "uuid": "36b482bb-107f-4658-bc15-571af284d439", "comment": "Malware payload (Mirai)", "value": "106425ce3146933319de1c8291d3145e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217512, "uuid": "a299e559-7a6d-48b3-863f-f6cbad639bc4", "comment": "Malware payload (Mirai)", "value": "00e755b20b1d9ffea3a0d903b94c918315a55094291ab5a3d65cd9f3fdd4fa21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217512, "uuid": "e5381476-043d-4d08-957e-6c3b50e259a4", "comment": "Malware payload (Mirai)", "value": "5e9b5525fd4e2b594d854fc1ad7a25238ec5b708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217512, "uuid": "6cad2d4b-d554-4c16-bead-3905e67ed1a4", "comment": "Malware payload (Mirai)", "value": "659827469d851cb02cbe745f4574fb1e1777d46353419270b0c51006b62227b3fe38e9b499006602ec9d447def3743ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217512, "uuid": "b17a11fa-f3fd-4dfa-942e-bd1f765fba00", "value": "T1E9145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217512, "uuid": "43ef6b25-8068-49b2-a1d1-207cbba5eda4", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NX1UaN:HZ15BTYCrYq1QDY6G4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217512, "uuid": "e45a9457-ca39-46e7-ab30-6cb015285588", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217512, "uuid": "76f20fc0-d92d-45a5-b622-8ab9455934a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217512, "uuid": "a9d891ba-296b-4312-91e9-d6dbce4ce5ae", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb6f98e-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245259, "uuid": "07950305-16a0-42d5-bf06-1f244fdf3161", "comment": "Malware payload (PhantomStealer)", "value": "9270589d47abec30fa5dca40f13157b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245259, "uuid": "ae7017c0-0b94-4dac-8618-4844a92d639d", "comment": "Malware payload (PhantomStealer)", "value": "0146646bed68c9ad6c91c7b3f5b8d6ea6d1fdf14346a881e604cff35a5d9a9db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245259, "uuid": "fdce4ef5-a9ff-4cac-a1f0-dede0007090f", "comment": "Malware payload (PhantomStealer)", "value": "7781d0027909efa0bca23a4e0f415260b4030ff0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245259, "uuid": "65c864cc-a8c1-4f7b-b274-5e8c30a0efb8", "comment": "Malware payload (PhantomStealer)", "value": "a48ec79ba06199a80b17ae5bc3c988b4ebbe492721620a55bf059412757b2c12da584f967abfb19119e5a4942bad50a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245259, "uuid": "4c412063-9227-4290-aeed-207edff08515", "value": "T18D055A70ED2805990B4717EEFD290AA0C8BEC916123754F1E6D51B5E730B99CE3FE268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245259, "uuid": "9ebcb821-e7f8-442c-9d30-9390ec266c49", "value": "3072:XIF4ZRjUO5/jUOQjLjUOdeIQjUOVjB9IjWjfjFmSjUO8jUOiLjUOqG/jULjUOb6O:ylukb8ehEnVzjiINoZvH1n65SmkCx/bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245259, "uuid": "de668491-433f-4dca-9158-ff4a2e4a3361", "value": 807243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245259, "uuid": "4d4b5cbd-07ab-4e6f-88b2-a6f0bcc40b89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245259, "uuid": "c9c35d18-702f-44aa-8839-653fc356a058", "value": "30%_Advance_Payment_Proof_PO1100261714505_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b208ae3f-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245533, "uuid": "bac8f61d-78da-47fd-b587-5cb2ea6f988b", "comment": "Malware payload (RemcosRAT)", "value": "2e2eff8498d449b6bf84dc2ded190a67", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245533, "uuid": "c4bc175f-7839-477b-8493-3df738191fa9", "comment": "Malware payload (RemcosRAT)", "value": "027e06c79c5b37d5eb2709797828646e50f6951a6ebf139a9c59be5a4d58ee6b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245533, "uuid": "5481471c-f255-407b-b0d3-e635d4a54378", "comment": "Malware payload (RemcosRAT)", "value": "2b2d346691db3210ae6977dcb14bbe5e5a1163c4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245533, "uuid": "a215def9-aa3e-4de8-9a2e-f9ef85594f39", "comment": "Malware payload (RemcosRAT)", "value": "328312fa70738512b5dfb2ae8baa0c69b1d58c93c761c19f136c1e3a6b96b45b0336ddcc1345a8845bb89a61a841503d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245533, "uuid": "8dd9f708-7caf-4b93-8fca-1d624131710a", "value": "T1B6058BAB481CB84E36E561B910BBB80DBC6D8E85D930331D7D0E03D91D96EFC96A534E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245533, "uuid": "ea52faee-d657-4f93-a2b1-bd68df86890d", "value": "24576:QU17lZntvhCes45rUPjjTxGi06lPHcb4aR4Cyl:dilPHn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245533, "uuid": "f5b62e26-a247-4f22-bcae-aabd68df2094", "value": 865831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245533, "uuid": "6d210c8b-07b3-4ac9-bc17-c8a16434ae64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245533, "uuid": "c8c9e1c5-6467-4346-a176-d8cc559e4416", "value": "RFQ-10-112025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1a2795-b9b1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762283052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283052, "uuid": "97037c49-8b86-4b5b-ba48-a020513a1118", "comment": "Malware payload", "value": "aa7265ce8fcb1683011ae92c2a6ef227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283052, "uuid": "2081d168-8b1d-4238-a019-3dee4a4ed3da", "comment": "Malware payload", "value": "030a8c9e64d92039e9b2b9a04337d303374964f52322a652ccda2b7080e796e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283052, "uuid": "e6d827d1-7bc3-49ef-9b2f-e5ce667d7b5b", "comment": "Malware payload", "value": "86e4eddc6cac8ae30f7cc63601145401a8c95e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283052, "uuid": "8779bf2b-2e61-4ce7-b9f5-366a10a05ca7", "comment": "Malware payload", "value": "0c7a8efba2366ae6d6213a44808958d7417f57129ffe50e139e5e7fd4f686255ea5af1d525f62131c3172cdd3387ae5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283052, "uuid": "211ef480-91ca-4622-a4ef-715736f38b3a", "value": "T118D64987F8A141E4C2ADE174C6269662BA703C994F3473D36B60F7B42F32BD46A79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283052, "uuid": "1efea04f-505c-4751-ab75-8513cf8ef8e7", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283052, "uuid": "e5a2df6e-08b0-4544-bbdd-b7bf851a44d2", "value": "98304:fMDXA/n8ZOSfu+JVmk6xHp7hMHn8EXxUFb093sxnEXlr/D:fQO8ZjuyVmdHp7hMHn1Xxib0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762283052, "uuid": "943e2637-41fc-48df-8e91-8e091ee11a1e", "value": 13488952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762283052, "uuid": "1367ca41-44b2-4c80-9918-99d082a1fa22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283052, "uuid": "ab50d052-5e55-469b-9d1f-f82b2752ac19", "value": "QQHong_aa7265ce8fcb1683011ae92c2a6ef227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c080988-b958-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762244879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "b83bbfe6-7503-4bef-82bf-ae5558d30c48", "comment": "Malware payload (XWorm)", "value": "9b7042b3a9a994573ae5fd140e69c472", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "42acf3d3-39dd-4005-9cb6-ae1720729395", "comment": "Malware payload (XWorm)", "value": "03c8d4550f0aa5717f4df6f7f3527ec033f97af5dd46132f91a552ae0c322687", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "ea87c5d8-57ad-4ccd-a02a-f575dad0c9ae", "comment": "Malware payload (XWorm)", "value": "44a77270e477f808afa0c897a2238e3fa30ca162", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "9e5935e2-50e9-4cab-a297-3fa6ca0015d1", "comment": "Malware payload (XWorm)", "value": "f8ca828e1de0e247d17e3981c16b5d6422eef3c3def9c50a3d943fa2412657fa9a2acb0d501e064fec6382f281601796", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244879, "uuid": "4916001b-c8bb-4cc8-81ea-745b3ea7ce12", "value": "T154F18A482416157F85E4BD7FABD489B0226CC4C26301BBCE562C81C9D9A7C9B8BEC7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244879, "uuid": "6bd1ed53-b66a-40f5-9a4c-92e6ec91ce94", "value": "48:5IsMiProSTwW23j5mugz3rgEQ87iVCesKPHcJFAr82SNQMzSKsJarOUBfZ8CB2BB:5IHqlTwWA5Tx8W6YHhSNQ8NBfZvmnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244879, "uuid": "5d9eca49-8534-4bfd-a760-40bae60966c0", "value": 7739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244879, "uuid": "3b773530-dbc7-44fa-a6b6-1dab0122a7ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244879, "uuid": "82517ead-e406-46a8-a910-2e1362e29191", "value": "RFQ4800056034210090034_APSTEEL_Sp_z o.o.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2210943-b973-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762256808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256808, "uuid": "be75db5b-f373-41cf-b1b5-a86322c4d070", "comment": "Malware payload", "value": "9c05d0cbd8ac3e40381c7b91af5919d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256808, "uuid": "cf66a0d9-4bf4-4393-aed7-a73f8305196f", "comment": "Malware payload", "value": "04078ae665487ef2b4829c5137fd1d64f3a75f9511407a11f72f67468d5e7609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256808, "uuid": "28f65749-4280-42bf-bce2-d0f3cb9559f3", "comment": "Malware payload", "value": "b56e079b665b4c23ac2534b423995f8d4096259f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256808, "uuid": "3fd755dc-6a93-46cc-a748-899d7524f2f3", "comment": "Malware payload", "value": "49890192620751606fa01216a40a45ea6b8089f23b2e809828a325a3dd0c9fa282af349f0cff1c7da2bd6324cf47910d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256808, "uuid": "8fb04761-ba3d-448f-ae87-056426a1ca48", "value": "T178C59D11A39504F4D57BDBB4CA929332D7B0B9865331E24B066DE6582F33E909B3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256808, "uuid": "45426067-aa29-4382-b0da-2835fb79f8b8", "value": "ee969995d21f932ce1feb47191b4ba2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256808, "uuid": "01f649ec-7d65-4476-b5b4-d09579cd4a76", "value": "49152:8E7W35Xreti09CJFza4Up+LZDD1mbE1ZBlMIH:4Vrp7z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256808, "uuid": "4c6060ec-afac-4de8-a93b-8011c87080cc", "value": 2559032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256808, "uuid": "c2439a33-2967-414a-9a7d-a3b724fd5f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256808, "uuid": "ab955aba-ca22-4028-b8a1-c4c34a426110", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042dabf4-b974-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762256838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256838, "uuid": "8a6d3d9e-d971-470b-be0e-7f13155ec8f8", "comment": "Malware payload (PhantomStealer)", "value": "be0aab21fafc8a261138896820c3f6ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256838, "uuid": "fde66aba-cb86-44e5-a623-e44d9ecdfa76", "comment": "Malware payload (PhantomStealer)", "value": "04dc09d16a969820f8373c25bc88b3cf0cce21ed369ca1b6b7338d414528ed84", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256838, "uuid": "a7c56b28-1f22-4188-b05b-22e6b7465ee8", "comment": "Malware payload (PhantomStealer)", "value": "334552c8f516bb52a6afac4a927fb0dedd192552", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256838, "uuid": "d316c9ed-8fa9-40ad-b429-9441181d9cc1", "comment": "Malware payload (PhantomStealer)", "value": "fa73902c65e16c00559893efcd314c95e3d96166dcc00243af3cda0746355cd4665769c239781139aac3d54748134e35", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256838, "uuid": "33e1ff9a-ad9e-44ff-a65b-73b989642019", "value": "T1F7056B70DD6801994B4713EEFD2607A1C8BEC916127764F2F6D51B5E330A8ACE7BD228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256838, "uuid": "b7b71e7f-105a-4024-ae59-f31a6b5ca500", "value": "3072:XIMgZRjUOZDjUOsjzjUO5uoQjUO9jpRIjWjfjSxAjUOZjUOrvjUOiDSjULjUOY+D:HF2QJPHvEQph9UIvnacWP/4u1+02/X75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256838, "uuid": "5167cbdb-907c-45c9-9062-ba31d355e7f7", "value": 812565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256838, "uuid": "1ffec949-cbd3-4eb1-96e5-4f0046f9e180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256838, "uuid": "6ebbaed0-6c53-4f33-922f-0fa1f0c6648d", "value": "Proforma_Invoice_20251029-013_Review_For_Amendment_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5d81a1-b990-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762269144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269144, "uuid": "28001f38-0da1-4142-bb3d-8bd6206d3c70", "comment": "Malware payload (Mirai)", "value": "0c2a5e02b8173306ff72751fa87f1759", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269144, "uuid": "3d7bf9f5-c622-4afa-b121-2e96e7bf556e", "comment": "Malware payload (Mirai)", "value": "06e731b8e22f545ed8c18e200a9c580f2e2f8a98b598dfda38ef47b6c7d902b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269144, "uuid": "c8d02892-8678-49fb-b42d-3deaebec16fc", "comment": "Malware payload (Mirai)", "value": "80c294f143e82badd417c34dd657e549afb25a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269144, "uuid": "1aa2c19f-d682-491b-9ba6-7a5538db4fe8", "comment": "Malware payload (Mirai)", "value": "324fbd4ffe887afca6725c7590812817a5a99b4ba42e6ba889f67dd9abc5d905338080877dfe0d978865d2e1abaa82a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269144, "uuid": "7201f594-0218-40da-81b6-604b7b7f1784", "value": "T1BB739D63C9291D98C64C45B9B1A4DE3A5723E8505A871FF2069BCB3BD003EEDF44A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269144, "uuid": "7ea7e2da-4821-472c-aefe-c04d67bbf36c", "value": "1536:b/z3PwYfs+MCigKYKFDK/7zEoTmQCeWTXF1k:bb3PXkPCxKfFcsoTmQsbLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269144, "uuid": "c1597ac8-c5b5-426d-8551-2c586d03b183", "value": 75232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269144, "uuid": "0e20a355-9bac-4067-a4f8-b7b66f13e5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269144, "uuid": "8e2391ef-afce-49f8-abf4-34559e722511", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc03f66-b9b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762284906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284906, "uuid": "6ec7dbe8-4752-41f2-a89a-e424b36ef625", "comment": "Malware payload (Mirai)", "value": "8170cd534e9f54392c6ce8beb2adf77f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284906, "uuid": "5f3df5d8-97ca-4bd6-be3a-99d03109ef67", "comment": "Malware payload (Mirai)", "value": "0779e0c1a760fdd1db92d98ffb28c3e5d5556ec6d6659ad91e4f25829213bd09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284906, "uuid": "e5a2c98e-e25a-4972-80a7-ed0b230e2487", "comment": "Malware payload (Mirai)", "value": "7b7a6edb9ae65beafc4dbc7bce562fd8c59fb84e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284906, "uuid": "f13d5c87-0b40-46a7-8371-013f397921b2", "comment": "Malware payload (Mirai)", "value": "0d01da75d0a96fe9ef1b96510aea503b0d89f103527e7b26a3676795fbc3236b42a99ad217a149709549f98e0528ba3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284906, "uuid": "0832df22-589a-4e69-bbfc-2e397c66d940", "value": "T13D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284906, "uuid": "c6f931c9-026c-4c29-adc3-8a1dcad181fd", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStb:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762284906, "uuid": "63164972-a7ab-4ee3-bb80-ba6d75b31fc2", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762284906, "uuid": "a107205f-8175-4e1f-8895-46744af22d0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284906, "uuid": "c2a20373-01dc-4c44-97a1-cff4b635f06e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f9eb16-b9b6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762285275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285275, "uuid": "8e7c5528-6308-43e3-b699-db2ef143f3cc", "comment": "Malware payload", "value": "06d43b3d9d97fd4d0d78c192c523b092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285275, "uuid": "c2dff774-9388-4bad-8d0d-64efb3b5b08f", "comment": "Malware payload", "value": "07b05ce1a411871e69f2c93b636659b677fcb545b4c05b6641d362b04138704f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285275, "uuid": "b9b74f43-4ddd-4290-83bd-14b0f71980fb", "comment": "Malware payload", "value": "bff165713876ea53d2e469998a057c2a365e56da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285275, "uuid": "3c25576e-57ec-4f68-a69e-4352c5709823", "comment": "Malware payload", "value": "a76d74c05af51651e69216bca5c2d94c69a1f6b7d78fc2758d2d902d1b6f0d3e6e4d46b8ee0ab46fa9e0c0319f09fb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762285275, "uuid": "45adfeda-c041-49a4-a1c2-60201776491b", "value": "T102625CA08FE84492FA379F3143FAA7222E75F2815C69945E208801896F037A4AF7173C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762285275, "uuid": "c1368a41-6f78-4a6d-a6cd-f48000a4096b", "value": "384:QC9BArxW8g2Wi2iZb6gupNEx0LSofousWu4IrW:F9BAr8qNXANEuLSoQuShC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762285275, "uuid": "2cb5af3f-0013-452c-8492-f3430f1b151b", "value": 14696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762285275, "uuid": "2538f70d-c0ab-4d16-b288-6aa48821f6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762285275, "uuid": "5be4757c-3642-4dfc-8655-a9c169ea1894", "value": "PurchaseAgreement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d363d-b985-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762264163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264163, "uuid": "a993d7fd-a8ee-42ce-acf6-a4f2b52249b3", "comment": "Malware payload", "value": "3fb5634feb3b0521a02ae404ac2cc4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264163, "uuid": "6618b1ce-53e2-47c3-b617-f490cd8091fe", "comment": "Malware payload", "value": "07e3e3a262016c7c7d339f8c074af15cc36abdd7528597a07084558364ffe59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264163, "uuid": "491ba8b1-099d-4273-8899-ec889e451988", "comment": "Malware payload", "value": "25085c1938a79f3429c7673c442b7334ac8bc6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264163, "uuid": "195d18d3-dc0f-4df0-98e9-5e46933c5c4e", "comment": "Malware payload", "value": "28513affca9d980894a2e3598ac1f60c67bba854a86e9dbb7daec7b853e2dcadfce80007a82ed0668f65e3082b2a0e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264163, "uuid": "684f7036-4013-41bf-97b7-c128ea42c726", "value": "T15BF47C2931EB1156C472E7F30FEFFCB69A7EF171212EB53625A3528687A0E019D92035", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264163, "uuid": "4958946c-ff22-44e4-88f4-c1a024fcc6a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264163, "uuid": "8a814127-f309-41f7-8c47-45e3eeb3379b", "value": "12288:4zQkjSJz8Ma7YEjnVmyMYfruHdacKRW5C7aqLRt5eFnvFkRRsMVJINbQ+:Ra79jAy3qdacKoo7a2BeFn2HsMVIQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264163, "uuid": "cf1c3a86-ba25-499a-9930-d28c40b268b2", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264163, "uuid": "10b90c4f-e27c-4378-a7c0-9c70ae9425d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264163, "uuid": "6e03df9b-9eea-4810-adff-e883be5965d7", "value": "Quotation Spreadsheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd67964-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269900, "uuid": "b2d60998-ef55-40ce-88c8-a294460bea9f", "comment": "Malware payload", "value": "b00e96ce8eb6874e5a4baf08ce121018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269900, "uuid": "666c623b-1754-4147-8137-d7342779a9ea", "comment": "Malware payload", "value": "0845186340ec28a2042a62cbf7d9cafd49630a3d1859c4899fd85ad7aff64aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269900, "uuid": "d3a897b8-a83b-4805-9d01-25119c9624ed", "comment": "Malware payload", "value": "546960c633c128394d1a68be0fcee2f72f61bcac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269900, "uuid": "f367d47c-e0ff-418f-bf7d-143ad7de5b66", "comment": "Malware payload", "value": "a242c8e2ada2c3046848d7ef7a51c927d25adbb00c8c8b9a77cb3178785230ea707cd52cd356142703743a42b1418a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269900, "uuid": "2769ca65-fa0d-4c50-9fbb-bc3a8f675d43", "value": "T15E05E017B2139D79C69780B4B2B7CB756432F40912532E5E0A7ADB313E34B107376AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269900, "uuid": "1695787b-477e-4b53-99d1-59e7117de21c", "value": "52eb83e3127e774891379f7cef58df0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269900, "uuid": "fb7f576e-7632-4bea-9b1d-023cb27cba6c", "value": "12288:wWuNNDgD8fCfanoB9b0npTc3xqLCCtLf6kYGbg9:wfeD84aoBunpowCsLfPdg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269900, "uuid": "eb14257c-1097-447c-9fbf-933cca64d35a", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269900, "uuid": "3e749bc6-7472-406c-9852-e73f4c051bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269900, "uuid": "4585764b-57fd-45a9-9db5-7e0b14630ec0", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b18ed0-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281050, "uuid": "7673186e-2287-4e15-bab3-fc49c9d35938", "comment": "Malware payload", "value": "2df4d107c6f47dc94c2735a89bfa9217", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281050, "uuid": "5f499c82-4728-4bf6-b930-bc68cf32a0af", "comment": "Malware payload", "value": "085db5975b15432a2a88635bd30b7629ceeef3669f785e4580ad16ba82e5b7c2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281050, "uuid": "b06a1e44-b633-47c0-a4fc-433f308ef275", "comment": "Malware payload", "value": "1b481422269b3fb901c3f1404a30df0374084de1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281050, "uuid": "5b7568c0-3c7e-494b-8e5e-eab1cf5453db", "comment": "Malware payload", "value": "064b2f10b3557cca13de96e1926d0673c237679631149736f3fc35b357399799ab896c1ee5e76a3ec07bcd1b9bc5b773", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281050, "uuid": "8cef6583-7ca8-47b4-ac2c-31261856523e", "value": "T152F1C626BBF0A8C7060D3D8052D91C3A21A1345EBF7E4AD7DA190CF56F71793EB59888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281050, "uuid": "e76020b1-f974-477b-a533-5022c7dbac96", "value": "192:blo+BrmKmhtPhbQ8uIvbjwUbc7cVfyvvHYJvQoLcvP:becOh1hs8u+wUo7cwv2bLcvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281050, "uuid": "ac3e0a40-e6b0-441b-bc68-45cc0aca987b", "value": 8062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281050, "uuid": "eb757a6e-6239-467d-a5ec-81f321cbbe58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281050, "uuid": "94eaf63b-a24c-46bc-aef5-6d6ae281cf4d", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcfdd1b-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244667, "uuid": "219c21a3-88ca-4108-a520-339ed1130c5b", "comment": "Malware payload", "value": "3c22a72db55c96ee172774e4d15fe61e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244667, "uuid": "1003fbf1-26a9-4f34-a7ac-d061601d2402", "comment": "Malware payload", "value": "087df233f4ad30638489f33c40d20430da635500882753fd05022d0eb8d08840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244667, "uuid": "2ad1e27c-7523-4b2b-a2b9-64120055cfe0", "comment": "Malware payload", "value": "0579a008e019c53da8d41bbc3d02399cd7a4941d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244667, "uuid": "e38bade1-dbd9-4422-a820-a1ee0d1e3666", "comment": "Malware payload", "value": "0da1f74d9d62db9e69893da8ff1971e88904a770543c3b6921ab712d294ab37202ceeb8a7a584a3443f487d41b9f8af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244667, "uuid": "b638b8e8-71bf-4c53-a718-0fcb67ef9e50", "value": "T10B0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244667, "uuid": "f35449f2-f959-4e15-883f-4d046015cda4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244667, "uuid": "807cf2aa-e240-4892-8d59-df8747ba985d", "value": "98304:aCT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:p2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244667, "uuid": "1d46fec4-81e7-48fe-b1bb-a25ac50842b1", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244667, "uuid": "6885ff16-9533-4a16-a775-ccb24c818521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244667, "uuid": "04116555-3d25-4ebc-a604-412cf5842f25", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d212e9b2-b9a6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762278658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278658, "uuid": "171cdc2f-fea6-4bc7-9b95-edbf3a1dfaa7", "comment": "Malware payload", "value": "2cee3f603679ed7e5f881588b2e78ddc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278658, "uuid": "6ee9547c-a620-42a4-b9a2-27ecb04e2532", "comment": "Malware payload", "value": "089cb67929c70e9361b2cb1c305b5ea227145675a13e5dbff8e95f7d16db200d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278658, "uuid": "1b7bfa98-9b8c-4d0e-bdca-73c63c589e59", "comment": "Malware payload", "value": "44b3e684bff06853af3f61a588ff66720ad24a59", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278658, "uuid": "e74e7020-365c-49a1-9dc3-0437375c921f", "comment": "Malware payload", "value": "cdf84fa293294669946d63b3878472e0e91a6678fde71e589c66222709e9695455b7a8993ca05cb6731696cc93829453", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278658, "uuid": "7c415975-850f-4c13-8b10-7eb881e32b9b", "value": "T1E506E08AF7195A2FC876153309FA573126638C078E879B037544772C79BB6E80F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278658, "uuid": "79568c66-70d1-4fdf-b314-1afa8658c94f", "value": "98304:I65H7+tLn4G6oMOFdpZude9i+9MiCDVCt3esHiD83UKqS:Bh7eL4bqKz+9CDVspt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762278658, "uuid": "187f44de-a62a-4915-bdb5-7710f7972a53", "value": 3740600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762278658, "uuid": "dfa8d62b-e65b-4659-be6d-9ab6bf346a1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278658, "uuid": "58c9a927-9e48-478f-a278-384c7e0c5b5c", "value": "2cee3f603679ed7e5f881588b2e78ddc.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97c6ecd-b925-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762223319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223319, "uuid": "3b810bef-20cb-41f4-a17a-3655de9515e2", "comment": "Malware payload (Mirai)", "value": "bfe70a1a6691484117f36f5072d5fbf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223319, "uuid": "69a463da-0c95-42cb-a3e1-c465fd412530", "comment": "Malware payload (Mirai)", "value": "08cdcf144219f119d50b977721175b667c7d2acecc2cf313cb76312e5db541da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223319, "uuid": "5bfa72b0-5601-4290-9a85-9282b262a148", "comment": "Malware payload (Mirai)", "value": "fa1f8aa374a480a68c70fd5725ab02a62567d1f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223319, "uuid": "d4d8a594-08a3-418c-83ef-189260562130", "comment": "Malware payload (Mirai)", "value": "08d84f9f4a5faa598f028b952eeb2f37cf1f04e29be9b492b9d85bbe136fbf92dab8e81cda0c7e62e231dcd768a70c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223319, "uuid": "f8e1e101-c4f6-4399-9221-4b38ea447710", "value": "T13B5302E6A0D8BECDC2669374010F1A0729C5A37DA089752A76C4E5658BF2350DFD8BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223319, "uuid": "315c04c0-0578-47b7-9bc2-d4b96d7d5487", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRY65qqLkg4azHp:CM5az1Fy0oPgdZX6hTo8RSzqLGazHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762223319, "uuid": "3603a111-27a5-4bd5-9869-3393bc540da8", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762223319, "uuid": "7013362d-9502-46d9-a242-407a6c114fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223319, "uuid": "5337e4d7-a13c-4a67-93ad-297ecbe21a20", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.5047.25328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ec7d76-b9d2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297486, "uuid": "61645ac7-5e40-43ca-aeeb-4a5c87e2691d", "comment": "Malware payload (Mirai)", "value": "4f2a67473d73fa48641aeaad66627943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297486, "uuid": "5e872a25-ba00-4dea-ad3d-fb1724da4fc4", "comment": "Malware payload (Mirai)", "value": "08e1e16849d33d3be443de6aa42842a8aaff58806728d439f1999f91fbf2ca08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297486, "uuid": "1da841f0-758f-4f9f-bdee-dbed4fe9bbac", "comment": "Malware payload (Mirai)", "value": "ba3cd0dbc1237c312c459e61c90ab72f8db74388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297486, "uuid": "5686d135-aa00-4fb1-89b5-60d019af6c3e", "comment": "Malware payload (Mirai)", "value": "1fa61340b1b99fcc6131a8349ffd94fa7a620cd9b84fb4e5eb93cbbc2faf8eedeabb9a1b77028ef076ac377c31c756ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297486, "uuid": "b75075fe-2474-4b79-baaa-7f7a49d01d3f", "value": "T106C3AE9B770B5811C86202F01BD79F8E3E6372168E4BC9F72D0D663B28795CB19467D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297486, "uuid": "97923133-8f0b-4b6a-819b-c1545132a552", "value": "3072:72Dp1Qf/7cGAgQH74L0c9Z1pFThYgqnTq:s2fY1A0etWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297486, "uuid": "a50a4f75-73ae-4660-befd-b1f1d8d8a74a", "value": 124280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297486, "uuid": "d02ff2ab-14d6-4d45-b9bb-a7be31beee81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297486, "uuid": "2d4ab569-3f79-498b-a4e1-40719cba04fb", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4f41e9-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244609, "uuid": "b69696ad-f9c6-4bed-9eba-ced4ecc29efa", "comment": "Malware payload", "value": "cf901d6cc20b5d9e6ee4377d9013f2a1", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244609, "uuid": "779b3055-bbd1-4bb3-88c0-5a8437f55c59", "comment": "Malware payload", "value": "09739e093467e0bebe39c19f29f350499d54df757ccd0b29fd869e9580e0efe7", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244609, "uuid": "276b9726-78f4-4a31-a375-6b76f984666a", "comment": "Malware payload", "value": "b0847d94ddaf27357837d918cbbeecf9b06fbf62", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244609, "uuid": "8f625a15-767e-44ca-9343-8529fff1057f", "comment": "Malware payload", "value": "c6f5a2204d78af3ae1567178a2acd8b50b83d1a85481645fd9612a307cb779a36a32e3eb649dd314062ff6d1147c7f78", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244609, "uuid": "f519e0f1-d015-4b12-90b1-7d9c12c26dc1", "value": "T1EE95F082EEFF4D72C22BCA3945E312144325DC188A719A433ACA763876FAF553723759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244609, "uuid": "fe575260-5b04-4b61-90f8-a19c02d3a915", "value": "49152:9Xy613ghyImJh4iRZchzW7TKDhH/tumuo0:IA3gsImJh4iRWU7hmur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244609, "uuid": "1e0e2390-8f82-4278-8f53-a56187ee4136", "value": 1950720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244609, "uuid": "8287c2f6-bbc8-403e-8bdc-87d3551589ee", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244609, "uuid": "9ceaca71-27fb-44e5-8dad-d74c75d7fa60", "value": "purchase order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9794852-b988-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vjw0rm)", "timestamp": 1762265705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762265705, "uuid": "b0c687e9-5d21-401a-aa58-7f61cc28c071", "comment": "Malware payload (Vjw0rm)", "value": "0e165205ff872a9149660a900b1a0966", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762265705, "uuid": "2d608cef-994c-483c-b2e6-f9ba8c306a7b", "comment": "Malware payload (Vjw0rm)", "value": "0a4b4ce43b2e1ad4a97eba5d317b894b08ba5046b0598b0be965dd778cc953bf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762265705, "uuid": "81da052e-366c-48f3-b7c2-11ffb372fa13", "comment": "Malware payload (Vjw0rm)", "value": "dd98fc2022c8b8279fffc02d2679a4272c14db7f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762265705, "uuid": "008f9744-66d2-4fe5-8c20-e3a2d0c8847a", "comment": "Malware payload (Vjw0rm)", "value": "882dc97c11794b1c176497dfe53af2d8411c41a9de1456df4bc0eb35fff3935ab22ec6af7aad0f9de21f807c0de2b1f7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762265705, "uuid": "259a8ac1-1177-45c7-8a97-eb6c35f63a2e", "value": "T1DD25CD778F619B1A202B4B4965B9CE68D4B4E5F6814288DF35A3E58D20F77132336E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762265705, "uuid": "fde658a4-c5cd-4122-8c05-1f999f072694", "value": "6144:His5tXNXxZsjCOKebrRAAb1gy9Aum5B1wKPUA6v29ta4MLS/RI:H/5tBshA61gy+umXPUAZOWRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762265705, "uuid": "3da643e6-7a9a-4be8-836f-d6b393fe2e8c", "value": 962358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762265705, "uuid": "972c7f82-8bd9-46b9-abd2-983e6e734938", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762265705, "uuid": "4a885c03-3ede-4bdc-b7d0-1caf8f31c0cc", "value": "ORDER-709856-00251103,PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b35d750-b92f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762227429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762227429, "uuid": "45f493ef-0776-4318-a38a-d42fdeed3ab5", "comment": "Malware payload (AgentTesla)", "value": "a8d9dbce56c1a85efa4d60e426139806", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762227429, "uuid": "4b902abf-e390-4cd7-b968-325f70144fc4", "comment": "Malware payload (AgentTesla)", "value": "0a9d9b402fb39cf8df21ca4e68b84577c39b3ecf00415c999b28fcc92a695663", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762227429, "uuid": "8ac68f6c-4343-4b0c-86a4-433ce8ae7d1d", "comment": "Malware payload (AgentTesla)", "value": "f2b2cd8b8386b3665aabe29c2d885f1c2dc5e52b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762227429, "uuid": "707afba7-6463-4184-9845-896dcb6b52f4", "comment": "Malware payload (AgentTesla)", "value": "5a3b4ab12cb8adb9eb3135c517f57dc481f3f501072f6cc1b99608fe8c9f321ec9a6525c7d5c68283852a712c03ba312", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762227429, "uuid": "4eee5bcb-bc4f-4dee-84ee-a801e18c3b61", "value": "T17C75BF52BE908D36F13F7534D806A3685515BEE02938F84936FC3E488BFB643291AD97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762227429, "uuid": "5f357ea5-bd2a-40c0-ac8f-29a7f48d7aa3", "value": "9509cd72617adc5aaaf1d9505b0f5cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762227429, "uuid": "6c380cc5-8262-4472-aa0e-be120be483e8", "value": "24576:UjOpBayIR+Oh64DsLTlxu4KhdRPtOjCaQVYuDjtGNY7MEEzp:UHvmTVmYBQVYulG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762227429, "uuid": "e174f456-0d28-41a1-901b-a6e5539b33c8", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762227429, "uuid": "5075811b-978d-457d-b5bf-13e158c41b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762227429, "uuid": "7c3f5f59-1bd3-4012-946c-e05f1d71da18", "value": "7212500419 ORDER CONFIRMATION OF PO-R1914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d5758d-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245263, "uuid": "832678a5-ef7a-4370-bed0-216107c5b446", "comment": "Malware payload", "value": "fb69eb3e8743b59d726952ea671c5365", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245263, "uuid": "50c68cf2-f3ff-4a3b-a70f-0f4a51dbe438", "comment": "Malware payload", "value": "0ad9883acc1df903c2155c5f88aacc4a943c46bbf897f0d156852c194769bc29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245263, "uuid": "c25b9abf-4293-4ecb-972c-b535c776f3d5", "comment": "Malware payload", "value": "c2353db9f007f7a414e43280cd1fe0dabe924dcd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245263, "uuid": "2992a377-f1f1-4489-a0c7-9439a66141e3", "comment": "Malware payload", "value": "b39fde6d092477a7d8f829b238280c78ad357639ea8c1d1c5f8fd94c9f9e3bc0d233962367d1ebe84cc475b43f73d02e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245263, "uuid": "26eb10a7-e65e-4dc0-b4d7-28a463f2a923", "value": "T1A61612A6C24D31A4761B7291EF48C49CF16500BFF93AA42DF96F189FBB2A8901D36560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245263, "uuid": "42fc7816-bfc6-47ea-907d-971645af2c48", "value": "24:x8M3BQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQr:B3dDwv4vJjRf6kTxdp6PTvV1U/ZI3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245263, "uuid": "b81d225c-34b5-452d-aecf-bb9a92968441", "value": 4094892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245263, "uuid": "af555819-4b59-4d8f-b2a2-d0dc3dc215bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245263, "uuid": "e3dd8ff0-8663-408c-8ae5-971ff2f7955a", "value": "PO10038282.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad7c946-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239777, "uuid": "1951adf2-732f-4a32-8342-b64d248f3e28", "comment": "Malware payload", "value": "a479044a3b7249bc1f2d6f49fd50d983", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239777, "uuid": "520a03ed-0ebe-4665-b399-5da3b312fd7d", "comment": "Malware payload", "value": "0b261f8fb76416c49fdf5d1f93ead9fe961b0b8eb24b8c877fab657ec5d5fdf3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239777, "uuid": "d2635163-49d9-4d1f-9528-a24f3efbdaa2", "comment": "Malware payload", "value": "367956d70d60ea54a117e99e424044471d37f062", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239777, "uuid": "098fe6f2-2699-41d6-869f-2d8637ea5c1d", "comment": "Malware payload", "value": "91afc1ffd6e2299e104ffaeb09a890fcc31e10921950fcdd835c3684aa72fa2ea7f2d41e3d14aacc318a86e37c2e20a7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239777, "uuid": "4d5c9d96-1e64-4c99-8bad-5e9cdc2dc6e8", "value": "T116362362EA9DE417C423F37DCF60B94B8C48109D9B48FB529B27E25C0DEB540B795E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239777, "uuid": "9dd04ac0-0576-4af4-9bf6-3da2bcd17fd8", "value": "98304:9qsXbt72GZ7urUHou4DNSrn5bRpIdl0xgJb6U+qsXyqsXQqsXa0K:1rtzIrQoVDNcs0f/ISS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239777, "uuid": "6e1514dc-ee82-46d9-8690-856f5ba8592b", "value": 4938006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239777, "uuid": "403089b4-dc79-4bde-89c4-4544d962eb2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239777, "uuid": "6c7edcd2-4a28-441a-bbf7-38e80b2809db", "value": "\u4e91\u6c47\u56fd\u9645.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ead589-b9d2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297373, "uuid": "883a0f39-9055-4d6b-b938-393248364bae", "comment": "Malware payload (Mirai)", "value": "dac493873890b40b6a42881ac93dd32e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297373, "uuid": "ae96d7ab-aec9-441a-be7a-f5362667a229", "comment": "Malware payload (Mirai)", "value": "0b92cb77fec808a81df7037d623f112a33c759a5f7cf13681d2ff71c8471fcef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297373, "uuid": "cad01d5b-fbd8-40ca-a54b-85d3075b2bc9", "comment": "Malware payload (Mirai)", "value": "9984146a58e2fcb4715a60fa3d7e3c2f334bff6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297373, "uuid": "3e74d205-d3d5-4ecf-b55e-5c34f6e3bf46", "comment": "Malware payload (Mirai)", "value": "5544e9f395573bf571b436d7ebfb48efbc79c474caf344ef692bcf55056b20d44c0440b7830f3c24e00f9751626389c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297373, "uuid": "656c992b-ce75-4259-9b25-7f5ee114a6c4", "value": "T191D3A60E7E218F7EF369C23447F74E31935923D522E1C685D2ACE9151E6438E682FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297373, "uuid": "86a01a67-f6fe-4b45-ac98-73388c970a4e", "value": "3072:I1LIQRiedhtdSC22clQKLJdtsrOvDA0sCB+Snz2Zg2S:I1U6Nhy9lz2asTbO2Zg2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297373, "uuid": "2b65858c-55aa-4847-a914-f4f4eae337b4", "value": 136288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297373, "uuid": "a00e9b10-b398-494f-9c1e-c805ebe03f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297373, "uuid": "d500fdeb-6369-4430-aaf2-ecd75aeb684a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ceefd-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261154, "uuid": "6b08864a-72bc-4e02-89ca-d5a5f5cf163c", "comment": "Malware payload (Mirai)", "value": "d26aaa5d8df491e99fab4c637cf6c1bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261154, "uuid": "bc347a68-5dc2-4aab-9a84-964eea65a74a", "comment": "Malware payload (Mirai)", "value": "0bbe982757a0a60bbd6e8a3e19779fe2a3d412f5dcf737549b436aa67d8610a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261154, "uuid": "6db90122-26c8-454a-84d3-0bb4b6f87ee1", "comment": "Malware payload (Mirai)", "value": "a71ebeb46d55a4a24e2a7039676b732562456e40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261154, "uuid": "f2856eb8-d0f4-4707-b2a1-dcc9eb1fb201", "comment": "Malware payload (Mirai)", "value": "c97f22ad574fe437f761f12bb15f3d925b613cc784d7926b7c2bf165fd396e8d9710905b3f6f41b10ff3d70081344660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261154, "uuid": "5fe8fc86-c364-4c81-8650-3a430e0c6f99", "value": "T11643F160FA251AC7CCA98C7481EE36715F1A712836DF87A867170E81B71D10FB96873E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261154, "uuid": "419f3e7f-7e9b-41e3-be29-36c2dbd7b8f9", "value": "1536:h8rRD0gn1aEVi15uooQJpP8LIYUK5xUStvTbjM:edUEiOdWF8KK3to", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261154, "uuid": "7939982a-d266-40b5-8eea-7ae643371ebd", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261154, "uuid": "02faeddf-32d7-4495-bd29-0430e837d7d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261154, "uuid": "ee68ea79-d9c9-4a10-a58d-829b6dc228e4", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7aaa0a-b9d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762296904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296904, "uuid": "38b99729-161c-48a2-89d4-b6e6b41e0c35", "comment": "Malware payload (Mirai)", "value": "c5cbcf7ee54efac55a5e5b94f9eac638", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296904, "uuid": "54387ad5-b750-4670-8568-f08abc767d07", "comment": "Malware payload (Mirai)", "value": "0c128a68f1416b52be4922c9c976764477c9c73079f0215fc88483630b3a6cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296904, "uuid": "d17003bf-27d3-41b0-9fb1-e64e99ee6d99", "comment": "Malware payload (Mirai)", "value": "7faf7315b6364d59d6ed9d7a338308cd1b64888d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296904, "uuid": "3e2f69e8-b12d-4431-b88a-b36cd6076e33", "comment": "Malware payload (Mirai)", "value": "ffbcd884b461de01a31612762dd489decd10aaa489019b78d5eeb704f5e8a4f6254d37fc8d7890eb5a2d34c82588e89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296904, "uuid": "847515ba-d44a-4e37-aa62-58d396dfb3d9", "value": "T141834A02734C0D47D1A75EF42A3F27E593AFE99121F4FA89650F9B4681B2E33154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296904, "uuid": "6222f24b-5640-408c-8f29-8f2bcb308c85", "value": "1536:LPKKcnlj5ytdK824Yry9Y+wuVdD+0Oy1b:LCKSjMQg9uueSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762296904, "uuid": "ebe1b711-9a7a-4e84-a96f-f0048866b920", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762296904, "uuid": "b19d0278-a56c-4c42-9e82-dcfb9f6b30f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296904, "uuid": "53f224e4-0216-4f16-9f1c-53bc92dac604", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e921f4-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224411, "uuid": "410c30fd-d61d-499c-a1f1-c226b263f57c", "comment": "Malware payload (Mirai)", "value": "0d1ca485f74ea47d93e5217f1422dd2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224411, "uuid": "6ccf8265-d717-4ef4-9451-eac3aeec8c1d", "comment": "Malware payload (Mirai)", "value": "0c986754be60c0d0dce2497496b302d30bf7276934c27eb0c3075f6ba2e6d578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224411, "uuid": "85416788-ce5d-4a9e-8a63-84e207c9f034", "comment": "Malware payload (Mirai)", "value": "c1874f9d696e1d4d5e1844e724f176ea8f8ee51d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224411, "uuid": "7a0cc510-22ba-4576-9d0d-cd7fa3cb3f94", "comment": "Malware payload (Mirai)", "value": "f53b0d3e592146715c15d478462cc276734a8ccbd297261f177209bbfd71e5196dccb96dfc1aba184dfa5197679d6c7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224411, "uuid": "25631d1e-4c5a-4c24-ab70-0dfe616c4968", "value": "T1A0334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224411, "uuid": "b98beb4c-3542-4e07-b8da-edde61ff707a", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Tw4:ivW3jdQGqt7Y+Z+zN9cGgI6b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224411, "uuid": "8cef715a-60de-4065-a19c-4f1770af341a", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224411, "uuid": "676df300-2b61-4a92-a4a0-8903f737a36b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224411, "uuid": "8231850a-74da-4154-ae0e-d3ce6d247834", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ad1777-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269915, "uuid": "df5894be-aec5-41f3-817f-1d5a55540f94", "comment": "Malware payload", "value": "ee24e1ebe4184c6b7c2d65738a14bf0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269915, "uuid": "25293444-343b-4be8-b594-42d93b89b732", "comment": "Malware payload", "value": "0ce283c575ae8e287d143a2a7760f232137f66014f94ffb5a5d2a92e341acbb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269915, "uuid": "b09cab5d-67dc-4ba1-8f32-637a5135c338", "comment": "Malware payload", "value": "5851a9cac5a28de14c728572685e701d27b2a704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269915, "uuid": "e66e1690-2450-44df-9418-6aafc6cb2cb7", "comment": "Malware payload", "value": "48377a38094a3ea7982dab52ce46bd5f6463a2f601227fd019b39c0ba591a09b87c432350116e509b286e8d4d86a7972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269915, "uuid": "830975a5-fe3e-45ac-bd77-3616dbcca831", "value": "T178C51A4359DF0DAACDD677B8A1835336B734FD308B295E3EAA48C23119536C4AE1BB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269915, "uuid": "52c7c575-06da-46bb-a8da-2acda520ab18", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269915, "uuid": "57938792-301a-40e1-9fb4-b57af237989e", "value": "24576:w+6RfeJVxthwuHIy24rIXRuriBGA+oPYMRox1WFjfpdJ6clMi81s3Adc+zM8f:w+6RfaxthwuH17rIh0AhFjIc+o8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269915, "uuid": "3c344a62-a280-48f6-ab73-d02fbf9b9991", "value": 2650167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269915, "uuid": "490d827c-723c-4d6c-9fb0-eeafb0717390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269915, "uuid": "06eb6880-47cd-41ff-88a7-fef7c23c0d3d", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3f04b9-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269924, "uuid": "b69fae7a-71b2-41d2-83fb-3ea3b8628300", "comment": "Malware payload", "value": "306e751c3458c5560dcf752ef056c803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269924, "uuid": "fcc82490-0e00-49c6-bded-87fc213c02d7", "comment": "Malware payload", "value": "0d14240f3f3fefdf4ea4f220c0282bbda14407b74f163a5c7fd1cfb17b5261a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269924, "uuid": "975053eb-7299-4c5b-ad15-50700f0695e7", "comment": "Malware payload", "value": "3a5dc8e1200a15074f1dc38f85864a1cb7dfb095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269924, "uuid": "e837efab-5182-46fe-8b0c-ddba3c4f60d1", "comment": "Malware payload", "value": "86335991c374a6f48b05a7cc29116a54db4b03b069b965eba153b056f8b604a0c4b7d3bad2297a63105f8f580cb46ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269924, "uuid": "a59664cc-2de9-4b5b-8a66-fc90d7399246", "value": "T1F4269E43A9DF0DA9CDD677B8A1835336B734FD708B295E3E6A48C23119536C4AE1BB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269924, "uuid": "91d49511-ade2-4e10-a782-9760017488cb", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269924, "uuid": "073c1e32-1566-4be6-9120-05a3bf7a735a", "value": "98304:mOCdxRjcNwZSc+o8E0oNwYUI5fPzsWY9CxrCEHUssgfDcMS+M:WdxRjcoOouYtfbW9ECE0cDcgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269924, "uuid": "3d8caaa9-7d8d-41ff-84ea-e0fa55fc93e7", "value": 4470535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269924, "uuid": "47c55244-a676-4adb-9d7f-c6a3ac1fa91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269924, "uuid": "dff74891-ae71-42ef-a6e0-37c41add540c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27add70c-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245301, "uuid": "628a2080-fe3f-42c8-85cb-8dc10ff0d73a", "comment": "Malware payload (PhantomStealer)", "value": "6fdb9c2868a2680fb730015fcab740c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245301, "uuid": "f34e4832-2243-4c71-99b9-8c37b1603600", "comment": "Malware payload (PhantomStealer)", "value": "0da2c401809ba20b81b1e55c113cdaa186973067d19ad1057766e3520b99e689", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245301, "uuid": "cbd2f326-80f1-469f-bcc0-6bfee35c0af5", "comment": "Malware payload (PhantomStealer)", "value": "6e21bd546fa6fd29b0cfeefd5e8a3be651c145ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245301, "uuid": "fb502b91-331d-4611-8ac2-bd202b520f8a", "comment": "Malware payload (PhantomStealer)", "value": "cbbceb5e969958b3fec789290dd40f9d13f32d44436da762296f8684ae8b4b21fcff8c37dc5da6da7f7c941fdff5fb8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245301, "uuid": "8f918437-49ee-48a5-b2a9-37df9285db50", "value": "T17D26127132C7A060053DFB478EB58E64AD77482FBD03AA05F58C2DEE6B14663452BBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245301, "uuid": "37954b6d-71be-4636-90da-b4c6a7d3385e", "value": "24:0fwEa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aFa9aK:XdTH8rGOPg/9iZf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245301, "uuid": "fe9adf63-109c-47cb-9536-c8670172bead", "value": 4576518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245301, "uuid": "40ee3dcb-601c-4b5c-af47-030ab54ec0db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245301, "uuid": "08f9c44d-13d1-408f-a0c1-82decf96fd32", "value": "PO10038282.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc481f1-b9ab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762280829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280829, "uuid": "6eab0b1e-a5ac-45aa-89c3-a9d19c8f7bcf", "comment": "Malware payload", "value": "e9b578cdaa2109cd33aa84be9bb32866", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280829, "uuid": "715e5fc6-d7be-478e-84eb-eb2dc5f76df1", "comment": "Malware payload", "value": "0dbab5ca9c9079ca6099b4f036f7c403e0b61fdcb77dea147ff25d8c349ed1d3", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280829, "uuid": "75ecfbc2-36f2-4310-b820-cebd62d2c53a", "comment": "Malware payload", "value": "66514e91c83859b1ebc99f0a64f584a682a34ec5", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280829, "uuid": "493ebad9-8b14-4061-9b93-56f63547849f", "comment": "Malware payload", "value": "f1ec04c9d3fbecec6fcca78532eccba0780f48648c54a8d932a5b856a65975adee5e21a53c56d503412d9ef951c71d30", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280829, "uuid": "3616c717-ecde-4ac7-b185-c0f77402670d", "value": "T11415CE2BB665B8DC765961BD207F390F301CCA8B9D78376D8D0E78511E21F4886B738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280829, "uuid": "7dcd47ca-ccc0-4b09-99a7-99d357723909", "value": "12288:j35lAuGbQihDm28SduCPCMmqxuoX5EIZ5FphmMF0vMH8bxeBrh3S5LIiKDt:bhihSwHPCE53ZcMvHtl3eIi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280829, "uuid": "0297f1fe-0090-4b61-b324-e587892a2941", "value": 908721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280829, "uuid": "8aeb3f91-6944-4334-8e6c-85186fe8a5cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280829, "uuid": "d97781cf-746a-4340-8481-8a077904e9cf", "value": "Sat\u0131nalma_Sipari\u015fi_2025_10_30.gz.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbcd5aa-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261152, "uuid": "2a5a0030-4306-461c-a03f-9f39b873db5f", "comment": "Malware payload (Mirai)", "value": "05c3b362f3356cc74ab031cc1c0a81fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261152, "uuid": "d3256f8c-c1c5-4e77-8c0d-9b7431bf8576", "comment": "Malware payload (Mirai)", "value": "0deb45bbf44527ecf14c094a19a6e135f26d6a848e63be203efbccc597b98fc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261152, "uuid": "b72930aa-3d35-493d-b2f7-76f510fc0188", "comment": "Malware payload (Mirai)", "value": "44e18ffe0040848015967d0e4ece141fd12a9c3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261152, "uuid": "1a7f882a-6965-4b37-9e48-7d559cf4c61a", "comment": "Malware payload (Mirai)", "value": "e33660eb4f1c7e3060d69bfb66428a4fba67913d85505f9f4edd4ec5e967a616f53cbb2cbeda018aebf2a428d46d2880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261152, "uuid": "aed793ea-d9c5-4adb-a381-2c046a3a93da", "value": "T1B5D37B73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261152, "uuid": "a46c849d-17f7-4286-ad0f-efc0cf853f72", "value": "3072:QOuckx3SPfcjjNr/qDhTdDWIZ19K6hh1LYb6:QOucl0jNri9dSIP9dYb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261152, "uuid": "678842af-ca69-425a-a90f-b1ab0b11fc5e", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261152, "uuid": "43802ef4-0b94-4785-8b2f-aa92f693f6f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261152, "uuid": "df1ab28c-3e2b-434b-ae77-3853b3f409ab", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cfa02b-b9a0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762275784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275784, "uuid": "d70ceab1-5311-4121-9d5b-f805d2898ce7", "comment": "Malware payload", "value": "ecf54d679c28c49cb2fa2e298373971f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275784, "uuid": "302d9563-4e05-4593-96fc-195a4719155b", "comment": "Malware payload", "value": "0e68c2fc400036eb279460e37953b1f9db393c6cb8c604ec0504e9de1866ab1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275784, "uuid": "f4a58978-c725-4e42-909d-87cbc1b4a3e5", "comment": "Malware payload", "value": "641d3e80169cfb14eec145ab77d46e032607c7e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275784, "uuid": "d193cbb3-647e-4381-a58e-0372e3323bb4", "comment": "Malware payload", "value": "31c7a2a5e29821574c87373b060561e2b133c1f1968125424d28b79ca33dc90653d37f11831fe34fc031db5a3faa9675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275784, "uuid": "d17bb989-bf25-43f3-9073-2af2c579d6ac", "value": "T13D843B126A758090F176C17C22A7B323F1773C4D96A8F2BB999CC70F2355B4672ADB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275784, "uuid": "447a34a5-4aee-49ef-8a64-fe9b3af23693", "value": "8f9fd47685e31cd3e27c4e76741a87e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275784, "uuid": "f88144cb-9762-4005-a2e2-972e6039a916", "value": "6144:jx1JsQgXiDS1NZ20PSzv5kQWDkn0DjdRkAD7ExV2QCqx6tR:jjXgWyZ20KPt0DjQAD7m3x6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762275784, "uuid": "1be578d6-b4e4-4e84-9e84-3bb7c6d21a06", "value": 407768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762275784, "uuid": "081ab03a-984b-4db8-b26c-7b5eb7b67f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275784, "uuid": "3cb6127b-e99e-4a16-bef3-cf00a40779d9", "value": "AnyDesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb64fd67-b975-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762257682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257682, "uuid": "601fc182-15fc-4e94-b4f5-e32f9915aecc", "comment": "Malware payload (Formbook)", "value": "fdd4c7c68b989d21c41c1deca6847ad7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257682, "uuid": "245ba422-e1b2-4c56-86f8-de490588ea45", "comment": "Malware payload (Formbook)", "value": "0ebe28f2022d5bd85167e22c8df97982dda3aa1b63d6e02e502ccb680c1b9ca9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257682, "uuid": "1125ba9a-b51e-4397-b917-0335eda06ffc", "comment": "Malware payload (Formbook)", "value": "c69f30b3bedc704fdb1bd0e9adad615b613e8f1e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257682, "uuid": "5410c549-bc68-4a75-a04e-dbc94531befb", "comment": "Malware payload (Formbook)", "value": "652bd901273cc941aef352836b4e956a44e49125e823a63fd5069b2cbe9960b24e8a207cd5419cbab1d980897fd5b8fd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257682, "uuid": "5ed0b3b3-47a5-4f37-b139-5ea2257562c9", "value": "T184F1B0A05C10FE3EE696BEF1A7165D688A54F9F31F371196650056CABF80182E6C2328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257682, "uuid": "e6429d4f-f865-4df1-bd23-f32bdf5fd64e", "value": "192:J2U90AraaIAghce/ps2Ts9JmsZq8yAXjqlYswVbYDq8t:J22traaChZtAneAz7rVbUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257682, "uuid": "568aeebd-5cf0-46a6-803a-d12f708d6b7f", "value": 7712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257682, "uuid": "126d2f96-86c4-4643-af5b-2ed4e0d0e8c1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257682, "uuid": "c615b810-e8af-410c-8ab6-00898d7328ec", "value": "RESOCONTO INSOLUTI al 31102025 - ATTENZIONE IBAN.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ab549c-b973-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762256730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256730, "uuid": "38597c97-56b2-4fd3-a156-db9b96b2cf1c", "comment": "Malware payload (AgentTesla)", "value": "d25a9f697c9cb57dcdaadb03bbe384ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256730, "uuid": "b07eb7cc-cd81-4382-ab87-7f1fe87fcc5a", "comment": "Malware payload (AgentTesla)", "value": "0f683ab320b6070a7bc825c53640c042011063b95e8fee80be4335a15b9b528f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256730, "uuid": "6bbfc5e3-d20b-4b50-ab9a-70e80aefab62", "comment": "Malware payload (AgentTesla)", "value": "99004016b759e65f0acd824ec472538c57e3498d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256730, "uuid": "0b924e88-9428-4e45-82c0-1e21548aed59", "comment": "Malware payload (AgentTesla)", "value": "f926bfdf1047cdcbbc95080f868bbcec334bf769a116302af0eb9cb4dfaf7fda2e0ff1492075d65b4e9a27e76d928315", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256730, "uuid": "9bb376be-db22-4086-bcfb-4601d496e8b1", "value": "T18125F12523D46F95F47F9BBC9574104187F4B80FE722EB5E7DAC54E82922B808762363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256730, "uuid": "6ffc8220-6879-409a-97f7-4dad08c941ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256730, "uuid": "e9f8ab9a-b3e8-42f7-af7d-913bd0f2e101", "value": "24576:TrdzN67rUBVia9FWqjf5ZmiLf1Db45yT/bG3K6HYqXE:TrE4FFWqdciLf1vznaZYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256730, "uuid": "d45805ba-1927-4759-9884-6bebdda2490f", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256730, "uuid": "4704acc5-3da4-4ee5-82fe-6ffb85f8d55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256730, "uuid": "69ead258-cff8-4c6a-9976-97e8e7656aa9", "value": "New_PI_Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb26b0a8-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1762245549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245549, "uuid": "20b49dcb-dedf-4fa5-900d-92e7e46ad131", "comment": "Malware payload (DBatLoader)", "value": "ba1d5330309d9db1cb52b2ea85cba9ba", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245549, "uuid": "5a49b05d-6784-4bc2-8c71-d6c7d6657dfa", "comment": "Malware payload (DBatLoader)", "value": "118222523450fd6d59061cfaff0e5d8954e2de985cb4fdf9868c6fbf6b6a9ed5", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245549, "uuid": "7d01bf73-6147-49c4-b0a9-c2070cad6886", "comment": "Malware payload (DBatLoader)", "value": "12f1021bceec5163b170281aa2832a76ca81f8ab", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245549, "uuid": "1dcc823c-91e7-4c72-860c-434905afb6bf", "comment": "Malware payload (DBatLoader)", "value": "ed6aaa75d13348b0c1a048a7bb189d0ba7a50bafafe793e3bfcdf557a281d04601c159240b9ae26bf5e4b54087c3c5bd", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245549, "uuid": "5e2e9574-7b1b-4fa5-bd6f-72a861950cdf", "value": "T1DEA5AEB28EB75ECA176864C8C9CE7BC43F2C57539524A614AD6FB0BB11691007FD88EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245549, "uuid": "161ce26c-d70b-4793-85b6-a7134f3402ab", "value": "24576:5uggkV4Oo4oAQTGn3Rj8RQd6wrojHnwy6XyVC3RRX+h6EpX4mjSmnTyg/ViKiQqG:Ng2o4o9+RAR+lr5XeCCpIInZZOrNNXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245549, "uuid": "779b178d-3a9a-45a6-bee2-7f98dbb722ae", "value": 2203323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245549, "uuid": "e2c6b91d-2458-4b34-a677-53939c295ac7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245549, "uuid": "34339891-3182-41df-8279-e925f39d6294", "value": "Technical and commercial offer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0809be68-b977-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762258133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258133, "uuid": "2a7c5073-c822-49b7-bc92-5028930e5a9b", "comment": "Malware payload", "value": "2be5f6afa114ee5607d88bc5aeec4d32", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258133, "uuid": "bd670c63-128f-4517-8463-84197dd3cc93", "comment": "Malware payload", "value": "122d9df1eea4f711fe7e1da9adee6bf254d39f3ff528687a4344831784db28ab", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258133, "uuid": "81312968-87af-4fec-9474-da33c9bfff84", "comment": "Malware payload", "value": "86b55eff8ee238161ef34a99086f6d1e482595e4", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258133, "uuid": "ae3e40fe-b149-447a-aea2-b2fd016748a5", "comment": "Malware payload", "value": "72cc0b08798539b20f02cbda9f4d86866174cb3a5e1625640792ee9f118540e4fb1afc07e3aaf88ddbdeb86897d28d0f", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258133, "uuid": "6bcdf78f-0e77-4ebd-b493-ab096efefb8a", "value": "T1FFA2290AE7DC5A70DD698A3AC09F4542B370EA66F763CA1F3C0E23543972746DE902C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258133, "uuid": "51672c68-a816-4fa8-bf70-4860acf52ebe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258133, "uuid": "2cf46b6c-bbf6-4448-b315-7e7c03a8c6ae", "value": "384:NpM2qO0TPjluWjfUGqZAL7eTRgqzM8c6wnaDRFXs4aR5cF96ilw2E9kZ6Ry3By:glXvlTjRwweTDfcNa4HC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762258133, "uuid": "1bf2b128-d159-4bb0-8de1-d067a853190b", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762258133, "uuid": "743efd56-2a7f-4110-b18d-a907c972ac99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258133, "uuid": "6239cb12-8e5c-42c2-96be-88a87fe0d0e0", "value": "blackhawk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77988cc-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762245516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245516, "uuid": "6f67af9b-5378-40eb-8df9-5a0e980f8182", "comment": "Malware payload (DonutLoader)", "value": "841f0eb77f0f74737eac0043ba6ed934", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245516, "uuid": "361335b9-0f87-4706-b508-4648e00634b7", "comment": "Malware payload (DonutLoader)", "value": "1358a87d3ba43066bbbe4eb5e3a418fb6ee28fe40b832e6a0f2717205a484582", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245516, "uuid": "547348fe-c136-4269-80e8-f766c3c9e407", "comment": "Malware payload (DonutLoader)", "value": "b83a0e3f7a31915c817d2008878ca3ac838eacd6", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245516, "uuid": "ea261a22-8872-421e-b11b-2dd529c43834", "comment": "Malware payload (DonutLoader)", "value": "b5b3d68f76da0cee4da10cf71f7e03a9e2304796f57175d197824c92975dbd9d9edd63d6d4eecaa47567036423383693", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245516, "uuid": "6a36cbec-b061-4af9-af2d-e2a13c80ea74", "value": "T1F4C4BE39C760ACA86BB93193EF693505B397DE0363A42B9CF4C280D83D11559CFA716B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245516, "uuid": "68e50370-590f-4cc2-ba7b-30dcb5485e32", "value": "12288:+ojN3uIwV/csalQ/Y8JQMrj5AR0KfHf38CjmSZ:1ev9RRY8J6VMLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245516, "uuid": "5d75e2ca-8bed-4e7b-ab90-09bea62ea569", "value": 560469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245516, "uuid": "01984e7d-dc9a-474d-9313-7eb5d49f89fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245516, "uuid": "e664576c-a684-4ee9-a4be-178b3b49c0ce", "value": "PO-O6545-000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b718fcf8-b9d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297081, "uuid": "638228ca-9cf4-4e98-8619-0a237067d209", "comment": "Malware payload (Mirai)", "value": "03b0fbda7e4b38d0a3b069024e1181d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297081, "uuid": "94914848-880c-47d5-b4aa-80296f6b6f9c", "comment": "Malware payload (Mirai)", "value": "149bfa4eaf489f54695a858c634009df7221f9b230a65dc90243a7374f941373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297081, "uuid": "c147142b-ec2e-46d5-a99d-5a16eed749bd", "comment": "Malware payload (Mirai)", "value": "b05509fc777437d85f7eb9abe7a322df757da2bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297081, "uuid": "45759007-58aa-4f82-8bb5-4f2b54eb22f2", "comment": "Malware payload (Mirai)", "value": "9821c639a44399f842dbc9a1674e2e8ee12022da9ecce7322d8fb40272f2aa721e3f8aa173f210afe81fddf76f105238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297081, "uuid": "8a743652-1e29-46ae-80cc-9c1152cacfb1", "value": "T171C35B42FA418F13C0D61779B6EF42493322A79193DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297081, "uuid": "650f51ef-4073-4963-a31a-0ea3d2359b4f", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoGrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIGrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297081, "uuid": "9bf01d61-004b-4933-a036-cb24f9ecd99c", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297081, "uuid": "532506db-fd13-42a0-a9e1-1a3bafcd6f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297081, "uuid": "164146b0-a698-4b70-97e8-03469e93c85e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f760c738-b9d0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762296760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296760, "uuid": "186b0b57-87c5-4567-bdac-65c32842833b", "comment": "Malware payload (Mirai)", "value": "020c1470bc4ecd5195b251ece3110594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296760, "uuid": "4013bf92-9022-424d-a43a-b236c391a54d", "comment": "Malware payload (Mirai)", "value": "18b40a18fe04c05ee7bbdc7a07125633eb803dd7cd9f198e89a2b824df628c5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296760, "uuid": "26808127-5217-4976-8ebd-b2e72ff12571", "comment": "Malware payload (Mirai)", "value": "6a31fbc8e45ce1084eb6150d82d3a957f6e9977a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296760, "uuid": "0e4e0ae3-ae5c-4d82-ac0f-4b4b48125a8e", "comment": "Malware payload (Mirai)", "value": "08558689b148c5c746b266091e14117d09e9795796f491a8bb5464b14183a1aedd72eb24e37ea27e6c415b771ce80bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296760, "uuid": "d3579939-69de-4c23-8311-69bf5000ae81", "value": "T119B32895B985EB11C6C256BBFF4F42CD331657ACE3EA7213CD284F6032CB51A0E2A056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296760, "uuid": "b704927d-78ce-40ea-a391-fd70a10cb433", "value": "3072:fUOFhuT3Wsdt3YZ2idVRFocTT5FNM8zYQlcfvFzG+sFFtm9ltRSByrDnz2:sOzuTmsdtoZ2idVo+Tf+8zYQQvt+atR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762296760, "uuid": "b2965cc8-6ea8-4ca4-b796-baa0406d8c84", "value": 111116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762296760, "uuid": "fd42ef6c-119a-4330-a430-ccb60ac7b72a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296760, "uuid": "83c3340f-1fd0-488b-923b-107f029bfb7e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525ba578-b9af-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762282310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282310, "uuid": "2711164a-0c3d-4877-9bd7-55bd27697e6d", "comment": "Malware payload (Mirai)", "value": "0189d95573d6c397bdc62e14056aea8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282310, "uuid": "bcd00934-2951-4c9b-84da-e806b3564982", "comment": "Malware payload (Mirai)", "value": "18dd8f23f4d4fff16d8be8b0d1eebd1707800ddebec542a761f0cd18e4405fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282310, "uuid": "e76f8aee-470d-43ef-884e-6d43b9667ab9", "comment": "Malware payload (Mirai)", "value": "502537943b19e2ea1f4d33356fb65e715001d20a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282310, "uuid": "e024a56d-0ce9-4d10-86ea-6e7ad27707d2", "comment": "Malware payload (Mirai)", "value": "a41abfefe80c64c2476ccc120cf93f978d8f6ed9cdbb35847ef9c508b06eeb2f4d81b870ab03dacab2538a90aad6c7ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282310, "uuid": "3aae4559-6394-43b8-8f1d-b51916d2c96c", "value": "T1D582DF3061AB35F5DBF10431EEAECEC6971A0BF8D0FC36D216586B78CA4250611F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282310, "uuid": "682b3239-9fdc-4dc4-b2d7-868a0e124419", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaOhymdGUop5h5lU:6/V0P6+kom0tVAoNvm+to1Os3UoznlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762282310, "uuid": "b5ca1e2e-6b0f-4b16-8b6d-f01a3ab096f3", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762282310, "uuid": "e2d1256b-3d22-42c6-b107-b5474fe055eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282310, "uuid": "1500d578-f457-4a52-a9fc-e2a5a8629af7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6836c7d7-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245410, "uuid": "c255e955-07dc-46d1-bf49-5f81621a693d", "comment": "Malware payload (PhantomStealer)", "value": "36bc1facae6413a95c36c3b279558fe5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245410, "uuid": "da2ba3fa-ff82-4228-8f29-6912bc4eec89", "comment": "Malware payload (PhantomStealer)", "value": "191e06590d8cecc1799ce78aca0940f78990f1dba7aa92298765dca2b583a52d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245410, "uuid": "2026936b-5371-42ab-97f2-312813b2a2ca", "comment": "Malware payload (PhantomStealer)", "value": "20994cbac7e2686c12027140c50e9c22c9180f18", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245410, "uuid": "22a4e0df-258e-4f86-8b28-be3a8c27e15d", "comment": "Malware payload (PhantomStealer)", "value": "8ad66186a8267e1e767b88d15d9f610d36a16e19647b26c96b2c14cc25c94d20603f6a8a36d170013ca9bb076f848578", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245410, "uuid": "552c28d2-1a55-4356-8dd8-450cd996fe8c", "value": "T1432612A97E9E169DC611F1201A83A921E33AF573FC4C59487386DEC247B067B9C62CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245410, "uuid": "0c74065a-4542-443f-9ba1-8df1979c1d74", "value": "192:JQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeQeZ:yAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245410, "uuid": "df7ffbda-8487-4e11-a054-057efb0e9f9f", "value": 4456125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245410, "uuid": "5061d1a8-f7a2-4f5d-9191-a6a6e56dc604", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245410, "uuid": "e0f8ceae-699c-48e7-a301-48835740b349", "value": "PO10038281.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd67cb1-b967-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762251351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251351, "uuid": "35c30e84-8559-4d74-84a6-b0406a1f5536", "comment": "Malware payload (RemcosRAT)", "value": "5d45f3f4dd051f6a12882f8dfe6143f7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251351, "uuid": "a72e95db-184a-474f-868e-2a173bd49efa", "comment": "Malware payload (RemcosRAT)", "value": "1922697d087e317f6324f8bf2d43d8ac8754e2d02a78f0679f7aeba2c95821f6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251351, "uuid": "6ba23e92-e35b-4eb7-8f48-6375546d598f", "comment": "Malware payload (RemcosRAT)", "value": "302cff9bf3c8022b1e398e0a61332dbd8419f033", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251351, "uuid": "b1cd658d-378b-4685-9386-4ee202f393c5", "comment": "Malware payload (RemcosRAT)", "value": "0c6e4079cbcbcb2e1659609d8a644cb4bf2ad4fcc1305d29aa879190ab9498e396bf508361687dd47197f3aa5b567438", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251351, "uuid": "8ec535dc-90b3-4c0f-8c7d-868af4eed9fa", "value": "T1E683AF22F8E14174B655377C9C91BA67ACEC8F37AA226258FB0FD180CFA4517C171A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251351, "uuid": "5034651e-69ec-47a2-aa4b-310a8d853de7", "value": "768:AnHTiJrkWB+VcyKD8ycT4yd9FukZJoBKpD4Ocy:ynJoBVOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762251351, "uuid": "c3d5439c-eb28-4f8a-bea1-571c44e064b2", "value": 83955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762251351, "uuid": "3f9bf174-29d8-4fa9-8539-dbd1f63be23a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251351, "uuid": "78286408-8eb8-4029-b4fa-d8c1930239a5", "value": "sfdkjs0d9cv00s9f900f920f30sd090bcv09dg90s90g0dfg09g0d0g90dg9g8dg09g0d.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b6b093-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236435, "uuid": "43921f5e-47da-424f-a1b2-cd13fa058e2f", "comment": "Malware payload (Mirai)", "value": "ac650924b1c5ee9bb3889eead1bad6ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236435, "uuid": "704adb85-27a2-4e72-b191-8761091378cf", "comment": "Malware payload (Mirai)", "value": "199b3c1d8ed21a02fdff533b9e344898574c01aeebd782b4d5476df857e15c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236435, "uuid": "7fb8e590-92ef-45ba-b30d-a45136c3eee2", "comment": "Malware payload (Mirai)", "value": "fc1eb20961cd70ab786d475e26bd2ff450a2c411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236435, "uuid": "87b5d236-ee89-4cdc-91ce-44dcb8608967", "comment": "Malware payload (Mirai)", "value": "dbb24242d4442a4efef3764c701725ee853de41b9836139c135ac483860328a32702c4dab038d24646cc4be5fc21fc29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236435, "uuid": "856bc9ae-7039-4c33-9c1f-bf6eb756d95f", "value": "T1F6046D46EA814A17C0D61779F6AF024A333297E4D3DB73069924AFF43F8275E0E67A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236435, "uuid": "549fa61d-45b0-4494-9610-aa96b20dd3d4", "value": "3072:Er+6sKQZi2dsg1DTECxSUPaVcw/6+ovVk1xURVDmrRsEM/9R3Y8:Yii2dsg1DTECxVPaVcw/6+QV9XDmrRjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236435, "uuid": "3b9ce272-e328-45eb-91c9-1ba0478497b5", "value": 176969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236435, "uuid": "efbac54c-62b6-466d-bec8-e236b41ef790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236435, "uuid": "759aea48-c718-403f-a70e-98038d388874", "value": "FGx8SNCa4txePA.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bdd2ec-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245246, "uuid": "6b96561d-bc6d-4491-b4ac-4863f158ca39", "comment": "Malware payload", "value": "1dffdfae0b55ac6dd4e1c1216467e0ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245246, "uuid": "efe4f6ee-0354-4b0a-8ecb-4fb32c5f4d82", "comment": "Malware payload", "value": "19ceb48fbe220347a4118555ce5b333f6e3295d86c0c9b37fec8d1e4a3882678", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245246, "uuid": "13a66185-ec79-435f-b2fb-e09be2cabfc7", "comment": "Malware payload", "value": "f636496da9958e366172a25046a0045586c7deb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245246, "uuid": "4ccfb4ba-595b-4755-8a09-bf5e4c74954e", "comment": "Malware payload", "value": "feb77c141e96e5ad81ec61f76da1bb68347478e48d3005adab9e05b4522a702b7da3f4c31c71e62fe1d3d816248b663f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245246, "uuid": "cd86dc22-7f43-4459-94fd-0395c47c5f88", "value": "T1A9E0D8BB2180715581A767C4FF6D544A5C6B5FB93988856284241AA4AE502EC4A18EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245246, "uuid": "80eb940c-9ffd-475d-8f93-69bd292fda1d", "value": "6:uk2IqXffzCtjg1mttVlOA/CL5OXQKUKlHJ/TV29HLClxvLbkKMCUfokEwwzPaCYs:ufVXf2K1mtXK1pTHARDjwWaCYsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245246, "uuid": "45239d84-bd5d-4e1b-871c-ca142bf714b5", "value": 379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245246, "uuid": "8dc1dce6-edef-44a4-b62a-bd58fb5513c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245246, "uuid": "d6caed3a-b4b0-4e5b-bf25-a32eea557604", "value": "NewVersionCLICK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13e72c8-b9b4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762284589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284589, "uuid": "355b20dd-2329-464b-85c1-e1f65138d025", "comment": "Malware payload (Mirai)", "value": "dc89e9aba8e31d2e431998db3edb2768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284589, "uuid": "a34b0809-64b2-46ea-9a8f-e1d0a769af6d", "comment": "Malware payload (Mirai)", "value": "1ae04557fad5e93280d5ca75bd56600659da26b6624b2e9104b682c549aff8a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284589, "uuid": "5f5cbf5d-e316-4523-9e9e-0cfb20b9ef28", "comment": "Malware payload (Mirai)", "value": "ba328ae47da198009f809aef52a5b9bbbefe21ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284589, "uuid": "dbdb29c1-e061-4633-aa96-458b565a420d", "comment": "Malware payload (Mirai)", "value": "5612a3e9225f215f9c7e9c3ba30ff2d166556a08505c5e1f158293842214aa8f0dca290976b948b5a183f5517fc32422", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284589, "uuid": "398f4f29-9fcd-4636-b2de-be158e0b73a6", "value": "T1F763951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284589, "uuid": "5d1f5c62-00c7-4826-8952-4eed6c3848b3", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAZ:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz6L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762284589, "uuid": "844d4c61-a862-4579-8cad-2ee28ec1f2fd", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762284589, "uuid": "82b647ce-e5a6-43dd-926a-ec5244d3f2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284589, "uuid": "bce80744-9ff5-4597-ab70-a9fac93e1f44", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aef9065-b9a7-11f0-91c6-42010a9c0006", "comment": "Malware payload (NovaShadowStealer)", "timestamp": 1762278915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278915, "uuid": "9242c431-2021-473e-bb20-470db12d61b6", "comment": "Malware payload (NovaShadowStealer)", "value": "c7bb8e629a40b50af84d8caf27236e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278915, "uuid": "90271c6b-8b66-4e6d-8c72-0b43c3724e8f", "comment": "Malware payload (NovaShadowStealer)", "value": "1d7888d4cc9c9ca665f8393ffb0bfa1c9a5011da61d35d8d2bcda24342dbb758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278915, "uuid": "bdbe8738-4fb0-4d76-a1d1-5a4109a52c32", "comment": "Malware payload (NovaShadowStealer)", "value": "e21072e612a45201e2d594a5ab7e7ceadc88951e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278915, "uuid": "c673964c-e253-4b2f-887f-d1cfc57b1235", "comment": "Malware payload (NovaShadowStealer)", "value": "a9d2a40a947f5a43219f02bee1f2f21f7d381104329efba3afaacdaa6e8e3b7cb34d8de0588dab277fd9d2432bce9937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278915, "uuid": "e3c1d0b3-b20e-4dab-834a-982494bda5fd", "value": "T1A90833E7E94058BFDB4AD3B493623FA23A9A80ED4D782D833242167E59887C4470F577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278915, "uuid": "02b1bdd1-0edc-4bb0-8865-dbaad86c5f08", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278915, "uuid": "55c66108-83b3-469b-9147-170f56540498", "value": "1572864:h4gPXMoAEklqzfsBwcclm4zKNDENAgVPR62W9Gz3t45pP6Q4WMA/Fixj:h4Ac3PlGa/clmcKNDRG5DW9Sd4/CQ4WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762278915, "uuid": "d5379982-5257-48f2-b136-1cd8572caad9", "value": 81979030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762278915, "uuid": "9a06e15d-f58e-4099-b0de-d26187555654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278915, "uuid": "0b4c3bd4-51f7-44c7-ba50-68297d5373e0", "value": "Test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abea14fc-b9b5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762285037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285037, "uuid": "da622e8e-321c-483f-b308-3b11dd1d898a", "comment": "Malware payload", "value": "410f1701efbcc7821be5b63b0590aeb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285037, "uuid": "9a3bfe94-1bcd-4ce5-885b-944996564096", "comment": "Malware payload", "value": "1e43c27b30ce575b55784446dff420f07b005ee10cfe073357255665b9ed76b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285037, "uuid": "aa69e178-b686-4330-a0b3-407dabc4b9c8", "comment": "Malware payload", "value": "bd59d47a89180a96abff6d3373c16811bfef5946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762285037, "uuid": "97d76be8-0de6-4c69-bc7a-da3fc4d303fc", "comment": "Malware payload", "value": "2f2cd120fbcc09c54b00c06507f1f9213af7cd18a8646a406470ed95e1b3d65a374ce592460ace529bb7726d78621af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762285037, "uuid": "4bb16558-2baa-40a4-8266-95681823fffa", "value": "T1B962C70AD603A5F9ED7A087259E7F7FF9B713E248431CD16EB60DE42EB52C166408B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762285037, "uuid": "d5422088-31f5-4320-a954-39d76263cece", "value": "192:tbN88Jf/+7+h8oEMjxCK1ULb7bf6HLGcVhuzYNtcjcwVyF6O2z6ybDhNKzIwh1Ct:he7+h8mNCK1NIBhbDhwcwhcY2/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762285037, "uuid": "167a158b-fb75-49f1-83bc-d15ddd099044", "value": 14991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762285037, "uuid": "bd4289b4-81aa-49c0-843a-71f140cb334a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762285037, "uuid": "c1ee0fcd-d117-47ab-856c-366f137cd3e6", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.22598.28148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122704be-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245265, "uuid": "491463cd-1b2a-4603-a655-fa9c18bd8aa2", "comment": "Malware payload", "value": "4cb6b57c0535a86c0134317010035463", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245265, "uuid": "8aedc2d4-3101-4a22-b6c0-eee8f1fd069d", "comment": "Malware payload", "value": "1e8c1b2490e5e9c15f30090795a9c9186595091b3d6de89bd9dc79f329af010f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245265, "uuid": "dc8c267f-e7f3-4fda-9211-7691ee15c383", "comment": "Malware payload", "value": "04a5d3727af5209f52044dd2a05423b64d8c3cae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245265, "uuid": "8178a75a-5c7d-4536-8647-02bc19edf6c7", "comment": "Malware payload", "value": "d4772dc2a228613ff6cbbc87ac6fadf6608c9b04d9f644f4d2c74fa1310049347a0a6b6e4ee0cfbda0cc9523651470b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245265, "uuid": "9540c5ed-f0bd-411f-b5d0-ff3db1c97bb8", "value": "T10F2612FE26114574E8319E7C9E4B5ADCF230AB5FFF061218B54E4FF66B304A50203A2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245265, "uuid": "7b007d77-2f41-47f7-bdb6-222b8c31bc38", "value": "768:FSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSF:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245265, "uuid": "bc8146e7-5745-4c9a-b1d9-298e6d58f7d5", "value": 4636707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245265, "uuid": "61535af5-4ccf-45b7-bb02-f48c3f287cc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245265, "uuid": "2262fd50-e84b-4896-9d31-26f2ca3e5560", "value": "PO10038282.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ed25cd-b94e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762240735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240735, "uuid": "8202e62c-9068-40c5-af93-aa80d95922d9", "comment": "Malware payload", "value": "94ade20a175ad2052a064c4cfcb964b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240735, "uuid": "abb271b8-6f46-41a1-90d7-8beecbf4603a", "comment": "Malware payload", "value": "1f0ab7931461925f67dc095d02bd49f0b3cf280c6668b1c5ed24dcbda220348b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240735, "uuid": "c25186bc-4a93-40ed-bee0-2fcb08b11bbc", "comment": "Malware payload", "value": "317fe2ca17bac02bef6aa39b73397f0d57d1de68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240735, "uuid": "92b20a25-a872-4289-96e6-afa0260df6ee", "comment": "Malware payload", "value": "4872bddc29dea77b39755b741adbeb34665e914f0d4b3a04006e74a9e6832849664176df0dbdacb393ee633f0100b1ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240735, "uuid": "eefc2850-5cf5-4cc0-b921-2ebccd7968cf", "value": "T100B57E47BCD108B6D0AAA3328AA752A27B75BC480F3663D72F50B3782F767D05A75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240735, "uuid": "7ff7a493-1f0c-4a66-83eb-2fff8cd594a8", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240735, "uuid": "60269958-258a-4aab-90f6-5dce4e542105", "value": "49152:31pWZvwW/g0ryFVRPUV5BZKITdZzeEFJ10i:31u/g0FNXbeo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762240735, "uuid": "0859c420-614d-4442-aab8-e2a783d6cfb4", "value": 2318848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762240735, "uuid": "9e35199b-5de5-4727-8463-6cff11efcd46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240735, "uuid": "f1ca4abc-8748-48cb-9985-4576604d93f5", "value": "1f0ab7931461925f67dc095d02bd49f0b3cf280c6668b1c5ed24dcbda220348b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c50ab76-b9d4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762298083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298083, "uuid": "f3713af9-4aa5-46e8-b951-38c7dd7227d0", "comment": "Malware payload (Mirai)", "value": "97e664bf3d72bca624d1043ad81d21ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298083, "uuid": "591c4698-5daf-49ed-839b-de4bdc5eb361", "comment": "Malware payload (Mirai)", "value": "1f73896329271c5248966d3fca5ad3584eeec89296e3260bf1c1cbc08f0a8573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298083, "uuid": "3f83c66f-0ea7-4793-9bce-cb50eed7445e", "comment": "Malware payload (Mirai)", "value": "86bee0e8b63897d9ac02aa9db24f57380b3e6bad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298083, "uuid": "3da28d19-4bb4-4ab4-b367-389f75a696d4", "comment": "Malware payload (Mirai)", "value": "719d7012d8a51700c028cd1f641842082961f732a33e777da3f1943bc4e1fc1a701f8a2f33dad0adb74717020dbf2caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298083, "uuid": "fddba104-919f-49c4-b0f4-2707661ef086", "value": "T11313F121D3E538B19B34BC764DB408923AD40F7CD2DFB41A57A50D0A26AA2C79A7648F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298083, "uuid": "a62af2ce-8dc8-4c7b-b6d6-5c7d7d2f5c04", "value": "768:qQw75FBC1PfjF672FK2t7BsS+Ul1f8VrrxqHv3v2MvtcWYLj0qakO9q3UELlU:S7C1PfJp58Ol1f8rxU3ufLj5zzLlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762298083, "uuid": "fc4a9d66-3643-4416-b89f-71aeca39b3ee", "value": 42972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762298083, "uuid": "be88de4f-4444-46d1-9e57-d79f309b5764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298083, "uuid": "6653748b-8f66-4a6c-8ec3-48a77201b359", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4fb514-b9c1-11f0-91c6-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1762290190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762290190, "uuid": "4ed79ca4-18c2-426d-a44c-c0902e19d1c6", "comment": "Malware payload (BlankGrabber)", "value": "70a1f790807ffb9453e72d16147aa7c4", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762290190, "uuid": "a9950fab-ee21-445c-9a79-7519e1e223b4", "comment": "Malware payload (BlankGrabber)", "value": "1fcce94880e7a12ea9a894c0e72e06500c3f7477511507e116dd66ccfc382606", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762290190, "uuid": "18621215-c0a4-48e5-af5a-4ee6e992b4cf", "comment": "Malware payload (BlankGrabber)", "value": "fda196fe300bbf03525bce01c6f8777626c31a17", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762290190, "uuid": "9e2d9614-4dba-4e9f-ac44-eba350904c20", "comment": "Malware payload (BlankGrabber)", "value": "2bee4cc4fdb7052e2d53346cfc4871627a566358d1abca2e9fcdee112749997c567526c51d8c1a8d2f7112d5dc1f0e6d", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762290190, "uuid": "0ee7bac8-4a4e-43be-8bcd-fd3d199e8d57", "value": "T15D563314239104F9D9F7123DC9639229E67678122780CADF43B48B756F27AF04E3BB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762290190, "uuid": "89123849-be3a-430a-9128-01099f804f37", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762290190, "uuid": "ff31b3dc-da65-4148-bc18-881a9d894466", "value": "98304:CmoDUN43Wjl54KjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aXtMY2:CumWP4QOjmFwDRxtYSHdK34kdai7bN37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762290190, "uuid": "583c376d-17c3-49a9-b79f-a9615f650d18", "value": 6220800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762290190, "uuid": "cc33ea9c-576e-4eeb-97b0-dd610bd69ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762290190, "uuid": "d70fac37-d971-4f4d-b25c-31f9728f61f7", "value": "bridgeunattend.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c66f385-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237337, "uuid": "adee2a49-6a4f-496c-bbd4-4dde34866d84", "comment": "Malware payload (Mirai)", "value": "7756b19c3f5338a0e7b68454708a7fcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237337, "uuid": "a2ae68e9-e060-413f-b48a-47c2dcfad9fa", "comment": "Malware payload (Mirai)", "value": "1fe5abeabf172ee128a8b69d730a751b2e69f3914a275066f4831c9be807acf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237337, "uuid": "b70e5f53-00bc-4316-9535-f42002cf735c", "comment": "Malware payload (Mirai)", "value": "8e280f892ce7c53e0cd272154d6101d0cf48b81c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237337, "uuid": "9de8090e-e825-414b-a427-a932b75a557e", "comment": "Malware payload (Mirai)", "value": "71850ab6e2212c910f49fbf074c86a45b38c9dbe3a737839849a94208dc9a1115c093c31974ed51e6b309c04f7d5ab2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237337, "uuid": "1e238f12-d9ac-4926-937b-021330e79670", "value": "T143531817F58182FDC099C13417BAB93AE92734FE0238B6A67BD4FF262D46D211D0AD49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237337, "uuid": "aab78cf8-ce55-459b-8c93-3d336137f923", "value": "1536:bklYu9RPiANIzTtAmIoR6mvmKmyG3hB8BQX0cxygcYNLv:mYu9UEIzmXoRHNYcBgygcY1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237337, "uuid": "62f6ef91-f539-42e8-8808-565484139a5a", "value": 66224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237337, "uuid": "53d29d84-6cdb-47b7-bfbf-4b42e725e57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237337, "uuid": "c3e3f1b3-3e80-4068-aec2-c3281404f5ce", "value": "uYtea.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474a4049-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217437, "uuid": "0aa04451-5be9-418f-abae-80119cfc15d7", "comment": "Malware payload (Mirai)", "value": "a29b3367b0335fce76adfa1e76303fcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217437, "uuid": "30445178-78d5-4f51-b376-6cd72d2659fd", "comment": "Malware payload (Mirai)", "value": "2051b2c2d773c12b2e398e29ee7e593ff59c989f7e677064a00f6ab375db826a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217437, "uuid": "2aa7b401-f522-49dd-b538-5c3877300531", "comment": "Malware payload (Mirai)", "value": "f8f109e7bd510db51613e2ea6585116fdb42205a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217437, "uuid": "a98a2bf9-648a-4144-afe7-3d21c66bba2d", "comment": "Malware payload (Mirai)", "value": "ce6d2d5eabd06f330fad9edcc0151245cae677b2ab08e6b84c0fcdedda8d92c5586ebbead543bb0183b0b09639f3f66b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217437, "uuid": "70dace97-713c-49a1-a9a4-2d50d1a6503f", "value": "T198146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217437, "uuid": "7d36a5ec-46a0-4ccd-ad50-7d6b58ef523a", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtm:BZAyFzQSdS7In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217437, "uuid": "b928ef09-1137-4b69-bbbc-1a58cff1b237", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217437, "uuid": "1fbd1301-5ec8-4c48-b7fe-c5422940d3ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217437, "uuid": "b0baf14c-3815-4541-a9bb-4fc4960e62e9", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e68fb0c-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245474, "uuid": "58afb5af-58df-44e2-91da-c5ed345b7a98", "comment": "Malware payload (RemcosRAT)", "value": "6a55b6a58900b6817e247cf56632e362", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245474, "uuid": "03cc5e8b-28b2-49e6-b67a-d137a929c73b", "comment": "Malware payload (RemcosRAT)", "value": "20d86db5703cb86084b2e52e4766cff9f254912f5643735d2621e2972da87a55", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245474, "uuid": "9f95f6cc-16e0-4aa5-83eb-e91834f797b5", "comment": "Malware payload (RemcosRAT)", "value": "f8ac6bff41c7dcfc3bed8202aa52e285f3dde82c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245474, "uuid": "3113ba67-57b4-42f7-8380-deaefd116d96", "comment": "Malware payload (RemcosRAT)", "value": "7ae41d2a8b5a948ec9def0bccd75b958d0a660e5861520f10bfec1152065e82197a3505e36c786e13b032da0990a5ba1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245474, "uuid": "419aaa2e-29b9-42d5-adb4-0d6d9466284b", "value": "T1B7C35F309BE09AEF0AC523576477C530C66B6D19C721F0A9FACAE20F12417D893693E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245474, "uuid": "7c96dc32-0b6f-41cf-8388-395671284a8e", "value": "3072:7yHIhG/+fzVLaSW/ILIFDLTPyWO3LK0Qbi2HxPdI2EVZx/WsesO6jPhNLwK8AGyF:7yHIhG/+fzVLaSW/ILIFDLTPyWO3LK0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245474, "uuid": "800b5cd5-099f-4e03-9506-aed823d249cb", "value": 118539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245474, "uuid": "33b7fd14-375d-498c-9dfa-e2beb36c1915", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245474, "uuid": "589a6faf-c615-4675-a2e9-183f6a87669b", "value": "documentos de env\u00edo.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e1dcfa-b9c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289936, "uuid": "fd1f8342-1351-465d-b5e9-46691c7d42b1", "comment": "Malware payload", "value": "7ac2f0c353862432ccf8045ee9e442aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289936, "uuid": "dbea410d-3e30-4ac4-be01-f0c5c64ffa77", "comment": "Malware payload", "value": "21a8324aa17461143bc39dd0e38dd5d68c7d22f41fc8fd6c1f4ee76ffc7aebf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289936, "uuid": "550f1d09-8f9c-4c9d-b104-a2c57b4b2d56", "comment": "Malware payload", "value": "6049f3e72a3d0b38729aa691dd79897f2c944f9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289936, "uuid": "f208c0c5-effa-4789-9045-f2d62f28762f", "comment": "Malware payload", "value": "3693ac1bd923505dc6d844dce89fb07309cfdb2d119ab6c249b190aa1dabc3f793943af6628ad5869d4a12dde7ce845d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289936, "uuid": "fc81e3cb-08f3-4763-8f6d-726189cb8fbd", "value": "T18A37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289936, "uuid": "ffed062c-f51d-4d87-95bb-7244f2a7d613", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289936, "uuid": "eb856718-7040-44db-9324-02548beb2c3b", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpw:q9WtLzgOTbjZvk/ekS/mcpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289936, "uuid": "8baef6cd-392c-45bb-970b-22adcab277fa", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289936, "uuid": "bf84c8ca-036d-4832-ba21-05c6d4ae2822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289936, "uuid": "6be23813-1225-4937-b5fa-022767103225", "value": "GIF INVITE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63a50e3-b9a0-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762276035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276035, "uuid": "041907e8-d76e-4363-89ff-419360d71ed4", "comment": "Malware payload (SnakeKeylogger)", "value": "1ce456b9a0cd7d650cdcae322b9af6c7", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276035, "uuid": "f0fe9dea-e988-4ab3-81fd-518df2dcd1f4", "comment": "Malware payload (SnakeKeylogger)", "value": "21ef045bc0f31750070ee021b7e781e3b833d5b08797512e646cb10bdf602045", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276035, "uuid": "ecda47ee-d444-4eaf-bcd1-9ce8a0196a21", "comment": "Malware payload (SnakeKeylogger)", "value": "25debaf7d15ea0e6ffb08372018bba1ee9ce6498", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276035, "uuid": "e2462fa5-2d1e-4cc4-b649-b7ad73c814cb", "comment": "Malware payload (SnakeKeylogger)", "value": "5a219ee41f0893bd669965acf81f91091c2200ef76b8d090a76962fa6136aed9826c772f21b46db98bfb18a68d238d60", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762276035, "uuid": "d3b96b59-2f2a-41dc-be9c-f143f7967b31", "value": "T19CF306EE8574ECC02329FC9054352A4632846A739EB03A2CAFE14FFEDC5B55CCB65658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762276035, "uuid": "dd3737d2-aeed-4a93-9c89-4983698dac65", "value": "3072:qaE6yVB1Yx7WREZEpEwS6xyWsVyXSt1CKuG/vdo:rE6yVB1Yx7iqEpEw1M9iSeKuai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762276035, "uuid": "8d61b1c7-db15-43dc-9f77-cd2242e9af57", "value": 163169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762276035, "uuid": "97c9f25b-98ab-4ec5-8d39-2285f053c823", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762276035, "uuid": "c0843a20-3426-40fe-bb75-4ad588ae29ec", "value": "567876788767765.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b3fe5a-b95f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762247815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247815, "uuid": "42f450cb-563c-4ad5-989c-8f87cc679441", "comment": "Malware payload", "value": "0bc9495e9db6c6c94832e5613c70c5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247815, "uuid": "6004ecbf-5ae5-43a3-a1d0-47042360ee46", "comment": "Malware payload", "value": "2226b5974c91c7cc82046c8ab516e8e55f88784c921604bdf3b17a1b3ce0dd7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247815, "uuid": "5c527899-1ee8-46b0-926d-ab17fdbcebf8", "comment": "Malware payload", "value": "bdda700e0ead9e5dfff3be99881bc40b98c73920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247815, "uuid": "3001f205-9475-41bc-8109-cee4be5a68cb", "comment": "Malware payload", "value": "cd4e610f632e46722113364913f53ae58025d32018186838d6db32864bd6c5d79dcf419ecea927198e21f82dfe4d7d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247815, "uuid": "102b2ed1-0acc-4a15-bb44-57ceed64574f", "value": "T110B61217B25E133EE429573627B2A944583F7B61252B4CA3C6F01E9CCE2E8502D6FF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247815, "uuid": "790245a1-8a57-4c2e-9487-7ee9cc6f3960", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247815, "uuid": "607dff52-0301-4a48-9a92-dd7c117cfc25", "value": "98304:VDbe6wFSq2Vso20Gv3YSJYwEApA3jQx7hNRTMiuuas:VDbUJesT0GvISWwEApA3Ex7hXwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762247815, "uuid": "d38dc6bb-56e6-430b-be18-a4613cef0058", "value": 11058246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762247815, "uuid": "845f5e9e-2789-418e-995a-dc4437aae5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247815, "uuid": "2741cf32-7e19-49dc-86f8-c2bd025e8ef0", "value": "X_Copyright_Basics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7ee413-b915-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762216234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216234, "uuid": "7e469bc8-0bea-4f47-8799-5d2c620a9d35", "comment": "Malware payload (Mirai)", "value": "6ce10606e4b178aaaa0fd11ab69f2d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216234, "uuid": "600febaa-beec-4a9d-be57-00315450e87c", "comment": "Malware payload (Mirai)", "value": "23156dcb23986e8be8f8c46cb53ba803e16105fb8a55adcd3216f61df0ab5fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216234, "uuid": "37bf554b-78dd-472d-93c8-6bd56485ed77", "comment": "Malware payload (Mirai)", "value": "d0a1758092b9a82e5ac63e0fa0df01ffc5d4b723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216234, "uuid": "2f72f00a-511a-440b-b3d5-f2ae777dec64", "comment": "Malware payload (Mirai)", "value": "ee62590babd6f6505c9e7b6859d3a674d4a72e50733f6f5c23e3a1af8de982a3c8a4780eeecb8af05082b4bc85249ab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216234, "uuid": "6e33412c-07d6-43a7-a4a1-36ec46557fb4", "value": "T15B82DF3021AB35F4DBF10435FAAE8EC6971A0BF8E1FC369317596B78894610261F92C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216234, "uuid": "5224823d-d4d1-4f7c-8a5c-bf5ab2d08603", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaYhymdGUop5h5l3:2dV0P6+kom0tVAoNvm+to1Ys3Uoznl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762216234, "uuid": "a19710ba-28d3-466a-a8b7-405c21ff3b9e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762216234, "uuid": "50850c46-0b0f-485d-a107-1e8ff9fae2a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216234, "uuid": "159ceccb-b76e-4f5a-9091-e3a6bbf3f121", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a1ba2a-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237329, "uuid": "54c45de7-9b27-4681-a0c2-fb4e7e228301", "comment": "Malware payload (Mirai)", "value": "2c403273b4f2248dc7e6009a971159c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237329, "uuid": "c9eab5cb-3beb-465d-900f-f61aee3bb2a2", "comment": "Malware payload (Mirai)", "value": "237370b7367800b8141e6caf922bbd68b323ca123987aa696cac116f8a3d12ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237329, "uuid": "dac15f36-aafb-4984-afaa-28fad3f9296a", "comment": "Malware payload (Mirai)", "value": "a2c17e8333d1b7c077fc451c8f7778bff5f86897", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237329, "uuid": "97219654-99f2-4f81-aef8-b36f2ead1ffe", "comment": "Malware payload (Mirai)", "value": "24b68b4e33b50e62eae233585d5e39ac2fef95b33c3cfe28473d0c4f3ff347923e49ea2c501728aa53bbd7f1504ed9f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237329, "uuid": "005bab1d-efc8-40c6-bacb-eef7f97dcdfe", "value": "T191635D53B2280D17D0A30A70293F4BE18BBEDFD121F0B686695FAB568536D331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237329, "uuid": "994e3e41-688d-4851-a4a1-b866a6d5832d", "value": "1536:HtDk+zX0QboUK99VB19wRaXb/E1WbIRVcxJa10q:qkE6pKPVB19oaX41WbIRVo4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237329, "uuid": "9484b248-b57d-4a0d-9d9a-1fb2aef5dea0", "value": 67956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237329, "uuid": "301377ec-47f8-4f75-a5b1-7fd4246db152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237329, "uuid": "19d22f21-789a-48ce-a623-2ab97225701f", "value": "uYtea.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbc3aa1-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217444, "uuid": "b30ee8d8-ca8e-4dbc-86ad-acb439bca78e", "comment": "Malware payload (Mirai)", "value": "405f4e42961f7190a36956913f745969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217444, "uuid": "f7398508-3def-418e-9ad9-fbefd42ccf49", "comment": "Malware payload (Mirai)", "value": "23e8188ff6a5422aa9a12a008406d166d10ceb6f5db08183acbd65a6898d3e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217444, "uuid": "c6aa1fbf-cd58-4d5f-a9b0-a5b116d58e0c", "comment": "Malware payload (Mirai)", "value": "53ffb7a641d800eed35bd24aa5e00392bf60823e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217444, "uuid": "900eb707-b170-447b-91d6-864800e70e3e", "comment": "Malware payload (Mirai)", "value": "520083b3056f2f731c9c1c346b4de1bf2cadf1a8e057d96ad95b1c92f8eb211f27097d60e466e4dea3d6ee915cb0d9c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217444, "uuid": "416544ee-cba9-44d6-b571-ca6d7f92d533", "value": "T13E730271316ADEA2D2B2803363837E597E23846603B4A2BDBC79975FB487E015C4C95F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217444, "uuid": "c4938b62-c533-4d06-95b4-6328cbe51425", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWm4TyZorX:8zRnwP0bMQ2RijvDZZ1rYGhG13VSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217444, "uuid": "7c893606-4896-449b-ad3a-061d8326e14c", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217444, "uuid": "4f5a19f1-7237-467c-a35a-1bfc9a59b4df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217444, "uuid": "e6b1a06f-020d-48a4-ba46-939999959413", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fc7221-b9b0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762282772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282772, "uuid": "9e0064c3-14fe-4d07-8e1f-ef499c29ff6d", "comment": "Malware payload", "value": "7ad06f31c2715f2b8e85c94eb226a47b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282772, "uuid": "558c242f-2ff8-47a0-81c2-106a4d107a89", "comment": "Malware payload", "value": "259f258b300c80b0100710ec569b67795c851c776939452a934ff78c4b526d31", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282772, "uuid": "6df07e28-15f7-431f-a5cd-2c12fb81de28", "comment": "Malware payload", "value": "4c73001ae369499482a870800e4dc4922b7e1251", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282772, "uuid": "1c978471-77c6-4bd0-a4b8-97d4dac56f58", "comment": "Malware payload", "value": "2e1e3fd29c292018cd8b02ff5faee7e83ee2b4744ab6549e89d3acb9a7edf62e733a28de277738d121599ee4675bd8e9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282772, "uuid": "d1618900-69ae-4fe9-808d-45fdb71ef260", "value": "T199B6339CF718E50603E1D96859345FB0667A333515F227A8C7FA072681764CB8FA2ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282772, "uuid": "bd3940a5-1571-4e20-98b9-01a1be06ab04", "value": "196608:5wg2Ps3cxJek+dup2/XXPqrGP95a1BsI39o799HtvMfczE311p2JxULy4xvrvhFB:5yMcxgk+Q2Hqr8S1Bs+op9HzWp8kznHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762282772, "uuid": "f8ed4ac8-c680-4c2a-b8d2-07916fa2f26d", "value": 10596097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762282772, "uuid": "faca56ce-4230-41cd-a0d7-a1b3a37a1504", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282772, "uuid": "84074d1c-bf06-4a4b-aeff-66b756fdf577", "value": "Brunel_Company_Profile.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2a0f25-b9c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289951, "uuid": "a64b8ad0-1e4c-4133-a46d-1d4dbe97325c", "comment": "Malware payload", "value": "6998ac1148ee43b5b8fe321c65cb0d6b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289951, "uuid": "9e20d183-8852-4076-bef3-809f484cabe2", "comment": "Malware payload", "value": "25a5f9537d531978909620515b6959fd6ec95515ba8327cf4820e22b6ae4c120", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289951, "uuid": "fd161156-25c1-4392-ac1f-433be10a15c3", "comment": "Malware payload", "value": "f431cfc6b250952d0630f22d5a7f27358d8953e5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289951, "uuid": "1c0d457e-b55e-417e-bd18-c0bbe22cd978", "comment": "Malware payload", "value": "23e997ef63d8b97b91459fee332bf04e38b9b52ea082a8ab066a5acb7f2e22f62e8a8b056f1334722480a799801191d8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289951, "uuid": "d420b351-c54a-49da-872b-058e2debaa6b", "value": "T1E23623725A54796B06510B19F04F37B2AF3DDC67894CA1ED68CCE19A31CE1A2893FCB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289951, "uuid": "c6a604ca-b123-4bd5-938b-3122e8b6820a", "value": "49152:GHQQvJ8IxDYGN0xfSpENAVJ53occ7+euLud5aHpuN/alkGj9yx/FDnLZvkpzk7:00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289951, "uuid": "290923e7-0c5b-4068-9a1c-abe70586c354", "value": 5107050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289951, "uuid": "4cfd1c79-37d3-4170-b497-f9c29d8c4c5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289951, "uuid": "b9b6b182-3c86-4138-974c-dbaab4ad7ab0", "value": "50428^_Exam-in-ar_^@618773PJOU.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6baada-b985-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762264449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264449, "uuid": "69f01a3e-d6ae-43e7-ab59-39da2a2e0f26", "comment": "Malware payload", "value": "4309549f7246526785eaf5a83c2f1209", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264449, "uuid": "6dfe4c59-b4a4-4eeb-94e6-e0387ceabf80", "comment": "Malware payload", "value": "2738e0b84a1009ce1996909cb60ddf2c35035834b355bc434da99dabf3056a6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264449, "uuid": "c1e936db-e5b0-4d3a-821d-4c39a77dcea8", "comment": "Malware payload", "value": "adc72ef54cfaa1e936724ef21336c9269a14aca2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264449, "uuid": "ae28b928-7292-46a6-b1cb-43aaaa5b9a3e", "comment": "Malware payload", "value": "fc6e504f857eed10d393dcfe18e9b5ba873bac65e93719312adc608ea5fa916df0aa73c0d8a3674604274c7863989864", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264449, "uuid": "2a72d05a-4165-4b83-9964-5ef8616d014e", "value": "T1F6E5AE21BA428C36D5BF12701CEDE73D4A6858100826477BABCAFE5C3E35FD35A59A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264449, "uuid": "7ef2169a-333a-4aa5-9e4b-f0c559b5e95f", "value": "5d04713d28b7e0a6c30634d9b63d4b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264449, "uuid": "9b1dc7b5-df9f-476d-890c-6ec08ce207ef", "value": "49152:1gA3C+itdhvLrmgxmKEASpXvNsxU4sG5D1qk+zoL/trf7Sbs40xpFu2h3IyjqqX6:mvL5xmKeXWxU4sG5D1qk+zoL/trf7Sbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264449, "uuid": "1167110b-dce6-4cbc-baa6-d25fc41912a1", "value": 3140384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264449, "uuid": "50d19e3d-3ffe-4cd9-99a8-92fe7c651cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264449, "uuid": "3d6f2b0d-99ae-4d19-aa7b-d216eb851a02", "value": "embedded_pe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6253e3-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1762245307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245307, "uuid": "17ebe77e-af20-413d-b673-37bcf25acb16", "comment": "Malware payload (CaminhoLoader)", "value": "ae5e935ce1b9d37e17f37548c7748874", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245307, "uuid": "dd6df78f-0b1c-4ac4-b464-d5a7f3aa4e7d", "comment": "Malware payload (CaminhoLoader)", "value": "293ced355dfff9834521f58f093fac26ac9e2c241c1888014d7929c0d876a2be", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245307, "uuid": "c40e04ca-3dae-4089-b428-b532e15fae6a", "comment": "Malware payload (CaminhoLoader)", "value": "0ed7e9c0626407add889bb4a63da1d8403f4fa10", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245307, "uuid": "87bfb0df-f139-4287-aa43-eb9d84ba590c", "comment": "Malware payload (CaminhoLoader)", "value": "c76819f74831a9298aafb26ef2c39b1c1f327ec363d5f31158cb9a2a00464db58ec39790cebd7ce9d563a7b948baaea2", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245307, "uuid": "6ff1ef30-0423-4ab2-8563-a006a7dae6ff", "value": "T1AD95138A1A79137AC2FE115A4F57D289FBD90C9FDB071208B46B52DCEFB0A2440B9D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245307, "uuid": "3a89dd8c-e65e-40fc-ad65-7ffd30a18b22", "value": "768:0b1Xa/tGgWb4GZzEt2drp1EF+t+89dwfTBM7+flbmPfTWpennQGebDiU7LiM08cX:Q1a6bnNR+84jErWpAGDiU72BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245307, "uuid": "ae4987a4-ec19-4d7b-be8a-42c0c46f3ba5", "value": 1938392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245307, "uuid": "7495493a-5308-42c0-bfc7-c75b089c9841", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245307, "uuid": "52c770fd-c28a-4ef4-bc6c-b78f2d95373e", "value": "Project Terms and Conditions.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849bb52a-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269938, "uuid": "a29713e3-46e7-49b2-90c9-7472f8b8aa9c", "comment": "Malware payload", "value": "e2e01305e938ea378a88658d81c0917f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269938, "uuid": "15c2016e-5bf9-4a01-8005-18b1c91a47c8", "comment": "Malware payload", "value": "29c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269938, "uuid": "386767e5-1c20-4c6a-b563-128f81ebe2ef", "comment": "Malware payload", "value": "6b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269938, "uuid": "f80652c0-88a4-47b4-b5d5-08be576f8978", "comment": "Malware payload", "value": "372dc031c9dbd1d8477b9673697784e00f2f693bf06bb84c1bfaec1e2705ce3ad085ffb8ff1131ab12bcdb28e269ee18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269938, "uuid": "9212ecb0-8614-464c-be47-3956389330ee", "value": "T1EBC5BF1AA6A401E9D8BBC17CC9578667E3F1B41603B0ABDF06B4C6B51F63BE1563E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269938, "uuid": "d1e75ec7-b8c2-42ab-b9e5-0e50bb8da929", "value": "e0cb9e655a81c9b36e7455134a7452cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269938, "uuid": "1d811553-0479-4326-869e-dc75dc3f7559", "value": "49152:aGtlqOIU6iJVwASOcO81WPz3qjFr6t1Dt+w+PpmtsHcFhKgwzfQHdPWkpRs6:m+18rcDINHAhKQH8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269938, "uuid": "1c6dac87-1169-48a9-9249-6b5d41171e4f", "value": 2736896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269938, "uuid": "6738adb9-4f83-4182-b999-7523c64d03a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269938, "uuid": "aae31484-6882-4698-81ba-06aa9d81f41c", "value": "CiscoSparkLauncher.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f020a2-b994-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762270791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270791, "uuid": "6ccc5da4-d066-49a2-a2f9-bcfa8566d3f0", "comment": "Malware payload", "value": "3def3511c01676552f069f2dcef17ebe", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270791, "uuid": "99c35543-af3f-4af0-a741-c405fb841e8c", "comment": "Malware payload", "value": "29f63a267bd8e4c687a8dbba704afa9d11322d032c4f56fbe0e4319e625a4b8c", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270791, "uuid": "863ba4db-ae92-4d81-a085-461c224837c6", "comment": "Malware payload", "value": "9f15960034198a237880c767b5ec488fc9d2505d", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270791, "uuid": "64b6da49-4e93-4b32-bf94-b88c796b4b0f", "comment": "Malware payload", "value": "0674dd8b93d872470448c133b9f16914716e83a1eff07c1fe94b6b276d723212429880cadb47c8adf585ffdb09de53b1", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270791, "uuid": "3d9b513f-4bbf-49e0-ad0a-665b277975d1", "value": "T14954124F38B7359A4F75DAEC70E6BB6600447EBA5644A353352C687EDACCB43230B119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270791, "uuid": "5851e9d6-f8a2-48c2-8937-671813bf7937", "value": "3072:bOWhmRqM4IZTgE+Z5PZK86zlOWhmRqM4IZTgE+Z5PZK86zlOWhmRqM4IZTgE+Z54:bWjDTW5Pb6JWjDTW5Pb6JWjDTW5Pb6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762270791, "uuid": "d2cc1e15-f769-48d5-b99f-8e7979215791", "value": 294054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762270791, "uuid": "29860773-9cb0-441e-876b-2f905a7ca51c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270791, "uuid": "f7c03c09-6a6a-4925-97be-5c9eb5c49966", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eb7982-b9d4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762298145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298145, "uuid": "8dbfb799-9502-42fa-b9f2-ca2298551501", "comment": "Malware payload (Mirai)", "value": "f91375cd8032a5798d12c7ee144e3fef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298145, "uuid": "97e637e7-2dca-442c-b014-d8ee1165495d", "comment": "Malware payload (Mirai)", "value": "2a52c390ecf6e3e27627a376ad60e05e22d6d796bbf392e1ee2f014cf09077fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298145, "uuid": "b78fab6f-7aa4-4613-ab1a-f299e776e1a2", "comment": "Malware payload (Mirai)", "value": "75bc4714393ffc298e310b11c3277668d60becef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298145, "uuid": "affc6a9b-19cf-4165-8261-33f91e843273", "comment": "Malware payload (Mirai)", "value": "63224d186481bed5bdedbd0f91cf069215827ac39d2f8bda43d968a975c059e40b1f43490bdf3b29c2b50e6bb7278d13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298145, "uuid": "0cb0f30f-e5ff-4031-a4bf-8f058e9b14e4", "value": "T1E5A33C47F9928E12C5C212B9FA5E514E33136FB8E3EE3212CD24AF6123865DB0DB7516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298145, "uuid": "3d2f51e5-f2f1-4e7f-a188-260204590ad8", "value": "1536:1AnWQS2D/4oS5rf53zIYkpTH5dGDtQTUFaVqcMXXDRRiAy5HcHfP7Fp5pYzE2:3QdDVFVH8hQTUFaVj5HcHfPZp7cE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762298145, "uuid": "ce08c46a-21e7-49e5-8d16-d1d56b098ef3", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762298145, "uuid": "fbb2b813-8588-40bf-a7a3-1e05c0a1720f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298145, "uuid": "610e0b2f-2fb2-4b37-8022-64c0611f011b", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55c98ee-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762244680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244680, "uuid": "6bb2cdce-3a6c-4b1f-9bc0-4dac78042e5a", "comment": "Malware payload (Mirai)", "value": "c7bcdc1a21576de05fbf3018d15e6d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244680, "uuid": "bdfe32c6-c0d4-457b-9562-db505d216c49", "comment": "Malware payload (Mirai)", "value": "2a5ed80f9526b3550dfd680db18b34e24a724ded5b8e8417d829fbe9ff8a47a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244680, "uuid": "3d848428-2a50-403f-9342-908a8d5527ac", "comment": "Malware payload (Mirai)", "value": "244415254870da61d4e31071b18101697e00e975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244680, "uuid": "01a46a82-6fca-4da8-9604-830246964ca7", "comment": "Malware payload (Mirai)", "value": "40411f161649fa65a51b6a1b79957e8c8437b7e522a3d5d6c468acaf6e1fad5df17a7294073e85445c1a678b63e65138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244680, "uuid": "d3e2647f-30eb-4f85-8bc6-bdb9aa765d27", "value": "T12AB3AEDBF70B2091C86187F407C78BDE3E6322119EA7E4E76C1F2A7A19360DB5916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244680, "uuid": "3457da46-9de6-437f-a696-4552f1e5a6ff", "value": "1536:Dx/MtihJvY8tUWFzaUx7g1a9WqEHtkIwlwbT0XYxZJc2gA/LWxg:l/MtihW8aWYUx7g1Mt4tu2T0Xz2gAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244680, "uuid": "ea5b82d6-7a91-4883-8f41-27a0defa1b76", "value": 116096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244680, "uuid": "e26722dd-b19f-4757-8488-616203a891e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244680, "uuid": "7538e8b2-9f1c-4c81-9c99-a12e8a9649d5", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49741c3e-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217441, "uuid": "fcd4b74c-d0c8-40dd-96e3-1c155e6c5830", "comment": "Malware payload (Mirai)", "value": "7b87c2a8ec3adf6d962ec8d7b2f5df49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217441, "uuid": "7d307e1a-8364-42f3-96b6-8f3b304c21b9", "comment": "Malware payload (Mirai)", "value": "2a7fe7471703266f9d762f8932e3b15edd56995d5c06254e793be88881d2904a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217441, "uuid": "320381b2-c800-4351-9bd8-e1afa01dc4db", "comment": "Malware payload (Mirai)", "value": "ec0c2e61ea43faaa0cdc0cdbac09c4563d8385ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217441, "uuid": "0cfc3412-576b-402d-9ef8-563cbf43a53a", "comment": "Malware payload (Mirai)", "value": "7740e857495ce58479a1a707d6dd288d90e08d1da6ccfe2345665e30cd3c65d0db7247245c7666088984152f9f769df5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217441, "uuid": "619672f8-6b36-4475-82b7-0962ab811f14", "value": "T1E104392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217441, "uuid": "36d674fc-5283-4409-bc17-f4a98c5a06eb", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w2UXS:7eJpJUVD1A8n0YNgEJi5aDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217441, "uuid": "e9236ec8-407b-4cb5-b25c-ef54fffb3778", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217441, "uuid": "26376799-7f65-428d-8497-c1382c985a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217441, "uuid": "0accb420-4a42-437d-b6f5-3661396d3c00", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ad46aa-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245437, "uuid": "8a76ea43-0498-496f-8b0c-b30f7c58678a", "comment": "Malware payload", "value": "35896c135d908f2969c25d3984bc6a06", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245437, "uuid": "a7bb24ca-da5f-4123-9a34-661fbd85d6ef", "comment": "Malware payload", "value": "2b0587f2420842379787417be7804a8f140dc5c5cddf12c446c4f598834b082b", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245437, "uuid": "28936a87-bf3c-49b7-a64a-6d2d82f7c13b", "comment": "Malware payload", "value": "3091903174859892562a4c34121424ff0a9fd0ac", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245437, "uuid": "93f5eb81-e5d4-4908-84f6-6643aaaecbe5", "comment": "Malware payload", "value": "9a6d0fe2e239a46ed03f12990f8783e052059309df234f9839691096e36787316a787f82384d796b58030f61a556ab9e", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245437, "uuid": "1d2cec36-417b-435f-b2e7-08b4adb9e455", "value": "T150955C17BCD158BAC0AE92358A6265A27A71BC140F3123DB3B90B37C2F727D09E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245437, "uuid": "025195ab-ba12-45ce-88da-4751cc59f6d8", "value": "e0ae24ffa3355aee145bba272be825d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245437, "uuid": "5b672152-fa07-4f38-b50a-df42823ffb4c", "value": "24576:N0ZiUGh0B1RlC7TgGubHTD/rX+jbj8KhCSB/o0+Hd1o:N0ZiU08Xk7Tob8j8SA0+91o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245437, "uuid": "d76c966a-d941-4ccc-84f6-143c4988e975", "value": 1951232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245437, "uuid": "2dc85f74-d91d-402f-a3fb-8e8c5083a1a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245437, "uuid": "78562755-1566-49dc-b464-124d08868778", "value": "Spysok_maina.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87922173-b9d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297002, "uuid": "4d9e327b-85c0-4049-98e2-9a80e8faa650", "comment": "Malware payload (Mirai)", "value": "59c6b8c3ba8a9b7d6b5c259fe81cff17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297002, "uuid": "b097c57b-e875-47cb-bd68-a55d7038a4b6", "comment": "Malware payload (Mirai)", "value": "2b9cecae7515cba206f1de033cccecd36ab9017b3116409abc9364aca4a3c522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297002, "uuid": "9fe1a8e8-ce95-474b-a81d-d981961304f9", "comment": "Malware payload (Mirai)", "value": "3235e5fca9e4cfc55f2ecd651f025ae61613601a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297002, "uuid": "6b8ce7b7-2dcc-49da-99d3-c80f628eada7", "comment": "Malware payload (Mirai)", "value": "0fb539826b2f44b5d4f984a6a7ef3239914c8d529d26672fe63bef4441d282da1bf756ca4f6a142811d07c08ce3a7f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297002, "uuid": "3ca68503-9f27-44c9-b9ff-564c30e5d060", "value": "T1F0B37DA47E4F7C92E3C7E37DCE444A72711B75F4C66182B4BE12432DC4EA9AA8AF0541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297002, "uuid": "371399ac-7e0f-43c4-bdd5-66bffc1588f8", "value": "1536:e1kV3MKQj07NgQqnp8n/+iizEO1DYcmrsPRF426w9ANS+lceDW:NJQigG+iizEODswY2UY+WeDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297002, "uuid": "ef929c06-18e9-41fd-82d5-462adce95d33", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297002, "uuid": "429503ea-0fa5-43da-922b-e32597f0d666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297002, "uuid": "9e4b6697-322d-4667-bf76-41d20b7bbccc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f879f1c4-b990-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269274, "uuid": "aa7eacc5-ae41-4f7f-afa4-764a6df58f72", "comment": "Malware payload", "value": "c75ccc4986d5d5d5ece06920e61b831f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269274, "uuid": "ec056c88-3ac8-4621-b142-c7f5de1699ca", "comment": "Malware payload", "value": "2d42f44cb857540a05b76c65c8085acb682340470acedd65367fa370a1161ecf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269274, "uuid": "21d71ffc-f0c9-4ed7-9832-e246c4244459", "comment": "Malware payload", "value": "c525d23aa22e71992ebfa36d6ae11ce07afd41fd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269274, "uuid": "912b8158-fd0e-495d-a375-27f98fb818e1", "comment": "Malware payload", "value": "09e81b1279e0c3dcef041ef230f2946eabf4efbbca1401832491bdf5a78701acae5f5fe73487ccf6b43808a19a5a42be", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269274, "uuid": "a9476b8c-a4ad-4b64-be10-d54ca3729cd6", "value": "T11E2723A0EF955413F1773BB76DAFE6D1C02E7DBF7221810FA284A91D0015616BE8723A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269274, "uuid": "b95aa8dc-de88-4e52-929a-21418e4a8f77", "value": "e7541a1327983db21a39d1e5dd13a082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269274, "uuid": "c7d517ae-4225-44d0-82dd-5fd93405134f", "value": "393216:R7lrVSEpD+8Gf8/VN8voiPGHCC9wjRl7q4jwJ9XQ0iOykKPLJA:JlrVSEpD+8GfoDXwN/qgYykKPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269274, "uuid": "f88af470-ecd7-48fc-bb29-604106d93533", "value": 21302272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269274, "uuid": "7740434e-2044-4aff-b29c-52b7a1ecdd66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269274, "uuid": "4462d350-08fc-44b3-9d53-88baff49e689", "value": "Renewable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec79b5e-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762245608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245608, "uuid": "399ddedc-22ac-45b4-9e05-a70bec818251", "comment": "Malware payload (Formbook)", "value": "74b40bfae8441a48b0ba198aa8d3d678", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245608, "uuid": "bbfd9150-3a12-4cca-b414-039208f382fa", "comment": "Malware payload (Formbook)", "value": "2dbadf426743e0123ff2a3bc297811b6886a45465aedcf3a1a6b3fe558db9e7c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245608, "uuid": "d2c3ecf9-1bd3-414b-bfe3-982474bb2d20", "comment": "Malware payload (Formbook)", "value": "3f364e4d7d7b80cf6bf6a5fac8f11d25e707c281", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245608, "uuid": "72a3a28c-b155-4a83-84f3-219e850a6a32", "comment": "Malware payload (Formbook)", "value": "09f2fc60a9d80b424229025a04ef740ffa546d97685d72acb5a289443adfeaee0241381d1bf74cff6a169145a6fc98ef", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245608, "uuid": "86ba2b21-7cbd-4820-9e52-ec5330b40ceb", "value": "T156F4239159C0A950C191B7348435CC528E793C30EE48763E936FF9AFB870397EA67B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245608, "uuid": "e37379a3-895e-4e55-9331-79eddfae8abb", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245608, "uuid": "6ca51298-cb9b-49d6-9b24-52e9811861f0", "value": "12288:Cz7hU5I5yuNHIgzSFKxWltRohBfSTso93UZQIuZLII+v8pBaBiYnkYXxoisM+0PT:Cf+iN57Gtene33nmIvpBaBikxsMy8mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245608, "uuid": "10fb005d-72b3-4ff1-9fa9-adfcebbf4f96", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245608, "uuid": "bca94cb4-60d8-4fec-a09a-28379feb6f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245608, "uuid": "cf806f31-0bb3-402b-9a64-937a6c447215", "value": "DHL OVERDUE ACCOUNT LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f13386-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236378, "uuid": "87bc9485-b23c-4538-9c24-d00c80dfc786", "comment": "Malware payload (Mirai)", "value": "8b9f3d11cf8b7d3fe33565da93c59f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236378, "uuid": "52fc2af1-63e5-4e6b-9075-a3a5425b2730", "comment": "Malware payload (Mirai)", "value": "2ef522ac22478e6f2df61a0237fff5f7f40471f48b2a332315bc818f2aa4b329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236378, "uuid": "599b3c87-7b84-4e8c-b94d-9b11713308f3", "comment": "Malware payload (Mirai)", "value": "288c05e8669c5062f188e37fe70b9d2c4e1e24d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236378, "uuid": "abaec3f8-6964-4013-bcdf-739b0857c19a", "comment": "Malware payload (Mirai)", "value": "c5e463fef6fc7d7d359cc4e3043465734f48cb7e30a508803554eac16ea1c7c58fdb40724e819d8762cda31dc536e58c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236378, "uuid": "b3126912-d0bd-476b-94ab-89e3b2107946", "value": "T16EE2E124322AADFFC51556BE00ECA84F756271936F4F89C9DDF48D1126EF232E9D4128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236378, "uuid": "394a5596-16ba-472d-93a4-56bf23fc279e", "value": "768:szK/s6FjyOq1ny4gJGo8n1zmYrb1NwXm9BL3LyEJ12:iKJmH1nyVGoY1zmGfmm73c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236378, "uuid": "892e7d2c-f16f-4de9-9985-18a65230a334", "value": 33816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236378, "uuid": "350e3c93-83e7-4a3e-ab82-3e1e5ee3fe77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236378, "uuid": "3b58083f-0cf9-4d4b-ba32-ab7b5733b91e", "value": "FGx8SNCa4txePA.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3f9a7c-b976-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762258063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258063, "uuid": "5d3d4b2b-1e42-45d8-9c19-f06be3233b92", "comment": "Malware payload (Mirai)", "value": "359cc6635317a3f7404f890ae00f928d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258063, "uuid": "e2e5301c-87dc-4da9-87f4-299d73c18455", "comment": "Malware payload (Mirai)", "value": "2f887ef167f69b9517347d7c0ee9049f2c4116f4c533e315db375cf2515cb25c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258063, "uuid": "51740bfa-4c50-4ea9-ab1b-ef693f072cb0", "comment": "Malware payload (Mirai)", "value": "6e1c2998a141fdd1aa45c9abb63883413d3bb1e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258063, "uuid": "55b39c8b-7175-4b5a-ac2c-6dc40c8dc1cb", "comment": "Malware payload (Mirai)", "value": "c742efa65fd54ce98dd0ba2cf9e20f15837e0fd4ad42010d4d4309a3bc21fc1d06f0ec7a3cd2149e1b8d3fbcf3e925cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258063, "uuid": "289d3645-5427-4d4b-8549-ed051aff247d", "value": "T1B4837EC9E9C3C4F5EC1209311276BB3B5EB6D13F22A4DF83C3A89876E912541E11679D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258063, "uuid": "425a8e57-32f3-4e07-b069-dba0039f34e5", "value": "1536:F5WNbII3KDgZ8elD0qquI32WPqvrSv+lScyf7SZon:FYJAgZTD0GHWAr08SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762258063, "uuid": "cd0814eb-a0ed-4098-89dc-b7e9315beadc", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762258063, "uuid": "75d28964-196a-429e-8892-0505c9f004fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258063, "uuid": "fb5bc7d2-1842-4185-9e00-61086b7ad566", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4589ac7b-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268544, "uuid": "b9cf2804-7564-4cf1-a448-ba6f2b937445", "comment": "Malware payload", "value": "527a2825fde79195754c7744ad2d5ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268544, "uuid": "9f76ea8c-b579-45ec-8d4a-fb1584e1b3ff", "comment": "Malware payload", "value": "309f0b4efad7c3d24843ed8e6956ca1c717d450e1c74e2d016de027abf0029fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268544, "uuid": "2b890369-cf25-471d-afb5-bdfac3b81f60", "comment": "Malware payload", "value": "a5d6b641aa7a29dd269a43e51babe2ba395ef4f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268544, "uuid": "e93552eb-1c9c-4f6c-ac88-37ea52f7666a", "comment": "Malware payload", "value": "6f785aba003255114e8bfc84c31927ad94fb0d2076f3600feb8a2ae62ccf663826a00d9a5c86c0c1a62db49315d2ef27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268544, "uuid": "a87902bf-abb9-4b47-a0db-6fb91480128c", "value": "T16E36927FA69C8838D4645E78886F6686A620BC13073353FB3E847A3DDD716F58A36344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268544, "uuid": "8faef4b4-835f-44c6-8bc0-b60b5734823f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268544, "uuid": "1ea20bcc-ff44-43c9-a9d9-38464a17f627", "value": "24576:tz1u1NQIvX7KY4yy97mLRakzxIeA/5gkCsrG5zQP8QJBi/1IaSMZAYNZ:tz1u1GIvwVaRakzxE/akJDQzpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268544, "uuid": "0ea6a853-9754-44e1-b5d2-83311b3a42f2", "value": 5050440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268544, "uuid": "217d2992-2c0c-45a9-b801-91d0bade766c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268544, "uuid": "b62fd8d8-f9c7-4d18-acd2-8500501451a9", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58d9abc-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268732, "uuid": "fcbd51c7-ad35-4378-9106-16f1654a3ca1", "comment": "Malware payload", "value": "74405d841984a399eba6eff492728b28", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268732, "uuid": "e02d6d28-c6d8-4e7a-8431-aa2e9f07b066", "comment": "Malware payload", "value": "30b0106242c5ced383acbbd520a94912b4c8da844bd493867ccebe9e0836a380", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268732, "uuid": "a491a6f4-d98d-42a8-a6e2-94b7bc8c632e", "comment": "Malware payload", "value": "b86faf0ec04d621b722b2ca157b2cf30aed3adab", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268732, "uuid": "9efe6857-0c06-4c8f-b54f-1ad83c620d9a", "comment": "Malware payload", "value": "bf883084c88cffc1e40956a21caad91b44817c7c8718f2af29a17b3f3d91064c9c312ad5948584d3d77c1b0763745cf3", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268732, "uuid": "8d31a652-d863-4fc4-9e01-5a7ac5de54b8", "value": "T1E6972245DB2D9433D7C4E07E0D2A01A23896ED2862A7E7D70C03F71E65B22DA4EEB754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268732, "uuid": "0dc06953-853a-47e5-986f-cde1db2fd20e", "value": "786432:C7K7Y46WL+SLNdjLNr8kJLhe1UyoGGXwsEFMBwmX8sinuRWdl1B+fD3spRWdl1Bx:C7KMg1LbBr8kJLh5lGtDFlcAnu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268732, "uuid": "08e92f16-052c-474b-b9e5-f544c616e960", "value": 41975156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268732, "uuid": "dfc8562c-6fb0-4239-9d39-f43cf9cdb011", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268732, "uuid": "703b7994-e77b-4ac9-8196-6441adf8cea5", "value": "Storage+Cleaner_1.7.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bced70fe-b9af-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762282488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282488, "uuid": "7c68f4ce-ec91-42ac-8daf-179a5fa95c87", "comment": "Malware payload (Mirai)", "value": "d3121868b3a707ffd95e6079cce9765f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282488, "uuid": "d2517729-6cbe-4a89-a4fc-d49e392fe5e8", "comment": "Malware payload (Mirai)", "value": "30cc9bd81f04d0e6f84df9dca963623b97448e45ae823e33b7707ec740927737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282488, "uuid": "e87ed9ce-d11d-4ce7-b926-bbb21054629c", "comment": "Malware payload (Mirai)", "value": "0e4e2c4564109639c71793d06550cd56aaa5465c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282488, "uuid": "f5dc9168-125e-4c8b-b753-5b8684a7a609", "comment": "Malware payload (Mirai)", "value": "2b2a40af80898bcabf5d0b0faac44227cc62bcf2d6978123d70285729c42bcbab4ece362def81e0d205fe7bb3d6fc1ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282488, "uuid": "a0c981dd-d3cb-49ce-b9a8-c9c337a835f6", "value": "T1C723F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282488, "uuid": "c6c653ab-e723-4b00-8e39-d43e8723366f", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9TH0:5DmKF7Gxyk8cqoHAmWurAufsG57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762282488, "uuid": "0c92ab13-56cf-45a7-8fa1-f3c26379dbcd", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762282488, "uuid": "448be5e1-221e-410e-8a12-a975f5df89fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282488, "uuid": "bdfb0443-962b-44df-84b9-294ae0bb917c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4947cc-b9ae-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281867, "uuid": "ae8c54e2-a699-4e23-b45d-4790d4999d5b", "comment": "Malware payload", "value": "630456350aab29707e07d7c6bdd05d4f", "object_relation": "md5", "Tag": [ { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281867, "uuid": "07230766-ee24-40e8-9bfb-39e9c4a68321", "comment": "Malware payload", "value": "30f0c2ba122eb63130a92e420bae0e49e4ad7c7f993db1008e50a34d87d39c27", "object_relation": "sha256", "Tag": [ { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281867, "uuid": "4345f074-407a-4b22-8a52-841067729f27", "comment": "Malware payload", "value": "708011c426b5448233a76e6723c9eddadc37382c", "object_relation": "sha1", "Tag": [ { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281867, "uuid": "54eb389c-7b4e-4c01-a85d-e603c466ca3b", "comment": "Malware payload", "value": "b07fe90a65077d062f832ceda53b0fc89dfa473a2ebcd793a3bc9618248effaa17bd17a00eadee3a476b8c86368ff569", "object_relation": "sha3-384", "Tag": [ { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281867, "uuid": "e4788f97-b1f7-41ab-91d6-8b05b414b290", "value": "T1A5283358668B0C27ECD4F6FEE10E605A42350F046A26CA13AD75B7079F30909FF75E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281867, "uuid": "9e080a55-5f9f-4352-b93b-1fd375b591b0", "value": "1572864:ZqcuCSAjl/LQKY57GEQ93FKy1tBDAOzyQ7E8yKRLbtDhDF3mCI46T2Z2:ZquBEKyjQ9cSf05Qfpb/F3mCID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281867, "uuid": "8e4d0aa0-8000-4eb9-a27d-b3e418f251de", "value": 93646848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281867, "uuid": "9a26ba67-5b67-48a4-a9ee-dc3ddcef21f9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281867, "uuid": "d446e0ba-4efe-4d60-950c-9f49f34ebe6d", "value": "launcherInstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2b9c6a-b9d0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762296531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296531, "uuid": "6e5f7436-7d69-4ba6-89e7-c8e8ef3c0373", "comment": "Malware payload (Mirai)", "value": "a3eeb2bd18e2ef2ad76f977d3cf3eaaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296531, "uuid": "b9a9a0bd-1b50-4975-bee4-2de88b6eab5f", "comment": "Malware payload (Mirai)", "value": "3269ba292e140f8fcc85a98956e404a07caf790d360bab109e5c37a40b8c7def", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296531, "uuid": "9ae6e192-8f1f-46df-b65d-dcca61492684", "comment": "Malware payload (Mirai)", "value": "32f78883686f4b05c164f71d438f8429f3dd8305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296531, "uuid": "e8cdd30a-5258-4239-82d7-4a8041b27e15", "comment": "Malware payload (Mirai)", "value": "ea81084697aa5a870d6d41e4a3207d8d3a23836a6edeb7289267ed8e105cf0e24221482b58d866d6f87b28ea6fae653f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296531, "uuid": "93753fe6-c14f-466f-aa1c-57c58be3fdba", "value": "T1B1332941FCD299AEC6C4237AA76E258F3311B3A4D1CF3607CD586F21778661F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296531, "uuid": "70abf653-fff0-48d7-93ea-cb9a12b4ee4e", "value": "768:NZyg0sFNtfDE8bcFVfu+erO5swMCNcgn0J71RxottDORHVkBNknxKmzCK:NuIxDEGi9swMCNo71RaORHVoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762296531, "uuid": "dc35e619-13a6-4a40-b484-38b5b34cfe51", "value": 51108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762296531, "uuid": "790a9303-44ce-4299-a1d1-03f65dcdbe3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296531, "uuid": "57e1a3b8-38d4-466c-be1b-24baab52b12a", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6ebe06-b986-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762264660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264660, "uuid": "bb7c7e73-8a73-4e59-92a8-fbc21bf40ea4", "comment": "Malware payload (CoinMiner)", "value": "abc79f8775cda4091175a1ba1eac7fe8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264660, "uuid": "a692f3d3-0a0a-4119-a35d-2c099b0cb684", "comment": "Malware payload (CoinMiner)", "value": "337d5860a9b32a0d24c732d7490deea4772bda48dbe3126fc0b1e838ac739aab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264660, "uuid": "0847ff2f-209b-4ed5-a2b0-74e3cc26e2fa", "comment": "Malware payload (CoinMiner)", "value": "b96ee0ec70d51b587f29a3d75e5f906e7d58c883", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264660, "uuid": "4e912778-7ec5-4fb6-9efa-08f47b1663b2", "comment": "Malware payload (CoinMiner)", "value": "da8a54edccabe9b6908fde6c9c8db1081f461c64cd566ee7465a594f8bce796a6b7181368538c1582721f2edc9f13ac7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264660, "uuid": "779293ed-7d1e-41bd-a100-506ae18b9008", "value": "T15BF5111C04D1242AFD1ECAB4319BD514D84B9EEC285D83BF176ABB3CB73219EDA22715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264660, "uuid": "97d68d33-4dbd-40b4-b78e-5f3e1c6a3009", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264660, "uuid": "933841c0-0baf-4c3d-a2cc-efd792e07e7f", "value": "49152:edJ5z4j4w5cxQWCeOTtYnYK5xHxE9CqXNeLc4vqGNwdS8bw/bPaN3jfRSukA:edJ5z43n2AtYVtBLckqGNwS8s+ZfRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264660, "uuid": "1eefecb3-42c5-4928-9c85-da681fee57ea", "value": 3473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264660, "uuid": "8a072861-6d3b-49bb-9cc6-345ed13e8a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264660, "uuid": "184513d0-a730-45c8-8118-d4446e5f66da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79acb50b-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236419, "uuid": "dde23304-62d2-467d-98e2-a66ca1801022", "comment": "Malware payload (Mirai)", "value": "07b474abdc947ec9e02c20a5b3193fe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236419, "uuid": "aac40756-c56e-42f8-a67f-32b16efa3c2f", "comment": "Malware payload (Mirai)", "value": "33d890049c0cb00163bcecfe9b2d137cd2f390bf1122bbfe1f70996bd6e0da59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236419, "uuid": "f1d4cb70-ad7d-497a-b207-eff511d7b3f8", "comment": "Malware payload (Mirai)", "value": "e0578295b7471b1f86c65a691e8897c5c5e6330f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236419, "uuid": "95d255de-8d47-4738-9508-e5b079e45740", "comment": "Malware payload (Mirai)", "value": "96951047a3ae401836cf1c4727a924a4f82d35213e110ca804239899f38eab4f3ea18d6e372f49b470847f968d976992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236419, "uuid": "54256c84-f256-4ad9-a51d-15059feb4dc7", "value": "T1A1734B46E747D6F0C84309B020ABFB3A6931A9752234DE77EFE4FBB36C725429406658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236419, "uuid": "ef7fdff7-65f3-446d-824c-7b2027ba55a5", "value": "1536:WyvBOuy5yBt1erihu5UGzAnLfKUfSy7dJJ8IDid1WEFsjBIr:WyvBOuy5yBW5AnTV37dJJmaVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236419, "uuid": "18019ba6-ed22-46b4-91e2-de79eec483c9", "value": 78564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236419, "uuid": "29129fb0-2b57-4d8c-b6ec-fd978decb6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236419, "uuid": "53a97c03-c0c9-42bc-b41f-30dbaedf0c60", "value": "FGx8SNCa4txePA.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145ff2f9-b98d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267603, "uuid": "ac7f4b98-d499-4f07-af30-4bc0c3fe6e16", "comment": "Malware payload", "value": "d8fd84bc155dc1264cc80328f5992da2", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267603, "uuid": "1dfbe2ae-9579-4799-8d75-1c8712cd3c8e", "comment": "Malware payload", "value": "346e4552dc9c779261c5e9581783775ec470c5610303b726b0ae571ffce178da", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267603, "uuid": "2bb926b2-04ef-415a-be78-3b703d18121e", "comment": "Malware payload", "value": "e4b9c68357a2babcfaf49feed765f557142cdbfb", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267603, "uuid": "7f659633-ad42-49ef-ba87-4550ccc1470c", "comment": "Malware payload", "value": "e8aeb59a2daf92074d5121518e094cfc6371cb23f6c67ad15760e5654a7faffa67ab7892eddb313d5ece83d0e99926fc", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267603, "uuid": "0ce3059d-35b4-4a16-ac4c-dc43716a1356", "value": "T1229523263AE0C562CDA797F2B8F602E3062C7C69CF5406536684BD8A3C7254F9875B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267603, "uuid": "115ddb45-40d1-4b5c-b776-34ecf6ccb32b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267603, "uuid": "b1ff3db6-c1c1-40b3-a9cf-43346ed2a6d3", "value": "24576:3Uy4bihbCbA6Y1UYD9I4bYBYWtnCVXYV8WB9v4p9KHW9dhi1/os9CGOPidshy8MR:TmfbjYFD6BrCCWLYKixc28lLLwEMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267603, "uuid": "7e4ab289-7435-487b-b020-f5622f735127", "value": 2030592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267603, "uuid": "ec7af564-5a72-4106-9ad2-c14c3bc8ed8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267603, "uuid": "f3781c6d-ff19-456e-a0aa-8dbe0872bad8", "value": "adobe_premiere_pro_2024_v24.6.1_(x64)_ _fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba2b750-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762248798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248798, "uuid": "248c7cd1-0388-4ad7-97bd-07c9ed53fed6", "comment": "Malware payload", "value": "c4c0f69173d4b6dc360e7fc0f7773a1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248798, "uuid": "0fd2c54b-fa9f-40a0-a50a-ed5b8e6768d4", "comment": "Malware payload", "value": "35ef679ba7ce792ddd5478b8978cadd671bf63f8b13a43e6cbe06c233555162c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248798, "uuid": "8822dd6a-ae0f-485e-a78a-53532ed2a869", "comment": "Malware payload", "value": "c0d87af42677f9da23d38d2cca10da38ceb58844", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248798, "uuid": "9ff04102-6a9c-47d9-8d6b-e90acb56aa6c", "comment": "Malware payload", "value": "8ae5978e6b7f251aabd0c35218eae64411ce3991095477919aed093aa1a38d7aa028f2d12dfa40b58bfd4a437bf73e02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248798, "uuid": "0c0388ed-ebdc-405d-ae5c-7c038971abe8", "value": "T1C1E56B85FFA91838C5E08D31C5AB03E93335BD902669A93F152FA3703E435D4EF8A596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248798, "uuid": "3961a74e-644d-4ae9-817e-e319f350f69f", "value": "49152:IEndW3onDKXCh6dlor6DhJlRStkmJQrDmrxSdHeylVjbonHw7NW4S8H1N6A:IEvDR6dlvD+Rrx8XW4SKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762248798, "uuid": "de35919f-9909-4f63-9a03-8063fc13acfc", "value": 3238304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762248798, "uuid": "a651b648-5e4f-4853-b200-17b7163736dd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248798, "uuid": "30afa255-1e8e-451d-b712-79b954c33458", "value": "ssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71348e64-b9d5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762298682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298682, "uuid": "ac28135d-2cfb-4428-93e9-ee44b88ba2b2", "comment": "Malware payload (Mirai)", "value": "29cd1c2b8224650118c16c48b11096ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298682, "uuid": "463f18a6-5c4f-4ed2-ba52-39b56ed3383f", "comment": "Malware payload (Mirai)", "value": "362053de3cf1f3c2fab28e93aa6aa05a662ae6d7a1770f7ad5315813e7ecb5bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298682, "uuid": "2e771fb9-9936-468d-97d7-1b4322ad2787", "comment": "Malware payload (Mirai)", "value": "1e19fa06b62aefb8832ac996750b560ccf33a5ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762298682, "uuid": "059e7007-833b-4ec6-b875-7f607c700a5d", "comment": "Malware payload (Mirai)", "value": "ee43972c48f11d652b42a6e69a0d4afe1dc68ecd363bc9ef24ceb76e0931f083b13261e474bd78fe9d77702a5489a025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298682, "uuid": "79a282ac-baca-4e6f-b32f-72a6c847ce9a", "value": "T141836C22B9391A27C4E4A57722F34336F1F6438A24A8CB2F7D710E8DBF2559036476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298682, "uuid": "0bb66946-c8c8-4e8a-9779-961e623a4503", "value": "1536:mjUKZLGNGgjmQ3HSvYkut6OYm5C4JoAEntlT:eGj0OYOCwYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762298682, "uuid": "58f0fb2c-1077-4d67-9546-c8cf627bc920", "value": 87168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762298682, "uuid": "005d8933-4125-4d16-a926-5e0fafb6a64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762298682, "uuid": "fbdf2c25-2305-430d-bc1f-e1c0f544ff87", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc2f236-b9ab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762280822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280822, "uuid": "4f5f4101-41b9-41e1-a6df-b4b307f3599a", "comment": "Malware payload", "value": "581199907cfd76da8029fbbc0871c4ae", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280822, "uuid": "7444c16c-be0a-4844-9f8d-714a72ecc267", "comment": "Malware payload", "value": "3632eef72d8e57723eb92690e19ef33ec7e6c4e4cf51c80d7471f607bcecb0f1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280822, "uuid": "86ac91b2-55bf-4d30-8f52-26bf13a2ae0d", "comment": "Malware payload", "value": "e22ad8a9f49ce9efa484539dd79125026523d698", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280822, "uuid": "3585f996-f90f-4e46-a4f0-8a73cd39cd4e", "comment": "Malware payload", "value": "541126e4bbce8a24cfdfc315222044765b714419c1da1c78da5ccd6f970ce2a3ef0ff20422848377b54e022322801e1e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280822, "uuid": "8d759c79-c312-443d-8a96-a3f7fb126bbf", "value": "T13BD423EDA18C77C2F2DE38E5531EDF04695A80D82D0E4C260D735EA4299CDDAE389379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280822, "uuid": "6d846d6d-4522-4d8b-b025-9ac449b392bc", "value": "12288:kzzr+Eoi39sPNdlz+gAnpqq06OXdFm3xJ/7ZPeV/5lLvlsBy55RVxZ2M:kXUO9sPNdlDApqq0pKj9gb9sBA5Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280822, "uuid": "7028a620-d7ec-43fa-b96b-e49e99596d9b", "value": 621514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280822, "uuid": "4041de0c-13b2-4c3f-a9d0-717e14f3f7b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280822, "uuid": "cd247db7-b788-4de9-9f6b-863a499f8213", "value": "Sat\u0131nalma_Sipari\u015fi_2025_10_30.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69fcadd-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289860, "uuid": "a3a8e695-c41c-42d5-a086-c6a34648c841", "comment": "Malware payload", "value": "364fea7dea4dbcb13dcad6667883966f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289860, "uuid": "a42281e2-b2c1-4e64-b079-b8444613ab76", "comment": "Malware payload", "value": "36c01710f8ff21e4e5a5e72373c419d3fadd9f22de8d7e78b1502e03a42bdd4e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289860, "uuid": "06dfc26b-2ff7-4758-99db-ca528b65976b", "comment": "Malware payload", "value": "2c58f0335b5f281012cecab26cef300e240c5c6c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289860, "uuid": "3784c905-54d6-49fa-9dfc-d1590452a82c", "comment": "Malware payload", "value": "eb317afa9336f29d1d48ed2858a607e2c272be5b581a139e22c1cce443ff46e9d6cdf9629bc067957c435c8008e7dc29", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289860, "uuid": "53149fae-a825-49e0-a5e5-f31da6a0ef97", "value": "T12CD31AE9A59CB88F32D9629C40F5F94EA84C0D62ED71469CB0051BD01DDFDFD8A1A38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289860, "uuid": "ca887191-283c-4339-9f9a-435d4af61196", "value": "3072:4LLbBdXJC87uyeXCIaULQ3KlUcJ9a81xhe:4TrXJC87uyeXJaUM6G81xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289860, "uuid": "83e94def-8186-4d8a-9da8-d1d5e7e8b29b", "value": 139026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289860, "uuid": "71d5ad15-ae07-4542-aaca-5c74787b3e98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289860, "uuid": "da41e016-6f1e-4d7b-92a3-608bc153ca8c", "value": "INVOICES.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623d5f22-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236380, "uuid": "15f5a3dd-85ec-465c-a282-89d4bc29ab1c", "comment": "Malware payload (Mirai)", "value": "9754c1e9130b152674559cbf9e940c25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236380, "uuid": "db5905b2-cc6f-4ff3-b45d-e2fc0f69a966", "comment": "Malware payload (Mirai)", "value": "36d697d54bec3dfcefddc0598761724329dc3d51d671c775c61708971d3da063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236380, "uuid": "c7b0fa26-059a-4a02-b3df-9449a266ba99", "comment": "Malware payload (Mirai)", "value": "4c59c68443eb695185258d93a6a11a1d0d742cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236380, "uuid": "edd9b729-c479-44a7-b479-379d7e8405df", "comment": "Malware payload (Mirai)", "value": "9e2c4d3bdb7e2637933e299efbf70c3099eeb70391e673a09a415a2335c6986ff982429db77b9c5033e1fa010933ec74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236380, "uuid": "e6eae330-0ccc-446b-a9c0-b147787b5c71", "value": "T19653F1B1E225C9319C24AA3795699E807E3F5EF5D1FB38778072D34108D4286AEF253A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236380, "uuid": "81af0307-1c3e-4953-917a-4f3f0758d024", "value": "1536:zA4Mi/HflGRR59Jdf6UVSc9MgDLGJPEs2zHuI:zrMi//lGRR59JdSgygDL2Es2zOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236380, "uuid": "3a6ca99c-e610-4e37-9db8-32b63a029bad", "value": 65116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236380, "uuid": "75a928c5-083e-40a2-adb5-0e2c1b7f0d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236380, "uuid": "cdc676d4-9d21-4964-8841-4c5bc7b4c15c", "value": "FGx8SNCa4txePA.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b61671f-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245415, "uuid": "d392b317-afa8-4d14-8b87-6975824690fd", "comment": "Malware payload (XWorm)", "value": "adabb6e6afb78360b360b7b3e5501028", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245415, "uuid": "085daa7b-a7ec-4c1c-83fb-d03d912dd74f", "comment": "Malware payload (XWorm)", "value": "383af49b39cab5da29cff6c729ee08eddf62380553315266fd0e3b1dfc0e552c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245415, "uuid": "e4cc4b16-6c58-46ab-bc93-c98f880ad8a8", "comment": "Malware payload (XWorm)", "value": "1db4211b5be65748b51a61254f989b746204d2fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245415, "uuid": "49747510-5ae7-4db3-82dc-3cef8da2e302", "comment": "Malware payload (XWorm)", "value": "4acb377ec18a931043dffbaff7885903ad8ce06c682a057eb7dadb07898425a3bd31c214e7c2e8813ec5ed95bb299bec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245415, "uuid": "b553b2a9-8cd8-4d16-93f2-da131fd1436e", "value": "T1E30485EED857BD4AE61463C213EA29AD273CCBE1B4270274CBDB9F2D137448A451906F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245415, "uuid": "fb892ad3-abc5-4971-8d08-0ae6ac839a4f", "value": "1536:FBNLwxghv4NdUux3RXywCC6A2OSlDJ9As+SUNHrqJtZmv/Wswuqvbrb8hRUtJkJF:DxkNPpmA2llTQKg7SJk9f1SGXV6Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245415, "uuid": "b9548c04-4143-4ca6-848d-9888ffbacd26", "value": 182211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245415, "uuid": "155979e8-3186-4b08-8469-b3b2b28402aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245415, "uuid": "e32eae1d-3460-42ce-b604-823ecba22e5d", "value": "output_1762115041.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587bd192-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245383, "uuid": "de8770c9-7b20-48ca-9733-981780c4eebb", "comment": "Malware payload (XWorm)", "value": "cf40919f86d7da9e5359ab3927c6f982", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245383, "uuid": "2810fd3d-48da-4cb4-8051-f58d154a56bb", "comment": "Malware payload (XWorm)", "value": "39a3c2852cc708ac49c7272b5f9f2f503b9c4f08a263a0530bc155b7795a3896", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245383, "uuid": "14ec2409-d8ea-421f-83b9-06d358d352aa", "comment": "Malware payload (XWorm)", "value": "22b7d08023ddb119133a320a1b148629a316a561", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245383, "uuid": "ea6a3906-3c06-4049-be54-c1c32160d749", "comment": "Malware payload (XWorm)", "value": "4e2440a3353c26b4826a7cabdf77acd8c79fcda20bfe3b3a7ee3c2a8aef9934e3979e6d0a967b48cdd5a2cac22392ccf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245383, "uuid": "73846e2b-219e-48d3-852a-4e69a699b6a3", "value": "T18C148F2AF9A7B8C4D204739D21E2053D208C2F56BB607624B69CDC7764E8BF7961CBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245383, "uuid": "7dd68760-b3e1-4e97-af90-ce0d4c1ff1c6", "value": "3072:UqQb3c5e1+1FYxcNeGra7u0znABuaRIZgp9:UFvxga7u0znA0FC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245383, "uuid": "a43e5c51-9afe-4647-a228-84588a99cf6c", "value": 209354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245383, "uuid": "7f70f957-d2bd-4a5e-8eba-f0448880a896", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245383, "uuid": "15e4f6e2-978f-486e-8ace-70cf9319367d", "value": "invoice_345432094.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f73dd1e-b9d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297847, "uuid": "2df0075c-4703-4844-8158-441e9fd04b60", "comment": "Malware payload (Mirai)", "value": "4f1535da6b6789b520d48f16b65f5de8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297847, "uuid": "94e23cdf-b0ea-4fc5-97af-f7e78a5217f1", "comment": "Malware payload (Mirai)", "value": "3b12859c55321b427daf3340665f28cfd4233ea7d693594f11712624f5e61f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297847, "uuid": "24a5c93b-f8c4-4242-9357-2c69dc6eac04", "comment": "Malware payload (Mirai)", "value": "66f4d3ddb742f8d456d6f49e7fe115f2ac88818b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297847, "uuid": "4f015f13-83b7-4886-974d-0fc00a8437db", "comment": "Malware payload (Mirai)", "value": "a0a2f82c205738bb765161667f1cc47f5337650199bc1a50e80fcc9e648a781b256be352e38f8c420cf3a6eaca707116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297847, "uuid": "d99ca474-66a4-4ddd-b26d-7af898e32e5b", "value": "T1D623F1B2F272D4A2DA207EB6D0B5579B52861D30D3BF742BB050054D98C2D326BBB9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297847, "uuid": "30a9a6bb-97e3-453b-ae9c-9f1ef954f849", "value": "768:AEmpMJgsGESZbnwb6vlAhd22eQ7gJlZVy/7sTgWdwzo+bK4hezpIwTva7/O4WOpr:APMgsGESZU7hVep5Vy/7sTizo+3helIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297847, "uuid": "6bb31414-9107-4fb0-a400-2ba4c771be8a", "value": 48072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297847, "uuid": "8568c9ab-1502-48d9-954a-cb7433de02bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297847, "uuid": "68ef9ca1-cc2b-42a1-ac65-257906840608", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6152c5-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281226, "uuid": "1735c503-d698-4179-b528-3efaf18d0bb6", "comment": "Malware payload", "value": "129ad635171128c11f9c673898bc3a0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281226, "uuid": "d2e8ed19-9b33-4fb1-b064-698d72c06c80", "comment": "Malware payload", "value": "3b9f7030cede5d4e6c29654a6c0b66cda26760c5e3c12821be05077221aa5f5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281226, "uuid": "988b7168-7b3d-4266-997c-5654b0723bc6", "comment": "Malware payload", "value": "4634d86aacf8bfbbc99aec4fb6babc5f2e12de2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281226, "uuid": "a7886c94-2e7d-4fb8-b073-729531e312c8", "comment": "Malware payload", "value": "0ada281655e0172281eb915dcc740affc206292d3cb4b7b69fe8d59d7a8b2ad6067c326fe605d8261dd69665836b367b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281226, "uuid": "f71feae0-cb2e-41ea-9a89-565e5b54691f", "value": "T10FB3AE41F3E142F7EAE2053100B6663FD73666288764E8DBC74C2D42A913AD5A73D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281226, "uuid": "1c0b000f-8c88-4484-82cf-3716fb8c1475", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281226, "uuid": "a3c82189-df7b-425e-811b-49d03155fbd8", "value": "3072:u7DhdC6kzWypvaQ0FxyNTBf3IlPbNYvAj:uBlkZvaF4NTBPIlPWIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281226, "uuid": "d11ca023-0dfb-4e8b-beba-fab795a2f31c", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281226, "uuid": "2dabbcd1-ee5f-4d1a-9ddd-ecf27fdf25ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281226, "uuid": "8698c366-4f0e-4a06-9fc4-2261a82d1e3d", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9246f6b8-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1762245480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245480, "uuid": "f05e8b2e-dbf9-48ef-aa84-017ad344e738", "comment": "Malware payload (CaminhoLoader)", "value": "3f6627acd7a85f3ed3b451ad2650f319", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245480, "uuid": "70b54731-e5a4-4651-bb6a-3f3e1c6a80c3", "comment": "Malware payload (CaminhoLoader)", "value": "3c25e04769279d7d83ee4e69084359f635e7ac12f001155b82e6f99085c3e50c", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245480, "uuid": "662ec6b1-0621-4e8c-904e-65f308ec6d8c", "comment": "Malware payload (CaminhoLoader)", "value": "2b4541754bde6b0934741bf7f6478d492f83e780", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245480, "uuid": "bc12599d-1189-4d99-b1b2-717703ad8905", "comment": "Malware payload (CaminhoLoader)", "value": "ef685cdea359fc3c25a194b7aa0e51516ed07a501ba0f7bce596ba86b837c8a3ed9177dd1e95ae9ac691fa08771789ab", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245480, "uuid": "d5228dff-1e37-4929-a373-e2063e19da8e", "value": "T1B2434BBDE162396D9837E21399947DE4B75B06E6323C3A26421241437EB2CADDBF04DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245480, "uuid": "dbd9c49c-8153-45b0-a443-03245d5b53d8", "value": "192:aejdVu4c7fibZqAAAAWvAHV7UDMbQt9CK2:3CHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245480, "uuid": "8a9d54c5-1c7c-40e5-9071-688de14ed667", "value": 56213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245480, "uuid": "82a67916-22d0-4067-a1cc-b1fbe6e4b99d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245480, "uuid": "4f87e01e-6484-4217-9af4-cac8fa35c851", "value": "RFQ COA OF ACETONE MLR # 25014.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d55f65-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245452, "uuid": "1931ad2d-1900-4826-accb-bf61c77633fb", "comment": "Malware payload (PhantomStealer)", "value": "6115cb87a6075a2075001d49d0744303", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245452, "uuid": "108df62b-7f05-4a09-8251-ae9f49376669", "comment": "Malware payload (PhantomStealer)", "value": "3c3414d78bc07edf5ba7099b116c0618c0c0793362cae7f7481da37df7ad3175", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245452, "uuid": "c560f620-93c8-47ea-83dd-dc1ab1485002", "comment": "Malware payload (PhantomStealer)", "value": "bfecef0da71106dd0d7bddb62d003d8ebf11e090", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245452, "uuid": "421127b5-6167-4d07-9cca-c4e20f9316e0", "comment": "Malware payload (PhantomStealer)", "value": "c43858984b3a69e650ffc97f63453707274f465c35ba7372fc828f43df53102bc0e771fd66beda591cb0b02b4296eca9", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245452, "uuid": "f2efe7d7-8590-4a03-8968-6036e74adeeb", "value": "T108158B788B6E9CA4066723FB30F97B051C5DC65D51B4AEF8B7E720770910A7882AD378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245452, "uuid": "e1bcadee-6bba-484e-bdb0-42990995bdf5", "value": "12288:YVLFlEza+2gpMsjDS7VS0aA7WeM8yDnO4F8ZvsFhwIhkpfVlLR/pr3/Cp:sLFH+dpt2Vja2/ytFoEIIh0he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245452, "uuid": "e79d6376-dcc6-406d-85d5-d2b2b2c92296", "value": 910274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245452, "uuid": "22276cba-961e-4e4c-b7d1-99dc434d689a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245452, "uuid": "c9123c21-71b7-4854-b5a5-891f61206844", "value": "Purchase Order-25-PO11.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef9d7b5-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261232, "uuid": "b7c81cce-ae9d-4e73-9ab6-e11c415f583a", "comment": "Malware payload (Mirai)", "value": "08c9f526af2f29eec6611c8840bb4566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261232, "uuid": "716d0852-fa96-458d-9084-1b24f07cd953", "comment": "Malware payload (Mirai)", "value": "3e160ec976dfa8ecd80e1a568d23069a4df9125a2a69dd480d18dba090621837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261232, "uuid": "a1caa7b0-bf5c-4a5c-8109-54811418380c", "comment": "Malware payload (Mirai)", "value": "8f78b4b57b41071f158198e2fe4131cab7a4b102", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261232, "uuid": "33994b0d-f7ff-4595-b324-e14951cab820", "comment": "Malware payload (Mirai)", "value": "8857a7133c92d8e580a33da23e3b089764e0c214e51dc29a647389b05a22d9165f965191d2f3849fa825621392bf7880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261232, "uuid": "e3fdd2cb-855a-4969-af7a-87648727c04b", "value": "T1AA14B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261232, "uuid": "4eb8cff9-24a2-4496-a3b6-44c2b8929711", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1PGDV:QDy7dCaWalr3bt+eX7EGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261232, "uuid": "8fac9e13-8059-4d1a-bfc8-c0f7c761a2ab", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261232, "uuid": "974b3c0f-7778-42c9-9261-a42c1677ae71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261232, "uuid": "5bb6ad58-4324-4733-a785-c771822fc054", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975c2d37-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245489, "uuid": "621fa268-123c-4a32-88fd-231f2c3f5e73", "comment": "Malware payload (PhantomStealer)", "value": "614efc9ba95586fdde6ae71cc0f4a3f9", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245489, "uuid": "ba57f0c4-19c7-4f3d-beff-bf8ee0837aac", "comment": "Malware payload (PhantomStealer)", "value": "3e2f884d7f43ee9b8f8e90b63545022ef62f3e67d4baec57de000e1835ecca43", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245489, "uuid": "53f3b7d8-5264-4bc4-aa8e-1785eed208d1", "comment": "Malware payload (PhantomStealer)", "value": "aefe42b9d1249e6dc9e5230ed625f7aacd05ab6a", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245489, "uuid": "12617226-d5b9-4897-97ac-c9938ce64464", "comment": "Malware payload (PhantomStealer)", "value": "96987fb63744b30964b9cb37980668a6695c5033acf084c3261d38e0c08cee55574c2d4b7fac397b3d3f0e247b80d494", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245489, "uuid": "0c99d57e-4e0c-4d89-aa6e-134ed373e26e", "value": "T15E15E137056D7CA877AD2EED23E3290910DB9632B52819DDC4F1489F0CD7147E7AE28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245489, "uuid": "ec9db809-cc78-4968-ab92-ce22ec352828", "value": "12288:K+6HAYyR2th4++c+gxhyN1wL7LiXELuILnEtLsZainZuCzF5gXK5rkx0:+xh4c+ewN1axu5SXZuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245489, "uuid": "a5824cd5-7cf1-4204-846a-a874290611e1", "value": 905243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245489, "uuid": "5c5ca72a-27b4-4d6c-8e2b-c2589e13f970", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245489, "uuid": "fb715452-6fad-4530-b442-27fd686f0c9b", "value": "Order Specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8e5a3c-b965-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1762250410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250410, "uuid": "577aef0e-74dd-43a7-9720-951ec7bd6cc0", "comment": "Malware payload (Arechclient2)", "value": "f240efc0a4bbf88953922aeeaec793a2", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250410, "uuid": "a99d242e-a5bb-4cd5-a611-15a10eb5c14d", "comment": "Malware payload (Arechclient2)", "value": "3e7836084c067b0e08b7c297e272a1f9b41a9086455b43a3637a5a789962392f", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250410, "uuid": "689f7520-0f9c-4742-a8f9-c86905fbfd0f", "comment": "Malware payload (Arechclient2)", "value": "74a9d98001930ac5dc2e2f74c9488c77d3d80d70", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250410, "uuid": "c131b104-bb9e-4f41-869d-6338308014ff", "comment": "Malware payload (Arechclient2)", "value": "3ac2c44daf6bfb9723826b7119e32725c0cc2d7db1d1078b8c5c5e7709e6bcb3af0acf08de3c36ee2fe431bcc15fd6ed", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250410, "uuid": "44b8c858-fe0b-4040-8fdf-bff62b1820cb", "value": "T156055A7D764B9E32FEE9777881FF6C1892A022A75091658A1D8C98D81FC137EC74CAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250410, "uuid": "3204d6f3-7e1d-4c34-8acd-b61215b491e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250410, "uuid": "c24900f1-a386-4277-aa80-42bd34477c66", "value": "12288:Swm3kTcm4u06WpKA5wi3shv6U7hqn8oPM4mLjVDbzEpiL7Xf9pLJl:Lm3k4m4u0tpO4Y5h9o04mLjBv3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762250410, "uuid": "f5159f97-51b2-4668-9d35-e758d92d654d", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762250410, "uuid": "32bd93f7-8f41-4f6a-88eb-d7390f9eb2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250410, "uuid": "05686142-d3ff-4909-b1a4-5142560267c9", "value": "3e7836084c067b0e08b7c297e272a1f9b41a9086455b43a3637a5a789962392f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e0028a-b9d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297001, "uuid": "f796d5e9-f1c1-4f9c-9146-55d7e0d6fb85", "comment": "Malware payload (Mirai)", "value": "2196540b78bcc3c9271f5f2cdac7c2b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297001, "uuid": "a883af33-e096-4737-bae8-ae40ed87e732", "comment": "Malware payload (Mirai)", "value": "3e8965b69670efebb1d2ce2e479f79ccccd83759020e60639a0fc50778073952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297001, "uuid": "24b6bbfa-f34b-474b-980e-20238f2f459b", "comment": "Malware payload (Mirai)", "value": "51b5afcdb10a935372a84af1d63ecdee45516571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297001, "uuid": "19a31312-3be9-403b-9fe4-cf072d075fe6", "comment": "Malware payload (Mirai)", "value": "ede2e1c1b11251f53cd5fb5b79834dcea31a395f13a541ec38c223d2a1d17bbc56be933350556d67caa17a844e20c9eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297001, "uuid": "8dc7c9d7-d38d-4a0b-9760-172113c1b7b8", "value": "T142230271880F8DB125703C76EAD9E7937AE12AB1C6673013D6280E3C2F65B531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297001, "uuid": "f7dfb63f-da00-4dcf-b80d-5bcd9219c808", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3f9q3UELbUXfi6nVMQHI4vcGpvi:DECFd+A6YHAxOLRQZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297001, "uuid": "2f3b9d0c-c00d-4cce-bcf7-7c90ba89cb01", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297001, "uuid": "9be55763-3cee-4e60-859e-eafdc41c640f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297001, "uuid": "a703a73f-6358-4800-832c-d82be9b7366e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad40959-b95b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762246219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246219, "uuid": "905684a8-fe93-4e2e-9ee0-4c60b0faf214", "comment": "Malware payload", "value": "09cd46e0916266e02e2bbcf2d870c2dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246219, "uuid": "8c47c8f3-88db-4278-8432-2919164ac54a", "comment": "Malware payload", "value": "3e973a85071220afcfbe0172c476b0cb3822c31ea3ed4f46826aba4f778ba8d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246219, "uuid": "e0723ae5-170e-47d0-a960-7a96bde3decd", "comment": "Malware payload", "value": "7aa4414a1ea2f1981d5123c1be776ac69be811f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246219, "uuid": "f2da4465-8244-43ec-b26f-80cb0a77c86b", "comment": "Malware payload", "value": "93b59a6c1ffc44759bdecb5e3bb6a343d39d3b33e48b49fb54d2b2d4e78e992a0b679a9f1f0fe310545a0d634611bd3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246219, "uuid": "04f817ff-1ce4-4ee5-a4d7-d4bdda0bb193", "value": "T17E065A85FFA80839C5D08D31C9BB03ED3335BD945659A83F152FA3643E436C4EE8A59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246219, "uuid": "31465106-bff5-4360-a347-29d68943456c", "value": "49152:98eV1xev7wr4CrwlHG8KUw9IEe7zn4nUx+/eONb:98e1a0r4CS4Mzvc/eOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762246219, "uuid": "d28170ae-9313-447f-985c-397d9703225e", "value": 3713112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762246219, "uuid": "91a6dc13-7cd6-4e38-bdd8-69c5dcbad1d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246219, "uuid": "9d0c9d3f-a14f-47c4-a187-eb930bf3e6c1", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4991daa9-b977-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762258243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258243, "uuid": "b98321f2-801b-448d-96b8-6ffad61bd676", "comment": "Malware payload", "value": "2a65ef55d0fc5ded8e3797edb13e33ea", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258243, "uuid": "3a36c199-0080-451c-9f44-c05cf7e0c760", "comment": "Malware payload", "value": "3ed8c9ffffa6340f0866c558293e5a146fcb23e21fa248facbe05f7fb55483fb", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258243, "uuid": "fb2ef2e5-e25e-41b7-bb90-69ca65e4222d", "comment": "Malware payload", "value": "b28b6d63d9115f36b5e7b16e01afb47d8576bede", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762258243, "uuid": "0afd0413-aa19-4a84-95a5-ba04f49e5f16", "comment": "Malware payload", "value": "524d99bc5fe7bbfd8a83cecf77a947866d72ff1f6ccf2023c1615b5450c957630e8537b2bcecc9690aaab82a26d93de9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258243, "uuid": "d8c306f1-e63e-4a3c-af20-1d203b92f986", "value": "T16B6197342B5FD65A58C21422FE3AD485CD380F5362B59C40F2ECEA40AA8F558D6F63DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258243, "uuid": "11003553-fcf8-4b9f-89d2-080e05eec117", "value": "48:nMkhwznAodtd2Eblk7AkvO6e0AI7FkUFNwGgGCXp9Rk9UOej7vMZ/+PInd3SpQX3:RHESZTFg/qevvOmPetSC0lg20lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762258243, "uuid": "bd3ba615-3942-4929-a544-98fe10a6f0ea", "value": 3402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762258243, "uuid": "337a7617-1354-46b2-9450-71211e64c1ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762258243, "uuid": "374813d9-eca3-4419-9ba2-9245b715f44f", "value": "download.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61977f58-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236379, "uuid": "f2154898-5032-4ec2-a943-a51b754b057e", "comment": "Malware payload (Mirai)", "value": "71f97db4ccd850add822c852955477e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236379, "uuid": "9fd626b5-55a1-4c0a-a52f-c5ca41e4accb", "comment": "Malware payload (Mirai)", "value": "3f8c38121309021b5bf8e3d606267754138626b9cc9619abe60bac100214ba46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236379, "uuid": "bd279b62-39c8-4694-aa9d-9866ac101cd3", "comment": "Malware payload (Mirai)", "value": "89c283c24d9021987a925bed61dddc466d7bfb14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236379, "uuid": "f01b0ad5-1de6-437f-8d5a-3fe9773c831c", "comment": "Malware payload (Mirai)", "value": "aea2c2d068bfea06b0ec9a2a29f8e3df8f3f9a104721f1fd98618e8518a738a38fda30830448694f6025ed253c8a57e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236379, "uuid": "d3e46d28-ee81-492a-bb07-b72fb13fe1c3", "value": "T1E413F201BBC4D730CC34143ED875C947BE262FFC54BD706B666909966907DC8EDE8A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236379, "uuid": "6edc9f5d-0436-4a97-8565-2c1f345ff2c4", "value": "768:ZUbeFu0zNDHFwdHsTK4qLj7L16o26VWWS5Vo3dRKsoMRwVdaNzy85O9q3UELCI:me80zNDlwdMU5wCdZoCUdGzywzLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236379, "uuid": "9b6a56f5-14cf-45d4-8716-070bf49276c0", "value": 43668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236379, "uuid": "133f3ab8-75bf-45f6-9ec4-0a3ad273504e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236379, "uuid": "3e8c20d5-9d43-47a9-ac40-e39315ba9164", "value": "FGx8SNCa4txePA.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef48b55-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224322, "uuid": "8bdf0f4d-4722-49b3-9934-c358a9faa58b", "comment": "Malware payload (Mirai)", "value": "61808d6289115b182ef43bf36d4caf53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224322, "uuid": "6a7273d9-ff19-400d-a60f-4001d8ad1735", "comment": "Malware payload (Mirai)", "value": "3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224322, "uuid": "100b00c3-1487-4587-8a3f-7f3906a76f5a", "comment": "Malware payload (Mirai)", "value": "17656dd314b29fd75bb859f05403b5a15e961c75", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224322, "uuid": "21d2fb39-abe1-4ec8-9373-2628dd34a3e1", "comment": "Malware payload (Mirai)", "value": "429da6e74428a2224759bcc62c0ce6c5775cc7060b56d67d4fbe82984608f474750aa22ba5811b735e3ed03355f37ef9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224322, "uuid": "32b6af0c-f09f-4813-8321-3fc9248f5cef", "value": "T10B518F8542444D7828A7FB16B6B7492C34819062ACFB7FD5DEE4EAE0065FF1432C8793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224322, "uuid": "183df74e-dcdb-49ce-aa82-ada2ac5bd1c1", "value": "48:vXe78e7N7hXe9e6GXeglezPXeNeKWXe7eoUXe77e7o7UXefGe3bXese9RXe/ecgL:vu797N7hug6GugozPuQKWuyoUu7y7o7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224322, "uuid": "f6f330e0-e941-49a3-b576-4c12eb593877", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224322, "uuid": "1d3e779e-aeca-457a-99b6-2aeaabc33d82", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224322, "uuid": "868ae15c-1007-4b31-bc88-cc5ffea0838d", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbd46db-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261149, "uuid": "75d1116e-329a-4de4-8eaa-1063ae179630", "comment": "Malware payload (Mirai)", "value": "cca6f812c2cfebeb8bf62363342ca6c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261149, "uuid": "3b1c78d2-04ad-460d-8087-7d1865de8431", "comment": "Malware payload (Mirai)", "value": "3fe17df2f523ef4c705fbc5e8f116032031a03b460e882d3945f98cee4dfe5a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261149, "uuid": "4d848333-2846-484b-b7b6-8aeaf122c913", "comment": "Malware payload (Mirai)", "value": "8a26fffea06b8615769cd0dbac0ada39b45d10bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261149, "uuid": "a6c2a611-4c5f-4a2f-97ea-fb67761dbb0f", "comment": "Malware payload (Mirai)", "value": "05ad7a00a19f30a8691a735dc1ad2415c8998d5561a0f5c4894ca0aa8fc637c0fe8ebaa3e05e9005a52c8d2f399c367b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261149, "uuid": "e2c601e5-a6a1-443a-b2db-7ca374e6b8b4", "value": "T16EA2D166D3E3D671C6508935EB7C84926ED08BB8F7FB3073113181DA22C5A9A1AF91C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261149, "uuid": "06f7a1d6-a1b7-405e-89b2-900c1c95af0b", "value": "384:zOTec4Qq28dNSrGxwmI+mCsOWbckgtUdyismYi2jvxhymdGUop5hXe:zOizQq28CrGxKCP/ky68ps3UozJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261149, "uuid": "0e050bbf-c873-4ad6-a4ff-417173ef1fa6", "value": 22244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261149, "uuid": "8b805241-bee2-409d-9e7a-e76cec8a14d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261149, "uuid": "84e716f2-8ee9-48f4-a4b2-2861a124c91d", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49333b10-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239774, "uuid": "081bcffa-57e0-4091-ae1b-b7e2deebe0a3", "comment": "Malware payload", "value": "3333ac01abaa6b59240ba757baf7e29c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239774, "uuid": "d3aa2978-d1b8-4be1-bcd2-746c4c5820c5", "comment": "Malware payload", "value": "3ff2a95af300940bf6691c552f75253ad98b46be102ab7a003fbea55cf25b6ef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239774, "uuid": "126ca7f0-0756-4931-bf09-77e14cb13f47", "comment": "Malware payload", "value": "0a1df7f629d47171d57e1b70705012b5537a6187", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239774, "uuid": "aa69a658-3c3f-49ef-8192-a3efd855cb11", "comment": "Malware payload", "value": "32412c3028b936e97c2432541f91d90ee6ba8865aeeeeb5f7d518b377a06d111383ab07e876957848c3dbe83c8a4bed7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239774, "uuid": "e6f709d9-e9d2-4301-aa68-7a7ce0df4ad1", "value": "T1B6D69E39ECC1EF32DA6614730515CDB1E26B09BAD9E75B421302FE3D648B207B3A5B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239774, "uuid": "d48bbb32-68c5-4f96-b879-3487b7bb1cae", "value": "98304:19d2G5iNCudvhtcYQ1yD46dmr/E1QWgW3EtHfrWAM45AahMeB3rXZVWTj7K9YhV3:EGgvoYPU81oCEtHf6Uz19rXZcT3K9Aek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239774, "uuid": "b65c814d-03c5-466a-8cf5-42ca96200f68", "value": 12706846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239774, "uuid": "da6e7938-9e5e-4433-8ce0-926e48c7f0f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239774, "uuid": "5461e595-f222-4570-b33e-2c52890d4bca", "value": "no-more-spam.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e406ef5-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245366, "uuid": "00a1818b-2c81-4e09-9fda-c2e6bbfb13a8", "comment": "Malware payload (RemcosRAT)", "value": "457502b299f2c977500a984920ecf80c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245366, "uuid": "d466b8cd-effb-42a9-9a7a-f9a72f95a51f", "comment": "Malware payload (RemcosRAT)", "value": "40f43ff5671b83889d7bf136e748c57c28e86f304d1704cdbb949c71bad161f2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245366, "uuid": "707179b2-e3dc-4e5e-8bc8-b75f9892d52b", "comment": "Malware payload (RemcosRAT)", "value": "a3344aa44ac0827337fceda4b12e31b33e14ddcd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245366, "uuid": "5eca9f5e-5b06-4108-847c-8399fd1beeda", "comment": "Malware payload (RemcosRAT)", "value": "9b2aa81b3f45d9b25b13570b5341d445d70fc2bb3a4cafb91e556358dfdd7387a448097e2a76d68a6b1230683781dbbc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245366, "uuid": "90222098-7a04-4618-98fc-21857f93f3c1", "value": "T1482603C82559404CE7336924E91B7E7B73EC49CB576E4DFC323A0AEEF72096840A6E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245366, "uuid": "db72edf0-60c0-472c-b1a5-c2eaad6f90f8", "value": "768:EcnXa/tG+9w4Zlb8dwm1pr/I3Q+x9Tk+uT3ORpVdchORX6mPfTWpebntg8gDKojb:bXarwK4r+xcErWp8ODKojyCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245366, "uuid": "cfd93774-fb11-42cc-becd-6055fcbd9335", "value": 4747792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245366, "uuid": "0a9d6533-ed7a-43dd-832f-28eed3c49651", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245366, "uuid": "cff5035d-e278-4418-8e22-05356c215559", "value": "IMAGE-6434677-099.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32e9aa4-b915-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762216303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216303, "uuid": "20dc1598-91b4-4cd7-b2f5-03122d961e42", "comment": "Malware payload (Mirai)", "value": "c0c695fe821ebf7c6d4bda4a2dcb0a00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216303, "uuid": "3bdae7c4-3937-4aec-9bc0-d8720db47826", "comment": "Malware payload (Mirai)", "value": "419ed2c57a0dcc99714ea500d3970c1abff43207aba8fbc27696844e62913329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216303, "uuid": "10f5bf0b-e07e-4e9a-9232-3c75848dc2a6", "comment": "Malware payload (Mirai)", "value": "41a45ab1ee82ddc6c65a6da50edc759dc73fa846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216303, "uuid": "51b78f46-2433-433d-9cfd-fca5db27e0e9", "comment": "Malware payload (Mirai)", "value": "cc30edd02869ec218e6089816bc5e586f0d72411608659eacbafe714d7de731ed11e71ee66238d5bcdc247534990a30d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216303, "uuid": "07a29334-436f-4c5c-90c5-38c405d62cad", "value": "T12D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216303, "uuid": "58642c50-46e3-4412-a362-7c3de3e74d2c", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStp:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762216303, "uuid": "c6515f2a-47c1-49c7-b960-59c8cb2f787c", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762216303, "uuid": "a132799b-8285-43e3-8032-314e564db34d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216303, "uuid": "7aa47d3f-c383-4a92-b557-1165b809aa99", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022c3a58-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245238, "uuid": "9bbcb99f-3315-42dd-a607-102e74082cb9", "comment": "Malware payload (XWorm)", "value": "9ed5bc630a01dc7b4d73bb580c2177df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245238, "uuid": "b86a2f38-988f-4ab7-af42-a1b782418ce6", "comment": "Malware payload (XWorm)", "value": "439175b5bfaafca117163a9570a900a0e7074dc96ecfa9dc7e9a210090b98cbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245238, "uuid": "886481ca-2138-4829-bd3a-0beeab2f97f0", "comment": "Malware payload (XWorm)", "value": "a185c71fbeaa6b7ff649f2d22d42a4d8b4bf3755", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245238, "uuid": "805d9797-3539-4168-b1c2-1a1060a8f9a8", "comment": "Malware payload (XWorm)", "value": "089f8ffe1f4a0dbd89d733479bc5c7ad2a4dbe2a34649c3f23e66f13f549ada730945f73a1415cb3e66529e20ab5290c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245238, "uuid": "f0b6f17a-9756-42bc-9073-8ac3880e4c8f", "value": "T12D34B4BACC8CB49EE2AC395C00776A0750BCCD935BB21A1C6D62DBB5BFD11C0578A746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245238, "uuid": "d250f34a-2321-4f83-aed7-b20fe913fc07", "value": "3072:RuA7VWBLaKRby1XR52a1NmyGav2ld+AslGvmM7lsX0FIds:RuEWBL3xy1XDj3myGav/AvpXFIds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245238, "uuid": "82545772-58f1-47c0-b56c-b7ab63896001", "value": 239511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245238, "uuid": "33472a63-5df5-42af-8bbe-35a6b07e3e2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245238, "uuid": "6f99b929-3cd0-4265-92cd-44758b6c7cff", "value": "RFQ_Items_list_AL OTHA-20251104_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb2b451-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268286, "uuid": "e8ac6761-0d0d-455f-9feb-51bda4d1ed83", "comment": "Malware payload", "value": "73b830a62eb4d86d0301be9e6db48a8f", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268286, "uuid": "226c0609-6292-41b2-8def-6978d872e177", "comment": "Malware payload", "value": "43c476eec75e941703a3a37260769f214d3a9786fe12c4b0ce0d12d64a3e8f8f", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268286, "uuid": "b2483be9-fb3a-4c5b-89f1-7743e6066a36", "comment": "Malware payload", "value": "bf048ef4a5bef81d0de4d34dbbe5d390756abb3d", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268286, "uuid": "89a94e9a-7eb1-406f-9d55-20e265b0a4fa", "comment": "Malware payload", "value": "d44e5f569457268820cf1b848c73a8f14ac594cf527f8a8e3fb160b5998dfeda891393f89be31d7ecfdf87b1ccc31b5f", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268286, "uuid": "5ebe38a3-b26f-493c-aaa2-536f94cc4a49", "value": "T18067336472642997E35BE0BD49CB6C5E0F5B9E0CC2D69E2A4C9DC19319E3BEE27704C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268286, "uuid": "864a3fbe-90d5-47ef-a110-4f546f5c8690", "value": "786432:iLmqzWtaF7KSQQVHEtigRgNi4YUQwq+wVLcHCzWJ9mZ+b+FYIe:iLjzMZSQQHQipS7wql9cHL6YIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268286, "uuid": "6bb3d9c0-49b6-4b94-82d9-fd7a8c454b55", "value": 31629964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268286, "uuid": "b6c05aef-3953-49f1-9740-110fcdea2c0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268286, "uuid": "811e93b3-a32f-46ba-9e42-5543e9ed094d", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cc0e93-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289885, "uuid": "874c0c02-bce3-42b5-8847-e4ee1b0cce5d", "comment": "Malware payload", "value": "86f0710f6bf3cfd087abaf0ae7c5fdc0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289885, "uuid": "5e84c9b5-7eb6-43b2-b48c-b8c5d7286070", "comment": "Malware payload", "value": "44346b8523e2dd1d6a722aca7aabccc787a2d8183527cfbe46da8d1a80362dcb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289885, "uuid": "db07eb26-37ca-456e-bf88-d1babb8196f5", "comment": "Malware payload", "value": "0abf8c2b4fbf6d74488a409216e02667b7f36ef0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289885, "uuid": "66e6a635-bb4b-4c9c-a1ed-bad68bfff8b9", "comment": "Malware payload", "value": "139b6ee7f5814be72ece56b6026ca0502831958f577f8fd40811edb206b52c5387c981377c7bd5dbbbc61678040cb842", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289885, "uuid": "7300de38-f414-4734-b7d7-0d74a1ff9eef", "value": "T1CD2245F8C9F1FDC0431F3391799AFEC5009A9703AE7B199CE68814A25F61758AB7D088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289885, "uuid": "23095cf4-3301-4de2-85fa-ee55a0fd8df9", "value": "192:7GEzKe6WpB5xJPbccXlk6mVGqm7p2MzYHT1k1C1rTeVD/Be3nfkYi8fRXGn1FdSm:7GIT64vxJPbccNmGp2yQAugte3sJ4pGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289885, "uuid": "59576527-cce7-45e3-923a-62df71489cc0", "value": 10742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289885, "uuid": "0d3cc453-6005-4ff6-81f3-67d860fa8e55", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289885, "uuid": "d6972c80-5f58-4880-b18b-fb490597565e", "value": "PAYMENT CONFIRMATION RECEIPT_.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7ee7fe-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269952, "uuid": "bdf3a508-0ac0-473e-a70e-81f30d334424", "comment": "Malware payload", "value": "b9c1429d4bcb37a6d14a29f49271b713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269952, "uuid": "e21a45ec-964a-40e3-a97e-3a2224aa3ad2", "comment": "Malware payload", "value": "446ee928d892a4b8a06a64b86fc1abd9658371239f303edd8819bb2f08a18a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269952, "uuid": "b4246efe-92ca-4fee-b02e-6eed10ffd448", "comment": "Malware payload", "value": "bebafa9491389a9265561841c7a964753608cb7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269952, "uuid": "3e01dd42-e342-4007-9be0-001117a1c2b1", "comment": "Malware payload", "value": "b6b4166cdaba552e5552748abf01027e0fe07a8a2cc8e508c46105fd366d97e29d9c4033e790f4c9d39ec1ce37c7ae1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269952, "uuid": "4b3a1665-9eb0-4e3e-8965-8df2a90bfc3f", "value": "T117C51A4359DF0DAACDD677B8A1835336B734FD308B295E3EAA48C23119536C4AE1BB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269952, "uuid": "f2f4ef9a-ebf9-4ed8-a1ba-6c4d3d0067f9", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269952, "uuid": "057ccfb9-b21a-459c-ae15-f1a056604c17", "value": "24576:z+cJfeJVxthwuHIy24rIXRuriBnwSPYMRox1WaXJseJ6clMi81s3Adc+zM8f:z+cJfaxthwuH17rIh0OwchOkc+o8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269952, "uuid": "ec9cd227-6fd8-4a9b-8540-50bab19730cf", "value": 2650171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269952, "uuid": "031c9722-affb-4c02-8b5a-1b2fa314b3b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269952, "uuid": "2daa080d-57e3-4280-9707-21d8f1f2ca1e", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd044a36-b9ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281656, "uuid": "58aaf52c-54af-4ae1-a391-09bd7d3559a2", "comment": "Malware payload", "value": "2c665c4121e92c4f4f535a8fdce34f67", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e4870a", "colour": "#F7FBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281656, "uuid": "d5315989-c4d3-4fcc-8280-fc3af5f68a79", "comment": "Malware payload", "value": "44c8d8dc32eb045a78e84af698406a77a53953bb3970c20b0bfcb3d792513266", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e4870a", "colour": "#F7FBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281656, "uuid": "c8ce83b7-f50b-4ac4-85f6-d9d0e7d7040f", "comment": "Malware payload", "value": "7704d0cde79da4a6ccf4364b97458ea5a74478ec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e4870a", "colour": "#F7FBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281656, "uuid": "2a704c74-a4ed-4399-badd-9376d28bf2d2", "comment": "Malware payload", "value": "59d3306020ea0ce51a20fd44d1128e7f66b2ec34308f05bc2161941273c6d0ae51bf40840626f938bbefba32c8a797ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e4870a", "colour": "#F7FBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281656, "uuid": "535c38c3-c8b5-4034-9663-a530a069c77b", "value": "T1B0D537027C9060E5E49AB271BA619191B6317E440F3137C3EB5CFEBA2A323F45AF9355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281656, "uuid": "d1c8b672-a775-4bee-b89e-67757c6b4c04", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281656, "uuid": "e3059397-5a20-4f45-99a5-cb7ad57a7406", "value": "49152:z+UZsbg68aykaRAPfURDMGSGHTNAAgLBKB+lWD1Z0J:cFP8Nk4oq+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281656, "uuid": "d3eb09f5-9b1c-4b60-9ac2-4b72e07c2fdc", "value": 2768200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281656, "uuid": "d0b605e6-94d6-4671-80b8-177e45253565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281656, "uuid": "af39a786-3a39-4066-b60e-5654604c2fb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64f0135-b964-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1762250346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250346, "uuid": "2da02062-2673-4568-840e-1be6352c89a6", "comment": "Malware payload (Arechclient2)", "value": "727b2aded7a1f73bf497e8861bd1a95a", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250346, "uuid": "2949970d-94b1-4aa6-824d-cf653535a2f4", "comment": "Malware payload (Arechclient2)", "value": "44f67b3fc93c00591f4db848953ad2af44d7235efdbd800f8368c39c79818a4a", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250346, "uuid": "da1b9954-19ff-40f7-8b81-b578ddfcda87", "comment": "Malware payload (Arechclient2)", "value": "48e13c45472d9282d2516c24c0a9387d9fc64608", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250346, "uuid": "d090b503-2393-434d-a6ad-e4f91d591129", "comment": "Malware payload (Arechclient2)", "value": "e5a1f61e76beb8cbad5e286543e88cc74ebb0e27631f634bf546e63b9d3a010851a6a28fd494c5c51b660c1fe0ade8fe", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250346, "uuid": "1c1050b3-f61b-4eb5-9693-e19c76b461f1", "value": "T10E055A7D764B9E32FEE9777881FF6C1892A022A75091658A1D8C98D81FC137EC74CAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250346, "uuid": "03dbb3bf-47f0-4fd0-bfc3-f1bde7c58957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250346, "uuid": "d70aa74b-11a9-40b1-82a2-1055c2a5295b", "value": "12288:Iwm3kTcm4u06WpKA5wi3shv6U7hqn8oPM4mLjVDbzEpiL7Xf9pLJl:lm3k4m4u0tpO4Y5h9o04mLjBv3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762250346, "uuid": "e02127e5-96cf-47ac-ac6a-8b9813f462d8", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762250346, "uuid": "8ef9453b-dde6-4c8a-8fb6-d0734d89ad10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250346, "uuid": "a2b78673-7170-41ae-9b49-32c45aeef69e", "value": "44f67b3fc93c00591f4db848953ad2af44d7235efdbd800f8368c39c79818a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03b6964-b95c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762246899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246899, "uuid": "258cb28e-f5d1-4fa4-a186-e39d62880fe2", "comment": "Malware payload", "value": "ef969eab9ebd3959f14d2ed4d68a5b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246899, "uuid": "ae2b8072-cc8c-4430-b42f-6b3790c9a5ec", "comment": "Malware payload", "value": "44f99081b3882793bd3fd9c7c82ff371adb95c193ab1cb4448b355047ab0f96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246899, "uuid": "5b810a57-1527-4d1d-9565-15c3539c547c", "comment": "Malware payload", "value": "96effb0462bbf93a581262647491014d49944a7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246899, "uuid": "0840fc49-39d9-4fab-966d-1dc5c0d58786", "comment": "Malware payload", "value": "7c0b31e3842e626234fc80fd5c783ac42c978a28a145a95a9da979c180d30f1a5932acb69e73ae1f73a4046cf0e021b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246899, "uuid": "565ce6ca-f353-466b-9723-169a1bb69224", "value": "T1A082A517F3E0CD7BC9D4237804570A74B6BA9870E72693131A2119B61D13798AF1FAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246899, "uuid": "efd17052-c124-439c-8aab-007672345f93", "value": "96:RqAiTAwBWBIDgtKUNozrhdc1vjJi+ZQ/LfYK9o0rszw7/gWZB0mggB6oiVPnm:Rcx8tKUN+dcNjO9PsEzZbLkoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762246899, "uuid": "bd2cfc57-af83-4e84-8f4f-173229a1a013", "value": 17656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762246899, "uuid": "439a21a2-7263-4299-b258-15a83eb8aa77", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246899, "uuid": "5a41c8ab-63ab-443c-9e6f-237b3e7b3e0f", "value": "dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c28b4f3-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245255, "uuid": "d6eebd1c-5374-4f5e-a293-6928c8121254", "comment": "Malware payload (PhantomStealer)", "value": "74829e953f1452ccd72cf84213bfa0d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245255, "uuid": "4eb63872-a16d-408d-83f9-87a2062eda52", "comment": "Malware payload (PhantomStealer)", "value": "4510101b677d3092d512e813b2f031924205fbc77582df3497634a8eef573039", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245255, "uuid": "d99a1aff-c850-4b3a-9822-85479632857f", "comment": "Malware payload (PhantomStealer)", "value": "b21488a3651a46da789ff29f4eecdf3e2dba9546", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245255, "uuid": "cd44cce3-f151-42fe-8a7a-1a4dd48b4d28", "comment": "Malware payload (PhantomStealer)", "value": "4d8f9dc2f5d5b2886912d0b3c6eabed21bf358d6d937df0f0ae2c112a6ca9d496128fcae9cbe1ff3a8cc2cbe1dd23bba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245255, "uuid": "66bdc60f-a2e6-4667-9e08-3960c4753398", "value": "T1F7056C70DD2801990F8B17EDFD6506A4C9BEC92A123754F1F6D91B9D330A59CE3BE228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245255, "uuid": "39a5dc4d-b36f-46e3-b6f2-6885d9722cbf", "value": "6144:TRO0rwiTEULm7FIvyuIFMonodL/Q2/FmI:OI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245255, "uuid": "11027bdb-ff41-468d-a012-f03da613628f", "value": 812097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245255, "uuid": "e55a2b17-7ecc-4b43-8062-7aee5eeae652", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245255, "uuid": "32e57be5-5974-4991-ae6b-4abb2942c0df", "value": "PROFORMA INVOICE DEC271025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7482da-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236478, "uuid": "5bbc4620-2149-4c5d-ad01-0530761f4529", "comment": "Malware payload (Mirai)", "value": "0563699df5bb3c54c68a084972e26717", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236478, "uuid": "774f731f-439b-47ac-87f1-ff2e52e415e1", "comment": "Malware payload (Mirai)", "value": "452f422527be367e91e54a5cb4c1ba6765252732982868566f72b4eb7d0c7bfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236478, "uuid": "1605df04-1691-498b-8d31-10146862ad32", "comment": "Malware payload (Mirai)", "value": "4d253a62d76aec2decc14abc199e0909a1d2697c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236478, "uuid": "b5c0dd57-4809-42d0-9622-3a36f569eb04", "comment": "Malware payload (Mirai)", "value": "6a0f0d20fea62e24c7501cf43d45715e5b66597cf7a3b375e6c9e0d425f915ff54cba4e8c86ffa2230eaf34c9d08f637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236478, "uuid": "a9266d04-f1bc-4e78-bd97-f8830ddc82cd", "value": "T1F4B3C61E7E618F7DF7A9823507B78A25978837C637E1C581D1ACD6006D6028E781FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236478, "uuid": "34e09902-5f97-4fcc-8dd1-d11b7174d02d", "value": "3072:6NiZUYrYM1DbgoiTiLDYrzZ6cXVN33wd1Tg:6NiZbrYMuoiOLDYrzZ60PC10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236478, "uuid": "09e8fb37-478e-4347-821b-1bf616c5eb8b", "value": 117864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236478, "uuid": "be92c818-dc4c-4b83-a37f-a1b79781fc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236478, "uuid": "d11a2ffe-9d3f-4697-8919-0fc954040a28", "value": "FGx8SNCa4txePA.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d05106-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762268333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268333, "uuid": "b02371cc-d38a-41b6-8a40-04debe19f259", "comment": "Malware payload (Rhadamanthys)", "value": "6114388b070c543ccb813c12a61df078", "object_relation": "md5", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8497", "colour": "#328D75", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268333, "uuid": "37984495-6d75-4d74-a2b4-64185ed69215", "comment": "Malware payload (Rhadamanthys)", "value": "4537c9ffd8a851300ee15e3f33ba7a4732fe6e4eaa55ced35fa5c443fc3ad3e7", "object_relation": "sha256", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8497", "colour": "#328D75", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268333, "uuid": "14099957-402b-48b3-b54a-a0020c659932", "comment": "Malware payload (Rhadamanthys)", "value": "cd3ec912f96f2213a2054943eaf8a6a0fae3b8c2", "object_relation": "sha1", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8497", "colour": "#328D75", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268333, "uuid": "f63a1ac1-8156-4bee-9810-305b3ab4716b", "comment": "Malware payload (Rhadamanthys)", "value": "b133aa53c524e89a124658e153ab9966d5c8f7cb1570caf3c0d33fced84a30c81b82dc1f16e4c8964a5395c5edc4d812", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8497", "colour": "#328D75", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268333, "uuid": "23151626-cd6f-4f23-83f6-63808cc7b4cf", "value": "T1741633DA48F92422F6E637788278454717C705BEF6FC59ABA71035A8ADC4332401EB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268333, "uuid": "7e6a3eb1-b455-4e2b-9ed2-fff5155ebc59", "value": "98304:0sryl+RFekcaZ+doB+x0RXo4OaDvXRSkglCyKTi5KrjCOl:bryl+3eg8dw+GY45Dv9YUv/COl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268333, "uuid": "18482ca3-a47a-45c5-9efb-5f0541c1c6e3", "value": 4308899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268333, "uuid": "0a103420-6c8c-43ce-870d-275158c517ab", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268333, "uuid": "2397ea1d-ea44-43cf-87c3-17f0548e7ae1", "value": "file.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57299fd8-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245381, "uuid": "eb04c02a-77d5-447a-a276-217eea8f301a", "comment": "Malware payload", "value": "1daafac36db774e5f51f397168ef9081", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245381, "uuid": "71fc3723-71c0-4875-aed5-06401352a130", "comment": "Malware payload", "value": "4562420e57fe0e75116ce1fed8318ffee5912d0827627c3b645d2c058aca027c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245381, "uuid": "5a487b2d-7fd0-4073-ad58-47f3b01fb4de", "comment": "Malware payload", "value": "d40732a6c9eb46d5c9ba62d4a9f1e0602151c744", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245381, "uuid": "d6d62efe-1716-4b65-8553-7aa40d9af3dc", "comment": "Malware payload", "value": "af7a82b2be89d2c3a40faa0ee30887d60b00448c702dcc65411ded70f82b81a968f245bc42164db562a137b9765d21ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245381, "uuid": "7752e3f8-fcf1-4fa9-ae9b-432fedb22857", "value": "T1C616026D12FE72A1A9725AF3CBA679C0F22064FF44235E37F0480BD66FA596E4511A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245381, "uuid": "f1fe347e-c16e-4fca-a39f-57e21b2b6c5d", "value": "96:IvuYZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZa:l9kY46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245381, "uuid": "7972e7a4-fd54-4f59-9b1c-49a7f5feac06", "value": 4155070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245381, "uuid": "c9554b72-856d-4318-a135-20c3edd4788f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245381, "uuid": "fa96a05f-b9f6-4973-b854-b660ad217148", "value": "PO_E002594522.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2ff1a9-b9a4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762277496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277496, "uuid": "1a581a27-2041-4904-a5f4-684fd6215f40", "comment": "Malware payload", "value": "f49d75adc11c0fdcbfcbbab943518c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277496, "uuid": "193d9b7f-11d2-48f5-8001-661580ada1dc", "comment": "Malware payload", "value": "457ac982abd3d09b639b21b7ebf4f702e39aab3de4b61aac6e28cd962404846f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277496, "uuid": "6be36638-2453-40ba-8f0d-8ae7df7afa85", "comment": "Malware payload", "value": "d198b0387ec4cfa49dbdde8d6bcc0f9e22dae092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277496, "uuid": "a88f17f9-0766-46cb-a37f-a9bda70ebd48", "comment": "Malware payload", "value": "4041c408e73bcb8b3cd33713ed0e965e385a7ff984c5234afef382861a709b7d53124642bb30fecd7609833548e38ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277496, "uuid": "10e006a3-aa0d-4ed9-ada9-af22ad2352e0", "value": "T12505E652E59010FDD5F69E7490F22936F8F3BCD96B54B6C7DA80B50A0B37AE0A839701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277496, "uuid": "b23caa66-4dc8-456c-8d07-ff952d35d74b", "value": "63da3ecbb96f94ac4609da3efedff6c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277496, "uuid": "68101469-d7e1-4b0b-8aa1-e578e9886301", "value": "12288:Jv8B3H3E6QsK+L3Cg3udoHqC55duzAwUQWt1mNBJ3VhV1gI:x85UbsK+TCtd8XgzAwd3VhVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762277496, "uuid": "c890a5db-4d2e-4d52-b923-52a8f3c2d0ee", "value": 832888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762277496, "uuid": "ec7e392b-ccbd-44c9-9f43-e05338dee8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277496, "uuid": "8b7cc32b-af00-4947-82bc-901859d682a1", "value": "GlitchGoblin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad7f3e-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237332, "uuid": "52fd3daa-7a25-4883-9877-596939473fe6", "comment": "Malware payload (Mirai)", "value": "b54b861e8b73ad4fbf952a43d973bb29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237332, "uuid": "c212b06c-e3db-42ed-b88f-2d112b3481b2", "comment": "Malware payload (Mirai)", "value": "45a52050f45003386f56a984d64cbb79fdbe3be969a16ebfc28a3ad1a9d02d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237332, "uuid": "4263b46e-7e40-4794-af70-631d7c359ca0", "comment": "Malware payload (Mirai)", "value": "89e3fbb57220a58482a6c8ef994dd2fd8d46b89f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237332, "uuid": "57c7a204-eb31-4c2f-a8a0-6be104ad9829", "comment": "Malware payload (Mirai)", "value": "c346fc85b612d695a8ee3514bfe50c87b75b84a48c422221db884f935eb3a3a347ab83794d22f3fdad5671b29f0d422a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237332, "uuid": "89c428f2-0a5e-44e5-b05b-17bd5d8cffb6", "value": "T1EC732A95B8818B11C5D5137AF92E158D371267F8E3DF7223AE205F607B8A86B0E37D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237332, "uuid": "d2ccc349-e384-4b25-954b-a427e918f3a4", "value": "1536:Rgn2TTT2hps+7M2CnPS1/x3alf1WkPDQNMEixSNRam5cJa10:HT6ps+41n61ct1vSNRam5c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237332, "uuid": "26aad991-4213-4b9b-85b8-5d6c5421aa11", "value": 80456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237332, "uuid": "328f227a-8481-49d1-be64-96a807e3c61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237332, "uuid": "ab7d9a4f-9cd1-4b59-b4ed-699b2a489be2", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39061562-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268523, "uuid": "1e276429-739d-45c7-8109-071c9f744867", "comment": "Malware payload", "value": "563d7a5a60a6d63718f3dd6784814269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268523, "uuid": "59543ad1-2177-478b-a16f-7cf899de2b71", "comment": "Malware payload", "value": "45c09f8710355aa9e1de695c87a1fd5eedf30f169c79479fd2fe12c80eb6fad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268523, "uuid": "a2488516-71a3-43a5-b7a8-2c0bccab74f8", "comment": "Malware payload", "value": "8a55256c5e48e54cfdcd03b0dccfeb688d5b8133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268523, "uuid": "d3806acd-47e8-48a6-97cf-23a91a64a016", "comment": "Malware payload", "value": "4f2089e4e1e8eb5ebda606b04e8561d3b6641a22bb3cb6d379b375a9bbcd1440a3d5c4264df05b15f06dd7df7027522e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268523, "uuid": "8f7f60b6-7ffa-449a-a1af-5e2aab0943e6", "value": "T1DAA54B45BC9980A5F57A933289A261F3773378842B3167DB2A807ABC3F736D0147A735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268523, "uuid": "34c479ca-c974-4adc-b95e-e2fd9e715264", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268523, "uuid": "a2588f75-8e8e-4989-a706-4de137263c8d", "value": "24576:nsw+X6rIEv6z1lCn6puwLqSdxLJ4JADewCGyWM1ljAMO3fjsJJ:nsw5r3iS6puwLqSTqJANW+3f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268523, "uuid": "3beb158f-f69f-45ee-86f0-228d8d51dd0f", "value": 2249808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268523, "uuid": "02a6f9b0-22a7-4264-8c71-e474a0a56faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268523, "uuid": "e2210ec9-cc64-497a-a10a-662316b4361e", "value": "Pro Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc88f61d-b99c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AteraAgent)", "timestamp": 1762274435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762274435, "uuid": "2b8d97f1-1081-4885-9bd9-650f1d93b677", "comment": "Malware payload (AteraAgent)", "value": "beafe7fbc585f86c6a548ebed15138b0", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762274435, "uuid": "241b4508-4a26-4836-a721-b6c4697367bd", "comment": "Malware payload (AteraAgent)", "value": "45de04af07d457f9760bbcc564e12ab424f6e7af05654b46aab8aa154d68dc7a", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762274435, "uuid": "b0d252e7-2c7f-4b1f-8ec1-a95577309c3c", "comment": "Malware payload (AteraAgent)", "value": "1c5e8e55153282c42afff0a8720a09ebd617a1cd", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762274435, "uuid": "0230abd8-16a9-4a99-b404-153b265089b5", "comment": "Malware payload (AteraAgent)", "value": "5d570700fe8d6528b7bc9fbb75861f795bdde8319fa5fa41ae1ef6823bc31e29a24a1bdc6f97904fae59cb3347459a25", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762274435, "uuid": "a6a63e60-0131-4668-b02d-861e382e04f9", "value": "T1F3D523127584483AE37B0A358D7AD6A05E7DFE605B70CA8E9308741E2E705C1AB76F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762274435, "uuid": "0bcb6dec-5fed-47a8-8466-75a4f2b88503", "value": "49152:l+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:l+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762274435, "uuid": "73d4036c-d648-4521-aa6d-dc1a4527d523", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762274435, "uuid": "fbd00692-01b5-4383-be00-e593a7261a75", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762274435, "uuid": "171ea7c8-3673-4788-8f2c-fb75a4459af6", "value": "Invoice-readerxx67384xx2025.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dc88fe-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245486, "uuid": "f8f719dc-e68d-40b7-a634-265d0943c78d", "comment": "Malware payload (PhantomStealer)", "value": "f340ae884db8e5f7f73b2d8e6ef595a9", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245486, "uuid": "6f4534d6-738c-41f6-9916-ab538e860b01", "comment": "Malware payload (PhantomStealer)", "value": "4611b2cc048201ce3acc44bc99ea3169203e73323012544eec7f31da1c3fab00", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245486, "uuid": "5029c3e6-116f-463a-902e-d1dd3775aca9", "comment": "Malware payload (PhantomStealer)", "value": "11da1ede7d1edcf3cd9d5c1083060b1301962a37", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245486, "uuid": "d01488b4-de10-4372-bebb-d27da6af28bf", "comment": "Malware payload (PhantomStealer)", "value": "033e68111dff835bcb572c3787950b342839cbad97ffd5c3a8388865119e0abb045b4da65506cdd3f0c9094aaaa60c2a", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245486, "uuid": "b206f67e-769d-4601-b01c-bd6921d69434", "value": "T11F26021589C86FB9CFAC5A1C80FE161E93F04A8E5427758AFB33BD4AAFE750442071D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245486, "uuid": "56996d10-e802-463e-807c-841bd5bcb878", "value": "49152:AE12mlYTrYmdlgRxTpUlHdNp+Ct0fczGf0bv0wFKqkEy:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245486, "uuid": "d6fffda3-924d-4400-bdcf-797b7621cb67", "value": 4469826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245486, "uuid": "f7c71924-3c9d-4a3c-835c-48cfc2bcf8bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245486, "uuid": "32fd0eee-6bec-47b3-b3f1-5533ee8bbfc2", "value": "CM6074148603R2795.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b73c575-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261199, "uuid": "1fa8b452-5556-46a2-b49d-a03599e11668", "comment": "Malware payload (Mirai)", "value": "a1ed5ff8458d0d934cc50ad8791c80eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261199, "uuid": "b6311c7a-1c82-409e-8016-1e48308be550", "comment": "Malware payload (Mirai)", "value": "4613110f4049043a73ccd1d6b77a77d866ed5e6ee8a90cf04cba9886c59eb0b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261199, "uuid": "d19c86bf-c68f-4297-9578-5d316701d014", "comment": "Malware payload (Mirai)", "value": "4df5a08e6223b54a9cbeae5d4b102dcf2f573168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261199, "uuid": "3b747771-78f6-4389-a403-211789aaecc4", "comment": "Malware payload (Mirai)", "value": "d72bcf9feca1cc975c0bf422008c1f1ce10833528a619f2cc3c3ec21bc3ac748b868c6dc73199be8f5898ddf9f26506d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261199, "uuid": "1b2c64fd-7b74-410d-853b-0fe0f6b0d120", "value": "T11024E80A6F510EBBDCABCD3702EA1B0129CC541722A57B767274D518F54BA4F1AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261199, "uuid": "5c6d9b31-8409-4a0a-b66b-64ad0caac107", "value": "3072:B2JZLxaR4/EUIxmKxY8LNqDcdE2+J6hh1PK0s:B2JZLoR4/rIa8LYGE6K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261199, "uuid": "667e83ea-58f5-4be2-b841-18583ae65bb3", "value": 211956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261199, "uuid": "4e51a097-b02d-4606-ae2a-a8e3689b923a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261199, "uuid": "e418e3d1-45a6-4c7f-8781-7a50252caa8f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0ab976-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261148, "uuid": "6ab45840-cc45-47a3-82fe-f6b8c97707c8", "comment": "Malware payload (Mirai)", "value": "537a8c74342b8ffca93de0e7fe6e9fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261148, "uuid": "fba38d82-aef5-4348-aeaa-7499ac49686d", "comment": "Malware payload (Mirai)", "value": "467cf4199c35b0825d8a97b4476aaf611f2a3b4e36b9d29af4fddc13c29ab7fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261148, "uuid": "a3bc7c0e-8411-4c0c-abc4-dfbf1e3785cd", "comment": "Malware payload (Mirai)", "value": "5aa8064df27bdb31092d162a75731fe3a568d3ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261148, "uuid": "c0951b8f-8cc5-4e2e-82e3-203d30ca0c14", "comment": "Malware payload (Mirai)", "value": "09aacf88cb3a5e0fcc01f38caac5e95f13e6a73e68b4daa3cdfde3888e271a73fe932d9df0ea0a513e7a9eed87f9037a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261148, "uuid": "113623e4-048b-4067-a49d-4707f4b8a0a5", "value": "T1B723F22A96D6102CF89C1036E439EFCB0DE0EB1F62A0CB613DE5957D92C677976107B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261148, "uuid": "2b94415f-0d8c-4229-b573-bef103417795", "value": "768:BessG0aMqhILLSH/GymQfMhpcqNzgmPtY3wXzB64XxrQSnbcuyD7UoQRjg:BessLfL4QxhpcpmFCwDkMZnouy8oys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261148, "uuid": "018934e9-81ac-4e55-85c2-779730376881", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261148, "uuid": "7935c74f-2190-4917-9b85-64aa2c152eac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261148, "uuid": "c6aa4186-6897-46b0-adc2-743947bf80ea", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8480be15-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1762244598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244598, "uuid": "c7046749-c6d7-4d00-a302-3a057b67c13c", "comment": "Malware payload (MaskGramStealer)", "value": "4da874c4f51ceee654268d9a5f7a5ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244598, "uuid": "977dcc71-1a29-4ccc-943a-0dabc1057c2b", "comment": "Malware payload (MaskGramStealer)", "value": "468953cac38ced6c77fff5e58805ce2ca5940d28a9b733414b63595cd45eb270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244598, "uuid": "af68a2fd-b95e-4029-8650-48fcd135e793", "comment": "Malware payload (MaskGramStealer)", "value": "0cb5e083cc8b5acfbcf160c534d142e8bc4464a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244598, "uuid": "7591521e-8d74-41e0-8a1a-e67e847478a5", "comment": "Malware payload (MaskGramStealer)", "value": "046b692d096d9ad44d7585b0b240a2b120c6e14610504acdc509dfea3661fc24eae6644093750a5572ac22910c9d148f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244598, "uuid": "a9323f71-52c6-43e7-aa0b-a662c36927fd", "value": "T142067D07FEE145A5C09A9335C5666172BAA2BC044F3227D32F60BB242F73BD4697AF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244598, "uuid": "c2a75d11-b524-4bc4-b581-63b94051500c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244598, "uuid": "ba66d112-1121-4275-b66f-f03a61091853", "value": "49152:+jdgjVkJKYvn726yofsVA9XWAGJ2MmbSro2gSuhG:+xV7s29XWAGJ5o2gSuhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244598, "uuid": "d600f6f9-565b-47d3-b8df-894757eba0af", "value": 3779048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244598, "uuid": "6e0e80ca-952d-407d-a4a4-95eb83a30969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244598, "uuid": "b6ad7cab-ef28-48d4-a4ca-8b2b570df3e8", "value": "Tunl4Qr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ea617c-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236385, "uuid": "ff6e56dc-f1e8-426d-85ef-9acf050c7cae", "comment": "Malware payload (Mirai)", "value": "184776899684f5f139edca3ac78be8b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236385, "uuid": "e82ea794-477e-43ee-abd6-2b5cb8c5db2f", "comment": "Malware payload (Mirai)", "value": "46972c0799419f100c9bb6f1e2b73bbbb41f4f0dbda61dda80f21b5ceac09b76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236385, "uuid": "c4e243d4-0787-4a6b-a095-831a9ba04a91", "comment": "Malware payload (Mirai)", "value": "b47f61180abede66d863ec084df925566e6efe6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236385, "uuid": "62fa05fb-3690-430c-9ddf-5462b7798809", "comment": "Malware payload (Mirai)", "value": "b17e9a65a8d3bb4e5ed8c769da35072eade0970d7eba20b009ad41321dab09d8f617b6dcb17feaa869069d6e5cab2ed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236385, "uuid": "3307fb5a-0054-4dbc-891a-390cf687780d", "value": "T19F13E19EA0A3B8C4CF2949F4142C2EF6479490C766FEA78673914848E629F9BB0CD016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236385, "uuid": "87c5ac35-94fd-434a-a5cc-e00346e37520", "value": "768:wpdi/4eU4Awp/mlxXm62hkfy1npnzpTCFCXLY+29GFlJH32XxU4uJiuiwn47WQE:w6pqK/F11np1Th4GFlJH3h4uouLnOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236385, "uuid": "796e5503-6dde-4fc5-83fd-78cbe1077846", "value": 42640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236385, "uuid": "7b68875e-a767-4775-90d1-c6dd0594c995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236385, "uuid": "57a4d20f-46c9-49c1-8d4f-3a703c0e587a", "value": "FGx8SNCa4txePA.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9ab361-b9d0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762296524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296524, "uuid": "b49ce089-bbc2-41a8-adcf-a97d46409bf7", "comment": "Malware payload", "value": "b9c267bef1ed5c4236693d13341d59ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296524, "uuid": "6b5cb1f4-06d5-424f-b0d2-c958f864de7d", "comment": "Malware payload", "value": "46f9306573975efd01e93530fbb3417b76f5e605f51059ea18c74f8481622403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296524, "uuid": "d1a3affb-a6db-4f47-9720-03a6320781a2", "comment": "Malware payload", "value": "72edfb71ba064e2308e59a35f4c970a7b603d785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296524, "uuid": "ec57b123-1513-455d-b8b1-f03775bcd327", "comment": "Malware payload", "value": "65d20492e15a64b1a029e732e7775c5dcf687a294b8278249296841fa5f7845d965f512ef2d7d7b1993e1dfeae99fb10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296524, "uuid": "f84fe13a-70e6-4797-8d2c-422bd9f44dc0", "value": "T1C4246386BFA03FFFD81ECD3702959B09129C490A12D8AF772A34D518B69B14A5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296524, "uuid": "49dee46c-5e86-4ba4-be4d-902834378624", "value": "3072:wacqtfzAqd1H3lwzNF7xAyhxP7/nzXsZ:iRqXlwRF7xAyhRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762296524, "uuid": "3c15b6ed-5c40-49df-8bfa-60576464f573", "value": 219328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762296524, "uuid": "0001031e-f31c-4fec-b629-6fad3f1ec953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296524, "uuid": "a4f4ec7a-514f-4da1-9186-bd04543b55dc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b73caf-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244645, "uuid": "1497826d-7814-41d4-8a49-753b7b0a277a", "comment": "Malware payload", "value": "b0b7a3259fe235c64272d8b931c70954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244645, "uuid": "c3cf9d2d-8489-4af4-92e5-ed3824dc7fc8", "comment": "Malware payload", "value": "47068fea388a7298b41b5471373f20d00f6e40fa6e6fd4c4d175a295486be2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244645, "uuid": "2377aee6-45c3-4059-8e48-63e57047a090", "comment": "Malware payload", "value": "7e14b0937ff7b9e41dce07cf675ffc8149ca85fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244645, "uuid": "a156b069-3d9c-48bd-8550-83683f54a53b", "comment": "Malware payload", "value": "f4b9b5c7e70e2faa278eee2e77dd85f8c955a5e6fef175dac73959be9fb058094251cabd54ada0c48dfeb8e9304a29dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244645, "uuid": "a0c269ed-b0a3-4db9-9c5d-806c29af6ae8", "value": "T1B30633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244645, "uuid": "2bd0aa0b-c6fa-4374-87d9-97ab0879aa2f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244645, "uuid": "0b83813e-e8e7-4683-b43c-dd747c1fddcb", "value": "98304:a6T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:J2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244645, "uuid": "93f4f52e-90be-48c6-8dd3-7b29c3b3f48c", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244645, "uuid": "c06a3bed-8025-40f9-be67-f9a3b39f0ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244645, "uuid": "5f7f6e2f-fc92-4105-b4a5-b79ffaec11a1", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00146fb5-b952-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762242228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242228, "uuid": "fd28b8e6-ecd5-45fb-ad10-974c35a19b45", "comment": "Malware payload (Mirai)", "value": "b15513cbbd3a216bc30b511e3dde8f50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242228, "uuid": "df59ca1c-e25e-466e-9588-3dd110ea189c", "comment": "Malware payload (Mirai)", "value": "4744626272a4f2a8dd92489b5279c68b75af35318c96c99fe37969710e19db4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242228, "uuid": "d40f11bd-7c69-499b-8708-5b94df78bcfb", "comment": "Malware payload (Mirai)", "value": "1f09feabf90901d23f2857969b5cbf56912abc7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242228, "uuid": "e61df766-06e1-4bd0-8ec4-fea42203f407", "comment": "Malware payload (Mirai)", "value": "bbabc7a74a592e9192baa37fd14f65e4406ebeab9c7e91494167919bfb71e8d257fd11d5055b45bf21bcfec81ab5870e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242228, "uuid": "1812407a-13f3-4302-85e1-40322063ef8e", "value": "T1AA634B42B31C0A47D4635DF4263F27E193BFA99120E4FA85650F9B8692B6E331186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242228, "uuid": "c246981d-4562-4c4c-b4af-582709797857", "value": "1536:LmalL/z0vzXfvIf5hnsfkbFO3XSAr8Yfz7GTU4IQLQ+8fByW585sFEh:5e+yDL4IB+1pJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762242228, "uuid": "8e736f72-24db-4d04-b468-0bd01ea372bf", "value": 71244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762242228, "uuid": "2fca35b1-92ff-48b4-b379-8d482564d8e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242228, "uuid": "3462b418-d7db-4041-b073-4e7458b714cc", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb0e9d7-b925-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762223328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223328, "uuid": "ceab01b4-16fd-4919-88e8-73ce5a7182ac", "comment": "Malware payload (Formbook)", "value": "d9f03f7ae6ead75190b91448bc0d7e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223328, "uuid": "dc55977a-cdc2-40be-b275-add238caa79d", "comment": "Malware payload (Formbook)", "value": "480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223328, "uuid": "7f8daeb9-337a-4352-914a-34dcbae44856", "comment": "Malware payload (Formbook)", "value": "f473f27ed0365dbb4c43c624be4c264d62702a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223328, "uuid": "d5546f85-2f7e-42fc-80d3-ba2163bcb562", "comment": "Malware payload (Formbook)", "value": "8b745aba539eccdeefff3e1a5afc137ff7d0f4e0bb78b18801c3a02fd174b720ef4e5972515bd5e8d6c8c362f0019fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223328, "uuid": "8582fe16-b078-4472-9318-857e527defc4", "value": "T16345BF027381D062FFAB92734F56F6115ABC79260123E62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223328, "uuid": "cea5c981-9dd9-41de-8f15-f6a91633c6ae", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223328, "uuid": "6b1c60b3-0da8-4371-bba1-42313379ac05", "value": "24576:o5EmXFtKaL4/oFe5T9yyXYfP1MAXDzYcih0ezoz4Yu:oPVt/LZeJbInGizYcrezoz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762223328, "uuid": "157bc117-843a-49eb-9468-9713adf6462a", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762223328, "uuid": "1eeba807-557c-4a4d-8ba1-8815c4eaed27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223328, "uuid": "6382b725-184a-401c-8774-c29e8721bffc", "value": "SecuriteInfo.com.Win32.Malware-gen.31592574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee7cfe1-b9a7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762278787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278787, "uuid": "c620c079-c290-40ba-bbb9-de243e814994", "comment": "Malware payload (Mirai)", "value": "a7c221266ec4523c0ad975a1b195b7f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278787, "uuid": "947c0cc0-2401-4d5d-9f70-3cdb389c9ddc", "comment": "Malware payload (Mirai)", "value": "482f886e4173c336193fec25f7ce899e179f6010d9e25c8568f6b922d8edd71d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278787, "uuid": "554e8c87-06d3-40a0-9f1e-24d380f3ee53", "comment": "Malware payload (Mirai)", "value": "1a6d1b59d8a70cd5ae71d79caa4525d700b1346d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278787, "uuid": "3c564c93-0db5-453c-a725-b38d9a531b36", "comment": "Malware payload (Mirai)", "value": "aa424fd12c08506eb92903a0bb468b7a1314b2eba8aa92d7b4911c0c117763c515ae6d73c044d244aed9bbacebab0b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278787, "uuid": "1246a05d-9ec7-43aa-b8c5-9286732d7749", "value": "T1E3B3E84E7E619F7CFBA8C23447F79A25A65823D72BE2C5C5D19CD6001E7024E281FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278787, "uuid": "609c02f4-a87e-43d5-9f67-8b0068644f6f", "value": "3072:2Kv1+oc0iwBySBanRnGTc7CY90zZcHX+Td:L1+oc0iPVnRnGA4rTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762278787, "uuid": "55039cc0-db90-4457-a358-e6b566f016ee", "value": 109660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762278787, "uuid": "b8bd0b44-484e-49db-9538-1e7e3315b97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278787, "uuid": "dd18e74c-fbce-4c43-9a12-c0021a7e3715", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7acee13-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762245543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245543, "uuid": "350a1b8e-d944-4a61-9d21-110d9babc432", "comment": "Malware payload (Formbook)", "value": "64d78b9a8a72ab0ad6d474ae40bcd7da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245543, "uuid": "3b50ae7c-3c7c-468b-b193-9640a9d4a8cf", "comment": "Malware payload (Formbook)", "value": "48397dd0a53c9306920e12fae76d6527c8c64746b2932ec0b652bf7319f6a33d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245543, "uuid": "81356e45-801f-41ab-a5ea-692b2201cebd", "comment": "Malware payload (Formbook)", "value": "f6e9fb5172fa82a9ae07ede9deb114f39bb2b772", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245543, "uuid": "80845830-2653-4313-b987-e3e0255eeaa7", "comment": "Malware payload (Formbook)", "value": "6923a79238bb6319c9cc5e947add23bb5b52bc33519bc50d0beb0da0302e75422bc60b2aec10ea4062b95bfbf03d1cda", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245543, "uuid": "c05b583b-abbc-4507-96a8-ae3168d0cec5", "value": "T1DEA5AEB28EB76EC9176865C8CACD7BC43F2C57539524A114AD6FB0BB11690017FD88EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245543, "uuid": "12d9a4f1-c453-463f-8a9c-4020bd0c6d62", "value": "24576:5uggkV4Oo4oAQTGn3Rj8RQd6wrojHnwy6XyBRB+gUVUu7us9EEowGU2PY3XvbDQU:Ng2o4o9+RAR+lr5X2CPOTxDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245543, "uuid": "9ef4f88e-e1b1-4bab-9583-c402be5d9c5e", "value": 2203323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245543, "uuid": "7feb0598-757a-4e61-84c5-b86fba493b8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245543, "uuid": "bff7634e-3c09-4907-b5fb-9dde94beb2da", "value": "Sample photos and drawings.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177be9a5-b996-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762271473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271473, "uuid": "84b1ede0-1e81-4a5d-9e62-54cf60e2ca1f", "comment": "Malware payload", "value": "9588d8301c072feca09c574baa5cf4fc", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271473, "uuid": "ece95893-793e-4cd9-b341-9205d7e7e1b3", "comment": "Malware payload", "value": "48c7ee30aae35f496abc615a429b577d8f01c05c1f55481bbd99e1955648f3d3", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271473, "uuid": "a80dbdb6-a449-4acd-bf9c-a6bb41719a85", "comment": "Malware payload", "value": "18f5f7a24b0a4748f832a7c9d3b8fc5585aee5ef", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271473, "uuid": "6c4148c0-28b4-41eb-ad19-23313d4f174a", "comment": "Malware payload", "value": "5056d9bac5e2741441994fcb917dea4465390e7d09e647606c2ac24f8fd2555a67b4c9a3ef284e1da0db3aa67b27ee82", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271473, "uuid": "11843c99-3b82-458c-a2e1-ab184e47ed1b", "value": "T1999523277AC4CA62CCA49772F4FA02F30B39BC61CF945A436684BD873CB25459876B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271473, "uuid": "aa1e70e2-d16f-408c-b4fe-78e897bbc776", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271473, "uuid": "c65b3b50-56d6-4b9b-9939-4772941079af", "value": "24576:FUy4bXhbCbA6Y1UYD9I4bYBYWtnCVXYV8WB9v4p9KHW9dhi1/os9CGOPidshy8MR:BmUbjYFD6BrCCWLYKixc28lLLwEMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762271473, "uuid": "645356ee-81e5-46cb-b653-cd6ff8c9604f", "value": 2030592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762271473, "uuid": "49dbdc68-ba04-4a12-9768-8aff416bd508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271473, "uuid": "e0374b21-e76a-47fb-b5fe-232c1c269c89", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20751cf6-b9d2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297258, "uuid": "43cfd299-d93e-4aae-98d1-6175a1d6998b", "comment": "Malware payload (Mirai)", "value": "a16929e7191c509368ab80105973d707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297258, "uuid": "4a0b63fe-3b9c-4387-ab71-c0f9786438d2", "comment": "Malware payload (Mirai)", "value": "48f8ba323a18feb719e4cba9d502e85a73e89c0e7d4c6a5b2dae7e808b19f692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297258, "uuid": "dbc07906-d871-4524-acc7-6814449c8750", "comment": "Malware payload (Mirai)", "value": "c01e98e391ec93d36d963d5d91e87142cc710b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297258, "uuid": "7d9d5868-de80-48b9-9f77-0cdc45f39385", "comment": "Malware payload (Mirai)", "value": "5f907892836e137b12fb868c66e528a7f2f2087434836825f6aefedee63aadb46c9f7b439e2be8526740d6a4fc420688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297258, "uuid": "c9ee34a8-03fb-48b1-81ec-999c1d7266a8", "value": "T1C1C31849F881AB14D6C615BBFE4F118A33135BACE3EE7213DD241B2427CB95B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297258, "uuid": "a46442e2-e0b4-4539-9a41-2842f1d317b9", "value": "3072:vZx6tr7w6Rv4cjZocstrVa0dy9vu/aez3OSLrcZpezN1eW7aznzv:Bx6tHw6J4cjZocstk0d6m/aez3OSLrwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297258, "uuid": "b4b36513-7338-4f85-8ec5-b483e5f8fb98", "value": 128496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297258, "uuid": "569f3e52-d4ca-401a-9b46-5fd9c290f1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297258, "uuid": "c436201b-7925-4a23-8d1f-cca3585b27ff", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65432bc6-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245405, "uuid": "feff8fc1-88df-43ea-adde-b03d646884a2", "comment": "Malware payload (PhantomStealer)", "value": "78f6a85a62fb52344dc691125cc9c74c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245405, "uuid": "11dcb472-eb4e-4e60-9e42-512af62b5d30", "comment": "Malware payload (PhantomStealer)", "value": "49621a642ef47201fc0636c5cb0f782a4c1fb467f09eb882420ec337d2732a35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245405, "uuid": "875e0df6-bb77-4b9a-9eb4-25704e7514eb", "comment": "Malware payload (PhantomStealer)", "value": "df7462ca8a4d8ed3a0aeaf07940fb7baf5d5de4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245405, "uuid": "d1903d7f-b1be-4e1d-bb7d-77cf72b7f217", "comment": "Malware payload (PhantomStealer)", "value": "d874a922a373dd1b5654c96d61f86fbb2ba367e883ff4d410ba650da682a730b1db67a57eb1e45009b8d9fa0686b6168", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245405, "uuid": "dd2c5bfe-3cc4-4ae7-a30e-fc48686de92b", "value": "T199055A70ED2801990F4B17EEFC2616A0C8BEC916127754F1E6D51B9D730A99CE3FE268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245405, "uuid": "eba24a9d-a70f-4038-b0d1-165539314f85", "value": "6144:KEKDBjkGE+kw/BbcDtRIH+TXX7L/Y6drF/thi8D:wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245405, "uuid": "2c2366c8-3776-4646-97ab-a7df23233a90", "value": 810871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245405, "uuid": "5efe512e-ce97-4ac4-9273-d631957e8d26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245405, "uuid": "51781068-f55c-4610-9258-ec85ab7457a7", "value": "PROFORMA INVOICE DEC251025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b52b353-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762244636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244636, "uuid": "d3689e21-ac8d-46fa-b19b-01a51aec803e", "comment": "Malware payload (AgentTesla)", "value": "f252d2cb3452d3996fca585fde035bcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244636, "uuid": "04b188f7-2de2-44c1-b289-284ab69422aa", "comment": "Malware payload (AgentTesla)", "value": "4a936df778d57f4f350ce7bca8d32b3adb74dd3dcdadb74403fbcafdfbc3fab8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244636, "uuid": "61a48974-ba9a-4cfe-b69c-a3f6892b3ab9", "comment": "Malware payload (AgentTesla)", "value": "5a023b2a7dd566832ed1f3ad3b4abec0f4dc55db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244636, "uuid": "c13878fb-9e7c-4e82-b974-5707c89c5fd9", "comment": "Malware payload (AgentTesla)", "value": "9472c6e0da7e186947f396f447aa6a32174e1aaff858eb3b2780e4d2103fa641a2dc08e5c3233f50c41c5163c4e7adde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244636, "uuid": "f04f283f-177b-49fd-8038-0e21bb28de76", "value": "T19A0502347EC98977C2300F379CA1F76361A8F8531A8D56B361580F6E68BE295C60F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244636, "uuid": "b43bc181-799a-49e6-b959-0189af408d8d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244636, "uuid": "c8101824-69d2-4409-84c6-4de3bc628cf4", "value": "24576:MfL2kAhh6fZzwygjMO3NlG8dJjpdSjxhP4NDOL:mCP4zzgjdXFdNpduxp4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244636, "uuid": "c458b8e9-65de-4893-8519-dad47a7c47c8", "value": 864528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244636, "uuid": "f1513ec3-4020-4973-b9ce-958baee4d718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244636, "uuid": "09c8213b-44eb-4918-a12e-56f8a825a330", "value": "ZAMOWIEN.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91935ede-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269960, "uuid": "c84be785-9bc0-4775-80ca-84005ebe0e37", "comment": "Malware payload", "value": "606fadc81266e55df8038c34f6daa8e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269960, "uuid": "10a8a7c9-f191-4bb9-8c58-2273c2a70d6a", "comment": "Malware payload", "value": "4aec77017152f275d3342f52a0f28deabf1edbd9e1d849967b7729af4b1ae948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269960, "uuid": "f6bec6f4-6a4e-4c3f-a696-1bacb73f4621", "comment": "Malware payload", "value": "39469661cbfc81e779a40c054bb1056f460aa9d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269960, "uuid": "b7647e7f-69ba-413e-8ee9-da545ddcab18", "comment": "Malware payload", "value": "71c33bdc4a9c1cd27f65cf7537e2074f7d407c6d4a9693f30ac9a4004bee163f554c4651597383939a07c288c3754fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269960, "uuid": "acb316ee-2ae7-4332-bd10-9d8be8091462", "value": "T116268E4399DF0DAACDD277B8A1935335B734FC308B295E3EAA48C23159536C4AE5BB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269960, "uuid": "10bae798-19cc-42b0-a6e3-4f37ecb253fc", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269960, "uuid": "99842516-9ec5-4c41-a995-06ee2538b28c", "value": "98304:ErDjDTijTZc+o8pQnHiI2RGSlm41t5gRytlWp:sjDTijOMRS4X5gRyWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269960, "uuid": "f1b64ba1-4a7d-4a5b-829b-1897c3b8fa45", "value": 4578067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269960, "uuid": "8c1b37f9-abb9-404b-a534-810874eeb0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269960, "uuid": "b23ad9ef-7d1a-4619-bc6c-91094d1a3cb6", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08da0dce-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245250, "uuid": "05cd5aab-dd7a-4d54-be81-b634b33ec16b", "comment": "Malware payload (PhantomStealer)", "value": "3f9acb1991e4e1cf68d1b196202eaa86", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245250, "uuid": "ce6b42f3-b3bf-4e68-a1f3-e8ddd3e452c8", "comment": "Malware payload (PhantomStealer)", "value": "4b012d15749ece19a215b18e88ae8e6123fc3ac809c0940eda15d83796874e60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245250, "uuid": "716ccd78-65ad-41f4-a853-2fea75d67e1b", "comment": "Malware payload (PhantomStealer)", "value": "49d7647574022402747075f4172b7b3b29d851c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245250, "uuid": "4b273857-5f26-4e7c-bd78-2f638c6f163d", "comment": "Malware payload (PhantomStealer)", "value": "efd666a2d60dd5396639db5ede6aa1acd68b5cab5016ef938c7550e02678a1b168672ec4a8a2899fff3d601c0fa396ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245250, "uuid": "d29721fc-ac4d-47d1-b5fd-98d5bce073ef", "value": "T1DB055C70DD2801990F8717DDFD2906A5C8BECA16223754F1E6D92B5D730B99CE3BD228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245250, "uuid": "2f0f6283-9580-455e-9912-c804dfa4587a", "value": "6144:CluYKtNfpESa+s9IULGCvuRy53ZlA/RZV:3XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245250, "uuid": "f07599b6-dfb6-4fa0-b4a3-439628c085a1", "value": 812028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245250, "uuid": "b7da5e0e-a73a-4f4d-91b8-254649ea8d4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245250, "uuid": "7302f3a5-dc40-4a60-a8d5-a87cbed0641e", "value": "PROFORMA INVOICE DEC301025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776a7907-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762245435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245435, "uuid": "e7cd4448-c6b3-4526-a650-da956b1896d1", "comment": "Malware payload (SnakeKeylogger)", "value": "ddad69dd37b17e751208ce5f54023336", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245435, "uuid": "d430a3c8-4f8f-4f67-ba3d-23103554953a", "comment": "Malware payload (SnakeKeylogger)", "value": "4b167b15f2e72494660009d0c540013258f70bbcf9f5940d3da3a1f0e23df2e0", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245435, "uuid": "0013f53d-aa85-4157-943c-0c28f0655aad", "comment": "Malware payload (SnakeKeylogger)", "value": "828ebcea6f5507389e3517053197cb2470f0615d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245435, "uuid": "de4dfbcc-e097-44d8-847e-aae80d6fedac", "comment": "Malware payload (SnakeKeylogger)", "value": "92e733560afab20cb6e7b2b9ebb3b594fff014c24eba762baa81965f56a8e94d0b9f0f4f1ed92bb22b2ff97d3ea54e8b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245435, "uuid": "b2ad2c28-cd83-4169-a86c-6689deb244f6", "value": "T113F50193DC923EC5A4E5F0D74E9F759A8B97B0563728382C2DC8EA53681683F6B410DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245435, "uuid": "9646423e-9340-4c27-9101-60c55dc6f151", "value": "49152:Nxrvff2mey+LAdcqnjiOztgKg+M87cF0IHo0Z4r2TcjHwvjUBcHJb12S:hpn+8tgKgQoHmr2TmSscpAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245435, "uuid": "bf9f8a55-8052-44ec-ae2e-cf81ee0d5faf", "value": 3623366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245435, "uuid": "5fe924d9-b5ee-4cae-ae79-239d26e66f70", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245435, "uuid": "70c05e77-f7a5-492e-a6b1-d37ee02651f4", "value": "Ref Number25-UAE89475.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1773f0c4-b96f-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762254723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762254723, "uuid": "123f5a6b-3ac5-44bf-83be-619a533eacb0", "comment": "Malware payload (a310Logger)", "value": "eab65dcc925c327c5a0c7a346108d29c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762254723, "uuid": "9b6f3b7d-4b1b-435b-a5ad-b2741ee7af8c", "comment": "Malware payload (a310Logger)", "value": "4c20b7534fed68d66cf717fd2714a2c475e38301dbb97cd50817de0b47297034", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762254723, "uuid": "1e0ccb22-8e78-46fb-8fc9-61ec5ccb4695", "comment": "Malware payload (a310Logger)", "value": "55672b6a46478e6c6b5eb720905d229e3c7b9c49", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762254723, "uuid": "9024b811-199b-474b-8be3-3c25b01df7ad", "comment": "Malware payload (a310Logger)", "value": "a34b75cd34aa8d496767b3d7af7636ffddf8f86c0d5b0723d6095943694de91e010e0b67800acbc4deaa62f5b6934eed", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762254723, "uuid": "07e6d273-176f-42af-bcde-730727ffd395", "value": "T17F75CF527D408D72F12F3534D806A3686615FDE02928F8467AFC3E888BFB653781AD97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762254723, "uuid": "c16173be-2a40-4ca9-a461-a77ab6dca7af", "value": "1c46483cb5cc22b9cc47e186fc5136c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762254723, "uuid": "0d5da305-0e44-4aa3-b2d5-d7ab2b38f298", "value": "24576:dr9ZqlAN7Nu2z8ZM3iJ9Q0y4KhdRPtLX9DYM70DJaMHvRpkB/G793JTp:5hJjsn5mj9R70NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762254723, "uuid": "c3a7aaed-4fa9-4168-8958-60889da152f1", "value": 1627648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762254723, "uuid": "e5a346a5-cc3e-457d-ae7e-1aa549d14710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762254723, "uuid": "a1bb5082-8086-482e-a115-3694c4f0c8c3", "value": "FACT97656780000900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a67860-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762249074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249074, "uuid": "6e56dab3-d8b6-4113-9bb8-9018534e59c1", "comment": "Malware payload", "value": "b79bee95f6c1167dac40b8a350c56189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249074, "uuid": "f43454eb-cb0e-420c-a291-c06d7244fdf3", "comment": "Malware payload", "value": "4c825f71ca40b66a65b810a0f8cce2d96ab006f81beed2ccb79e48d0b236c376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249074, "uuid": "234c86df-ed2e-4123-a676-9a1cdb8146ee", "comment": "Malware payload", "value": "0414937dcd3dbb70ab293de62f6c9118d2035ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249074, "uuid": "2b381e79-9d48-48a7-b9f7-c3a2683c047f", "comment": "Malware payload", "value": "4a32b5cff455976e2807974917eb94c6f413eec3beefb967f28bc90e9ad0497d700e851ceb25e096a3170ac23c91f656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249074, "uuid": "b436d8e3-0a47-4f5e-9744-549e251ff865", "value": "T1DE859E1672A400E8C47BD078D7A75A1BD7B27C841360ABEF12E066A96F37BE5077E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249074, "uuid": "f061e8db-fe0b-4dc4-9517-1e60a3e20d2d", "value": "5797746d17e4c294db3cfd29cb556309", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249074, "uuid": "e452dd11-b773-485e-ae0e-4bbd50f7ad12", "value": "24576:8YZ4zKgW+SGklxoC6ojJ2FZPD8GL3DZs5vjAr17Tlfi7nMu2SbwFK1/sA:8M4WlxoC66J2FZPD8GL3DZ67aTlK7nM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762249074, "uuid": "7ab4bafb-e6af-4fd0-b727-9c7e46fd45e7", "value": 1793296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762249074, "uuid": "c6c468e7-0cba-4e0c-b69a-a3ee253508ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249074, "uuid": "78425543-7419-4824-b388-38f57aa3be4f", "value": "4c825f71ca40b66a65b810a0f8cce2d96ab006f81beed2ccb79e48d0b236c376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cde819-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236413, "uuid": "6b1fb9dd-5287-4e62-922e-0aa3c4ce0271", "comment": "Malware payload (Mirai)", "value": "4f935c578b8f6d4b11c140e0663752d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236413, "uuid": "aa4e8a87-6704-4d68-8871-b23ad7e51283", "comment": "Malware payload (Mirai)", "value": "4d5b8778f9caf3496d596413d15dfeeb1160a98a839914b33eb1c2a7b345475b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236413, "uuid": "2d0cd061-a218-460e-bfc4-fdd60967b4bd", "comment": "Malware payload (Mirai)", "value": "3f092bbf715a86185a12a6f950f9ad9088857457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236413, "uuid": "10e96689-136d-4127-8d77-4e0b80a72e5c", "comment": "Malware payload (Mirai)", "value": "661845fd75d87eaf2a7dfbd8da65fa67f560ea9e934ead62b8c25fc440e5741aea3a79c377c06fb66c36bf15ad70923e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236413, "uuid": "f1f71a45-a69d-4455-bdf7-24623ab45e71", "value": "T1C083290AF98584FDC08AC134177E793AE875B1DD033CB3A7A7E4EF262D4ED601A19949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236413, "uuid": "ec7a3798-d842-4867-ac0c-f60e9eb6939c", "value": "1536:4rEE4BdkD/jhYFfYuCzU8IEdGeeEcDsWRTnsNW29M+iacKYi7PxCrbz:zE4Bdk3KFfxCAPGGPLRTnsNW2liacKrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236413, "uuid": "85743c15-7301-4947-aa0c-8d2b4379e1e2", "value": 85632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236413, "uuid": "66a3adac-ed46-4bed-a67a-fb2ca8c0a8f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236413, "uuid": "3ab678d7-9d85-49c6-99b7-89e5f14a6471", "value": "FGx8SNCa4txePA.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def9a14e-b921-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762221557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221557, "uuid": "f2b098c8-b9a7-453b-b732-0dbcdd9faab4", "comment": "Malware payload (Mirai)", "value": "1605d83690fa06e9d4ff651704210126", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221557, "uuid": "e4898563-4250-4bf1-82a9-bb50d0c12d01", "comment": "Malware payload (Mirai)", "value": "4e2175613d96d322e94385be23785ca65c112b10229cd3f79fda76e833a143ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221557, "uuid": "e53192dc-d510-494f-bb93-6385da310f76", "comment": "Malware payload (Mirai)", "value": "5c7fa0c025ae97c5c927fc08ed3d47f9ad68c9cc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221557, "uuid": "4eb50781-cccc-4396-97cf-5aa27c7f8d71", "comment": "Malware payload (Mirai)", "value": "33ee8991bcba3305835a85a3882c35d498b5e3e8751d8d19891bbaafa735b9fdc950311f455bb4abe974b15fb6528bf1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221557, "uuid": "aaffc227-039b-4ec1-a24f-c4a9d5b46ffb", "value": "T182014CCF2461C4304851966837E3DA24B64DE1E463C52F98E45D463B149DE59B43DED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221557, "uuid": "6f2d1163-0612-4f16-be91-ec25b25d64c5", "value": "12:vWOZF85ZMNM2V4ZMBAwryrrhHWXwYAWdK2JTsJT2CIyg87JTsJTC:uOZF85EMy0MBz+RWA7uCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762221557, "uuid": "3068a3e8-0fac-48bd-85d5-f548561d1bc7", "value": 724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762221557, "uuid": "b223c8a4-400d-4a4f-b81c-efb974339d66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221557, "uuid": "58a8526a-9e8e-457c-b7a1-dac9d2a5e685", "value": "mwah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937fa27c-b986-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762264809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264809, "uuid": "89f720b5-f951-4a10-a6bb-59f43e5f619b", "comment": "Malware payload", "value": "03a81c535c3a4d604a45ce62f75447e2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264809, "uuid": "94ae9f37-4ee1-4683-9837-84f426a33f83", "comment": "Malware payload", "value": "4f163c5d57a2b215ec9ebd5491a8d893f7dd8d8bbf478e585978c0f90aecbe35", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264809, "uuid": "9091157e-6b5c-4ade-9413-eeee8652c3d8", "comment": "Malware payload", "value": "c6ba36ff21b4e2e7eaabbff4b3c5c78179897cf7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264809, "uuid": "cbd2575d-a176-48c3-b109-eb0248959ba9", "comment": "Malware payload", "value": "01d91d0de6027b4e3cf6fd968b47280ad5cd44fe2af752b2c09f53f1942bb2ce390da59404fd3c9e73df1fd40c912386", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264809, "uuid": "ac8902dc-532f-421f-bccf-2ae3014c0421", "value": "T16814902D9175B88AA26963D860F4352510EC99EFF5F3C6DC86E084675C1CFB0AA3D34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264809, "uuid": "8fa7a830-d540-46dc-84af-d629a7d642f9", "value": "3072:46yfiEAf+gVanMXYfLmLhT38gO+t9j54tzUhRSE7VXn+Mm5v/RhvHlX:4dfW+gsrfLih5OrmhRSEXn+Mm5v//R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264809, "uuid": "1e459774-e2f2-44b7-9a50-310c7386ac10", "value": 204618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264809, "uuid": "a7bfad56-2cfa-4813-99a2-05ace4b69d5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264809, "uuid": "46413b5f-755e-4af0-8828-702436c427bb", "value": "rBQLayout-2F-64Coway.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c43806-b95d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762247313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247313, "uuid": "44797c1e-91db-43fa-918e-5864b06de4d6", "comment": "Malware payload", "value": "571088182ed7e33d986b3aa2c51efd27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247313, "uuid": "f35ffa49-036b-4d68-a7af-2dd79c6b64b7", "comment": "Malware payload", "value": "51a9d90a021c8a2a77658a3eca8f1a2297db52c13c17be3b5a08867a7d73d1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247313, "uuid": "f9087a27-cb9a-4da2-94b2-b81ffe82b07d", "comment": "Malware payload", "value": "5612c6546685bd86eb8effba89aa1e8942d5c120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762247313, "uuid": "3018d60b-82ec-4f46-be39-accf31f2dc4d", "comment": "Malware payload", "value": "e3421b07cff8141ea79a16866f5ca9efb3e7ffa4dfd87753cd08d3b94ce0a228040dd28cc4ec67b1581bfc61039c237c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247313, "uuid": "ba0786a3-123a-421a-8fd1-b8613fe98851", "value": "T10A155B223B46EE7BDB2F41301BF3C5B165D9A01626E699CDE363532D2E113852C2EED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247313, "uuid": "edc1976f-06a8-4dcf-90a3-2b533ee01dc4", "value": "12288:GlAexybH7LikR21BHrv3KGibxDUa0t5pKYr25WbsV:5/D+r81IHr25NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762247313, "uuid": "67ed676a-f771-41b1-aaef-d9d1dfee1595", "value": 937744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762247313, "uuid": "db6c11f6-060d-4053-b430-4e088f629215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762247313, "uuid": "2bb51d1f-6ea8-45aa-8a85-b594cf018404", "value": "51a9d90a021c8a2a77658a3eca8f1a2297db52c13c17be3b5a08867a7d73d1ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146ce77c-b9a9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762279629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279629, "uuid": "4bca17f3-b70e-4cd2-ab96-454fb3b554e9", "comment": "Malware payload", "value": "217b05d53610a3c98cbb7491d8f861c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279629, "uuid": "9f804c4b-4476-4ced-947e-00c0e5be1481", "comment": "Malware payload", "value": "51fae03f58dc7f16a437c3f951ba7523b908fb7250d137a571458196c7fb7f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279629, "uuid": "a41dc4a8-d387-45f6-8350-ee5fdf80787a", "comment": "Malware payload", "value": "c37f736c70ce1c2d13e2ee63948a6ee9798add13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279629, "uuid": "2a06a880-b76a-477e-a40b-3424cf40e15d", "comment": "Malware payload", "value": "3cf5e333407482e1c0bc239d15c6484260afbcaf4e2ca6a205f6eac187412bfe5db7c9330349c4ba8270ebdf8afae0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279629, "uuid": "981982f8-003d-4d58-83d9-9f562d18fbae", "value": "T10E18E11BF7A440A6D02BC07586579637D7B2B4544B20D3DB32ACEA1CAF63BD15B3A324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279629, "uuid": "bc421a7c-f3d2-454e-ab74-b6d9ae6e98fe", "value": "1496847df462370e0250810456cc540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279629, "uuid": "d67d97de-88f9-4e6d-8b8c-e6d7fc3d7dc4", "value": "786432:lZDXoFPBzyxOhvCtFJnkPZJnwvd//VzvJ9nTDtYj2FatF:lZD4PBtvCbJnkPZJwvdnhTXE2Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762279629, "uuid": "6794b12f-95b8-49c1-83f8-3961bc6eb8c9", "value": 87661568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762279629, "uuid": "035367ff-39f9-4e0d-a508-6e7bdf13d214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279629, "uuid": "111a98ba-25a5-4d6c-bf95-7d99734b1a58", "value": "Vape V4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f99d68-b984-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762264069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264069, "uuid": "f1b547ee-ac67-4dbb-90ba-444dbeed98b0", "comment": "Malware payload (RemcosRAT)", "value": "59761600fd1e109ed7ac6a0444f5d993", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264069, "uuid": "6a61d446-e1f4-447e-bd43-6275c4c64f2f", "comment": "Malware payload (RemcosRAT)", "value": "52c431c39253d87fea7e9465ec9ad2ddebd67ec928b25486cddb0dfdace82ad7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264069, "uuid": "6f0c1443-d3a1-4aaf-8bab-ee3d44ea91b7", "comment": "Malware payload (RemcosRAT)", "value": "fb69643529d6e04076b02887289351ba7cfe7477", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264069, "uuid": "b3954406-749c-4e36-b92f-8b605e53f41c", "comment": "Malware payload (RemcosRAT)", "value": "5453e8d68310d6572fe18ec785a3042d6a121237075ce5ba7c101fef5dd2e1601520e747ec9fbf20b64c4a42cfb54e3c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264069, "uuid": "b8df7683-7af1-4e3f-a5c4-201e37da4a74", "value": "T1EB056829CF6CB89C32E960EC02BF3A4D10948B6BF5741E7C575412F01DE4A81BA37B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264069, "uuid": "3117770a-ddfc-4b03-b214-35829abb8486", "value": "12288:jWg9+uI80ela8xVbMCeXnMrGOxdQmqySvdvplAN5zSt5OgOUsmADgpnrpAizGGkx:agU0eXJOxcySFvpi0W3UZ1pXzGg0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264069, "uuid": "f8ce7ab4-74fe-437e-8761-50a99df0a2a2", "value": 813792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264069, "uuid": "5dd4a976-3be4-4e17-a36e-92509d93d699", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264069, "uuid": "52b60a7e-09df-4ddb-a6bb-a618c53c60aa", "value": "RFQ 762230094 Samples_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4d1e14-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762245582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245582, "uuid": "039dae01-d6c8-42b4-8f2c-55e4b091c7e6", "comment": "Malware payload (Formbook)", "value": "954ce3586e2e47812eaa5ad759a019d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245582, "uuid": "8dd91d97-73e9-4bdf-bd73-0026646074df", "comment": "Malware payload (Formbook)", "value": "54b56ce2ee93bd876bab1bc94946bdbc5f0f7fee55a6ed56841c9fc275c0bd6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245582, "uuid": "7c777140-a4fb-430e-af0c-da5da4d38d0d", "comment": "Malware payload (Formbook)", "value": "6b2f48ad0dfaff247c8f9768f8973c2d1131b5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245582, "uuid": "26c530ff-92ab-4288-9c6c-85f4a4377f08", "comment": "Malware payload (Formbook)", "value": "1cac0b9f64207c0b6f840df7f683093834d000a2a90a164db6044680e08144036df28a5498f5ba33b3056900cfede358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245582, "uuid": "010608d8-359a-45b5-ad3d-fe51678ba1a0", "value": "T179F48D2531EB1156C472EBE30FEFFCB69A7EF171212EB13635A3568683A1D018E92075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245582, "uuid": "91a5f1a5-e2d8-43ed-bd22-8489393a3a0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245582, "uuid": "b2aec858-8868-4e0b-838b-0e7cd9881f3e", "value": "24576:w6uqFBiGs8Jg72dSjn6nmMqIhOyYGPk0:w6BiMhdy6sIhOyhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245582, "uuid": "ab2964cd-166c-4eab-8ecd-9f262e5dde81", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245582, "uuid": "e4dc36a0-fdda-440d-b9b5-15c0fc2e2965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245582, "uuid": "ddf4904c-7eae-401f-9a8c-965b2f1acf3d", "value": "TEKL\u0130F TALEBI..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1682cc82-b9c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289940, "uuid": "879c7cd4-9491-4bfb-bf53-79acbb6a14e6", "comment": "Malware payload", "value": "a962b63930691ca3e7665dc084e00ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289940, "uuid": "0a777ce2-b416-4454-8a83-5cd20851ea01", "comment": "Malware payload", "value": "56336dcfbed450f1af90be8e4dca88d4a58a5ff04225284a5360243bf2224a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289940, "uuid": "a044c99a-fb1b-4121-afca-6e0f707ad3c8", "comment": "Malware payload", "value": "6645dc564973d638f9999aec06c0a21cbae76ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289940, "uuid": "db3a9efc-8fde-46d9-8392-ce66d472c32e", "comment": "Malware payload", "value": "cfdcfd6f8cf259f2aaf2be422540fbe3fd4da3719febea146fee71827dea156dfec8b01e102e8858caa477b1f64569b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289940, "uuid": "a4c5f32a-d9f6-403a-acb1-afac29870e5a", "value": "T112A412533B02E9BAC9AE43304976AF738B35FDB421212A5B1B312F987C765460D5F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289940, "uuid": "6621937c-2b8e-49b4-adc3-58437a06fe08", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289940, "uuid": "54bbad3e-43d2-45d0-9fe0-b0c4a0ce0504", "value": "12288:+DScuw2F6W9Tl3uV/Qpl0JvH6GbIYcWhToI:jcuP9l0JPL5c9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289940, "uuid": "ca72ef89-30da-4582-8702-5327f68ca46a", "value": 465712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289940, "uuid": "55dba482-747f-45bd-81b7-1d5f6a81bfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289940, "uuid": "0ff21d61-dc40-4964-afdf-9fe95955c08d", "value": "Forplantningernes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f5e4e1-b9aa-11f0-91c6-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1762280358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280358, "uuid": "20f386ef-cfd4-40c2-8e83-975b62f4b5f4", "comment": "Malware payload (BlankGrabber)", "value": "d2ff3e2da68a6344a8d425d3b2f07cf2", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280358, "uuid": "8bcc2568-43c2-4b12-b826-c509e4badea7", "comment": "Malware payload (BlankGrabber)", "value": "5694e27ceb0213e0bd1ffceef596fb2e7bb2e8a7636f057080b60a8ce61b5f0f", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280358, "uuid": "94105a05-669a-4ee2-9aa5-70260fb41591", "comment": "Malware payload (BlankGrabber)", "value": "081254bdf361951c728ec2c9d299e877db953cb1", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280358, "uuid": "0a7df3a6-aad1-47f9-9ab8-3f38bd681d5b", "comment": "Malware payload (BlankGrabber)", "value": "7915f82b43bdc9f11530ba4a60cd719cf99b39f34745b2e5dddd563473f6fd7bed9f2efdc5f130f96293848f20ab9d72", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280358, "uuid": "fceeced2-8dd9-45c5-81a3-b809b5048d3f", "value": "T1018633816620C5DAE0B2833DB402D9F2A271BD25A3D4D69772FCBE173F232915D7A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280358, "uuid": "deaeb782-348b-45b1-a9eb-b9bcbd2a4d63", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280358, "uuid": "42dcb25e-9755-4214-a7f3-fe5c88789a52", "value": "196608:lV1z7iHLwrEB6ylnlPzf+JiJCsmFMveHn62qnjZ:F7bwBRlnlPSa7mmveHKnjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280358, "uuid": "8a1c47cd-5c02-4b39-8668-5acf3229b67d", "value": 8401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280358, "uuid": "5d19dc35-9d7a-40ac-bc4e-231ffe6e7e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280358, "uuid": "47c7a076-b251-4fbd-89c6-3a365ac6079a", "value": "Crypter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27bfaa3-b951-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762242206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242206, "uuid": "5f720b14-d3d3-40a8-bd26-68a36e5ac270", "comment": "Malware payload (Mirai)", "value": "dd815f171d36fc2c6d0b1fab154889ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242206, "uuid": "1cd03926-cce0-4d47-a6e3-d4ee2cb94df4", "comment": "Malware payload (Mirai)", "value": "573ed9dde72bdbf9fd366ba569e819c517c1c8795b8a24eefa415716dec13318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242206, "uuid": "63625b81-4264-44b6-8181-1310445cf6ca", "comment": "Malware payload (Mirai)", "value": "da70d15801fd9c021807002136f5f5fe4558b41b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242206, "uuid": "2e81a822-b118-43e4-9612-c42b7b08870b", "comment": "Malware payload (Mirai)", "value": "b11508a4b38f00941cf8572af4c92bc4010f91f8b6970e016bc246b751e9ead7f843a7c47daa3e35b8467cb7c312d6e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242206, "uuid": "67f0206e-20aa-4c2a-8350-029a61cee9c7", "value": "T15ED3CF32E0086DA0DD2017B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242206, "uuid": "e48ebdc8-3a4c-4a35-b9f8-b6ac7c7df421", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zt6:xOFgpOEoVv3MXL5NhGOt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762242206, "uuid": "d7a3ef6c-6705-4fe0-9c4e-89c457a29045", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762242206, "uuid": "df569517-52c9-4cc4-8a62-64eed5fb6d03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242206, "uuid": "b120aa35-d9ae-4341-b628-f1000f1c3bc0", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53bc635-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762245512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245512, "uuid": "93f848e3-db5a-4e5c-b6b2-f49856ee7fae", "comment": "Malware payload (AgentTesla)", "value": "f8599c8a87ca8a79e3d881399140b998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245512, "uuid": "f0549f10-1f64-4fd8-aac2-f8bbcda6c14f", "comment": "Malware payload (AgentTesla)", "value": "57fa8d2a3bc481225430bb8834082afe9c753be61b5a9b2b0b08dc294c378542", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245512, "uuid": "2d517243-499e-4def-bcea-d95d77f45c46", "comment": "Malware payload (AgentTesla)", "value": "963bebbd04a87ac8974389c2f46f075e19b8d2a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245512, "uuid": "7680600c-06f5-4a2c-86bd-c6acfec2a0a3", "comment": "Malware payload (AgentTesla)", "value": "659374d3f1d8f640a64b45401ab226f6b5fc30a6b2b0f0a2497b95ad9444a109180bde2f8cff162a8f51f02bf78feccf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245512, "uuid": "0a839bb9-b450-43b3-bbb1-0b806403d3fc", "value": "T19645021189C86FB9CF9C591C90FE160E93E04ACE512A758AFB3B7D4AAFFB54402071D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245512, "uuid": "b57f932e-f98b-456d-b140-19eeef423ec0", "value": "24576:4Vc58zyvjnBPCaLWDjuA5K9coUmeJPFZPQ31zo7:Sw8sPLu3ZAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245512, "uuid": "7b319185-71ac-4e7b-aec2-3c9a9017cf5b", "value": 1237838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245512, "uuid": "25431f40-bad9-4fac-a600-a13ccd982139", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245512, "uuid": "023375d8-24fa-419e-875c-98990d1162ed", "value": "PI90042542562.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfd9bb9-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762245256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245256, "uuid": "5e26b375-2637-4abe-80d6-8e89b69917a1", "comment": "Malware payload (Formbook)", "value": "2d1f286990ef6ed0ddef01d5cf5406dd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245256, "uuid": "7a16da65-6de3-4475-8160-ba3f00e7eef8", "comment": "Malware payload (Formbook)", "value": "587dac4b8f22808a180114ad69a949d97f46d655ee89049b729a5880aec504cc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245256, "uuid": "3eca12c6-2062-47e1-b19a-926a285d8ba7", "comment": "Malware payload (Formbook)", "value": "42e46878ec22d6453d69ec4d3faa38a6a43db378", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245256, "uuid": "2d21e650-3ab7-4f6f-89b0-5a017c3d3794", "comment": "Malware payload (Formbook)", "value": "a87db8266abaa7ebd8d289dc3aa62a76f3f48a02b1e718561535e48753a0aa211c47fb10a42a1169d333bc71922c0ac5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245256, "uuid": "fa039aa1-5d51-4395-9edd-1c6ce18a8ed9", "value": "T139B22FC87FC2F2A2137760B32D1BB049E25B2941F58C5199E274D6A4F930728E8F693C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245256, "uuid": "e62d9c40-cc25-4f2f-85fc-f7ce334f84d6", "value": "384:gEypWyfPMHHMALwKeRc+34eM/fO5gV6DQjMgyLH4hg:gEypWoMHszv34V3O586DQIg1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245256, "uuid": "cd025308-3c62-4b81-a577-616d893325b2", "value": 24703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245256, "uuid": "093ec320-d735-4ff1-a8a4-7d47834264b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245256, "uuid": "bbb3fe79-5f52-43c2-88b3-6f8f6861a0fd", "value": "Potvrzen\u00ed_platby_0003112025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02a959a-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289876, "uuid": "75f8c5ea-9a04-4184-b90b-291390a50c02", "comment": "Malware payload", "value": "89fe7834f9d946aae27fb7539a45a848", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289876, "uuid": "14de6265-603a-42af-9305-b43d5f2d361c", "comment": "Malware payload", "value": "588f35133f3b40ab2b2388337f4350ef394133a743110b48b1a7a065c17ed40d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289876, "uuid": "2f4a9b1a-07dd-43ca-a97e-cf6ccfc80509", "comment": "Malware payload", "value": "631ae0dd226a90c758c00e4fa38d2e4c499b4813", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289876, "uuid": "1f61c5dc-ca0e-4b05-900b-7b2426f8fa6d", "comment": "Malware payload", "value": "43e2c2ce0fde594b73a806c1b84765e285ac3929b3f0956fc20591ca59467fe44ae9fbd8ec021fcc30bfa78da8016244", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289876, "uuid": "4b364b53-b843-458e-8ae6-fd206f6d3b1d", "value": "T17F21AD3CEAA4FCD4036FB5D4467A3E86209C5B23E660376CF9C1089710242DADF3608D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289876, "uuid": "67a81fee-0d67-4a87-bd0a-e77752a6633e", "value": "24:AF958fmoEEGy/V/KpddWg0zdSucpF2k9imumwn8hCkmJRqtPYbDfWJBRHBJQnvnN:ATOfmoEEhNzg0JSlFxvhnmJgtPbvBJyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289876, "uuid": "b6cc8742-16d3-4ca0-a7b9-b0b9fe233458", "value": 1311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289876, "uuid": "30b9bce4-68e7-40e5-9cfe-8040476b3526", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289876, "uuid": "6b0c6480-1c48-43e1-aee9-75d9081da2dc", "value": "Docpac.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1eac40-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (FleetDeck)", "timestamp": 1762244690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244690, "uuid": "446d8471-4c9f-4c0f-9f55-2c4270678bba", "comment": "Malware payload (FleetDeck)", "value": "d303bd4751f3088b46d7c0ec8f2e54c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244690, "uuid": "14ea75da-571c-45be-bcbd-04b4e7c4e43b", "comment": "Malware payload (FleetDeck)", "value": "59068556c09bd777b2ab45d13f19842f166b994eab856e2a87a6ee39d7fe18df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244690, "uuid": "f626a016-fb7e-4618-b713-76a36e7eb3cc", "comment": "Malware payload (FleetDeck)", "value": "d88cf42ee56ccfeb7e895d242cfab0cbd1b6af27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244690, "uuid": "8ff106ae-2c49-4729-b03e-29b46064a597", "comment": "Malware payload (FleetDeck)", "value": "d8f22b8a960f0705e5b93c8d56f115321a0b9fe071f731b34c6ad7d35217f1327893a74a1bf2b1461319b28d529dfb60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244690, "uuid": "0037f6cb-9100-40a0-93ef-eae0523ea671", "value": "T12D16CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244690, "uuid": "b1652c28-86c6-4870-8bae-f525b746ad92", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244690, "uuid": "2a6f3e31-a97b-4b5c-9b76-e6cd14720b82", "value": "49152:IP0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snUp:IPtZAl3XzKnaIcDgRjOl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244690, "uuid": "e6b53789-831b-4421-aec3-8cc4bba8b241", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244690, "uuid": "19b07b1b-20eb-40a6-8f9b-ca003caaca31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244690, "uuid": "ba8e5f93-3b1b-4b7b-bcc4-ceb3b3ba64f8", "value": "WalletConnectdevRestore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d71e7c8-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762245418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245418, "uuid": "4c52c875-4ef8-4237-9ed7-66c37464f4f3", "comment": "Malware payload (AgentTesla)", "value": "211dbd443b34d1421a2e8d33911fd558", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245418, "uuid": "9f9c348f-d186-47e6-91d8-1d274cc61787", "comment": "Malware payload (AgentTesla)", "value": "59a71277745cd5899efa4f959ff05b1a3bd755a3315e5011d4ec239a5c577956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245418, "uuid": "0eb87176-865f-4af5-a509-e55f5148eac5", "comment": "Malware payload (AgentTesla)", "value": "a20ebf3d0b6f032410ed4f33f035863b55ca204a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245418, "uuid": "0c7dd71e-6a69-4c8b-84c5-9241a13b128a", "comment": "Malware payload (AgentTesla)", "value": "141a1d3be4b528407d3062a98cfa6ba477307bcd8d77617cb36e95757c10b0a5898071e37500219b69f029c1973d6fe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245418, "uuid": "7c18381a-8fd5-4b8d-abdf-34ee8b54ca46", "value": "T1EB83408E7DC5F9624665E9333E1F70AEE4BF6C80744C8502CDB9BC64F528718D8B162A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245418, "uuid": "6a78e1a5-906c-4425-b91a-05b122c9cdca", "value": "1536:sF7Mq6nBYMXcbosc/Ef3DwGEA6rxVLZbFJkrYGy:VHjMboS3sGE7r/+Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245418, "uuid": "58e4f956-cfa8-4787-afd1-d5bfebd689b8", "value": 88759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245418, "uuid": "e479f52b-77e0-4496-b0a4-bbea64a0ae53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245418, "uuid": "9e31231e-a855-4a6d-b485-2a5d8247c795", "value": "Order_Specifications.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26b8319-b9d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297933, "uuid": "3b9aba6f-62c0-4f99-a19e-ce428f6ee30a", "comment": "Malware payload (Mirai)", "value": "28d9f2cb14022770fe5d80402a7953da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297933, "uuid": "ca5d9b2f-7a01-4bb3-91b7-31b98cda9304", "comment": "Malware payload (Mirai)", "value": "5a55d7f0ab99e1562580398b936076e9128c731863164f193930ee1d64206a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297933, "uuid": "3b4b4a06-4344-4012-af30-bb90422cc40c", "comment": "Malware payload (Mirai)", "value": "bc491127c3e38243312dfa5e51ea277ec67da830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297933, "uuid": "e1943a16-13b8-4713-85a3-eeb251e043ed", "comment": "Malware payload (Mirai)", "value": "cbe9ff435ccbf8a74a5730aeca1eba83f1fa3489fdbbda0c127a0589816fb44a28233829479062c86e31eede88d65b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297933, "uuid": "5dd23fa9-9713-4742-aca8-ba0e1b71c3c9", "value": "T1DCB31A46F9819F12D4D732FAFA5E418933136BB8E3FA3101DD246F6123C699B0EB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297933, "uuid": "39b83c54-1185-4f2b-aa3e-7998eece14c6", "value": "3072:NR2oP67+hQaBqqrBmdMOlDPQCw/H0rM6y:NR2NsQaBqqrBmyOlUCoHMM6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297933, "uuid": "f154b1ec-18ee-4858-8a87-6ebc4374e69b", "value": 111764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297933, "uuid": "55042dd0-30d2-41bf-ab47-9abf7052b74b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297933, "uuid": "530ede74-993b-4e28-be7c-c69a7ca63f86", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b86eb50-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762245442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245442, "uuid": "9919a01c-62a7-4f9b-aced-5bc14c6d00fa", "comment": "Malware payload (GuLoader)", "value": "4404cdc677c17ebcfa0d9a46c4074490", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245442, "uuid": "c3b31df5-3c04-4894-aa7f-4ed6b21f7b22", "comment": "Malware payload (GuLoader)", "value": "5ad19c369d5cf7905ca29c5fe3161328ddf5dd5eeb92c0224cfda5572f1350f7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245442, "uuid": "45156439-6bd6-4e84-8f92-ac5bb063c7eb", "comment": "Malware payload (GuLoader)", "value": "edc1e3b6fd8603c6bb83d537e5a72ebd0e47be9f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245442, "uuid": "89b804a9-5537-4990-8148-bb2ef3533f55", "comment": "Malware payload (GuLoader)", "value": "c94966d9a9eea639d3393fe0330ce68a337050dc0508ef3170f43c2cff6d89303a2ba3d69eb4ce7a37e70355bcac0347", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245442, "uuid": "36e2eac9-3c80-4fea-a1ab-8c2a1ea783eb", "value": "T10093E561DD35155B098F2E9EAC4C0AB1C5B885052D2720F9FDE9134F710B9ACE3BEA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245442, "uuid": "1f7ef303-fb25-43a1-91f0-2de8c2281c8f", "value": "1536:lzzcPfeCMT59+wd8JQYJhf5vF7hy7Aji1TuK+H0Cuo0gbpo0Kdpue4snzS:h+f5Y59EQcNha+iob0roJpKpue4s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245442, "uuid": "9eaaf578-c126-4ef6-b5bf-5f8d4fb7d086", "value": 90508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245442, "uuid": "e78356e3-90b5-4f4a-b60f-954737ff5962", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245442, "uuid": "21c55609-c99d-42ee-af04-98c1d1186e7f", "value": "RFQ - Hassan Allam Construction.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3996f2-b9d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762299905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299905, "uuid": "2ab02d85-157f-4b35-9f4c-17a0a242c75d", "comment": "Malware payload (njrat)", "value": "728caa2921605eb4fd19f1d48653e29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299905, "uuid": "7bab4123-1cb4-404f-a580-81374c4c4585", "comment": "Malware payload (njrat)", "value": "5ad64b6710d8a21f4800f3b45e5bf7ed96fa4072486e94db13b81f5f44ba367c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299905, "uuid": "36ada8a1-bd9c-4588-92b8-f167c91ae830", "comment": "Malware payload (njrat)", "value": "ae87d80c4c08bfb739bd75cfa54cad525a41489b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299905, "uuid": "48731dad-c433-4d43-940f-0d3eababf591", "comment": "Malware payload (njrat)", "value": "cf3034bd0c7ca59eb9c442093b0f8ba1cf4235ca24aa7e41e490f472debe8f179cf9c06736aca2ee44a79ecec820e3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299905, "uuid": "2fa67610-cf04-4e0d-9771-6d2275c588dd", "value": "T108534A7A33B7B92BC12DCF70E593796117BD81430E029B5AECC24393DE161B8254BD9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299905, "uuid": "3027d447-8820-447c-b68a-5018b4330ba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299905, "uuid": "b8b5660a-8513-4d07-81ae-83730138a950", "value": "1536:zUPyny3Q/bfBd71URsSogRb13/xf10XGrFgGB:zKyy3+bBd5UReib1910G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762299905, "uuid": "22d4622d-6032-405f-8699-245c6dbe6b0a", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762299905, "uuid": "9d7509fb-8299-42e4-925a-29621eee005a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299905, "uuid": "fa2d06f0-9508-4cc4-8d28-3173eb4adec6", "value": "728CAA2921605EB4FD19F1D48653E29B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e25e460-b9c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289953, "uuid": "675be69a-ffe4-4536-bb02-8974aca5facc", "comment": "Malware payload", "value": "1427095db6ff4e41c970d3a138d663f9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289953, "uuid": "a43c5e9a-988b-4455-80fc-2a3d5270462d", "comment": "Malware payload", "value": "5adea89e760512a15f42da8a308eee14db4e6db0762aaa683dc2c4bd4669a4d5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289953, "uuid": "1b79efec-61fe-4a2b-a9e7-b39ee1020bf9", "comment": "Malware payload", "value": "5b82698bd27427aa76a3499c173bc255a8f38934", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289953, "uuid": "92719cb4-4814-4d61-ad71-6b534f97aae5", "comment": "Malware payload", "value": "60512e505450414450cd66c786e590e7623bde1783c35bfc578776f4ff583af8337f6a42adaa77b0c222c0f538a6c5d2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289953, "uuid": "368a1648-da6e-4940-8656-425d2bdeba18", "value": "T11272147BD55CDFF00B2F21F041873D1520A49326A83ACD6DA8DA8155BF2A7524F978EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289953, "uuid": "6e252581-9b60-4ab9-8025-c3ac8d42c8af", "value": "384:XXeXWo/l7hX3pxmsx/sH/a7KPdpt81v/66+w5epNrq0:WWGltX3HmwkfiK1p2CGwjrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289953, "uuid": "697d45b8-7e76-4944-966c-490e895d6a9e", "value": 16644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289953, "uuid": "02ac399f-20df-4372-8344-44f9310dc55d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289953, "uuid": "22ef8e64-6812-46d3-b8bf-87a023f67577", "value": "generated_script.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777eb292-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236416, "uuid": "f53296d1-ba12-46b6-a3dd-cb9ce5caac7e", "comment": "Malware payload (Mirai)", "value": "0ba3f45aaaf4914b3a18484d797c4d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236416, "uuid": "acc8a069-24a4-475f-9261-db473d624d4a", "comment": "Malware payload (Mirai)", "value": "5af66406e0c2af4773a9f2efd99461788fed408cc0d67a91e8a553f25c53b912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236416, "uuid": "2cabf953-ddfe-452c-83e3-19bfcc08a3fd", "comment": "Malware payload (Mirai)", "value": "86e65e3d1455b1c24f08aba2905153d7887e0c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236416, "uuid": "76c504e5-665f-47d4-8ed7-d934ef8918a6", "comment": "Malware payload (Mirai)", "value": "e11c08a3387fa3cd0ce65dc4a4f71bbd88cb30bcc62d167e487a7763c2c49b5c25f5597bfd0e608edd55eac41f95e620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236416, "uuid": "346aec41-7f5c-4cf1-b912-7fa76ba68e5e", "value": "T110735BC4EA4BD4F8EC5606342073F72B9E71E5B91138DAA3D3E49732B843651AD0679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236416, "uuid": "e8cf3935-5af1-45d4-b446-baa357e15837", "value": "1536:iTM6sR1W4h2BGr1V/wVRjKKoO7jYUeYhdEUADw3oLdh+q5PH:cM6sR1W4h2BG3/0RjKKv7jresdUDao5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236416, "uuid": "82f77a5f-b73a-4297-8875-0722c5261936", "value": 79408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236416, "uuid": "fcd7248e-2250-4fc5-b8af-89ff8ebdf1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236416, "uuid": "3c49ee78-e18e-4e61-b326-a5e3a8b95078", "value": "FGx8SNCa4txePA.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64356992-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236383, "uuid": "4f405a01-55d1-41e5-a070-de51acfd487e", "comment": "Malware payload (Mirai)", "value": "40b8ad461480e512534bc420e103b56e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236383, "uuid": "837b6df6-1a91-4b69-8bb0-dd226b895362", "comment": "Malware payload (Mirai)", "value": "5c03a5d6315a9e3c90f42441470498e91b423dccc1d0c357e47ad6aa437e77d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236383, "uuid": "83637820-5db3-470f-ab56-4248f03b045b", "comment": "Malware payload (Mirai)", "value": "7a9b89ee4da2027d1092973370475c2587679df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236383, "uuid": "ddb3df50-3913-4b77-b105-fa47d65bdb28", "comment": "Malware payload (Mirai)", "value": "7dbb8863cdc6489f3cecb9ad55c8c1204332e14c666b1d3e7bf9705ac13732867ccf26274d5dd3bef9ea48eaa71a43ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236383, "uuid": "bbb5c0ed-3dd7-4a29-a9ba-bff3040c0ec4", "value": "T1E8935C317A791B13C4D0A8BE11F74729B2F196DE61A8C64E7D720E4EFF206502947EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236383, "uuid": "672d39fc-6ea7-4a7e-8c30-cf0c833bb063", "value": "1536:8eKDBzpFFcXW9CDBMo9G7MfXY8qdmO6pIskHCP75ktaVh:3K9tkWKWmp3kiPVDVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236383, "uuid": "6ee75746-ba34-4211-bdb0-789b309d8d1d", "value": 89528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236383, "uuid": "9e1279e4-3ce2-41a4-a219-c8782e6e3bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236383, "uuid": "901ef76e-155a-4b8c-8bbb-87f22c2cdb3d", "value": "FGx8SNCa4txePA.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e4458c-b9d0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762296522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296522, "uuid": "77a3a72a-9b19-4b81-b4f4-00e34ed4d964", "comment": "Malware payload (Mirai)", "value": "bcf309481b1a6d974808a14e61912891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296522, "uuid": "d646051c-1514-49e2-9022-e804f7f955a2", "comment": "Malware payload (Mirai)", "value": "5c206addf1b03b981e7ba3cd188ae2b8644e0cfa0df2752503222571b01e1a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296522, "uuid": "48688cb7-0c6d-4bf0-aeeb-8d56d4caaca4", "comment": "Malware payload (Mirai)", "value": "2a625267e648d8f64aeca366e6da0d0fb6fad341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296522, "uuid": "9de82849-73f4-4444-aa39-14c95523780e", "comment": "Malware payload (Mirai)", "value": "d0d4b8468bc70c952e4dd617fe38a586147b880e6c368ec20b906030a624d96a38ee17e8c96f7ab7cf38e8046b2252c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296522, "uuid": "d1fb7a1f-2261-49ce-bb60-22f689bf1ce3", "value": "T130B2C04156CEC573A2318C7DAB6DC3C6279B41B8C0DAB2E116B8A758F84201953FDE7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296522, "uuid": "4bef0246-c263-425d-9dd4-025b814b51e7", "value": "384:6IZ/sS5+TU3Y2dxMlhhfOkPrzZUUazSSNiBB53VWBXRGhymdGUop5hG2u:R/mSrKhhWkPr2fSScBTFWNRGs3Uoznu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762296522, "uuid": "adbad209-a460-46ab-a48d-2aaec655f7b2", "value": 23536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762296522, "uuid": "1dde8753-a7c7-46d8-bab0-627788c06dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296522, "uuid": "81dda45b-81fd-4168-b4c6-c8b0cac3673d", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce5e3d6-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762249095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249095, "uuid": "099d84bc-7040-4416-b1a3-54cf65a0d8d9", "comment": "Malware payload", "value": "374787e898c3ef23c92d9a3dfc716afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249095, "uuid": "2c6f17c3-d38c-47ae-a98b-a50a56b81183", "comment": "Malware payload", "value": "5e78529d0e8fd4937657bc73b1103d9629a1ea6f581b0b03a89a5ebe3130fd04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249095, "uuid": "ae4fadb3-4d9c-4272-b049-024d340ccfc3", "comment": "Malware payload", "value": "7495a9daa156e568b0f29b87353510c8b5320903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249095, "uuid": "9338bf64-abc4-4c67-ba4a-d116982186c8", "comment": "Malware payload", "value": "ef11d4334b1acef585644aa1dd41237759173757e56c76d0a8b485005fcfb4c265108a8f4fa00369a364632714991829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249095, "uuid": "f3381bb6-e73e-4b1c-a333-126fa94a2da9", "value": "T14EF39F45B2F40198F4B7A57895B5B11BE47239505B3087CF23E046BC1FB27D0BABAB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249095, "uuid": "a52f8202-e5d4-4240-81eb-f16375d8e5a2", "value": "50c8efd56811c37490d3de6b90d59156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249095, "uuid": "14672c66-d402-4357-af09-5776a5abcd27", "value": "3072:gpQ5EHiPCXFzn0pBYoTlHGpS7bAHxuCPBzowBA9adFUbIkhy:9HqXFL0tTlHGibqwCP9+Ikhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762249095, "uuid": "ef2b81c4-e612-4705-b700-20bd2a591e95", "value": 165472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762249095, "uuid": "bc767c0c-f7df-48fb-995d-a360be07dd08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249095, "uuid": "0929ce71-f23e-4c0a-9d43-e5ebfa30e733", "value": "5e78529d0e8fd4937657bc73b1103d9629a1ea6f581b0b03a89a5ebe3130fd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945acc54-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244625, "uuid": "eee3830e-917a-4100-b116-89ac339d4ce9", "comment": "Malware payload", "value": "bec1888aacbce4103557cd55f85ec0e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244625, "uuid": "f123c3e9-cfe9-4a30-b3b0-e3f0f708ee0d", "comment": "Malware payload", "value": "6231d64a140831a1445506f506eaaaddb6c9209c3d7c930e1b713a1d271cdc14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244625, "uuid": "aa8d5d89-957c-4932-acf9-82b904c144b5", "comment": "Malware payload", "value": "04c4a40fd50d1da94c7919eaec4e36681375a1ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244625, "uuid": "e50aa509-ff5f-4fe2-b268-de3b326b0bdf", "comment": "Malware payload", "value": "b01d9507ee7b39fd06e5437a30316b41d00d6765cbe5fc8bb42b75225d585955f68f4c6e3775503b382c602bcda689bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244625, "uuid": "5107ef5e-d92e-4955-ac59-ae6902625deb", "value": "T1450633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244625, "uuid": "45063761-ee83-4bfc-846c-1a57ff042539", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244625, "uuid": "8426ccd4-bb47-4f3c-b2e7-b7c7724ca7d4", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:c2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244625, "uuid": "5527ab75-6931-4021-b7cd-70130b278857", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244625, "uuid": "e08551e5-65a5-4ac8-bc85-26d29be7f596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244625, "uuid": "feca2cfe-f1c0-4c56-a340-f6e23950b3ae", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9d7f11-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762244581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244581, "uuid": "1a411779-b9dd-4d0e-8505-6e29b791262e", "comment": "Malware payload (Mirai)", "value": "7422c5a8c02bd2f871e5b4fadf2ee1eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244581, "uuid": "3f872069-62f5-46e5-b7e1-bbab9a6095e9", "comment": "Malware payload (Mirai)", "value": "62ee38f06cbd74b3c52dc8c0cb5b7b05bd24add9441b50e2948d1bbed7393578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244581, "uuid": "fde62035-7d8d-4fe1-860b-96fb98eb99af", "comment": "Malware payload (Mirai)", "value": "059dda14af8f457712fc7c0c5ec057fcd306de4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244581, "uuid": "17c1b4f0-e6e9-4f06-83a8-16b3c9ad9f5b", "comment": "Malware payload (Mirai)", "value": "ba1e0bfee60c6fface2ce2997dc92d7cdd7d6e09d0f6af61765c9af4fbe60d8af6a131ad20045c0ea78ed402222d260c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244581, "uuid": "fb57a709-1c2b-4707-9105-5f33045ac96b", "value": "T1DA736BC9F6C3C4F6ED120A311173BB365AB7E13E2269CB87C3A8957AEC12541E15634D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244581, "uuid": "4cecb6de-6b91-4658-bc6e-448c577da715", "value": "1536:yC1Vl+X2zFOHMvI41pFw2C4itPLRVQV/3SCI:hMX2ZOHMvX17whbZlV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244581, "uuid": "55af1f59-d93b-4ec7-a472-7deee0d7c22f", "value": 79700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244581, "uuid": "6fe937ad-5b70-41b0-8694-f88e85e257b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244581, "uuid": "67886703-7afd-476d-80b4-25abd9aa6742", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc7c99f-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239780, "uuid": "43ee1949-c625-4605-a790-204d227877dd", "comment": "Malware payload", "value": "b7ac67acdedfa8c5a6857549b7200261", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239780, "uuid": "df16e872-d024-42ae-9875-2668d6c84e59", "comment": "Malware payload", "value": "6342f3a142e9f42c767ff579b708c68f0371c42efd45b430df32236b57d1b6f6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239780, "uuid": "7ee79267-6ef1-4bb1-9939-20f3f04a9b8c", "comment": "Malware payload", "value": "7204884a4b802863b833efee82d9747246f7b9c3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239780, "uuid": "501cef37-d15f-4309-8f6a-8a1eeb813505", "comment": "Malware payload", "value": "4f34ffb847bb3004b10d5d9d77699955a54cdb12c9028c6876e35c9aaedacd3bca3261e34a99c656fc2c82a8aab82b29", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239780, "uuid": "f063277b-9274-4525-8adb-e3b24f9e9881", "value": "T19656F187F798A92FC87710B2897E527115874C128E839B436D58720C6DBBAD43F5EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239780, "uuid": "6f6fe9f5-89ef-4f59-aa43-71027a515925", "value": "98304:4dPzr1gLCrSHAfPSLGIiHgb5Oq0Q8reT0DAar7oUa67KI6owyf3ifhOq6uPpAHEL:2ULyAbk/zrAsJr7oRcKmSkq3RkEh17H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239780, "uuid": "66d342f1-523a-411a-bae4-687fe9d3abc3", "value": 5906255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239780, "uuid": "fd93121e-d862-48da-9952-dc0308686b99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239780, "uuid": "6f4eebad-c16e-4c87-854d-39089d4d969f", "value": "download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac58435-b9d2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762297276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297276, "uuid": "1029858e-3dcc-4357-b0ae-d296cfd086f4", "comment": "Malware payload", "value": "838e5c5d08eb1a59a5b891cff7e2659f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297276, "uuid": "f02d6571-48b6-45db-8b38-0d5761a4d1a6", "comment": "Malware payload", "value": "644043c21025ac97dfc9f484b12ce59832a95b7b87f16710cb4928d197c04e47", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297276, "uuid": "e3879673-70ed-4932-805d-99e68adb025f", "comment": "Malware payload", "value": "2bf74e6aa84d13900400fbfe4c61b804fb09c9de", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297276, "uuid": "e060f5c0-8f93-4d69-943d-c7a2f6dd0175", "comment": "Malware payload", "value": "98e395c5eecb5dfab7e7f6a5ff9e4b0bdb4139fdb1592d64ab5511c1c7134b2c61f5bfc1fd4bc0f91d2258e178e9a262", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297276, "uuid": "4beb63ca-d758-4d71-a5b8-eb85b2e25b08", "value": "T16F169D17E39901E8D06BD678CA569232EAB1BC460735A6CF0698F7552F33AE05B3F311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297276, "uuid": "fdd72410-ea74-4540-8c40-6e11fed2cd20", "value": "49152:2/RynhYYlEbb5Q4TT05haziJgVUIqa0yOrPOtSArMGTIpOoRjjDw1baKeEBl:2p2WizJgVyriM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297276, "uuid": "04a84096-f509-4856-ad1d-b12e1b8a7191", "value": 4182016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297276, "uuid": "7ad01f43-cf50-42ec-b8ed-c0b83bd9a174", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297276, "uuid": "a158b1cb-637d-4b96-a36a-181077a5b049", "value": "nDatasheet.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe74de3-b955-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762243832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243832, "uuid": "13c2e62d-4980-45eb-9482-0243e0e4ff38", "comment": "Malware payload (DonutLoader)", "value": "000e50af7b6fd0145550c61b32fa6f12", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243832, "uuid": "bd88d0a1-5d63-4a17-be39-a031563060bf", "comment": "Malware payload (DonutLoader)", "value": "64778aa8864822b78ca0d0aa70258ae236f8ad0f43957a78d36f28f41e217205", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243832, "uuid": "b8a4cbff-d6c4-4394-bb61-2dfdb601695e", "comment": "Malware payload (DonutLoader)", "value": "148b3baa9082035c719a892c605ca98f1c36e91e", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243832, "uuid": "bbb45f36-86c3-4cf3-a419-3557b7c37856", "comment": "Malware payload (DonutLoader)", "value": "f824b85ff5cec8c49fa19ad20c46fbc53894378802c823ecd73c5bad90e54aff415e58b4ddaa772948f69d4261df1869", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243832, "uuid": "a8542cae-5742-4a29-a17a-4798794ef5cf", "value": "T139E423D11A54530CE56CEAB68F82BC06A87EBD794D4D055D0CEBE9143E8FAEAE730071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243832, "uuid": "eb48d5a0-3e49-4118-ab53-2c2264e0ea99", "value": "cf9fe8688c9cad7a9539ec9bed0bae85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243832, "uuid": "b452002a-6a55-446b-bcd1-7bcc449c2277", "value": "12288:PecFGtMMlmAl+Lv0/vWLl7VLwlPeT7b9Brzsj3e7NMihfmMY+uv9UnhPT8di:PRFepmAEL0/+hpLc2TtBrzsj3gfjilsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762243832, "uuid": "c228832b-496a-4627-80cd-08b8f3096d97", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762243832, "uuid": "adba2e9a-1f71-437c-bbbb-019692214eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243832, "uuid": "e961987d-1be0-4f4d-b210-c1559ac41733", "value": "Whisone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a905005-b94d-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1762240206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240206, "uuid": "fce73f1c-867b-48d4-b685-d8d8346e22d3", "comment": "Malware payload (GoToResolve)", "value": "b1517bb336f42a3b8894952e30548b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240206, "uuid": "30d44690-59e0-4bbb-9700-6494da059c24", "comment": "Malware payload (GoToResolve)", "value": "64ac0cad9f4c938f2b5a4940964e3de96699c0e6651954be8bfda7923cf41200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240206, "uuid": "06c9a517-6091-4366-944a-9f7eb1e50f97", "comment": "Malware payload (GoToResolve)", "value": "49dd3dd4acdb359d0d6535960223526ce86f5227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240206, "uuid": "322030ce-7c30-4177-95d2-c97888c7174a", "comment": "Malware payload (GoToResolve)", "value": "2ee23ea1409daf6f3014befb8d55aa13fa3e767ad221908d6b535cdece47fb02aa865fefe0c41a04b46e8bf272b414e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240206, "uuid": "9310a4a7-585d-4d08-b199-95b36afe4daa", "value": "T1AC37333132568471DC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240206, "uuid": "5fcf06ce-f71c-4316-baca-cb33ccdbb675", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240206, "uuid": "38da97a2-1be0-4036-90c1-d077b1d1cd7d", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpx:q9WtLzgOTbjZvk/ekS/mcpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762240206, "uuid": "d66d976f-957b-4d82-985a-1639056c92ba", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762240206, "uuid": "cde5cf73-256b-4f42-866c-9bb7d4fc7619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240206, "uuid": "5cd795dc-b345-4b94-8c12-bc84fac6b3c4", "value": "ZoomWorkspace.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccd8d93-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762268019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268019, "uuid": "cc4ba490-076c-4534-9ef4-75626bbbdb4e", "comment": "Malware payload (Formbook)", "value": "60c03ecb938f1ea4c659d5f50617a0f3", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268019, "uuid": "4949ea4f-609d-4dfe-bd63-b1d33a9eb051", "comment": "Malware payload (Formbook)", "value": "65bf773423063f4ebbb59dc582718020b0eeeedb2f3786f09d12f3b890595973", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268019, "uuid": "f0938d93-c49a-4e7f-bc53-867531362286", "comment": "Malware payload (Formbook)", "value": "cc4de1c11f5f6303f0815f2fb6b5dc1767439564", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268019, "uuid": "0aeb5a6c-294f-4951-97ca-1eed5505871d", "comment": "Malware payload (Formbook)", "value": "95f9e19b886856ac8cdf17fd6ee0d1f46fc00d8608086458209a7b988b0be6e4d3555683ef17764fbde8dad45c6dd3b3", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268019, "uuid": "5ed26c7c-a8d8-4280-8960-d93823e056fd", "value": "T1E7542307E81C269FC5D1043C2796C094C6CA87B21F46D75A722DF68EA63DD6E2EB0783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268019, "uuid": "408753b4-877c-41ea-9d9b-c22f4991275e", "value": "6144:yo/zjN2Cm7DMNisXkhQeihZY7xSnY1PVSiVxsRrSYGSPfsDB9DiF+UmvsnzPX:X/zjN2Z5ENnAgPm124BZc+4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268019, "uuid": "d1cc936e-6a40-4f1c-9195-3259f4af9b27", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268019, "uuid": "80e46929-df2f-473e-a899-3a4b2b8078b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268019, "uuid": "807b7689-36a4-4de8-8ce9-e94eef7598fa", "value": "formbook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9fd2bd-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245471, "uuid": "69ba2762-2c31-4d30-a853-674fb11e1e4d", "comment": "Malware payload (RemcosRAT)", "value": "3043db9d512d6eec70f3bdf3efbd9815", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245471, "uuid": "9d3f364e-aead-466a-93a2-fecb709f84f7", "comment": "Malware payload (RemcosRAT)", "value": "6660dac885d404ab9ead2af117ff5f8e0c3760cce08707c993e5e6ccb44d73f9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245471, "uuid": "1067c0e2-aa0b-4893-ba0e-102b33768780", "comment": "Malware payload (RemcosRAT)", "value": "80dac4dbef4eb65e274f182b06bcb9f603b309cf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245471, "uuid": "64612174-41ea-4f8b-ab53-8ff3fc3a75f6", "comment": "Malware payload (RemcosRAT)", "value": "a8ed580be43459fec026bcb4db52adb9daa3c00900a68de331de5c449d4d5a726fda176aca76082686e79907eaba3c7b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245471, "uuid": "908134bc-7f12-4993-86e1-7746e6c5af41", "value": "T1125317E6D8F25613481633DDA94987F1CDB9C1C0262396F4EEA5531D3036AA873BF21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245471, "uuid": "1f20d655-591c-4b46-bf91-04f0ad118ba1", "value": "768:mIBoFJpmtBaGfGB5ovkHnQPgWLyOyebTTlPkLp32hkBF9FZgn8agjOxL5:mIClWaGfGBjQq9ebTTlPskUF9a8ai89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245471, "uuid": "8cf0a2c5-e6e2-4342-9d32-2b1ec1d697df", "value": 65508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245471, "uuid": "9a51075d-7fce-4e08-b145-5507396d0c19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245471, "uuid": "ee19b199-6b36-4a25-b33a-9c070992c381", "value": "Order 12# Revised.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8515c6af-b94e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762240733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240733, "uuid": "f1fa7761-ff21-43e8-9e76-4570d8207bea", "comment": "Malware payload", "value": "f5bae92d3598a423e35349913294384d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240733, "uuid": "5ed43877-bfb1-4e2c-8619-42e4a5b175ae", "comment": "Malware payload", "value": "66d0040243556fa049a2b42fa053f4d37df87edfe227ff20365a9f2677945745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240733, "uuid": "2639799f-c3a3-4ce8-9874-402c011ba1cf", "comment": "Malware payload", "value": "c4e0142079122fe389db801d80f2eef0862bb4e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762240733, "uuid": "d5c56162-8861-4ade-9ab2-0f9ef434abc6", "comment": "Malware payload", "value": "e077e85a9c1f432ebc235fcf8ab88b93079bc667fc97b8808f1af949f925822deace3c3734405526c8b5b92f6d349336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240733, "uuid": "bf48a9d0-5c11-405f-b477-06d3f385f5b3", "value": "T136754B4BBCE058BAD0AE9232896651A27A71BC440F3127CB2E91F37C2F727D19E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240733, "uuid": "e3e181ea-a3b6-4a09-b623-85446298ad01", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240733, "uuid": "821953f7-d1bf-481b-8f30-76c7a0c7b26a", "value": "12288:CqTg7zhqIwx2AzR4vjzRfRILQ6iEsk6azjRUn8RdTgfV6Ux4+oV0Y+ttBoMujk02:Cj7vwc0RQZUQ6iEhjuFZhvskuaJBAXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762240733, "uuid": "2f9a301b-7264-44cd-8084-b45f03819988", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762240733, "uuid": "faddc631-3e8b-4d71-87f0-ddad546f18b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762240733, "uuid": "25e58e70-09b0-41d8-856f-b6333171aaa5", "value": "66d0040243556fa049a2b42fa053f4d37df87edfe227ff20365a9f2677945745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c11124-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (CyberStealer)", "timestamp": 1762244567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244567, "uuid": "c4bde455-b717-4804-aaba-16dbf4797363", "comment": "Malware payload (CyberStealer)", "value": "88518986df458711849b49987a2da449", "object_relation": "md5", "Tag": [ { "name": "CyberStealer", "colour": "#E50867", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244567, "uuid": "ed69654e-eeab-432a-bf2e-1094b39c553a", "comment": "Malware payload (CyberStealer)", "value": "673243eb584ea8ba0046d0657c977d51cdaf5781d474b791527d4c26035a7847", "object_relation": "sha256", "Tag": [ { "name": "CyberStealer", "colour": "#E50867", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244567, "uuid": "8d126e6e-a202-44b9-9baf-b60e9260612d", "comment": "Malware payload (CyberStealer)", "value": "0e66886978985517d4fb83cb506a637537c29000", "object_relation": "sha1", "Tag": [ { "name": "CyberStealer", "colour": "#E50867", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244567, "uuid": "b4cddf7f-c5af-41a7-9fd5-a93fea3a33db", "comment": "Malware payload (CyberStealer)", "value": "7b35dc7df29f71fe1ba037c343cb3b41064e1ffedd6d283e0742f47a2e8f0d080028164509012d23bb89cee39563d765", "object_relation": "sha3-384", "Tag": [ { "name": "CyberStealer", "colour": "#E50867", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244567, "uuid": "41eab8a4-71ac-4235-bc61-5edb489ef56b", "value": "T174652A17E6A344DCC16FC134C7679772AA30B8294134BD6F1AA4DB322F25F509B6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244567, "uuid": "aa64e29b-4770-4b60-8a95-305470e87b8a", "value": "e06895cef303722eced2e51335c5fd9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244567, "uuid": "cb3a3fc6-3ca0-4751-86be-2399c0f15e77", "value": "24576:zNZYOUkyvAks/IwjqPNH+6jg563wrFCKVPMeKV5wBCmU:hyOUkyDs/sPNH+6jg563wrFCKpwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244567, "uuid": "e286ddf2-fed7-4bfe-8e8a-8a90f537672c", "value": 1420288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244567, "uuid": "f379f874-ed0b-4af5-af85-407841f3e1cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244567, "uuid": "8fc82c81-2acd-45fd-a0fd-515e6b86ae61", "value": "ChromeB_test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdbf0bf-b9ae-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762282032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282032, "uuid": "42117941-7c38-4091-a588-f5c9f5325769", "comment": "Malware payload", "value": "a6df6466331f188c23292f59b6fb1bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network ransomware", "colour": "#4222EE", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282032, "uuid": "a91bbe9b-bede-44fb-a106-dd76a0635b29", "comment": "Malware payload", "value": "68baa671a39b1bb7b58d0924c3238d7dd571d78fa0fd2748edd4df360f7e9f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network ransomware", "colour": "#4222EE", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282032, "uuid": "3f4b7451-6578-47a6-9ed3-1300ed0b016a", "comment": "Malware payload", "value": "2cd0371aadfe60cd3f552e026dfa0ea72b1aebac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network ransomware", "colour": "#4222EE", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282032, "uuid": "fd00ba99-e885-4ba3-a4ca-15d6d86c6658", "comment": "Malware payload", "value": "ee2893646d40532cb895fca35578dc408dc5bf120f136c09e6d633633360316ee87c855e89c1228e437a3c68a4b81f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network ransomware", "colour": "#4222EE", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282032, "uuid": "30a7ecdb-12c0-4a33-ad3b-5bf1a8700a73", "value": "T1B2B39E45F3E202F7E6E2053100E5712F973667289B20A9EBC74C2E529953BD1A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282032, "uuid": "869d31df-acc6-4217-ae6d-e49e4ed84dd4", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282032, "uuid": "4fc1fcd3-ee6e-4263-926c-5fdfce4a2101", "value": "3072:C7DhdC6kzWypvaQ0FxyNTBfQmX8ll3vlZ8iY:CBlkZvaF4NTBYmX6+iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762282032, "uuid": "e83c1221-c120-47f3-adb1-5260753e48ee", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762282032, "uuid": "7567b341-fe9d-478f-b08e-c2afffd9079a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282032, "uuid": "1232cab0-0127-4862-939d-dc4ae19faf8c", "value": "Updater2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bd2be4-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224326, "uuid": "84828d1a-bcda-4f12-be8d-b290b349257a", "comment": "Malware payload (Mirai)", "value": "683a9653dac8cee1a7df9252cf801513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224326, "uuid": "fa68ff6b-ce4e-421b-8985-5e1f2c40e196", "comment": "Malware payload (Mirai)", "value": "68bf99be77c1c761d7a5649ae614b00ab568f09430ef64ff3003b7a7d43a15d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224326, "uuid": "192cf67e-e4bb-49f1-a451-7bfcf7d66038", "comment": "Malware payload (Mirai)", "value": "bb4e5a4c9a89b42a128676b0fe708ad0d8025fe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224326, "uuid": "05f12f52-20ea-4d34-82e4-5bc955906ae9", "comment": "Malware payload (Mirai)", "value": "3f88127a34ac00749b44b92f8d1f5931de2566bb0d898399e8e17ca3c012d97dc601f88072b017edc7704e9a7fad3dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224326, "uuid": "678e9f97-afe2-4e3d-ba5b-333c343d7efa", "value": "T114B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224326, "uuid": "05d19c20-1246-4046-9b2d-c4cb740f5ab1", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1u/LWy:c9sSyzz36YaWWgg1uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224326, "uuid": "dc692e79-2f43-4074-a6cf-ffa90a751860", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224326, "uuid": "0ed50eae-dd6d-42d5-98ff-e153012fb1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224326, "uuid": "81395b77-b0f7-4142-af09-8d8eee394d0f", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acbdd9e-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239696, "uuid": "a5a22154-b560-44da-9720-b1ce38a789b8", "comment": "Malware payload", "value": "683e72b6c571f176437255dc842994d6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239696, "uuid": "5451bf7e-4329-4112-b144-9f8cbb83329a", "comment": "Malware payload", "value": "68c142aecd006c86c0f28a8662bee5f7b94beeeac27b8e356901fb8ac0425b59", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239696, "uuid": "c5afa81e-e36f-4b69-847d-fe69eed31a79", "comment": "Malware payload", "value": "1c46bf02aa0c7b4c73b1aefe9677e9ad9a8b005d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239696, "uuid": "b115cd60-6747-4a38-b848-5c5d71ea59ae", "comment": "Malware payload", "value": "f72fd285ad4373fcb7f89dda04aa1181b52336bf1ee0d0ddcbd5bf59f657884afecf9d50f73ac337f497f3f369b66899", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239696, "uuid": "ad04e131-b236-474d-a6f6-2e514d6cca41", "value": "T13F661203F78E492ECDE2B97C1E9313716615ACAC1810929F4D12F218BEB36D95F26BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239696, "uuid": "613e9081-b135-4d6a-8d85-be6d19c52fb6", "value": "98304:awRrb4LnAtnaQsPedmyGBwZR2fm1/6PLYxzpqmggpsDCnFgqqLtiWpUkKWxtaBc:DAnAdZsPedEI2O1/6PLYxzpq5DKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239696, "uuid": "bbd36e8a-c8f5-4c76-9a6c-5852665a73f7", "value": 6976708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239696, "uuid": "2c13cb41-9e76-49fe-b10d-163da6ffcac5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239696, "uuid": "7aca3d25-0697-4dfc-bf90-890eb3b4d71b", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fa05c7-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217438, "uuid": "acd27fea-3038-41aa-a24d-b2e1cef126d6", "comment": "Malware payload (Mirai)", "value": "cc8dafe0c108a5d2fd857a89e229cf76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217438, "uuid": "7c4448f4-5889-4c2a-9bf0-984c3cb952f9", "comment": "Malware payload (Mirai)", "value": "6956dbac3319b8acbb5bef935e05da5b2de2e429812a7a632b32ae6d745f5dc9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217438, "uuid": "c8731b29-8ef0-4d58-98c4-8d712ede19c5", "comment": "Malware payload (Mirai)", "value": "6130738cc6bdc76e1c2b5dc97911568669720f36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217438, "uuid": "8850a269-238b-49b7-a170-ea7b158c711e", "comment": "Malware payload (Mirai)", "value": "652fa38b124b87d95f7241a6e808be7ccd81df06ebbcdecb86650b120c927357b752c2f6250f8400f39fd7ab85667a37", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217438, "uuid": "077c8c36-4781-4b27-a48c-df4f649a3f58", "value": "T10B516D9E0200DB31D60CDE4FF7F2B134610FA182A7DEDA45B9900E6C0EC9D4CA685E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217438, "uuid": "34f0e80b-5ed3-4eef-811a-3bc782c9fafc", "value": "24:OCT0a02JMcdGdbiBop9puZwIEfIEnE2EhEZYLvA9Abw5NzvzLGLJUfokv/a/hM3Y:gx2JMkSbiBEjuZvvcvyYObwbUhM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217438, "uuid": "448e91b0-ce45-40ee-a4f6-e0c8b0e50284", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217438, "uuid": "4322e74f-ecc3-4865-aef8-27e54a44460f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217438, "uuid": "b7cd1459-0d85-483a-ae5e-1394e6fdb7cc", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cc2ac3-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245565, "uuid": "e9f99f58-c37e-493f-9d02-615d1cf51261", "comment": "Malware payload", "value": "3b0bf3f15f67dfeecd1b928b55353922", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245565, "uuid": "330c47e0-6b82-4b62-9d4d-30a773055999", "comment": "Malware payload", "value": "69a565aa828ea46a97e7cda846ef06bc136a782f1c208207f6c27c0e5d7cf37d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245565, "uuid": "f341e0fe-187d-407c-aade-8b2ed6c7af44", "comment": "Malware payload", "value": "5f4c75f8abca42e0f7cba3717f17932ff38e3846", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245565, "uuid": "01a93c8f-7bce-4052-8f38-a1f96c1648e3", "comment": "Malware payload", "value": "e02c9809dc263a5f0f525fd9892ec43d493402ab8fd8cd9fa0949001dca4960d358730b63be3cd8944b6a47da91f1cf4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245565, "uuid": "95b56945-92fb-4452-a53f-9467762d498b", "value": "T1F521358FD807D7746B0243C6861B5E4DDAF397176101C829B8DFC80EE718168E6724BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245565, "uuid": "dab95b3b-266f-412c-88d0-75f91f7efd9d", "value": "24:KqahwAi9c0KWrJW76noFuCQq7Yx3nm/MyUJu4Y6FPnyF0rSon5XnF9L5:Bze0jVW76nok27C4CJFXEF0rSoBzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245565, "uuid": "61d26dc7-9419-400b-8a47-2f18d6ceda8a", "value": 1307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245565, "uuid": "9240ce50-47e8-44b6-be99-679833610e0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245565, "uuid": "cb51d61f-f671-41b7-8480-4f16399e2728", "value": "Auto_downloader_classicshell.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bd761a-b955-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762243545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243545, "uuid": "b4fb5c27-ce69-41b5-9392-a6bcd3df5f4c", "comment": "Malware payload (Mirai)", "value": "7df0a3029bd0f1f8699fcef991955701", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243545, "uuid": "1fb15f01-baa3-4aaf-8acd-9bfcd24a659a", "comment": "Malware payload (Mirai)", "value": "69c7018803baede99b479a8cbf5a1b112ea8ef59da3e5a6ad41d3a5726f25b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243545, "uuid": "51032191-11b4-453c-bf69-1ca84186e8c3", "comment": "Malware payload (Mirai)", "value": "733dc7c15e6a8dbc0400c9036097c1b99954237d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243545, "uuid": "874abd31-9801-449b-9e2a-d1a977b31dc8", "comment": "Malware payload (Mirai)", "value": "a61f2881a30a45495cec60ca84593c9669ce14b0dc4170bbd4993d5c34c6d230d4153a4fe5158f38186fb35f3acdc003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243545, "uuid": "1b00d91f-6c2c-4f6c-99a2-d24cf1086723", "value": "T19533861A2E22DFECFB5C873547B78E21A698339626E1C685E15CDA001E7034D741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243545, "uuid": "d44ca0c6-e144-40cf-8851-af5f9227f867", "value": "768:RDBXxXBZq9rHUR43tjwRxOMvDUF/bpxpf2vPlEs68fu/Zac7fc3/N0w:3BXBZAU6djwjOMv+2vPlEsCMQfsWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762243545, "uuid": "8aec87c6-3782-4d15-8dc0-9e63e905e090", "value": 51212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762243545, "uuid": "dac3eb0c-b69f-4d69-84f0-fe48262d91a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243545, "uuid": "4703f325-38e3-4915-80ce-4633d23c6294", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adea7a6-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224395, "uuid": "8d467c38-2621-4faf-94b9-0b70e2ee6380", "comment": "Malware payload (Mirai)", "value": "32eedf6583863b647664242f06b739cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224395, "uuid": "2278d881-cc35-497b-8c7d-27ede2fd8324", "comment": "Malware payload (Mirai)", "value": "69e40a78085976b9f352aa47d1a6e113bdaf653453be5c813107734578182792", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224395, "uuid": "859265b7-076f-4a31-a663-ba7ba85135ec", "comment": "Malware payload (Mirai)", "value": "f0035c8426c00890fbca38e4cc094932bb56cf7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224395, "uuid": "5f3ee848-afbc-4c65-97d2-64a5b0263e64", "comment": "Malware payload (Mirai)", "value": "c635b1766724e0c18b2ecd9b6ed671885c292ec2f27eed951b95446f7d80f5bf86f6d7db06e1f3aaa1c1ed400da0d86a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224395, "uuid": "ddf20fdf-8d7e-4166-91a3-2f85c04d761e", "value": "T1B0431891BC819A23C5D4137AF56E56CD372423E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224395, "uuid": "54abb0be-1941-4333-ab35-9702b350586e", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224395, "uuid": "183a5caf-ba85-4bf9-bc1f-7685c8d61329", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224395, "uuid": "8c11a38b-32b4-4164-bf30-36bca5d31c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224395, "uuid": "4da5807f-4a5d-4790-bb3a-07bcd7f79d63", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526ec415-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1762245373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245373, "uuid": "06a7417f-7adb-48e7-83e3-5eab0fba5bec", "comment": "Malware payload (STRRAT)", "value": "da65e5e343d39bbcc8ae6a3683847a29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245373, "uuid": "53526edc-69b9-4443-9102-5de4534b377b", "comment": "Malware payload (STRRAT)", "value": "6a424ad9babce34e03c625225408fa5f6c043f4e6fd9570af4aeb1bf95e5b3b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245373, "uuid": "3fc1702e-62f2-443b-83d7-f0bd2365ba2b", "comment": "Malware payload (STRRAT)", "value": "bdcde31f1bccb4dcd66eda267cdb5454f1206498", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245373, "uuid": "87e82b85-2f57-4cf2-81ed-0d056c8bc5dd", "comment": "Malware payload (STRRAT)", "value": "ea2bd4363b80b33538c7596f009c02d0e2dff34b0817e9ede2bd40bd69094cf485204443596922b39699404a0e7b3926", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245373, "uuid": "f46778c1-b7e0-4a49-b37d-08af5d7e5a7c", "value": "T114042330BFB239CB5D6B4A1AA837B7B8174476BA64001CCF4CC659D9662BEFF8493015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245373, "uuid": "7a4cc80e-b941-4db3-80f9-6da2b95987ad", "value": "3072:7AU33jf8EFbk+fMpaCrSzjWurnUQej6ziJPjYP7svgnBfVc3tw0Rb2u6iW7OO3uI:7XvlN+SzCujrwbG74Ldw012aUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245373, "uuid": "6aca3761-b3cf-480d-acdb-52405e7fcfb9", "value": 189474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245373, "uuid": "16a36b10-afd8-43b8-8312-f5a38d969f76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245373, "uuid": "4943d51c-fd48-4687-b50c-966fa08ead26", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e227a7-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236391, "uuid": "881e88c8-b4b4-42f1-9185-6e84873e39f1", "comment": "Malware payload (Mirai)", "value": "5bf2fd620b497ea279f9b98941dbebef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236391, "uuid": "96ea4d28-dfef-4eb5-a6bf-d394c29cd384", "comment": "Malware payload (Mirai)", "value": "6a529f018578f056c87fb4cc2852bc285a93e82b632ae67666aea41bfb750dd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236391, "uuid": "4294e561-8b27-4fa9-a0d9-eba70e111946", "comment": "Malware payload (Mirai)", "value": "c1bc2ad4326971600c09afcb65191ccec524e9b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236391, "uuid": "819c9aa9-7478-4601-9a1d-b52708f3d01b", "comment": "Malware payload (Mirai)", "value": "23b027170a330185e1d2cf5f89cbdabe07876e569366d08f0ece84aa71aaae59359b129660ed05939da0561093f2ea17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236391, "uuid": "d72764cd-6210-4f02-8ecb-56e37352a8a1", "value": "T19103D0BC2E01C494D8A561B40BE20BD14E964FEBFD82DE46275ABF51ED2D1B4B801FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236391, "uuid": "5835e36a-924f-4a98-881f-982ac3040762", "value": "768:OT7EQiU3rLR3Ty8qCWU32J92o5JPwZBxxE0TOXvNs02JgGlzDpbuR1JH:AEy3rZJW4kn5C90cVJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236391, "uuid": "f4dee97c-3711-40e5-82ed-b020d2cae76e", "value": 40088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236391, "uuid": "55c12943-5d5d-40ee-b062-a96fcc620377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236391, "uuid": "f7e954de-d05f-4bbe-8dba-1dcc8193dc1f", "value": "FGx8SNCa4txePA.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f77a63-b967-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762251417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251417, "uuid": "bdf5b1aa-1735-4dec-9e94-609c883911d6", "comment": "Malware payload (Formbook)", "value": "b546d90bbbbc7a28084ac22ef9b0be5e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251417, "uuid": "4db53959-3737-4459-9e79-10aa99bde4f3", "comment": "Malware payload (Formbook)", "value": "6a7b8aa6c8bee7a62da97f1345f6a8686f09ec25839308cdfb82e22bf9c0902b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251417, "uuid": "ce64421a-d222-487a-9e78-9316317f8836", "comment": "Malware payload (Formbook)", "value": "c90cdc486b087d38c894ebabce718ed31542ee08", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251417, "uuid": "d6f11929-c66a-4c1a-8f76-4757adc78ac9", "comment": "Malware payload (Formbook)", "value": "2d4420c7d999791df76513a7fd0e7205b9be426db3c6d59569fdf47421ead1de6ce14aa1bfacdad53ef66d37fe52c941", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251417, "uuid": "9a5ac0a4-4c60-49f6-aaa1-0bcc92db0398", "value": "T18C838C4C695EBA208A1A81E5E6C1F02B8DE1B83DD845F6177C1CC4D60BED5A4DA18CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251417, "uuid": "e6f76067-7beb-4b90-a7b8-2206442e2f79", "value": "1536:WXwYRo3JI6E0b2jndhOKQqEwWdbB+oBr6H:WcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762251417, "uuid": "68c54459-0df8-447d-afde-7168e7e55074", "value": 84337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762251417, "uuid": "03b0bec5-add7-4b62-a591-0b52a39dd341", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251417, "uuid": "f85618a1-0638-4402-ba54-e1eaf380d3f1", "value": "9hg990ghhgh998hhgb76bc45dfdhfgfhghh09jghhg990900hhghh889ghgh99989.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6af773-b98a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762266464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266464, "uuid": "5a520aa6-bde0-45a7-9130-68a7839f1e0c", "comment": "Malware payload", "value": "072cbb5142aa12a4652b5f27b609f071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266464, "uuid": "b5c150b0-c75c-4212-94c2-cc05efed9b31", "comment": "Malware payload", "value": "6c5087d06021234b772afefdacfad8da2cf0a085bf2392ec2ad60f7544fc41f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266464, "uuid": "9ec226e4-1cfa-43f4-9322-371ce29109cd", "comment": "Malware payload", "value": "fa3a65302b2c2dc9efc9353f41fc7d5350811a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266464, "uuid": "d39dff24-c33d-47ae-bac2-1e820ffa1e75", "comment": "Malware payload", "value": "ff8728d59b8d72657216c066a79aa6cb3eeefb14a8269010624274dc226ca8f88932f2e913692d0ea63a5c623151ac12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266464, "uuid": "b56b962f-4652-4b4d-9460-50cb171851b7", "value": "T135953313A6F894B4D8BB1B3465F6369B0235FC7967F482E741418F6A2CB2FD0A434B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266464, "uuid": "c9e6d9ef-8b4f-42b9-ac48-45feaa7c7fcc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266464, "uuid": "3fe49e6c-41e9-42db-a166-045981f3c043", "value": "49152:OpBfaB8QYXxup79SCR6y+239YXF/An9L86Ru1dRWrG:IaqQ9p75wMS1on9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762266464, "uuid": "998846b1-2392-45ab-a056-36759fa54984", "value": 1953136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762266464, "uuid": "b53d18e3-da8a-4259-9ffd-a8b62e3ebc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266464, "uuid": "fe6c0637-3407-4ed1-b17f-5b80102ec714", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7f4f8c-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1762239832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239832, "uuid": "dd664324-a750-4dd8-8c28-8d2fd2f63599", "comment": "Malware payload (Gh0stRAT)", "value": "c43aebf6418d72b19fca46bdc2b70b36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239832, "uuid": "0e7e41cb-6170-4e64-8753-1999639302c3", "comment": "Malware payload (Gh0stRAT)", "value": "6c98414b8cd5900ad18b34ad416e7a98fefa2794cdbfed6351c3af828594ece3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239832, "uuid": "1e0c4ee4-2de2-497f-a1a3-61e3badd3c0e", "comment": "Malware payload (Gh0stRAT)", "value": "e34b708dbc103ec228bd7f88924210db38cfaf74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239832, "uuid": "6169782c-fd4b-4127-8718-38862f0e5e2f", "comment": "Malware payload (Gh0stRAT)", "value": "7750f926a9eeb1ac4c56bfa278a2f62f224888a1a163709cf634755d3aac72c4ac808c4d724c692f8e959e064dc98fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239832, "uuid": "cf248244-d2c2-4e96-92dd-2b3e97a6d49c", "value": "T1A007337BF3AC653ED41B073104738660447BBA65A92A8C2E07F8695DCF3A3601E7A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239832, "uuid": "05c9bff6-d89c-4bbd-96db-c86981036800", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239832, "uuid": "182259a7-77ac-4ddb-8479-3f3a300d0c8b", "value": "196608:o/Mg+iEdDgH/+NgdejlXU+aCcTrV2zlWg+0s2KaaS4HYxYNVb9jDJAzzftMRSOpX:oHqs4GeJXYCcH2txYNp9jEWRS4OZav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239832, "uuid": "ffdaefa2-0c1b-41db-aaa4-b913a33cabc9", "value": 17031282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239832, "uuid": "6babbad1-83c8-486e-812d-034953bfa0f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239832, "uuid": "bf8125b8-8d71-4ec6-89b7-b0587954412c", "value": "kuailian.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05e79dd-b976-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762257986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257986, "uuid": "00552467-1ef6-4609-b350-b6e226a8a839", "comment": "Malware payload (Mirai)", "value": "0fa9184d494ed2f9208f27fd1a8e92cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257986, "uuid": "0ef5e4fa-ca1c-4eb3-99fa-148bb4dd3712", "comment": "Malware payload (Mirai)", "value": "6dde4b2e14f576bf2dbf13f3b9e6e0985c6301107767d9b54ea003a3ce716baa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257986, "uuid": "4e803523-6bbd-460d-aeb7-80781929c110", "comment": "Malware payload (Mirai)", "value": "b5219946d7aea91ab4a9449993e29103527e28c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257986, "uuid": "6cab7b69-0897-4888-a451-2896e180ece8", "comment": "Malware payload (Mirai)", "value": "a83dcc57e3e58e5537b4d7e49a4644b7350e4bfa68618f05771939c1e9ad0f51e6f937e9b506fc667e9468a15b260d04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257986, "uuid": "b3a42797-7c7b-4d16-9f8e-97da6c6237bb", "value": "T16013E03053E71105C812A43CA87B699F8021F3267C8DD9FFE6D8DC974EA4A54731A2EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257986, "uuid": "7cb845a6-cc97-4ef3-8c57-8efdcceeaf32", "value": "768:QJgwZtcvHFNTIOYK2puHAMnI3gZGyKXDpqT4EqkijxGZ2uzJeonbcuyD7UHQRjY:vwtcvXwKEMA0tVKXDkThXkxUeonouy8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257986, "uuid": "b87c12c9-c278-4b52-84a1-1a92c8d980ba", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257986, "uuid": "899cba4d-e1a2-4444-bb93-01ae51c7b3fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257986, "uuid": "a3026a2e-e293-49cf-a2cb-2a01f9fd8c4c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e26903e-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236427, "uuid": "1cdf4329-f827-42f8-ae87-4dc29b6c91fc", "comment": "Malware payload (Mirai)", "value": "92f107dc6f559da217f476546d5e77f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236427, "uuid": "a75650dd-0d00-4ac9-86a3-b755af8bbc36", "comment": "Malware payload (Mirai)", "value": "6eab1a10af93e554e24df8dffa673eecff80455a44146b4fc14a98aca4c251bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236427, "uuid": "ec1974da-e7be-4ab0-bd5e-83314e211cc9", "comment": "Malware payload (Mirai)", "value": "2979dffc75a063fafc561ead11a8a391415caec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236427, "uuid": "6ef3cb69-ea21-4563-9d9c-56557e7f69c0", "comment": "Malware payload (Mirai)", "value": "4550d27d117833eba62aa4025716055a5f4b0160c92ec8a54c255c3b9fd5ce3bee0af0958486e86dfd564b04dd8593e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236427, "uuid": "9a6d793d-25a6-49aa-aff5-ecf162621c55", "value": "T17CA33996BC824A25C4D513BEF92D118E332217F8E2DE72239D209F3137CA91B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236427, "uuid": "7617814c-7c7d-423e-bed2-6339368267ea", "value": "3072:JziJnc6xZNd/QkGhti4P+DCaW3+E5bkFR+pu:sLZNd/QkGhtiq+DCaM+E5pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236427, "uuid": "071a8600-87db-4143-93e5-228898687d42", "value": 104056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236427, "uuid": "2ceed372-aaaf-483c-bb20-639d6d716c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236427, "uuid": "0f2c28a4-57b5-4f8a-9a50-0afe32286eae", "value": "FGx8SNCa4txePA.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0031ac98-b926-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762223331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223331, "uuid": "5e302a21-ee1e-4973-b6fd-66ea7851a91c", "comment": "Malware payload (Mirai)", "value": "0ee0347a26721b10e8e0e9673a911917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223331, "uuid": "1dc30518-3bdc-4a5c-b779-340a7c36ac1e", "comment": "Malware payload (Mirai)", "value": "6f24e9ccf39d4ee5b717a220d84851ebb58801d44b22da76c386626493da3927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223331, "uuid": "d3af288e-69ee-496f-8f95-6604bf3e7805", "comment": "Malware payload (Mirai)", "value": "27ca5faafd6e5f43de93112e2cda62b4dd33b980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223331, "uuid": "a1d8d1c5-752d-4e70-9f34-ac024796c8e8", "comment": "Malware payload (Mirai)", "value": "1cdaf8d7e51f75a0e569e26339dac954c1980c78d443d5caff77197686102a4c38623cef35ee0893c44e85cb1bafa9a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223331, "uuid": "049640d7-d94f-48ba-90c9-8ebe66814c21", "value": "T15BC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223331, "uuid": "fa209a07-c79d-40af-954a-9ab228688965", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiytw:VoRNjmj1VGFVrRiyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762223331, "uuid": "0a83a38c-38d4-46a1-9572-473ed661ef95", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762223331, "uuid": "034a6693-8c43-4d7d-8e0b-4e3bf0d346f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223331, "uuid": "1ce5b2ce-8c31-405a-ac6c-3e6ee5c298e2", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.5047.25328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cad5d3a-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762248934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248934, "uuid": "4dac7194-c9bd-4666-842c-b2a656c5ec3d", "comment": "Malware payload", "value": "1c171c0bed826e1289503a069d56eb6f", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248934, "uuid": "aade071c-c095-462a-aca8-4e9876e788c5", "comment": "Malware payload", "value": "6ff952e61e8f515a3d98596fd8bed1108eefb7c3d174c6ac3d6099b97c7a1298", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248934, "uuid": "f3807fc9-abfc-4d2f-88f3-c96a56ba150b", "comment": "Malware payload", "value": "4c5c209a1bd527cde44b59d43de3c160a614aad3", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248934, "uuid": "252a1b70-b1c9-4695-8348-dc4edfb6b55c", "comment": "Malware payload", "value": "7015e9672b081c290991c73e3d947d7f3041eaf96f8d64e28a12231f98461ee1b92e994cfcc1319f07d9f50539926446", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248934, "uuid": "11148a2c-0239-4890-845d-e4834929222f", "value": "T1A7E412B311C93C3DD45E5EFBD603B53278668D444AB63A07281B2BEC0E02A5E16256FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248934, "uuid": "84b6f85a-c522-4f34-aee6-a739263874f7", "value": "12288:GuHgnDhA4F9WKLo4LcjVvuRPZn163pCezJcPO6DlsiPu0w9scDlSd6fEUr:G2gdrFt1gjduNZnc3Bzg00yllfEUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762248934, "uuid": "fcec372b-3b62-4e9c-b1a2-0cf65ff1b7a2", "value": 665140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762248934, "uuid": "fc38dacc-e2d1-4f90-b8d8-226b12e69353", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248934, "uuid": "6601d8db-608c-47b4-a6d2-608d6ebfaddb", "value": "PO#3287.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd77176b-b98c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267457, "uuid": "83dae2ea-7772-409b-a5d0-2482f183aa58", "comment": "Malware payload", "value": "49117e892544aca8cca1c94fe1168e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267457, "uuid": "a315865e-f5aa-47a0-ab16-78f89425ace3", "comment": "Malware payload", "value": "70899b5db2a29ddb727436c93de60bae06839a517fc69c1e31bafb6039a7df50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267457, "uuid": "ea438e93-5dec-4e8a-b9f3-6ea2a4774da8", "comment": "Malware payload", "value": "ecd1879346c1fe01c256599cf4adcd0aece534fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267457, "uuid": "346750e0-2966-4c87-8210-cb9da8bed605", "comment": "Malware payload", "value": "21151310454c6caa23193e383b1bd9f60fea8fbe38561ce6994c5ae3835204dd15a90348fb55cb048492627b09d66ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267457, "uuid": "a9ca1047-0b1e-437e-8a97-c5034136ef7d", "value": "T1F346334F4D49ECAAE1994E743252B5493391BD437E529E12B333371B6CB748AB4E3A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267457, "uuid": "08c5e00b-c5f4-4921-9739-0c98839eed14", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267457, "uuid": "4ac86afd-9f0f-4f0d-b123-981d40c25fe0", "value": "98304:oMKgyKvxpiKMsLyBgRSajqQUVDaAMftp5qCRbBYkhB+zSnkopU10YZ:oMyeORswiRb6kKzSndpUyYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267457, "uuid": "5bffde70-d820-459d-942f-e38dec13b67d", "value": 5641728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267457, "uuid": "61288079-338d-43e9-8767-62e5aefba2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267457, "uuid": "ed2a47a0-a948-4143-bb13-472fef0453be", "value": "Installer_v41026_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e774e6-b9b0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762282609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282609, "uuid": "07e35fb1-1304-493c-9031-82258dd15afc", "comment": "Malware payload (Mirai)", "value": "9f9ec4de3ca4ea4096a4e4ad0b3d2b30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282609, "uuid": "821d44bd-38a5-4db4-adb2-f37b0f80b20a", "comment": "Malware payload (Mirai)", "value": "718d98e029a73df87e279a5b283261f4686c02ecf8432514e6d90a4b236aa5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282609, "uuid": "2fe39b0b-5303-4198-9495-e52221072126", "comment": "Malware payload (Mirai)", "value": "39b7bb9dffbf4ca292bdf9b7232dabd94f0451ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282609, "uuid": "65df7dc3-56a3-4bae-93ca-90435ed307a8", "comment": "Malware payload (Mirai)", "value": "f1e15b4781f60d57911200d73bf0e7694e756ada7b68b3cd1e10d43e28077e1c0ac2495400d695ff17d2c19d65ced23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282609, "uuid": "5e1c32de-e6d0-4b91-bda2-7e1acb76cb57", "value": "T189330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282609, "uuid": "2c836b5f-27c1-4ec1-b834-8b8e3dd57d22", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJMcjeqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762282609, "uuid": "c6ff81f7-3da4-4806-a9b0-9c8932b140a7", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762282609, "uuid": "caefde38-c9a0-453a-a9c8-4e97759bf965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282609, "uuid": "e824a001-acca-417b-adf2-ff7397f4a59e", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afec5819-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762245530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245530, "uuid": "67562230-fa23-43bf-9df2-cea9dbcda6aa", "comment": "Malware payload (AgentTesla)", "value": "04428fba0f6c5caaffcc55dd73e911e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245530, "uuid": "cb23687f-fcc2-4115-95f9-8e7b2ebd6eaf", "comment": "Malware payload (AgentTesla)", "value": "724f4402e1dec2650eea2a84169396c7c67366f6f135a84351b3a033d07c7eed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245530, "uuid": "a5f3df7c-3965-401b-9f60-fc5b1f486f5b", "comment": "Malware payload (AgentTesla)", "value": "8a1d4b42234ef0cc4573ba5686e33415a2c80cae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245530, "uuid": "8b01fdcf-0506-4f62-8a2b-72bb8810ce4e", "comment": "Malware payload (AgentTesla)", "value": "60c1eb08442ce898358ed45d1caa37aaa827d843a3af467563cf0b8cbdc748e88f49e8cfe88c2a62d4fbf2a6f2385d41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245530, "uuid": "7d97e03c-f4ba-4f87-a69e-8d62b4c30646", "value": "T10245012588C42FB9CFAC5A1D90BE161E97F00A8F9426748AFB37BD46AFF754442071C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245530, "uuid": "23618b78-aa1f-43ee-b4f4-163d6f7e1ec5", "value": "24576:ZcIg3s31CU0nTeQOIsNtB5CB++VtWQ3ddH36uNu/imdH:dA5W9oH3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245530, "uuid": "68ca779d-6144-4c98-b6fd-8fa62f47932a", "value": 1237846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245530, "uuid": "1eacfe4e-f00f-425f-909f-b0cc5caa0a85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245530, "uuid": "26982513-72e0-430f-8e03-c3a4777273a5", "value": "PO 4923539294729 ALHILAL SCANN DOCUMENT.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55de0b8-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289858, "uuid": "dcd285a0-2dd6-4142-a944-02422eb332d2", "comment": "Malware payload", "value": "0e6652d475071effde5b20d7603f2713", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289858, "uuid": "ce9410c3-1f53-4637-a44b-48f5f717b087", "comment": "Malware payload", "value": "725fa8a572e79ad4cd07631c6fbaf74c0cc7fef48701d7aada67fd199fe21298", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289858, "uuid": "47d07e7d-e0b3-4f37-a301-84a5ec048623", "comment": "Malware payload", "value": "7cae586b85cc788dbedac0cd078b3a7dd0350eca", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289858, "uuid": "611d9484-b561-4421-8301-22cbd8fe50ea", "comment": "Malware payload", "value": "e85cbde5a64f3caed0b3b0a2ad774d28c5b5a864950b7b5b42b909c143faf4a914a77958995208774ae621741bde1869", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289858, "uuid": "fa36a3f8-8b9d-4194-a18d-cde008b1d2ee", "value": "T1F54623725A54396BC6510B34F04B37726F3DD8678A48A1ED78CCE19A37CE291893F8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289858, "uuid": "a52fd29e-2893-45c9-8260-6a45efb9fc8b", "value": "49152:KHQQvJ8IxDYGN0xfSpENAVJ53occ7+euLud5aHpuN/alkGj9yx/FDnLZvkpzkuT:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289858, "uuid": "ee4caaeb-dfb5-4c8b-aaad-83938493d3de", "value": 5533696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289858, "uuid": "51fd5490-36a4-4f91-b6e0-b27e40dd6e58", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289858, "uuid": "5170d4de-7977-4060-8562-95b984005ad7", "value": "QFG47545T9U581957.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ddfa71-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289882, "uuid": "ba43940a-1831-4e25-a82e-e76c75873033", "comment": "Malware payload", "value": "a00ccf11869391331be8dda9bbd097b0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289882, "uuid": "d3913caf-be00-42f3-a0b3-68c3ee1c1570", "comment": "Malware payload", "value": "74792a38f6b76221c1a1a53b0ba3425de9eada27ff6b26a013b16cfa9636977b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289882, "uuid": "138afad2-24d3-450d-bf26-860aef1f987f", "comment": "Malware payload", "value": "27d7bc183d2a699d589f8c7632409d35f11810a8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289882, "uuid": "16e6f0bf-7401-4506-8b4f-e4da4bb4891b", "comment": "Malware payload", "value": "4e290e7ae052cbc514cac4deff1f7d83e9590423c7cfe860f960bb8d99c46354a86c169ef12f0756a3bafe2ca77b8d52", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289882, "uuid": "ea492e9e-160c-4b89-9b26-1314c7d678ee", "value": "T1C3C423234D48686ACE2764E3F409FADC75BB8B07D38A912D29954E7DC8370D5521B2FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289882, "uuid": "3412f09e-3690-4679-9a03-253499c6abc3", "value": "12288:PLaI90Z+1E3p9QBStnnAN60GOYw0t/FdtbnrXzptn:PLatgC0IZpw6HFnr91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289882, "uuid": "ab0c80e0-e8f7-4c9f-88f9-ec003c398c3a", "value": 546288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289882, "uuid": "1c79e9db-1a0b-4b42-a916-f24bb3ab579b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289882, "uuid": "3f585bd2-563a-4c65-8a6f-83c93d555732", "value": "F\u0130YAT TEKL\u0130F\u0130 BEKLENEN \u00dcR\u00dcN L\u0130STES\u01302.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5336841-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1762245592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245592, "uuid": "9e132351-e248-4a0c-ae7c-2c8a60957e48", "comment": "Malware payload (DarkTortilla)", "value": "315de9579fb7d98cefcd42338816b3e1", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245592, "uuid": "33e0448e-f816-4350-80d6-2aa237d37faf", "comment": "Malware payload (DarkTortilla)", "value": "75e978c27e6262cb702ceeb675c1daee950e477e0f5be0f7f65b834ea1b91682", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245592, "uuid": "9f800b7a-7435-44ff-8b53-7d737c5bbc05", "comment": "Malware payload (DarkTortilla)", "value": "8cca41d5fe9717a50b7bdb361915b75655304157", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245592, "uuid": "bcabeb38-e62f-4a87-bf61-fa5ad1da5217", "comment": "Malware payload (DarkTortilla)", "value": "83695076907af3fc3b432104aada69fa5482d20547dc4cec28c8034fefcaff9e947996a3c306cfa98f9b8ab8efacd841", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245592, "uuid": "02aa4208-815e-4b06-b5fd-bd42ed11502f", "value": "T18346222221C5AE95E53F87B8843C85C193F37E0FBF11C79D79992A8CAE013866763653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245592, "uuid": "3f13a131-5e62-4587-85bf-846ebefabc92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245592, "uuid": "366fa5e5-d159-418c-9e8b-c2a28842f16f", "value": "98304:YE4FFbyuKmKBUVksBHhsuMvgPQSa3v0fRT9Q37PE4rm:YZCUGsBHBMIPQSrT9Ibr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245592, "uuid": "d9363d38-737e-492e-93ce-9a34e91165ea", "value": 5618176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245592, "uuid": "63abb614-5589-45e5-b557-fcd92e7ca8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245592, "uuid": "b5c8f088-b2aa-48b9-84bd-3c054414088f", "value": "DHL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadaaf66-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245575, "uuid": "66f9b894-671c-453a-9b72-83a8f9b35d7a", "comment": "Malware payload", "value": "fc4ee75d5bec11da8904ccb630f0a96d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245575, "uuid": "d945707a-e73e-429e-a388-c3ce9f42c69b", "comment": "Malware payload", "value": "77373ee9869b492de0db2462efd5d3eff910b227e53d238fae16ad011826388a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245575, "uuid": "e524f596-b353-490e-b8a1-cdc81dc3b9c8", "comment": "Malware payload", "value": "6712001f18151927935f017d004bf0e096cc8123", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245575, "uuid": "94d1df54-5ab7-41e8-9298-404661678577", "comment": "Malware payload", "value": "c5222498fa3b618117ca82d4b2b09da8e5cbc2e020ca69b67f8298818bcae158564b975aac99c03347e5837c9acb9c94", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245575, "uuid": "9d3ce643-f02f-4a78-ac1f-1e23eb264759", "value": "T11F0146086EEA0622E3F68E7684FF6712993E7C05DD515D1C00D547482861A20F8B1F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245575, "uuid": "3e5b450b-053f-45a0-bca8-3ba643d5f132", "value": "12:8YysY0m/3BVSXzZUjIAx9k56qn8bbL1Il+giNL4t2YqlzKOcLh:8Yy1J/ByUZbGJ8c+V5/5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245575, "uuid": "c2792242-a584-44f4-92f6-062af9f7d9b4", "value": 812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245575, "uuid": "7a28b4c4-402b-435d-a377-b6317f4f0470", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245575, "uuid": "4130f377-9ad2-466e-bca5-ae6ee9084197", "value": "CV.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126f2d1f-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261157, "uuid": "9e42fdd9-24d8-46aa-920f-ae45ece8e71b", "comment": "Malware payload (Mirai)", "value": "1fc17adfe0a7a10ab4064647311f1bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261157, "uuid": "80597484-f0f0-4c64-bc58-1e79a5278ccd", "comment": "Malware payload (Mirai)", "value": "77617689ecce7784d917175c68f85cd0d4c465a471d0df44a1330a7c6994169b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261157, "uuid": "cb6267e9-325d-4cc8-aee6-8f1ace9052f2", "comment": "Malware payload (Mirai)", "value": "011da9c1570ae596fef5339a8e7fbc067736c369", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261157, "uuid": "19994f38-5522-488d-adfe-60b026d01954", "comment": "Malware payload (Mirai)", "value": "8b09b5fe0a4ed29cad6091b967e3fc2f82db2e3c78d5cbbd3beffce9c2ddee9cd19befd119061e52426e8e82b0606c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261157, "uuid": "7bddd5ba-7854-49c3-aa67-d4948ce3d3c3", "value": "T106430268A31502A2E9150A300BAB479C331E0FF98687B962615BFBBB5D460FDCD03D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261157, "uuid": "3a25e924-1a09-4cca-9cb4-7a4dcede75be", "value": "1536:b4kKad2CGj1NUqIpaBotfHathOWSQEbdSVJuG:Yyqxt5B77C4VQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261157, "uuid": "46c49fe0-727c-4acc-9e28-88dfdd4a87fb", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261157, "uuid": "ffddaa86-2726-457f-9460-7d1af4128de6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261157, "uuid": "1b6559f3-1b46-4f3d-b364-2509a83c4cb5", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbb2373-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237336, "uuid": "ffe14960-75e4-46fc-804d-b5e95fb44d93", "comment": "Malware payload (Mirai)", "value": "7b40a25dcd22b4af37ae593e08a471de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237336, "uuid": "bd895cf5-e438-45bb-866b-5affce0cb87d", "comment": "Malware payload (Mirai)", "value": "78be901a05877eb6d3eb722ac4f57ad04c7946efbf5379d16213059385768d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237336, "uuid": "4340b2f0-a337-42e6-84a6-cf9430e823dd", "comment": "Malware payload (Mirai)", "value": "fbe4e143aed77810f59b0ec82f3717a57388d910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237336, "uuid": "92fc4082-65f5-48d6-af2d-1397f49c09fd", "comment": "Malware payload (Mirai)", "value": "87324d4765ad0dbf37536e86ebec64b6ec808e26e20da4534c569def12e458aa5413af39e19a5a35373936194d6819b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237336, "uuid": "08c569b6-22a5-45ca-9cb7-2044478f2280", "value": "T1A06339D6F8019E3DFC0EE67A84550E09BE7163D112831F266BB7FDA36D720A66D02E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237336, "uuid": "3207de6a-666b-4f63-95d1-caadf363f7d1", "value": "1536:HL3mMsvOLG5XJrr1DctrT+JHdtIi5zFY9BgOo8QNLgvQ5:rCat3IOQgBJy13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237336, "uuid": "feae5a88-e8c7-4d43-bb02-81c0742406e8", "value": 69148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237336, "uuid": "975e0a55-ab07-4b17-a9e6-1585a017f7c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237336, "uuid": "7a25170b-9136-4586-b9e5-44f96cd8414c", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f8bbbe-b9cb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762294479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294479, "uuid": "abfe4f38-0365-40e3-87e9-5edc228ba422", "comment": "Malware payload", "value": "17a51e1717971fb0232404da229b42c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294479, "uuid": "0fe2b5d5-b5f6-40bc-a87c-ce50e37d82a4", "comment": "Malware payload", "value": "797556b4320bcbefd8274d1b222007258762f33f5b40e30c9641298f6cd023de", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294479, "uuid": "679cba66-6bbc-4d3a-ad2e-d6627969fcd2", "comment": "Malware payload", "value": "b3ab967b0b51eedd94c7b28b4eec49ee2900561d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294479, "uuid": "93d402e4-2066-49c1-b106-fe6da52e6f23", "comment": "Malware payload", "value": "e42867311987e0b90271e588e26aed45e2bdb01122b39728cbfabf56d6257011578db6c577b51a970bedff702dbe8d6c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294479, "uuid": "fc4310e4-2105-4f40-9eea-2619a4e13d54", "value": "T14AC08CA2453DC471A33A0A5EB261F6F89D06A4290BB138F1D8288784A2740741D4F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294479, "uuid": "5c820a8a-8015-444c-a50f-f509b77e3e62", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfAaRShMitUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfFwMhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762294479, "uuid": "14dbbbec-748c-4770-9fba-57e4299d22c1", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762294479, "uuid": "10796e89-f632-4c3a-a8e9-c3024dd1d983", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294479, "uuid": "43644c33-a129-4bfd-b7c8-1965f826d7b0", "value": "q6a13xi27h.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432f759c-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239764, "uuid": "548d25ea-e041-4452-b975-588a19ae7c9a", "comment": "Malware payload", "value": "9e9b2f85b7cf810413cc3d2297df4a5d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239764, "uuid": "af998f75-1f29-4ba4-9ae3-aaa0a78a48f7", "comment": "Malware payload", "value": "7982c897c5bc8f3b31fc610b9cada477c8a8b66138aa5dba47ea6526152318ac", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239764, "uuid": "6e2ec317-7f6d-4fb0-b707-e07d4df95b43", "comment": "Malware payload", "value": "4e7db115175e64b4016d6d96db2df3c6c5898d17", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239764, "uuid": "471e24b3-a77a-438a-a88a-1b3a443aee98", "comment": "Malware payload", "value": "d305c832def13b43910156ba3d40326bf44d5806f50fb5c033b4205cd4215883992f0cea61888495be473ff2b31c9483", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239764, "uuid": "c157397a-dec8-4d62-b8a7-a314bb04d267", "value": "T168760203F78E492ECDD2FA781D9713616619ACAC291092CB4D02F218BEB36D95F25FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239764, "uuid": "7bc515de-4ad1-4320-8eaa-cbc95fc01b9a", "value": "98304:awRzbnLnABFGLfGEgEHAogGNjwrcMZ7oaArI04Pd0PmC8X/GH5Jc9a5nIF0n3:DTnATOfGEp1laZ9yI3PdC8X/GZSWim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239764, "uuid": "acdf4ef0-eec2-4534-9ee1-d0f0d56b2e94", "value": 7120068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239764, "uuid": "d01f4daf-7c6c-490e-bcb8-3791fb631a53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239764, "uuid": "e38257d6-59c7-458b-9e2d-bb156ef25878", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e65f37f-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261150, "uuid": "ff83ffe3-127a-43a7-983e-722d52f7ab24", "comment": "Malware payload (Mirai)", "value": "2af08829568daaa43aadf337f36f7b7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261150, "uuid": "83434bd9-4aa0-4349-a82c-37f2bd0f7e24", "comment": "Malware payload (Mirai)", "value": "79a10c6256bfb3fab52d88748bbcb2ff0f2e94744190c3c7bf0f783dba7bd7c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261150, "uuid": "6e3f7e79-8556-4086-80ae-d8a8cd61c0bc", "comment": "Malware payload (Mirai)", "value": "c53d82281788a6daaaabf652f17dbd13ed7b0117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261150, "uuid": "ddf3014e-744f-49af-823c-b5766d5f82a4", "comment": "Malware payload (Mirai)", "value": "59bc8f86479aca492a7cbe1af930f5be8b1cff93b7f630e528c9b2ad54d6acc32a62205fd76d32516cbdedf5362af82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261150, "uuid": "b3f3263b-cd87-443e-beaf-e0cea6fd52bf", "value": "T14733F12409DBE344E6301E3DBDBD8C0A1DD567A8D9F4B0B245D09B421E07EAD98B9F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261150, "uuid": "cf5dc445-afb7-48d0-ab44-d5a2a0570029", "value": "768:B44O4eyC217SuUTXZazr6s7PvQAdpakxue6+t0NGX06/OnhqolRRN1iZ20njShIY:BbdAsKU64hp1uGKsKR4M0IBg27zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261150, "uuid": "d7590bdf-5de8-462e-b274-0f0729405ec4", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261150, "uuid": "f72de9fb-c223-44ef-b4c6-406a893af75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261150, "uuid": "fdff34d1-bd6e-4d78-b77d-03b2d5c36c61", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c3ad47-b9a2-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762276685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276685, "uuid": "1e5d1f11-38fe-4ad0-a55c-263f94bd3306", "comment": "Malware payload (SnakeKeylogger)", "value": "e42abdf045914ed41b0bbc7c17de68a9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276685, "uuid": "d4ec3935-2cc2-4549-981c-5d357fbac258", "comment": "Malware payload (SnakeKeylogger)", "value": "7a1ac0566d753f699dd7fffb5b96326812eb33c19e454b93fa916a21fcbca4c0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276685, "uuid": "8be019e0-b1d6-4f6d-ab71-f029471abdac", "comment": "Malware payload (SnakeKeylogger)", "value": "0e9f855e86b05e3f00003bb08aa2a3adb018a1b8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762276685, "uuid": "aa030056-9d81-49b6-8f6e-5ced7c82cc44", "comment": "Malware payload (SnakeKeylogger)", "value": "febb150f50b93520b8cd6e093d42bea3ded98b80ef922e78f0675c08ede4a0c3aa2f7ef93347e088bc5c33f861be94ed", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762276685, "uuid": "eb6f410d-1ffd-4fef-b1c6-8672cf93f017", "value": "T1F2F3063D9564ADC307F975B35E692A0F2008CAD3AD623B2FE954CB9A3854584CBF311B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762276685, "uuid": "e06ad1ff-8d9c-4b76-8108-66b47ba69db4", "value": "3072:9qs5BWLAqyXT0lOR9aPF6iua7xmqSB//PDTRx5/LQ+9e855Xh3bBS+:9qs5BWLAqyjci0Z7YrB/H/1LQseQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762276685, "uuid": "da4dda80-28bd-4c61-8508-b1c5807204bf", "value": 160376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762276685, "uuid": "cae7b669-8ba9-4bdc-b130-ed3d6bf92ded", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762276685, "uuid": "6014da5d-74d7-4d19-9b92-4c28b6e6f807", "value": "output_1762247586.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a519ee08-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244653, "uuid": "3e258ac4-d875-45e3-9295-a593ab958b17", "comment": "Malware payload", "value": "314723d208b4332831ccfaffeaca9974", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244653, "uuid": "66346a0a-565f-4a12-8fed-98b793411fd0", "comment": "Malware payload", "value": "7a5b0b2f503420003294373eb8ba142a8059619727428fdd7da492951738324d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244653, "uuid": "7cb6908a-8069-4433-bb2a-47aececd06f9", "comment": "Malware payload", "value": "82931e0d44e6b5031ec9338f3cb4ace11aa787c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244653, "uuid": "859e9d8b-d93d-4428-b01b-d18a9589371c", "comment": "Malware payload", "value": "1fec79cb34de0f0785b4fe26140f42849e66e16ba09b2db2cfde0245940a08952b11baddf9e43e3397f2e5f82933ce0d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244653, "uuid": "3e18f1e5-93c8-4d55-9a92-50aaaad89b2d", "value": "T1B402D0593D8026530B4717D7EF2BB8C4FA18D89A3AE40787E450BD94BA55F70D3D2A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244653, "uuid": "bd57252e-e778-440d-a68b-256b956449a3", "value": "192:REgbUMg45k/9G3AyDI4E1vHO6FIdHFy+TtFHu74SffWemob5VJY+5YEXrtg9JouY:RNbUMg45k/9G3AyDI11vHO6FIdHFy+Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244653, "uuid": "9e75201d-121f-4859-bc5d-44a004056c1f", "value": 8511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244653, "uuid": "6f8606d2-f9fd-469d-a463-9eb289f9adc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244653, "uuid": "1c285dbf-5daf-4cea-9407-39b9c98b7863", "value": "buf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261d30ca-b949-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762238427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238427, "uuid": "a2b9b291-2a59-41d7-9559-6987f46b4993", "comment": "Malware payload", "value": "1c78e4e4c2c36aef3de23f0658f249dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238427, "uuid": "5a5bf9f8-cd63-4cee-ad09-5b3638cbd6c8", "comment": "Malware payload", "value": "7a5ccea5287eeba3412d97c3ad509535d9a591b7c99ba0ce1930dcfcbfc16f61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238427, "uuid": "087903f7-b0ab-474f-a69d-c871f5adbd68", "comment": "Malware payload", "value": "06f8ab609fe7be1b199777ddde36ee589aa2b72d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238427, "uuid": "333ea8a3-2793-4222-8087-b6bc56d66001", "comment": "Malware payload", "value": "d9cca64bdc4587274d4bc43c133a767546c6630faee28936ac2a63b006d93ba8d1d469c95e3f950c18ce97d9f5fee9b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238427, "uuid": "2c6531dc-6bde-4469-9095-85804ea6c99c", "value": "T159319EC91B424871EED69E3771A5C814B0D8A45FACC4AE0495EA3CFDC85DF08BC4EA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238427, "uuid": "64408e1c-fd93-40bb-beef-c143659f452e", "value": "24:vL5dROSLw2IOSLSQdwoOSLB/pOSL63OSL8QkGOSLgDOSLOCeOSLtdOSLqNV9Ol:vdRCRGMRtpRoRgGReRcRPRwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762238427, "uuid": "db6cce90-426d-459c-a1e9-133eeea215a2", "value": 1803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762238427, "uuid": "eac48bbf-c316-431f-855e-dec117dcfee0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238427, "uuid": "ffa6beab-22ab-4a95-b8f9-7e7cb422e91e", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822c5fc2-b986-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762264780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264780, "uuid": "48f07da4-8827-4a45-94f6-e6d55096b3fc", "comment": "Malware payload", "value": "5a6c72bbb2981a732541a0898da5b195", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264780, "uuid": "7a01da23-4c5e-4324-a8cf-74cee019f5a6", "comment": "Malware payload", "value": "7b4f073a41c02a76d33fd9afbc23056c6acf9eb40b37fa57f58ba3686bfebd83", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264780, "uuid": "550c7332-5f14-426a-850b-f09bd6345f94", "comment": "Malware payload", "value": "fd5b0ed7b1e5ee7132d7865162016b4ef71a4ba2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264780, "uuid": "61f07a38-d34a-4f4d-bc14-a8461e27940d", "comment": "Malware payload", "value": "f4a481e6ecde2a7b54b6132fe16a3f920cbefa0237930576695baf9cd2f70ba59c40c414baceef80a9e2b9506c419b1e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264780, "uuid": "50866ddb-a44e-42a6-87ea-f042b88b9544", "value": "T1EB3533CA7B07C61C7C064745B808A24DEDDDA6DE0057CAB514E734B3A3708A656AFE3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264780, "uuid": "9770e153-2eab-43e9-a88b-30a406855afe", "value": "24576:KWmSQL9MWHsx1SAlzHqlMm1zZC0/6wZdiQH269:hAL9MWHY1plzIVZC0/7/H99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264780, "uuid": "68385e1b-103f-4bff-bb6d-4d301efa2537", "value": 1071818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264780, "uuid": "351cd589-2a63-4feb-b347-1ada16139fb2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264780, "uuid": "14692344-b0dc-40d9-9305-5504c94bca74", "value": "Scan-Doc104_PO-068790-MOREX-05-2025_PR01244.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc33a31-b974-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762256881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256881, "uuid": "f9d4ffd2-4550-4aac-a3fb-165030a64613", "comment": "Malware payload (RemcosRAT)", "value": "5eba3cecb98203ecc414ab6afeae3bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256881, "uuid": "2d249da4-3e4d-4609-b940-272b31c8a6c3", "comment": "Malware payload (RemcosRAT)", "value": "7b7bcf7d003fa175d98f521aed64dc5b723103ff5538fcdbd6d58b0b5afc2680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256881, "uuid": "646dfcb8-d7ea-4db4-8df2-a3f95a90be2d", "comment": "Malware payload (RemcosRAT)", "value": "a005768d41568c6da87a90832821440ceb2a9b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256881, "uuid": "80b08646-559a-406b-b674-8e726bf7bdf7", "comment": "Malware payload (RemcosRAT)", "value": "a9857621e9e757baab6ef1691a4b63f510e42c8ebfaf072acf57d3f17b7c05eaee851392403b365c7e72b4fce7e12007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256881, "uuid": "df5fccd2-9e97-4d08-b54c-c831aa366cb7", "value": "T10D149AB3D31CC8D1DD9222F4224ECEA71A507F9FA4D466C859EDB53BCB38161E1E4892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256881, "uuid": "b2336ebd-6ab5-487d-b5ac-628935ae029d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256881, "uuid": "1e72d0b9-f39a-487d-899e-5c27e4f40f45", "value": "1536:XFVuL4mqGzEBqRjSUozsqT/k6l6fiJ/mH:iLCGw+Sl6f2/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256881, "uuid": "603a6471-1f93-477d-b1e5-c619c561fbd7", "value": 200824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256881, "uuid": "5983dab6-2338-4929-8cbd-03f8df52db25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256881, "uuid": "2bd20e89-1476-4df2-bb72-6a26ec930810", "value": "P.0_3578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69c82c4-b9a4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762277780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277780, "uuid": "18971a09-8ce5-477c-ba9b-00117570f376", "comment": "Malware payload", "value": "f90a14d5dd596b3d841f4abb3e7da9a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277780, "uuid": "f9d87fd3-4313-4beb-b07f-57b1985f0cc9", "comment": "Malware payload", "value": "7cb5533799dcddf3a5dec1ff2833a14ba6ddbfa60c55b1f74dc282d898dceefe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277780, "uuid": "4e873d3d-7e69-4a6f-afa7-a38c78cbd563", "comment": "Malware payload", "value": "5341afa2ffd1f0bd5cfee44b4483e16eda30c77f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277780, "uuid": "ec74171f-6480-427f-9bac-94273c3306ac", "comment": "Malware payload", "value": "4d17f45807ea2b3358bf72b494b99ffae1f6315e9088803818913572977d745554b0b2aa61d38353d36c54fb76753118", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277780, "uuid": "a60db0e5-f67d-46f8-ad6e-40599c3d6451", "value": "T1CBF42344E421F40DEF464FFB1F520E46FF6992E13C3E5665A23903B086B0B1A9B66719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277780, "uuid": "8cf21cc6-f894-4e99-81ee-2c72a25c3869", "value": "12288:oxOB0lx3gd7rnoXPG0EmB1MLYOoPWLhkkZQHy3bJYs8DVZFn3jfZFOhdH:ok0lx3e7rnoXO0T1ML8UhpFrJHmZFn3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762277780, "uuid": "fce86535-e443-4c46-b731-052007a433c2", "value": 751124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762277780, "uuid": "ebee3103-28f0-419e-a4a2-86d049b61d86", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277780, "uuid": "0844d0a2-b06a-4404-8c78-0fb40cd1cb20", "value": "COMANDA_DDT112_21651770_2025_11.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc060370-b9aa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762280447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280447, "uuid": "a48e3d5e-0cf0-4976-9f12-db867a0b22fa", "comment": "Malware payload", "value": "1277afe120d43c8573913415fc0c2609", "object_relation": "md5", "Tag": [ { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280447, "uuid": "763a73ca-78fa-4725-b49c-f59382f28dda", "comment": "Malware payload", "value": "7d32f76f0ba2fe4af4f4f4f13797b79e05b73fa5a7fd105d12ab4dafc57c7b81", "object_relation": "sha256", "Tag": [ { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280447, "uuid": "359867d3-c777-4daa-ab4d-a24816ce924a", "comment": "Malware payload", "value": "3f4235732852b75f12f38fcb0f3488e2de17bfc1", "object_relation": "sha1", "Tag": [ { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280447, "uuid": "0aedd611-9034-4226-aabc-2fcb7226bf80", "comment": "Malware payload", "value": "833f496b2d27872c3b45c5d155ec77acf8b08b842e1c95aeabe7e64dd6bf8f01f98978ba3a84c2d3211d41e2a4693972", "object_relation": "sha3-384", "Tag": [ { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280447, "uuid": "7eca887b-0dc4-43b5-a81e-561836d796a3", "value": "T1C16633BFD2929C7CC16F63F364618645A5E502BC88E43844BA89F30C66D7DF65B212CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280447, "uuid": "ee50bc39-240d-4773-9657-ccb8833366ea", "value": "196608:w/RPz4kwXRG5lKoTVnQi0Uc5/abmmC1p2dj:6RbwXRGTTJS/B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280447, "uuid": "ed68a0ea-ce59-48eb-8d5d-2018e18ac8be", "value": 6490705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280447, "uuid": "89b1cca4-dae4-43d5-89e5-ecd07e265399", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280447, "uuid": "bd4cff33-6a13-45f5-9ad2-79191e822463", "value": "Xeno-v1.2.85.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62de9aca-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236381, "uuid": "e4e02292-994f-4e05-8f28-8b123832586a", "comment": "Malware payload (Mirai)", "value": "1197cd5aab5f0a20fb0c175d10bf52f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236381, "uuid": "5f558669-76c7-4d24-b7a3-5801a0b696e2", "comment": "Malware payload (Mirai)", "value": "7dc4e70b7cad3aba6a869bc6cce445c4e3a3deb3d457968fdc4f760a64f0a22c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236381, "uuid": "8ea6da99-e886-4a98-be52-4e4724542f4f", "comment": "Malware payload (Mirai)", "value": "34d42f57865d9216c0a3a64b7c864d974aff44d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236381, "uuid": "c6ecd88e-190a-475a-875d-3475240a16ff", "comment": "Malware payload (Mirai)", "value": "8d6e8028ab20496512ab12664ae39e4be489024e0109d58e59c0f651793959629a96e9e63c60d9a964bf8b2ee06cf9b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236381, "uuid": "1bcea71e-b86c-4aa0-9148-08716e334845", "value": "T1A8F2E27069986954FB6F3BB5AD9897F95FD8CB8DB70A09807341BF621CA30055E02D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236381, "uuid": "5429c3c7-77b3-4924-9ed9-0d14d4258790", "value": "768:yyfPtSklj3fdLsMhP550eoaicwgWU2JGGPBeyWYwCs2INS6J4uVcqgw09MJ:jtSqFh571iDslYwCVoSe4u+qgw09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236381, "uuid": "523da1c7-6cc7-4bff-8f31-735bcecd9a98", "value": 37108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236381, "uuid": "b832b102-0914-45a1-91d1-00a5f33097f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236381, "uuid": "77f5800b-0653-43ec-b6aa-e12d07c095b4", "value": "FGx8SNCa4txePA.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e89f72-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762281034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281034, "uuid": "54e78bc3-0482-4c2a-96ce-6a8a19a7cc24", "comment": "Malware payload (Mirai)", "value": "587d7d581489e8c6191e3da85d3b5bdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281034, "uuid": "17c868f0-c181-46ca-8f40-3f8d74f45e3e", "comment": "Malware payload (Mirai)", "value": "7de0eea122c2169016122a38a585fea3c8f793918edb23a220b764c4d7a71aa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281034, "uuid": "0d9f81cc-f3ab-4520-b073-9791140ed938", "comment": "Malware payload (Mirai)", "value": "a21d79f23da187dfb815ee42508fd113f95354c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281034, "uuid": "41dfa973-9803-4454-a76a-1e4aa278b833", "comment": "Malware payload (Mirai)", "value": "4a7e788290508a11645143465d22d4b7a9dc580fb10123981ad9894e416a56ff80faede0dc5f9add2b157f315925fd41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281034, "uuid": "96d74dd9-58ef-4b81-b6b5-0730317c27ea", "value": "T11A83D50A7F614FF7E89FDC3749E92B46249D542B21993B39B930D818F25E24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281034, "uuid": "826fdd0f-72b2-4e51-9b0a-2481e595bc29", "value": "1536:6JS73cXws1ulXAws6doPkv3s5SbDPQ2BhbD:0SjcwlXzPTQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281034, "uuid": "3ead5a94-ca0f-4884-80ce-218c5d1789ff", "value": 85020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281034, "uuid": "d585625b-cc3b-4153-8298-caccdfa3de0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281034, "uuid": "0ac70777-c0cf-4847-9032-da32b0d35918", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61048fad-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245397, "uuid": "482bd4aa-4337-4cdd-95b5-1982b51d088e", "comment": "Malware payload (PhantomStealer)", "value": "e06573c95278a2b8dd59f9e25457dd66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245397, "uuid": "e98837bc-bfa5-478b-8f54-92235d6386ea", "comment": "Malware payload (PhantomStealer)", "value": "7f4622cd63dc13c5e30f7544fa5f0dd43e40aadaa0355e9f9580f88b038070f2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245397, "uuid": "39e1d4c8-287e-4073-852f-a3efb70e2d69", "comment": "Malware payload (PhantomStealer)", "value": "25dfed809931aa566fcb2e7d6fda4c2c9eefd872", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245397, "uuid": "3e36b3c3-cca0-4bcb-8c3f-aaa2eb231ea3", "comment": "Malware payload (PhantomStealer)", "value": "803323c41a8fbfc3079649fd61d61d598f1bb3a75317cfd62e9558e0ea4e101485f45344168f73accac8654514019573", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245397, "uuid": "2130016e-0168-4df7-9856-f4497918ee13", "value": "T145055B70DD2806990B8B17DDFC2506A1CCBECA17127754F2E6D55B4E330A5ACE3BE268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245397, "uuid": "c740c927-d523-4507-86c8-091d192d30d7", "value": "3072:XIaJZRjUOG9jUOJjkjUOkt/QjUOKjdrIjWjfjGBOjUOOjUOKJjUODrvjULjUOkci:qIS/uYUnEv3PKFIks/A3UcHrIK3D/Od3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245397, "uuid": "a882c276-4a7e-40b1-a0a8-07cda449728f", "value": 812429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245397, "uuid": "377b2864-1966-4b79-a0fe-fd3cf1dad2ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245397, "uuid": "dc1c1688-f4cc-4582-8554-c2e9b5a6c9f0", "value": "Advance_Payment_Proof_PO110026171505_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddc4fa6-b9b0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762282919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282919, "uuid": "a87746cd-19ee-453f-b9c0-75cf6d618bcb", "comment": "Malware payload", "value": "5be444b3b278046ea16b5b4c430c37a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282919, "uuid": "defdf9c5-e02a-4d51-bb71-c074f4f03466", "comment": "Malware payload", "value": "7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282919, "uuid": "9f06fbd1-a454-4b1b-980e-116cb68c7262", "comment": "Malware payload", "value": "1b38bc38085131d4b2fba0f1a013cc11c348dca7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762282919, "uuid": "b8665f33-a803-4e7c-b35e-c0669f8e6482", "comment": "Malware payload", "value": "9f47752e95c1e0ee04ef7d7e30e320d2b2ee61359f65815f3bd7854452304d4846fcd1621274e404f90fd4924a22433e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282919, "uuid": "7d5abe53-ed16-4774-acb8-224948bafda8", "value": "T1B0661213F18E773EE469553A55769910943FAA20A41E8CB396EC3D4CCF2A0602E7FE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282919, "uuid": "eadd460b-7c07-471e-9b37-b9db56786ec6", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282919, "uuid": "f749643c-596f-4c32-b0df-8ca756bb11f3", "value": "196608:rDbqonGaJHG5XE9+O8n3jxJs3xcJWr3GpKScav:rDbGKGJQ8TYip9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762282919, "uuid": "90235196-cbd8-4b30-a8b5-6f0fa864ea34", "value": 6693887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762282919, "uuid": "0f42a7c2-3a3e-4fa7-a72a-bfdf8e6067c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762282919, "uuid": "f7c99bad-284b-47a0-9d25-10c0e84523be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fabe216-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281043, "uuid": "859e8054-2866-4411-9c05-e1b680ce644e", "comment": "Malware payload", "value": "10092c780f572b68d7de880e6ecfde8b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281043, "uuid": "7b4ba677-6a9d-49cd-b125-b47491151a53", "comment": "Malware payload", "value": "7fb83f83385b0dbddec6e836de891d7cc9f1f372efcee996d98807991fbbcfa0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281043, "uuid": "d45632f9-22d1-4c03-ac6a-835d0a946f98", "comment": "Malware payload", "value": "7d021c74a07569fe25d169445bee39f64129d9ae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281043, "uuid": "591ce11d-44e0-4228-b31a-3692a8744209", "comment": "Malware payload", "value": "b88569031afe6dec1d195670a0a66c18ad95544f498c62b73068f37373c1c7d615a30b59e670c7b22f311b4c911de605", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281043, "uuid": "d2539120-967e-4c8b-aa70-5c864ea89710", "value": "T15DA10A5402C4E7EEF16D89AF21EE007D92163939E3A016C0D3C69E437B9C54FE5F5612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281043, "uuid": "3dea1858-832c-496e-82ac-af6564bcecee", "value": "96:oP7iK2P0QzgVVaFlwFtMcLA1C0O2rxlD0Q3Q/kZ3JvIGJ9sJLGW2Pb:oP7ipP0IGVP0KPI3JtsJi9Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281043, "uuid": "3f3083c2-3c1a-45ae-be21-bce5f304f79c", "value": 5062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281043, "uuid": "ed0f09fd-0697-4891-84a3-3041fb0d86bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281043, "uuid": "7ca4bf72-d80d-4c92-a72c-8706750e6565", "value": "echo.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141eb613-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245268, "uuid": "5e58fac2-a4d2-45f1-bd5d-a2a7bd4317c0", "comment": "Malware payload (PhantomStealer)", "value": "9b7169398ae9f6d2139b372151a762e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245268, "uuid": "22353f94-f365-43e2-a604-aa0d9d02dee4", "comment": "Malware payload (PhantomStealer)", "value": "800b56989dcf3ef7dac2819564a1bd74e0350ef73e2e91ae64a3db2afdea52e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245268, "uuid": "4f1d0da3-631e-4bea-8455-ec5361c08cde", "comment": "Malware payload (PhantomStealer)", "value": "26e49ec9a2304c10ef10ba37078dbef6af5ee280", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245268, "uuid": "b4eb1855-325e-4a57-a782-d29b6f6f415b", "comment": "Malware payload (PhantomStealer)", "value": "03a3b712e0515231932f4b391962da9cdf3a5a376c190a5a397a8aba38546cc568a37972c9a62d59f7e81acf6e0099c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245268, "uuid": "8f07c237-3391-4309-98b1-42fa317c7747", "value": "T1AF16132E476FA040916D1F9A6FFE9860A15B591E9CC7150E77C4B3C267ADBC6C022F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245268, "uuid": "0c68f29a-099a-462e-a4c0-32284a1a4ddc", "value": "384:HLvFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7:FF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245268, "uuid": "d158c94f-2957-44c8-8e7e-1fb8ef995144", "value": 4395890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245268, "uuid": "37b1d9af-a62c-4948-8dc5-a263eff8de4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245268, "uuid": "4bccfe66-a338-4c16-9b4e-656d8511a6c6", "value": "PO10038282.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd5b1a3-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224404, "uuid": "28744534-e627-408e-822e-07173732aeeb", "comment": "Malware payload (Mirai)", "value": "c351ef43f0c128b60f60014e63fdca1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224404, "uuid": "51bec73e-8688-44c2-ba0b-827f54e6da0a", "comment": "Malware payload (Mirai)", "value": "8025dbcd4407c821a03be51158eafda60687e11769f8160254897877d2a8a295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224404, "uuid": "c6e4a4dd-bd4e-4b59-9be6-19a156b6358a", "comment": "Malware payload (Mirai)", "value": "ca6a2989758b3d3eb4ae961bf55abf64f09c35d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224404, "uuid": "1c7af3c3-16a2-418a-a7da-f36ab0d68d6e", "comment": "Malware payload (Mirai)", "value": "097bdbf8fef05fffea20d9da3233db8703bd86b1afdc1984e97d3aa317b38d1cc0b4a95b326132b03e2a4135e068eab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224404, "uuid": "30d43bd8-9b30-4a76-a69a-2b9c68192a64", "value": "T1A4630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224404, "uuid": "9baeeb49-35ac-49b2-85f8-f60e009692b2", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224404, "uuid": "60df33f0-0069-4572-a33e-6e81647f0762", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224404, "uuid": "4dbc7445-f7a1-4125-a3a0-2a13dd8e4379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224404, "uuid": "f4ca7a06-7aad-4bc0-b003-ed5de0c295db", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c491a3-b999-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1762272752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762272752, "uuid": "39eaece6-afe0-473e-a62c-f2e172a0a943", "comment": "Malware payload (Phorpiex)", "value": "24e61055d182cae7183cb72f6649584a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762272752, "uuid": "9c0e465a-2e46-4f45-a1bf-56ae6ec1a108", "comment": "Malware payload (Phorpiex)", "value": "805db6f001167b526485cfb9bd6fac5dbe7737af6a46100cc69348c9145bee4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762272752, "uuid": "de69c4a1-5443-412b-9422-6816be501487", "comment": "Malware payload (Phorpiex)", "value": "a7e36d9639fe4c571cfe9ca6fbe3b048bd2eda1a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762272752, "uuid": "b84e76e1-486f-48d7-aee0-979849677897", "comment": "Malware payload (Phorpiex)", "value": "1e929118628964f5f1da5b3522bbc87007574a5387cc4cbe7c70470b5909e2e92a99e40447d54bf4ba3fb85374df67a9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762272752, "uuid": "f50dc884-d937-4774-a17e-60accd224902", "value": "T10993C642A4A0A47FEEE986BA91F18D68542CBF75138948E391503657C7243FFFCB9027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762272752, "uuid": "9503f8e8-e49e-43d1-bc92-addcf168967d", "value": "f7da79b7c3f003ced1454bf7330a5f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762272752, "uuid": "ea343a7c-bf75-4019-b6c0-2f40feb72745", "value": "1536:P2qBXVOFmav82jR82D8fq5YdVB1B/8Bauoz:eqxnOrR9DL5c/19Eaug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762272752, "uuid": "95b0b714-9ec8-4f89-afa7-4be4696857b7", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762272752, "uuid": "8be40b63-fdeb-43a4-a654-88cbadab8e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762272752, "uuid": "16e0de7b-fd48-44be-bfa6-627ba27745b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0461f3-b956-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244181, "uuid": "70a4d38d-dc9f-4d70-af41-03283dfc1d0d", "comment": "Malware payload (RemcosRAT)", "value": "a2fe19153b3aa38d0c253079f7897528", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244181, "uuid": "1a81c3c7-e309-49e5-af2c-1fc7e5315f91", "comment": "Malware payload (RemcosRAT)", "value": "8090a7e5df35b01e1345e0eacafc347fe3f8c0ed584103e168e959f892f2c408", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244181, "uuid": "044a75d7-0286-4f4a-97a6-2011c096064b", "comment": "Malware payload (RemcosRAT)", "value": "6080e34bdf23b7960eff64db27e4bea990a88e20", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244181, "uuid": "08977da0-db43-479e-a4fa-e8da2f825f98", "comment": "Malware payload (RemcosRAT)", "value": "5c46b0876054a3498fd90ade3210ff90b17eb936b2e36274112dda6324ce0392bf53ef0ff83dfaadeba964f6f21dcd4d", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244181, "uuid": "6abcf45b-273c-4430-a8b2-af8ec7855c22", "value": "T134057A2ADB6FB8D4865B239B61F57B2C1C5D8B02717026F487EBCC77091532486AD3E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244181, "uuid": "a550567f-7295-4dfc-8141-377b577e594b", "value": "12288:+d5Bt1lduYJmU9f8LybzxX2CjQkV7fXF327it2tIw3rhimshdDM9G5:E5BN4g9d8Ly5X2CkkZfXFki2Iw9ipZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244181, "uuid": "231b0895-b1d1-411f-adf6-73f83863c39c", "value": 862108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244181, "uuid": "eed1e445-ba45-479f-9a8d-e2c5d7e0c7e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244181, "uuid": "861ea12c-cf46-49fc-a1af-785556399026", "value": "Quotation-887996.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da31d050-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762268364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268364, "uuid": "799f1c87-94a4-439a-b671-0da485db713b", "comment": "Malware payload (Rhadamanthys)", "value": "7c131df5412deb08c7266c78fb3762e0", "object_relation": "md5", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268364, "uuid": "4c5eaa5a-54cf-4eb9-b7eb-54a08c2638e0", "comment": "Malware payload (Rhadamanthys)", "value": "81084878c91fdd523b75c82ad788393e43e668093d3526210a89ce1fb32826b6", "object_relation": "sha256", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268364, "uuid": "2d4efd2a-5524-4faf-a936-1ac7a19ff7d5", "comment": "Malware payload (Rhadamanthys)", "value": "f11c4bd44315748e163c5f3414b46d1685c12869", "object_relation": "sha1", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268364, "uuid": "2ee39c3b-940e-4f9a-bfbb-797d7262e173", "comment": "Malware payload (Rhadamanthys)", "value": "bb71b941c32805ac6a24fcb22c605fc76fea41287ee3587bdc3c209a1f750a9e51b9584445978d654ecc90ba9027ad23", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268364, "uuid": "de19958f-fe85-49ad-bfbf-fabbe40c2676", "value": "T1789523277AC4CA62CCA89772F4FA02F30B39BC61CF945A4366847D873CB25459876B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268364, "uuid": "29c25625-5131-47d8-bdb8-3e98ff7acd83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268364, "uuid": "469cac40-e8fe-4650-8623-9d75eb122075", "value": "24576:HUy4bXhbCbA6Y1UYD9I4bYBYWtnCVXYV8WB9v4p9KHW9dhi1/os9CGOPidshy8M8:DmUbjYFD6BrCCWLYKixc28lLLwEMQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268364, "uuid": "efa4576d-bf36-4775-a5ee-37be953ef4de", "value": 2032128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268364, "uuid": "5f3fa21a-3198-4d09-85fd-d64101dba50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268364, "uuid": "43d0c2cf-f772-4bb4-9adb-e9dbedc6f3b2", "value": "file_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aead0854-b976-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762257983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257983, "uuid": "53daaa3a-99e9-415d-9082-34ec29d946a3", "comment": "Malware payload (Formbook)", "value": "b3e69dea8f7468b2dd53e5917b8a9ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257983, "uuid": "61aa78a3-3e4a-4974-944a-5f889e017301", "comment": "Malware payload (Formbook)", "value": "810ecd256ce1afe106edf3e2cab6ea9f33840ea71d5b9f1559bf60a5984c6571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257983, "uuid": "58aac656-9808-4f5e-940d-07f2047999af", "comment": "Malware payload (Formbook)", "value": "d1ca567620ee59113a3c4f122a173cbc6126fd55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257983, "uuid": "d2aa6a6c-9f88-436e-a68f-8caeb4a1dad7", "comment": "Malware payload (Formbook)", "value": "2f2cffc26bce1d4c56d3bd7f5c2e8f7d0f1f8ec753f9b8a8a42ef4ce754a880c1a94bdc4b4614e2dee6b3ecff5750de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257983, "uuid": "18f8c05f-649f-4861-886a-6df4e7a50d63", "value": "T11BE47C2531EB5156C872EBE30FEFFCB6967EF136112EB53634A3128683A1E019D92075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257983, "uuid": "9e369ac4-dcaa-4e24-95ef-7fefff70b381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257983, "uuid": "e82f4150-1869-4937-ae2d-01771018c1f3", "value": "12288:66+kjSJz8y/sr8+SndGnviv50qhwBU3MCjl6yGho0MPDDppO:4m8FSviv50Xm3MC56RhqDpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257983, "uuid": "1615cec6-b546-4f39-a608-43ec4d2cd8a3", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257983, "uuid": "19470ed1-b7a2-4287-bed4-766a2e9ff0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257983, "uuid": "fcfae1df-98d9-446c-9b00-7b2a829946e2", "value": "AWB-628976668987877523696529689#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef3c3ab-b956-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244267, "uuid": "c3aab11a-05bc-4abd-b3f2-f49d9a1e11a4", "comment": "Malware payload (RemcosRAT)", "value": "e9301fdc8eb63f842a59da85cb7a23d6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244267, "uuid": "09af834e-5b7a-4f83-9b4d-8bede7a891e4", "comment": "Malware payload (RemcosRAT)", "value": "812064b475ace7118e0a6f845f88202250f98cf3cb6643aa5eba99a47964efb6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244267, "uuid": "09173607-e15f-40f8-8aa3-0a3cc5892968", "comment": "Malware payload (RemcosRAT)", "value": "88d89ee6de3a62105abd9e7bf210c658417be9f0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244267, "uuid": "6c1c2f23-cc71-4bdd-b0a1-7f1de8083329", "comment": "Malware payload (RemcosRAT)", "value": "a685d5553c4b290a2ff2c383299b759c1297b83659acb4169dc5615c88d9c9124e1e71154d6e032b4465b5e2a8826e3e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244267, "uuid": "09bf08d9-d9f5-4541-9e0d-f14b4ca45bc3", "value": "T16683CF0CBF866D94CE63AA5D2610B50C7ABCF37565128DCC3A0FF66B97FE7608612421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244267, "uuid": "a1cc9054-1f18-44ad-8003-45dc6f8c4871", "value": "384:+JFLR5ynLR7mpYuf8yvvXm/RKD+DKmfZlJMKOX5X5NG5bUJ0MvoBKajbBZMkosLg:+Rks9voBKMtdKcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244267, "uuid": "9315a1fa-90d9-4161-a04d-d574b41a74b3", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244267, "uuid": "44710c6c-a7e0-46e5-a53b-b681e6d3d6e7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244267, "uuid": "0f964a00-8eae-439f-8a6d-b79857c187cd", "value": "fsfjjs903dsf8328sd3930f03303fsdsft233030g484030f309fdfg320400rtetdfg0xc3049gdf329dg20.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c27ecb-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762245466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245466, "uuid": "9f82bd34-69bc-4586-bc35-6b54c9f3d60e", "comment": "Malware payload (AgentTesla)", "value": "dc76accc21b1b06f3f8cc23c025acaf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245466, "uuid": "4e4eef8f-1fa3-4255-8ee9-1117f048b982", "comment": "Malware payload (AgentTesla)", "value": "81391f792ecfd10b31173a8e41716ec84e8c05c6a113bc52aae7795b435f7c6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245466, "uuid": "0f750011-ec80-448b-b62f-2f09ea821f0c", "comment": "Malware payload (AgentTesla)", "value": "1169cbcd80af27597e40bac7fe65922ab94dc983", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245466, "uuid": "5155a77e-5c6d-4263-a547-3443de21361f", "comment": "Malware payload (AgentTesla)", "value": "152c68323301c31a474802d0585b65363a46af45656b4ed5b9aad0649136a222d7f31b6cb725dc7e8d7fe868e3e29e50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245466, "uuid": "04953dd3-98c7-483c-af56-52eb5fad1b28", "value": "T17545021589C87FB9DFA89A1880BE160E97E04A8F5426754AFB37BD077FF7548020B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245466, "uuid": "789dd326-112d-49ff-aae9-1a93a4acaa85", "value": "24576:hdMUKdSs/wchk6C8m0s30hKawL1HZvQ8eCLoJwljfeXH67:hdMO6wxZL1ZvqZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245466, "uuid": "81e4011d-7478-416b-81d5-2510babf7bea", "value": 1237782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245466, "uuid": "c6d03109-f292-46a7-994d-aaec89066aca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245466, "uuid": "2976ba8e-dce6-4197-9d60-4e98e6da1792", "value": "1941468967000125 pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15d662a-b9a6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762278711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278711, "uuid": "b54fe314-74b6-47dc-832d-6f4186db0c52", "comment": "Malware payload (Mirai)", "value": "b34d5a4cc2d33ed751a44798be3adf8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278711, "uuid": "da74bcd7-ab47-4a19-95d9-705671e88306", "comment": "Malware payload (Mirai)", "value": "8161604182580664b468c66faa7cb2b228e2310e19a4e6c6ca86748274435457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278711, "uuid": "df9b41be-18c4-48d7-91d3-d9b916f6e7c9", "comment": "Malware payload (Mirai)", "value": "80db38ae3d3dc5f37dc3a295eb4b0d7d2d70cdc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278711, "uuid": "69f139e5-b5ef-4b08-a7fa-e0feec1f374c", "comment": "Malware payload (Mirai)", "value": "c723455c52a8c0683c21af321f6be21d3d53b6085170c139f1081021f586d540abf586ea8922b8b63a1b79d6e7cdb124", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278711, "uuid": "caae0e72-5022-43a2-b143-d36df227cfc7", "value": "T1DE03E15EBB0150DDE459C07C02EE0F012FE24F268ED73E9EEA1AFAD18A474506495ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278711, "uuid": "dbda5686-420d-4b54-8941-99c54bc99223", "value": "768:Hor4OehE2RMSz6fhKUl97U+HRwZcUEwHEQng+tQAEnLqCSf/+zbKLJgGlzDpbuRQ:Hi4vE2RMX5KllZpEwkQnftQ9802VJuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762278711, "uuid": "6b17b4e8-237c-4144-9fb1-156357b47e64", "value": 41028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762278711, "uuid": "e6a5467e-86ba-45ad-a5e6-e2b1772955d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278711, "uuid": "526586fd-4c9e-4c02-bb30-c19ec5fccc42", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7257206-b9ab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762280814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280814, "uuid": "75152c2e-d5ef-4cf9-ba4c-d8e8bdb4203f", "comment": "Malware payload", "value": "f7abc2f91b524a1c6faaffdfd7824da1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280814, "uuid": "3015204f-3324-4254-9c60-9877a9d700cc", "comment": "Malware payload", "value": "81814d20f119eb0de3d50d1ce624eac8af27586d919b6b3c6e341ae224290ec3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280814, "uuid": "046b79a0-f3bf-4f67-a293-72644cec1a94", "comment": "Malware payload", "value": "645bec18cff51c8d26cea5e953a18f6656fdc541", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280814, "uuid": "67676f8a-21a5-4c22-a3df-f12def563175", "comment": "Malware payload", "value": "47b8ab33ace59bc57282bfcf7da9b1cd590428bd380c3e0bad59fa26a8dc1309b1e1585d570c3c393412e5e0acea97c7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280814, "uuid": "5fcf5328-4ddb-446a-ba68-d3736cb29b5e", "value": "T11ED412520B052AEA43F0267FA9DB75DE225F8AF34380E4FFD36A6A83050F7725857045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280814, "uuid": "a0ef1b6c-1148-4b96-a03f-236d2add70c7", "value": "12288:Vyl3pyg1JiwlvcLCr6IxRGWyG6CaSAcqdEFnhWudmR5v:ATy3t46IxRGW/6uzWud8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280814, "uuid": "b0193d95-ab8b-4c04-98e3-3f09dee97a97", "value": 651175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280814, "uuid": "0d427d51-a3b3-48bd-ad77-2b540b6eeaaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280814, "uuid": "816ab7bc-63b5-4437-9a84-84d14aca6167", "value": "Set of Documents (BL,PL,CL,COO) 3789994_48833.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454596d7-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217434, "uuid": "d6cb872a-7933-4aa1-9d88-3e72337ded1c", "comment": "Malware payload (Mirai)", "value": "acb404bd811be7dc37aa9e2dc36b1c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217434, "uuid": "679c15fe-4e1e-4f4f-ba6f-8610145fd29c", "comment": "Malware payload (Mirai)", "value": "82b1b382ebaf0dd33615795edeb142cda63da9556e0f2c37b72e6a922ee59c08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217434, "uuid": "b0b0b88e-14da-4b8b-959d-dae2c4c7462d", "comment": "Malware payload (Mirai)", "value": "084f20daf1ffc630b40169dc7636610aa48eadf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217434, "uuid": "9e876767-3606-49c2-ab35-01e550dec1d7", "comment": "Malware payload (Mirai)", "value": "ae4ec530a7073d99ab54840199baa3bb1cda310f822171ca4892de38bfce6f88e7d143392445c2e3e6a8cfd8c58db579", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217434, "uuid": "e1580019-ce49-4d32-9b3e-2ffbc342fbf3", "value": "T199734BD9F801DE7DF80EE7FA8453091AF631676152C30E3E26ABFC57A8311A54963E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217434, "uuid": "fc763ddc-aad4-4ca9-9883-1c6ccecebd69", "value": "1536:mQ4zXeUFX/WZi3cccvVHNbFdTP8ihyqQZEnVFK2RltOaGaMCwE5N:vkegPWZi3hCVHNbFdTfyqQOu2ngBE5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217434, "uuid": "c843880a-b1f1-4d7b-9676-ca064ff30fd7", "value": 78632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217434, "uuid": "70f9a7f8-86eb-4dba-830b-1b1f79d2ac6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217434, "uuid": "d08c840c-0657-42f2-ac91-e44405ac3e03", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4349f0-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244634, "uuid": "140aa8c8-158a-48c1-84d3-0c285a444c46", "comment": "Malware payload", "value": "38896816a6d1bc13ba603c573572c3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244634, "uuid": "c03a01bc-87b2-488a-a0f0-4ae0b463dff4", "comment": "Malware payload", "value": "833406a6d312da2d095be63a23135e97c644e80fb70669f233a8c83239da63a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244634, "uuid": "cc332026-3fd8-416a-9ad1-37f71719caaa", "comment": "Malware payload", "value": "d17d468475b76280506729333d2b6f8a88a87e1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244634, "uuid": "ba88c648-5eca-46c4-a826-f9f85b98591a", "comment": "Malware payload", "value": "906ed9648d6847eb6a3e0d36060943c45a91d99a521fe6f0de948c6936afbfebecb24d86a721c45435ce92867b1a4081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244634, "uuid": "746205a4-58a2-403f-baca-eade255ae305", "value": "T1CD0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244634, "uuid": "162a1ab2-82ac-4a93-ad2a-a10d9d9e2e3c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244634, "uuid": "c48874d5-6f06-4aba-a741-685ae26f9d8a", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:c2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244634, "uuid": "2a2dd6b5-d7b6-47c6-86c3-abeb74852641", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244634, "uuid": "9fce01e3-64f8-4512-a456-4a9e216811b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244634, "uuid": "5b08730c-097b-4af0-9f49-74f80ed8dd0a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942f8a9f-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236464, "uuid": "5598277a-3cb7-4663-9218-96929280fc40", "comment": "Malware payload (Mirai)", "value": "ac476d1467c8d6598b7902c253453de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236464, "uuid": "48f1c748-c096-46f3-8325-f603883c96f8", "comment": "Malware payload (Mirai)", "value": "8451ebc7ba174b253773850df39c10af99e9bd07f96357dc5e50569b570afafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236464, "uuid": "5be0432a-0a8c-430e-98b1-32b02d2a8d04", "comment": "Malware payload (Mirai)", "value": "b419175145ba575b17ba1330bb0586a9fd823e29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236464, "uuid": "cf28ed5f-9f59-4a81-ba23-bb1426149a9f", "comment": "Malware payload (Mirai)", "value": "955c996442d31be162bfa3830d06f99474b12458365746530678834afb5fb2c9faf09c3eb0d3a20c0f5e10008b408b19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236464, "uuid": "dea8e55d-d99d-422e-93b2-0a3ea8a27645", "value": "T18A631981BC829A2BC5E4237AF56E668E336463E4D2CB3227CC614F20779951F0C77E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236464, "uuid": "95406704-1aa7-4861-9598-bdfee31918d7", "value": "1536:8fJ36BoecYA/a7YtCpRhX7Yt3awKF3SjXyKmLt5nVrqASG27denSeVDRX:8fJ3QFpfXKw127dqDRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236464, "uuid": "5be230b4-ebb2-41b3-a783-d10b38f82372", "value": 70896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236464, "uuid": "0b5f0f9c-0464-48dd-9fe1-44d718907615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236464, "uuid": "5bb192c9-ef71-49bb-b92f-8c3b2bf70817", "value": "FGx8SNCa4txePA.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8c887a-b9b1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762283108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283108, "uuid": "1c0d2eab-4b1b-4f0d-a990-f0175bebcd3a", "comment": "Malware payload", "value": "b53a05cf033ad049df03800ba99527d8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283108, "uuid": "ad8591c5-5bb9-4c8b-a379-274d06819990", "comment": "Malware payload", "value": "850a1f2ac36a70dadb7d6054a4139ea784f548444df27bf9dc20d9f77a3531f6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283108, "uuid": "e03013b1-f02c-4286-9c4a-26bf8669b6e2", "comment": "Malware payload", "value": "7f1362e89334bab4b4a988baafbb5f5ffa8da082", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762283108, "uuid": "bef2c261-450e-41cf-be3d-a77373189332", "comment": "Malware payload", "value": "f4f5e327e4381c06aa114e56edf4ec13f4784065cf7d1db349d6b8d461a94c3c69fd1d0abc422945d87c9a13f6dc50e5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283108, "uuid": "faa36f5e-8eb0-4a5b-8244-86cc01e867c4", "value": "T12D45B3D4E4355F8AA69A095244330421CB231AC289AE78A3633A1F1C5763FD95377FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283108, "uuid": "4fb77999-d4c6-485e-8adc-50ce1ff661c6", "value": "192:WrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOYrOD:ydZaimh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762283108, "uuid": "2d261c68-ab8b-4b09-a32c-181b45514ad3", "value": 1276692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762283108, "uuid": "aac01768-aecd-4690-ab68-85c801634599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762283108, "uuid": "4e250867-c7f1-40b7-b09c-3a08a8bb79e2", "value": "Photo Facial X Ray Medical Records Dr Review B0311b2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca50a507-b9a7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762279075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279075, "uuid": "b4ba6bfc-d44f-4e47-b329-e8bf65f962b0", "comment": "Malware payload (Mirai)", "value": "60597fea843eb2100f6aeb0f5dfabf8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279075, "uuid": "91a21d0e-7e5c-4964-8e58-d386c88f1097", "comment": "Malware payload (Mirai)", "value": "85297bb7fb564cef16d19347bb563a3d3582b5e3c3ca799a2586faf02ed18d1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279075, "uuid": "5694380d-66b0-4a2a-b740-71a8ee85851f", "comment": "Malware payload (Mirai)", "value": "9bdfe5f09a3742bf28fe56f0ab9a8aaa631b84be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279075, "uuid": "0032506e-ef65-45d3-98c4-be84d9eda2a6", "comment": "Malware payload (Mirai)", "value": "ad3e0839059859227b76bbda58ca713cc46e54984934651328e62762cae012b3ac25103ff09d2fb0a323be0bd93a9f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279075, "uuid": "8c035f97-88e6-4706-a998-1c65fd7aa296", "value": "T19603F067D8C19FA2F09FE2B32936B8060544E250941CE6E446D8A5DA2572F3CBE4D0BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279075, "uuid": "36886e14-9f02-4d71-9057-a53d2e97f2dd", "value": "768:hG3b/Cc2od+OHGwl64QLR7zn840wneUhsBoxEgDmSzcJVnbcuyD7UHQRjf:Q3+wddA4Q5awne+DZJIVnouy8HyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762279075, "uuid": "2faa4eb2-d2de-4ff7-8768-07eb9edea900", "value": 39820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762279075, "uuid": "9a25fc89-ff42-4b16-a224-ec697d177b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279075, "uuid": "048f4430-9ce0-4cf8-97f4-b84286fb5721", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153363e1-b9c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289938, "uuid": "d0f2c712-dd56-487d-920c-457bf83e10ec", "comment": "Malware payload", "value": "dbfe552da93c91418c92aee56a78600f", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289938, "uuid": "f78d7145-d36e-4c0a-aca7-d7eb122e962a", "comment": "Malware payload", "value": "852ae02d41d06e7c72f6e288467a2a1fe4a99de532f49ab639638f16ab738b48", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289938, "uuid": "7d4862bb-2bd2-4003-8364-dc289006d5e0", "comment": "Malware payload", "value": "1f1358a8c288b64a3cb2648d84bbecad12467cb5", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289938, "uuid": "e48281b3-33cb-4d8c-b31b-10e5eb028d34", "comment": "Malware payload", "value": "23a00a2758b008a149f4946214ea7a8f6cfcd59d77ebcb80f721418fd3eec6d30416bd5bf3a8650205f8e36cc56d69d6", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289938, "uuid": "939a187a-51ad-4538-abd6-f69d7c82701d", "value": "T17CC401156A22CA13D9A593F40A71F2B953BD5EAFB601E3568FD87CEB7873F440904243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289938, "uuid": "298352c3-4cd2-4732-870d-b31e3203143a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289938, "uuid": "d57d7a87-abfd-48c6-98ab-65bb8bf31d60", "value": "12288:IdTrzbFfVaZR3k0LxXatRBqH7J32m8xpVQuxxPASyKU:ETrzbFofkGXC+pn8xpV3PASyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289938, "uuid": "9dca8f2e-d065-4ef1-afb7-b12c9c60fc71", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289938, "uuid": "9183888e-302b-423b-add5-13f9fcd5a407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289938, "uuid": "b56febb8-ee60-4e79-b00b-4e84be647407", "value": "New Inquiry for Quotation_255195011_Doc.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1330fb8d-b9d9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762300242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300242, "uuid": "3eea25fd-ed27-422d-ad23-95dba8891664", "comment": "Malware payload (Mirai)", "value": "7785eff2cd8da268a7f59ac17afa4648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300242, "uuid": "947bfb37-3918-4a43-b00a-b5a7b2749dfb", "comment": "Malware payload (Mirai)", "value": "854457830b32723de7263a9df3ad681c735bd689d97c628794bcd3d84ea08fb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300242, "uuid": "d7c44132-c347-462d-b579-9fea8e7744c4", "comment": "Malware payload (Mirai)", "value": "ab820dbf468328543110370f49983aa94242149e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300242, "uuid": "7aa60c1b-f915-4075-bb6c-d679246b44ff", "comment": "Malware payload (Mirai)", "value": "cc07b1ec8c648f51abbea6b2f3cf692edcc9c3db7f29f5a847290a587365acc6026ded3c749da52d47a286f916176e49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762300242, "uuid": "1757991f-f61f-45f7-ba6a-e98b64969fd6", "value": "T17E03F1911E215D729B249833EAB18D8973B68BB4E7FF727B8408456C6B4901F7AF41A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762300242, "uuid": "6da92a79-eec3-40b4-998c-e4e518b96453", "value": "768:TdMOw6ywZqJ8THwSVF2DOqYO7oeyGZCX1PvhXQMCgbPs3UozI:TdYyAJGwcCOS5GRCgezI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762300242, "uuid": "010d660b-498e-45d1-b057-3730045a4bc7", "value": 40096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762300242, "uuid": "162a797b-4e2d-4535-8ddc-028faddea26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762300242, "uuid": "91632037-6837-4ac4-a5c3-a27e3cda3bbf", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98470157-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237330, "uuid": "167197fa-0c7f-4064-82b1-31775b9c3f59", "comment": "Malware payload (Mirai)", "value": "59a308b40f4793aa2cc8c365f753a501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237330, "uuid": "737eb154-1a75-4dea-af98-296db3c3fadd", "comment": "Malware payload (Mirai)", "value": "85f244681b5b2c3f2729da52f75320b6e583e87646bf3f4bc5df3e45159bd34f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237330, "uuid": "5f64f935-4355-4d03-981f-933d6c03d4b6", "comment": "Malware payload (Mirai)", "value": "588aaef63fc70c68c4e0ce71e2ee2f74cd397e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237330, "uuid": "4e3e46bb-05fd-4658-be58-8a944eda5afd", "comment": "Malware payload (Mirai)", "value": "af660240ddc7ce150daae7a2dbf636c66e4791541d295cab3fc85c974a3d91f648682d9e0f0129b3f00d9efedc55a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237330, "uuid": "3bb10d5c-5629-440f-9a84-81486dde1baf", "value": "T1FD430966F8829B3AC1D0627AFAAE568D333073E8D2CF3117DD601B517A8A41B0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237330, "uuid": "1fa77d7d-3d29-488f-9bef-c8acb61b2058", "value": "1536:v3jN08yCL2q2dFNJf6/QNzokRHELtOKOJa10Hlr:v3jN0xzNzbhEpLO4Ilr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237330, "uuid": "d72b962d-0155-40d7-b2d6-66c48ee0e309", "value": 59924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237330, "uuid": "b5e16301-2b8d-4ef1-807b-516850b081ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237330, "uuid": "195917c8-7d83-4734-9306-1d549a8aba65", "value": "uYtea.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4cbdc4-b922-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762221928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221928, "uuid": "2bb062c8-a680-467d-bb14-f2fe5acb88aa", "comment": "Malware payload (QuasarRAT)", "value": "db8cbecdcfc00e65d9ce129518d9cf3a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221928, "uuid": "403edb9a-8c6c-4d5a-a141-37c72054a6d0", "comment": "Malware payload (QuasarRAT)", "value": "87bdcee9a09330b4c19e9e30eb77cb744c7ae325e1a7a61fae424ba936fcd7b0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221928, "uuid": "782e7bcf-63f0-4f49-acfa-e2103469608b", "comment": "Malware payload (QuasarRAT)", "value": "19831266fba876e197fda3614daa19a81ee80ec9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762221928, "uuid": "8f068b72-9267-40d6-9d03-74d67f15fe98", "comment": "Malware payload (QuasarRAT)", "value": "2bc0ff859c1d91f924e893a0cfbc2cdec8cd0806ca982a0c2b7fb1186723342040f55d1423e7b6c9f10c5c2d558551e0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221928, "uuid": "4c44eb7e-6608-4a33-ab24-a52133d18d92", "value": "T1C015CF5473F54207E2FF1BB9A9B605050B77F942D932C74F1988A0AD1EA3B80DE613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221928, "uuid": "fe8c76fb-6469-4db7-b0ae-5b374475cc9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221928, "uuid": "379c9dca-dbbc-4e6f-8007-43a3df10a544", "value": "24576:h4HouzxJzck+uGW/yFoBkkABfAutpptVF:h4IuzTYjqqanWtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762221928, "uuid": "ac517c4c-6881-4e7a-92fd-370ba3e6f00c", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762221928, "uuid": "11080628-63c4-487c-ad4d-830d2a6367f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762221928, "uuid": "73da3e11-a432-4e2d-b237-fe7103bd69b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a519af6-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236474, "uuid": "5a469231-3e7d-4f67-b564-7d000da04da2", "comment": "Malware payload (Mirai)", "value": "fdd24ed26e903bd48684d469e8d3ac5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236474, "uuid": "669c5398-46cd-421b-82a0-04259dd14bd0", "comment": "Malware payload (Mirai)", "value": "882bdac44cb7897f4a242ad178f95f5e738a69c40bdfeab8c817aa88cc73f5bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236474, "uuid": "d71bc72d-dc7e-408d-a4a9-e66db61a5e07", "comment": "Malware payload (Mirai)", "value": "ded49068a122ce829c893ab2154267f326985fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236474, "uuid": "19c5fd35-2b61-4fde-b7f5-b5bd0178f942", "comment": "Malware payload (Mirai)", "value": "7df4df363200ef94fbce4761746609a813d1a224aa6b0864ab94406b10eee2567f62ef763a5fb526c02b698273ab809b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236474, "uuid": "5fc87382-e994-4ab8-a404-fca1ce729a4c", "value": "T1EA933A81BCC29917C5D423BBF66E528D372963E8D2DA3217CE215F2137C692B0C7BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236474, "uuid": "4a307319-7431-4fc8-922e-44dc1cb594ab", "value": "1536:x61edzUnePK7OMRa+Muy5vH50RPk0c5TqOEkuIomFU/kxsK3Y28rH5vMop03VJvW:81eb+/yG7kr2j1eXyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236474, "uuid": "aa9794d6-5a22-4563-acdf-1d651a98c140", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236474, "uuid": "d2e54bb3-966c-4b27-9995-4f2f45ff1c41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236474, "uuid": "1e529634-49c5-47b4-b2e9-327d7cfa9ee7", "value": "FGx8SNCa4txePA.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a17373-b9cc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762294720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294720, "uuid": "771c6748-2bd2-4b03-9d13-db52b307f621", "comment": "Malware payload", "value": "3970a18b9ef23d1301a2f54c7a8215ea", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "network-worm-ransomware", "colour": "#DF4B1D", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294720, "uuid": "4be09d4e-d1e9-49c6-a507-744d4ebc7e3c", "comment": "Malware payload", "value": "896dee0099962e3666f508945d134b655aebab495334118d61c307e5734c3be7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "network-worm-ransomware", "colour": "#DF4B1D", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294720, "uuid": "3c878ffc-c328-4cf1-8858-0751021381d1", "comment": "Malware payload", "value": "93a96766317a18b3d890191ecd53b62d21aee3fd", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "network-worm-ransomware", "colour": "#DF4B1D", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294720, "uuid": "fc99b9c5-0e68-4d4b-a179-cb506f932b7f", "comment": "Malware payload", "value": "e9d209715986bdccf5f1c8f30c19be75f5cf59ba515ecd9a9e4239b5d8b74f1d91fc98909dd888e0d90b61f400c6209e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "network-worm-ransomware", "colour": "#DF4B1D", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294720, "uuid": "085b5826-2cb4-4e39-948c-854067fc89d1", "value": "T160C2CA1B1B5A842684D7D362CC5BC592EF3452982441048B33DCD0F7A71B1AEFB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294720, "uuid": "ed5abafc-d566-44f2-b065-51233a6ad65f", "value": "384:enSpHfXdTwhq3nwfP5zCpiOSFdgA6VguA6VguFolRdBFolRn+73nw0PgYCogJdjP:GSpHfXdTwhCivFd6/Q7pNT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762294720, "uuid": "c9a89ede-d960-4d84-b4fc-169e5a440a9b", "value": 27765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762294720, "uuid": "7a3841e9-5689-461a-867c-550676afcbeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294720, "uuid": "67238a8c-3cb6-44eb-b53f-91e8518d7670", "value": "Updater.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0e54fe-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261151, "uuid": "93972f45-d77d-45c0-9e67-2a958b9d5e7a", "comment": "Malware payload (Mirai)", "value": "c3d9f2e99276e77232302e3c11bb832b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261151, "uuid": "a9faef24-8f37-4dcb-bbff-93eb1f94c819", "comment": "Malware payload (Mirai)", "value": "8a792b8f64d5d9b88c24eff678823fcee78eec0c85174b7f67313d178d511e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261151, "uuid": "5a6e4d67-5af1-424c-b33b-2147a51ff4ef", "comment": "Malware payload (Mirai)", "value": "25f86ff6dd7ec2bd45dff8fb97236c75571f5941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261151, "uuid": "cfe03d3a-c2ce-4549-be5f-30e8a756d514", "comment": "Malware payload (Mirai)", "value": "db998034887e0af0f201e26c67ee2854bef74ac6440bc13d4f41e7da0ba85a4708a076e70b98326b11aba3d8b4b11da1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261151, "uuid": "7941b053-b5f2-422b-ac1a-2e2224360cb8", "value": "T12E7302082499D210FF111B76D89924CD4841A8D5D0EEB1EF313A5E39D9CF9A32CBFD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261151, "uuid": "4faba3db-4b47-4053-8803-bd2876a0e96e", "value": "1536:L8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14JaLtBcGXUqh9+sadEO3dzzUCRy:wIHq+kOQwgrBEEO/h7iF6q5v4JaL05D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261151, "uuid": "3e61ac5c-be64-4909-bf99-99d9203ecd39", "value": 77208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261151, "uuid": "22019ecd-7ea4-4fc7-8131-4aa3f49df324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261151, "uuid": "24eb321e-47f4-4918-bbd2-e68a870e0364", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f05e2ad-b98c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267379, "uuid": "cac37c91-87c6-4626-8577-8467dcd3c9bd", "comment": "Malware payload", "value": "b3122f765e6caa205a98a86af5975162", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267379, "uuid": "db94c8ae-6f47-4ab6-b584-ccaf3e5f24cc", "comment": "Malware payload", "value": "8a830eb47cd47ecfd262ef1c9ccda95776a382867211fb8522f1e4d16285a407", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267379, "uuid": "1c2fb277-721a-4ac8-97fe-d30678dfc6c0", "comment": "Malware payload", "value": "be0390717b33c2fa3b0b5acc37e3322e5a931b7d", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267379, "uuid": "f0386b5b-4a9f-4587-a80f-2fd474efa708", "comment": "Malware payload", "value": "0ea956667b6ae8b13d01af37367179c7e2905281310640daa166f94d6d44d4191f32f20958f7e5d497acac3c4bc6e0f9", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267379, "uuid": "c7fe0cfa-fbe9-4c5e-b921-da5755f055ec", "value": "T162D63391F68092CAEC371470E8B29E95957DFC39C676C39B5274332A5D332E1893B683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267379, "uuid": "521ecee4-76ac-46f8-bbb9-c7783890259e", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267379, "uuid": "4b70860e-a521-48f2-92ff-d802ab0581e5", "value": "393216:D8T67SNVVt2BZrXMCHWUjGqcuI3/PjuUwg:YYSK/XMb8IH/rAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267379, "uuid": "be919bd6-adb0-478c-ab11-2e5212744372", "value": 13087759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267379, "uuid": "2acc54cc-58a4-473a-99db-50bdecd82068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267379, "uuid": "0b2c8a6f-7040-4c49-a93a-51c0d86da975", "value": "adob\ud835\udc1e_\ud835\udc1e\ud835\udc1f\ud835\udc1f\ud835\udc1e\ud835\udc1c\ud835\udc2ds_\ud835\udc63\ud835\udfd27\ud835\udfd5\ud835\udfd9_\ud835\udc63\ud835\udc62\ud835\udc31_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683e3c02-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236390, "uuid": "2e8666e1-7dce-4d7a-bb33-a120ed588105", "comment": "Malware payload (Mirai)", "value": "b40879be807c728f02beb8b2500cdb07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236390, "uuid": "77c77abf-4751-4e0b-933f-e16dc31f21e8", "comment": "Malware payload (Mirai)", "value": "8b7b059957821a660a48b102d122ad624c65d7f7831c60db44a150ee2b551c47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236390, "uuid": "32af0ace-c07a-44ad-a738-4133e0af223f", "comment": "Malware payload (Mirai)", "value": "22611cab1001f736110e0452fd8a51c91edb117b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236390, "uuid": "baef5dc0-74f6-4de4-a6da-ba7147ae75fe", "comment": "Malware payload (Mirai)", "value": "f67f2daf3c2c96f1a0309e3c4323099a655be3a1a84581844db20e326f9c207bdb16373eb8b0a70df698386eddb929af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236390, "uuid": "9a773a54-2a0b-4507-89eb-875949a8ddc1", "value": "T19E03E13852CBA4B690A52C71F92E414B0BEE0BB89EFC327FA5419CD9BDC259311B4417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236390, "uuid": "faeb300f-dfe2-4323-9978-52cb141d782e", "value": "768:whl14Y5v99fZSsgFzmsv5sbq50u5HQADTEJ3IqlHsJD1Xrds3UozRU:k5VCliO5/HQADoFIqlHK1X8zRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236390, "uuid": "cc4d274d-c83d-4223-92af-a4dd4aee11b5", "value": 39268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236390, "uuid": "10f651ff-46d0-4a8d-91f3-a701d3e77e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236390, "uuid": "86e83876-f3a0-455b-8609-1eb2fc7d8706", "value": "FGx8SNCa4txePA.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4732c90e-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1762239771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239771, "uuid": "cbb7839f-6a3b-4100-9248-411b34fbd405", "comment": "Malware payload (Gh0stRAT)", "value": "b2820ad9d92b5580a79a9c51925b4e1a", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239771, "uuid": "ceac2f9c-e0e8-418d-bb15-6633beced5b8", "comment": "Malware payload (Gh0stRAT)", "value": "8d15b4160b15eb30d6a0793ee8264b3a9a7c52bb8eb4dd3edb39a7a2ffb26fa3", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239771, "uuid": "5b8185e2-3749-4627-8ab0-447141d98bf6", "comment": "Malware payload (Gh0stRAT)", "value": "bca7d3fee53677daf505f7939a7658cd838ea0e5", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239771, "uuid": "5c3ea7fe-25c4-48a0-a56e-900884d1ff2a", "comment": "Malware payload (Gh0stRAT)", "value": "2ea1b4ab30c8f3225755d684af2c3c2b8d3b3fff281fdf8ad2b7a2e47a265a294e5be9fbe13f7804963d65de69ff1e9d", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239771, "uuid": "93cdfc17-a994-4390-b791-988fc775e2e0", "value": "T177F633F2D6EDA2B4E20752910D0B06F6E2DA3522DF3C693225BAD7C1837D6EC9109731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239771, "uuid": "1b8e0f78-033d-4c24-bb2f-59a9971fa704", "value": "196608:nc9CnUuYQctDw57EhIxkNlHQsuWG51VqnBesGMqc6Q8aET4Rc5xHXj/t+7zR1S1M:t7EQM4kvHyWGFcjRc5ZXjeC1OqsjSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239771, "uuid": "59a0179d-44fe-431d-a90f-f85e67930af6", "value": 16457717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239771, "uuid": "7f7b3587-6ad2-4c11-a8c4-95dbf1db897d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239771, "uuid": "e2a14353-d3ea-4b87-ba33-53345521988e", "value": "kuailian.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329dfa7b-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239736, "uuid": "61fb9e95-e394-4cbd-9530-687925acb713", "comment": "Malware payload", "value": "0705be119dd534d819f2d58a819ed372", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239736, "uuid": "c23ab60d-5e12-45c7-9f8b-ccac5d3867e9", "comment": "Malware payload", "value": "8d96d0d7a8d6b0717e6f75f60a3889e86a4203aa8aab0e9349b70e38ad8ddf8f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239736, "uuid": "67022036-d4ae-4d03-b077-1cbbefc24db0", "comment": "Malware payload", "value": "bcb6cbf59a39d9223ec63a59eeaba232d7983ebb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239736, "uuid": "e0fc61bc-25b4-458b-9446-ab0bb5d9e3db", "comment": "Malware payload", "value": "5db1376d6c986df3cd8f6d6cdbcbfd56cb88606c687feaba3c8cfd5f057c5eca7ba4400d6eab912d8688728f54c2165e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239736, "uuid": "c6d09ab6-9315-4c08-914e-b1a7c72ed924", "value": "T1F2660203F78E492ECDE2B97C1E6313716615ACAC1820929F0912F318BEB76D95F25BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239736, "uuid": "338f4c7c-3e0b-4e5d-8d77-a43f17c1bf4c", "value": "196608:DonA4ZsPedEI2O1/6PLYxzpqiuX4Me2G2:BWyIvi041Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239736, "uuid": "1f2705c7-98fb-4e2a-878c-7094b5fe9287", "value": 6976708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239736, "uuid": "0fcf6d9b-8439-4794-b9e3-ec3a2adda3b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239736, "uuid": "d0cc6c6f-9ef2-4fd0-be86-0b5f528dd75e", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00857918-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245236, "uuid": "38f05409-a27b-46c2-86f6-eb0479c5486e", "comment": "Malware payload (XWorm)", "value": "9ec3d789449a29efc101edea4dd829bf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245236, "uuid": "11ce4a57-181b-4094-b125-486cbde2925b", "comment": "Malware payload (XWorm)", "value": "8e1564e858a354a4d0f3d9d10e2d69d67e395e4a464744c6e0dd3d1e1e1058a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245236, "uuid": "871c628c-4f39-4ffd-b940-3d8b3b86ac11", "comment": "Malware payload (XWorm)", "value": "fd1527563efc0812dc156a61138066cf6be015aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245236, "uuid": "76b2f7c2-1531-498c-b9b6-c1654ab4a122", "comment": "Malware payload (XWorm)", "value": "faaab5b60746c9479ec6d4173a0fa11e3a9fe5491cb14796dd08247b6997c3f0e978cbd9dd28076468c39a870f695568", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245236, "uuid": "4f1f47fb-479d-4d74-a94e-40a93cf6c863", "value": "T1B7361944F48497981C275D26B774F0E183D2B65B7E46C913E01E96F2BFB31C2BE2216A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245236, "uuid": "465cdbeb-7f4a-4004-8bc7-b63c9f3f5d5e", "value": "98304:VTJd2/9Xundr4qT2VmW1acx2gznrrA3L5Ld7BzEDivK+K9zBevJCREX9FWWBvq/t:VVd2FKdkrVOm/7PAdLdhewBCRS94CycW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245236, "uuid": "34a3d64c-0ec0-4733-8d54-44c824610a5a", "value": 5204699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245236, "uuid": "e8c812b6-127a-4c5f-bb78-2e04322be002", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245236, "uuid": "2c8b3020-0e73-4431-83f0-6405693a2a1e", "value": "UNIVERSAL SUPPLIER ALLIANCE KYC_Form.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9232a021-b947-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237749, "uuid": "a3a6add3-23ef-4ada-9b93-81c711edbe76", "comment": "Malware payload (Mirai)", "value": "0c35faa1a2b70d99eb6c025c848b16bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237749, "uuid": "fe8ed5a2-c28e-4115-817c-6b8770b5815a", "comment": "Malware payload (Mirai)", "value": "8e532e6644d0256ffcb15e8e7721de2e8ba19b626d21c96cb3517742f63e81ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237749, "uuid": "f118421a-3a2e-404d-911c-6500a67cf036", "comment": "Malware payload (Mirai)", "value": "ab26e8d6d696bf2c735492dbab647d153a78cded", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237749, "uuid": "9d74a9b1-434c-4d9e-9140-e93b49cd3891", "comment": "Malware payload (Mirai)", "value": "252af11fada81a9e008a2123e5f5e4161db4b25d3728c8e02a8609db010a42850abeff9802d8e2c104fa4a702637d806", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237749, "uuid": "45cf5d16-f62b-4ce1-868c-61a2848525cb", "value": "T1A951D6850552CB363CA5A4A331A6096CF28B689358E97F41FBFC78F8928CD08F15CE43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237749, "uuid": "c2cfc3ce-19ac-4482-961d-356d6695ea61", "value": "48:vTkZTVBTb+XTYVT3pTM+2TVZThRTC3TNqoTyBTutTnAfj:vajqKV92THeEogwkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237749, "uuid": "d2f9f736-4ce9-489c-981d-597e16cceee7", "value": 2535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237749, "uuid": "f52610c0-30e3-4e5b-b3a5-9a3758f7e2b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237749, "uuid": "a6c9cc65-97b6-4247-967f-3ae2827e250c", "value": "0x83911d24Fx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b90c12-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268652, "uuid": "80a958d9-9f91-4b8e-9d70-5212b2b90a49", "comment": "Malware payload", "value": "b24d144f391593cc76cc7cf14449c943", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268652, "uuid": "5403c9dc-58ed-455a-a0a8-de147b60f0a2", "comment": "Malware payload", "value": "8f40b6ceb3714dc368e717078f2b7a1c3e4070ea744775d9bd5860008483531b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268652, "uuid": "a8880f3c-9bd1-4f87-908b-508a16b8a69b", "comment": "Malware payload", "value": "9695208e7f7420932cf153ae13558cf62869a142", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268652, "uuid": "32f7f40d-d6e1-48f9-b1e3-3cbd65d337c1", "comment": "Malware payload", "value": "16af69ddcf24c97f8205a03582d99e77d85e1fb4eb8f25925c353d923fad37a724868f95ecf1a99b67e2e68a82230665", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268652, "uuid": "acd09aca-b69d-4cde-8c06-4445a17bad37", "value": "T15121ED041BE55B22FBF30F3654B2B6359A36FC12E942DF1E008681881932B61AD24F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268652, "uuid": "7755d644-d84f-43f6-921a-6af9d3aa98e5", "value": "24:8IJ8JsPZAO7ypgAM6Ji+/xN2zORJWgORJxYqVwOtab/cm:8IWJG/yp3xN7Yb/BvtaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268652, "uuid": "2c0b95f2-cedb-43e9-b226-5c3da06008f9", "value": 1439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268652, "uuid": "6a0427c1-8e4b-467c-9b21-78ac1216b7aa", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268652, "uuid": "646d8f87-c40f-4df7-8502-0ce92928bb33", "value": "R537JS829031.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb5a763-b986-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762264884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264884, "uuid": "402fef53-b003-4188-8e3e-ad22eba494a1", "comment": "Malware payload", "value": "ab793b00b78ccd9a640f94aa5d9be2b6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264884, "uuid": "cddd1a0b-5dcc-43bb-a946-70e2245713b4", "comment": "Malware payload", "value": "8f7a9ccbc0cf84ff484d3cae040da9f5cba01a74344ca3a859767c61df1d37ea", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264884, "uuid": "4c6c3f94-568a-4054-9c2f-cb1fe812c473", "comment": "Malware payload", "value": "a6067687de24a36c09c8441b254f4139be984fc8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264884, "uuid": "6a9f0a9e-be2c-4e7d-81b3-74cc2ed7f696", "comment": "Malware payload", "value": "e9bb02dba849f4cb70f43a4a490f70f1d2918b5ee3fd85d10316ea8a104c686de17f066a0eda32a8cd86bfad36cfa7f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264884, "uuid": "04f41b92-6b8a-4665-8231-9847146a368c", "value": "T1481523E93D8BAA6D39A303177BD2F29608F7E89E44030836917E772582037D446D87ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264884, "uuid": "e1f2f8c2-a6e0-42ee-962d-a6971cd334b2", "value": "24576:qmP8hiBEcwdV1dwYgpVxGg5tEQoLaaMdlvLxLGEijHA96:qdhiBEcOwn3ryUvATHW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264884, "uuid": "56313b38-3617-441e-9cf2-1cb6005de5e3", "value": 878639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264884, "uuid": "9f193ac8-e45c-4bcd-a3da-266503464746", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264884, "uuid": "55c01a54-d072-4660-903d-cbedf62191f7", "value": "Vendor 012433 PO 00013491049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d6980b-b992-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762269974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269974, "uuid": "82dd0ee5-6802-4877-9ae9-74237cc92d2b", "comment": "Malware payload", "value": "944ca2ab1c2f9318e488edb11f2f04df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269974, "uuid": "e251af95-55f7-4a49-bb76-0e7923183dd7", "comment": "Malware payload", "value": "8f82ea128fcdc9627d4f5455f336899df9bfb43aa56cabe212b45544da696f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269974, "uuid": "0fc30474-4c25-4371-bbc5-6e3df11a9c88", "comment": "Malware payload", "value": "1a3cf153bc5bbe2f0ec69a14f1407b2b6c550aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762269974, "uuid": "760f6550-5507-406a-b47e-8c789d6af925", "comment": "Malware payload", "value": "f2134289ea234aee2517db2799f5e636bf320d60f4cc6b236366d4b5ce969b676a0ba20c41b0d50f2dd33082f15d82e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269974, "uuid": "e08f776b-be19-4dfc-b926-3aa3476c8bf8", "value": "T13F957D03F29581EDC1AEC1B887579733BA32B88D053476AF17D4CB642E26F906B1DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269974, "uuid": "baae9287-01ca-4ffa-87f8-eb0a02eb40ff", "value": "662aeff8088d29be52e7695538cec598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269974, "uuid": "50a7d5e8-1d34-4950-ae43-db60c57b4700", "value": "49152:ivTKFnGDvZ+r2cvUN0aOgF47p7PwOIU6iD:XGDvo2cvU0ax+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762269974, "uuid": "8e58e27d-c334-47a8-907e-8e4aff8b034c", "value": 1926656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762269974, "uuid": "8dec2cf3-61b5-43dc-a0ca-cd7d2fcd1956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762269974, "uuid": "2a86779e-4b82-4513-ba17-a68312ef4dca", "value": "nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87a3739-b925-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762223318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223318, "uuid": "28235765-c5bf-4e09-a361-6829c1e4cea9", "comment": "Malware payload (Formbook)", "value": "22f951c3f6fabe1c08e8c906dda9699f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223318, "uuid": "660cd56e-de46-479c-9f9c-51efa9c7c21e", "comment": "Malware payload (Formbook)", "value": "911ab907376843edb05b47e615e37582276cc4af2b676727af7d61831d9fd044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223318, "uuid": "35bafe6d-4347-4b18-a9a1-b013db296ea4", "comment": "Malware payload (Formbook)", "value": "c952a9c3bd78641b3118c633837a3028730a6566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223318, "uuid": "508e7a5e-7ef3-470e-8145-57883f576211", "comment": "Malware payload (Formbook)", "value": "00404b45bdd04ba5aa6b1058b01adb18066cb5f2df1bfc1c5a7cce1b525d3671a6824b4580779a6a2ee327b58adcc6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223318, "uuid": "6e91fa7b-1812-4ab7-ab3a-4d27fa958c8f", "value": "T1E8F422851A81A961E200A3308833CC5599783D606F06D73A872CFE7FBC75397E96775E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223318, "uuid": "96316870-7930-487b-9828-fbf37fd55363", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223318, "uuid": "e8d792c5-790b-43ba-be59-2f8dfd5ea71b", "value": "12288:Kz7hU5I5yuNHIgzSFKxWltRohBfSTso93U/azayibDBNaezoyZwGK9GD+pxkhw:Kf+iN57Gtene3wSih0ezoz4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762223318, "uuid": "cdc6d7f8-4dc1-43cc-b286-298742b81750", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762223318, "uuid": "1841471d-5ac9-4e85-aecc-245b3779f3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223318, "uuid": "ce82280e-945a-4f96-a45f-54268baa3976", "value": "SecuriteInfo.com.Win32.Malware-gen.31592574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90036744-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244617, "uuid": "80fffd79-b58a-4cd1-a1dc-d71f9593f572", "comment": "Malware payload (RemcosRAT)", "value": "8a5b1d4bd19cca893d10a088023515c8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244617, "uuid": "37c429f6-d18c-44e5-8378-88b10b1c3edc", "comment": "Malware payload (RemcosRAT)", "value": "915deaa0d50a32a34898ca465b842d325a8ba3be8c74e522f67daabccda9030c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244617, "uuid": "3d5688d3-0496-4b47-a94f-aa3ab25b6380", "comment": "Malware payload (RemcosRAT)", "value": "cf64287508b08e691824a7f9916328098bfd6722", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244617, "uuid": "6fc6aa9c-555e-4cc6-a74d-41bb7696bdc7", "comment": "Malware payload (RemcosRAT)", "value": "049f2527ad4d4f91cac67861463a20d9237dcf4b65098f6a9fa8e8d322457c4e0858aea124d09a0cb38119a4127e40a7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244617, "uuid": "eca1c46a-b631-42d0-b261-5b1332528dcc", "value": "T14195F182EEFF5D72C22AC93905E712144321DD248A719A473ACA76387AFAF45372335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244617, "uuid": "4bfc3b85-0086-4fb7-80a2-1e2d659a5be7", "value": "24576:0t9y6sNtKXrBCZi0GwDhSzJdg7mEgFjB/Pkw4sNFAlOZcUXyg9ikdhUi2oAwMfpr:0Xy613AhyImJh4iRZchzS7CswZ+MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244617, "uuid": "8d81e1e5-0964-48ab-85a2-13295edf956a", "value": 1950208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244617, "uuid": "10478a6d-6f5d-46cb-857d-fce33e6d9c3c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244617, "uuid": "fcc67986-4bcb-43fe-8152-dcc2b490bfa9", "value": "Swift-Mesagee-dekont_04112025.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66436acb-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236387, "uuid": "0408705b-f83b-47bc-9dee-82165eaba387", "comment": "Malware payload (Mirai)", "value": "fc2089cf1cdc9f255d8fd8086bb68acc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236387, "uuid": "b4ab005c-011d-4ad6-990a-28aa65ce4f24", "comment": "Malware payload (Mirai)", "value": "9188cfcc7a07df866973e2706ddab2ef223ab11dfa5f57c823cd8d3fd0688845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236387, "uuid": "0a029192-3e2b-4c51-83b6-e1087e9d1c62", "comment": "Malware payload (Mirai)", "value": "8be3e6bc4c761a4edf5298176fdb5f4b967f78fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236387, "uuid": "20d1b0ac-505f-4763-af0d-c1d6c56ebd06", "comment": "Malware payload (Mirai)", "value": "109f0567872c99d0709086c12f6aacec465f53d378fc87f4800cfbd2bcd2f3ed09b49d2baab47474aee8e5ad2763b2e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236387, "uuid": "2f9859d3-7720-43ba-b456-a98b47c8364d", "value": "T1F6934C8AF8019DBDF80FEABA44170E09BA3063A116830F3B57ABFDD36D721954953D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236387, "uuid": "61c0e21e-9007-4450-b337-90efdcdb0df4", "value": "1536:M9n4XDeDowZ+dV4eX8+hb9z8zbXpsGplzjuDp7kMtWywBXJL7L:M94TEowJeX8Cb98aYzyDxcXJLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236387, "uuid": "7e0154b4-50e0-40c6-b89f-13f3a100c4e2", "value": 90832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236387, "uuid": "d9f5d851-1bc1-49af-a6e4-60b55a61ff3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236387, "uuid": "d9efdd5f-9c4c-47b5-8506-ccccf07cad9b", "value": "FGx8SNCa4txePA.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4833f674-b9d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762299043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299043, "uuid": "ecbe88c7-bd46-402c-aeec-bb83e2a4ea8a", "comment": "Malware payload (Mirai)", "value": "1c0f17f2c8fe24404b5725ba71074ba7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299043, "uuid": "83f31491-c03d-44b7-a77d-45800c68b08f", "comment": "Malware payload (Mirai)", "value": "91c2486b644cc56b3dfd7c4cae8b29c5c1b5e27a398d10107288b5019bfc82e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299043, "uuid": "e4b9deee-a966-47d6-a5e8-6491de6237f3", "comment": "Malware payload (Mirai)", "value": "5172d91754ce9a06bab69773db34b449e14ddb51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299043, "uuid": "db186673-0290-4a5b-9077-40f3a0d060f7", "comment": "Malware payload (Mirai)", "value": "cf8136594552de4c860fee859f1d61afc3a379909124f72a6ce8bc1a3aecfd4232d459052aadd7b1a29c4cb1cef2dc7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299043, "uuid": "51078241-7b20-4fea-89ec-7b936bcd7632", "value": "T1EC03E11AD0F04B80E4A9953A65FD374EB991F5BD8C81D54AF998FC3F00127F92A2C729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299043, "uuid": "22654518-d858-478f-9c94-fd8ca0d8fa5a", "value": "768:eSbw8FwnvKqLSnxEa0iGSXS7LVF1hUiobF9//IOXv1nbcuyD7UHQRj2:vbn4LIxVFRXSn71KLF9//Vv1nouy8Hya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762299043, "uuid": "1f095277-d69a-40ab-bd11-bdf60fae4d67", "value": 40028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762299043, "uuid": "d74d7fe9-a4e4-4ee4-8e44-7e8d8dda1c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299043, "uuid": "10aef675-c431-47b8-9781-2d59b9f7916a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fead48-b926-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762223475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223475, "uuid": "1e22fe9a-0981-4b7d-8008-d9307a41338b", "comment": "Malware payload", "value": "e8040922ace0622fd7b9f4f5824dd44e", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223475, "uuid": "49d87de8-e94c-440f-ac43-f48ae942efcd", "comment": "Malware payload", "value": "91e1daea7dd5d0994878aac8fd9248065ccabd92c4ce022a931cc9ef62e38007", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223475, "uuid": "22577889-7b6a-4742-a812-ac193414a9df", "comment": "Malware payload", "value": "9c599577e25becbb262b4566cfcbe1535fcb8bf0", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762223475, "uuid": "01191f0a-7bc6-4892-a285-84f03fced7e7", "comment": "Malware payload", "value": "79fffa1051688254d09f7377bf5dfe3b053ede3087362545b7671849b2052b68c1972177ada5432c7aff6aee6b78e9f7", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223475, "uuid": "37eceecf-ee5f-4026-8975-9d013887a0f0", "value": "T121931260C9AEAC241161D3A172BE6D0BEF267479DC178184BC531F62B089F1EEBCB552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223475, "uuid": "954fbfe0-e079-46fd-bd83-90daabb709f5", "value": "1536:Weyvvf3+Aa6ViqBaAYRCxyybhncp0bKpgdFV7MhU+cf0QITuimn5PqNrvBI6QKsx:YUYRaCYacWbygjz+kHIC95SZG6DoAsX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762223475, "uuid": "c95a4f7e-7ea2-4c8a-8428-8a6b4c738e39", "value": 90388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762223475, "uuid": "c8e18946-78ab-4b10-b68f-f1207df0f7e9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762223475, "uuid": "a31bd2d8-8205-414c-aa0b-2c15a04f275a", "value": "nBQ__26_Layout_-_.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99002bef-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237331, "uuid": "2457c3bf-b086-44ff-bbfd-c739332a9d01", "comment": "Malware payload (Mirai)", "value": "de1333f5ddd7cc670ef34d51ef360ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237331, "uuid": "f02f3473-0d30-4787-b85b-4beb1b714434", "comment": "Malware payload (Mirai)", "value": "9246217e8b9ff28004360900517c94106d100a57683a13e714c35b8ae8ca8853", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237331, "uuid": "ddd0849a-6ac5-4063-bc9e-16acd6649b5a", "comment": "Malware payload (Mirai)", "value": "c5374086d143c805e8971b85d9fd8f0f316cca6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237331, "uuid": "5fe42b45-8b5c-4dc0-a3b7-00efbb188910", "comment": "Malware payload (Mirai)", "value": "38644cb9caffa08ab12e7ea791d1dd511a4c194a344b82b0bb8eb055670103ff59711a020780b7b52a72ab63aa0d6033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237331, "uuid": "6c035b9e-d33c-4ad3-80b2-d845aeed6769", "value": "T13883D80D7E21DF7DFBAD823487B78E219A5833D626D1C581D1ACEA005E7064E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237331, "uuid": "7be277b8-aeee-4089-afcd-4df45bcac544", "value": "1536:YJcFgZRC592Xogr5Ot/srVQWQVRDOBQjw8Q4EqJa10/d:uc0CfEoheQWQVRDuQjw8QTq4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237331, "uuid": "6edcedb1-39d6-4e9c-96d3-037c1d4927e4", "value": 85636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237331, "uuid": "89d21522-acde-43dc-bfa6-bf274d12ced7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237331, "uuid": "fa02cc4f-37c0-4683-8061-949d4d231815", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6261bbc0-b973-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762256567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256567, "uuid": "107bdd08-d7ec-409c-940f-4725e95bacf5", "comment": "Malware payload", "value": "c70da30e00ab753f853be8c38a48f034", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256567, "uuid": "c51666fa-845f-4a77-8bcc-c59274e004b5", "comment": "Malware payload", "value": "9254d1584818ba031253648594b1f6a92513fc71714e35a8909c41da7788e56f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256567, "uuid": "359a20f4-f8e3-4d06-835c-25576b5c4b78", "comment": "Malware payload", "value": "9a6e152c47428f566b76229252698d2469e6d801", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256567, "uuid": "02a873a0-7bcf-4ff7-986a-aa903ddb53a4", "comment": "Malware payload", "value": "9d6b7e94a7dcbcf756b0119dca61deb36e03f3bed29bc91d93d7f7c2dafaced76bf972bf0092d44cde1e3164390e8c5a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256567, "uuid": "1b85a382-3327-43f4-b52f-b0ad9245fa00", "value": "T1BE536DD0C8AE1710EB8A22FDEC434571C9746104392648F5BE9CA32E3522694FBFF65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256567, "uuid": "5078ee40-a819-425e-91d0-5012df47112a", "value": "1536:U09pFaaHcdcfc8ccMKG6hh8ltSTtcB8hX8QasNkFp8A0M:U09raGcdcfc8ccM5Ah8/gtcEdc8AR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256567, "uuid": "b1a051f7-0f28-4300-8b7e-0140cb687759", "value": 65150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256567, "uuid": "24a5155a-2854-4410-b669-90c39baf62ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256567, "uuid": "99c2de53-6c4f-4957-a7d4-7fc58d0c9919", "value": "RFQ-11-2025 & CMETS Energy Project Order List.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65980fbe-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236386, "uuid": "89bc0b34-feb5-4a9c-b059-e609fbf29159", "comment": "Malware payload (Mirai)", "value": "3d02a534e4fb3278310637de477125be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236386, "uuid": "c10ccf05-5adb-42fd-8258-6a5ff2b2d66a", "comment": "Malware payload (Mirai)", "value": "9261192cbdbbe30488bc66a858fd0e072b4667b6661aad766071fb85f33284fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236386, "uuid": "e5cfeb45-ad10-4b4a-abff-768340cde5a2", "comment": "Malware payload (Mirai)", "value": "963ebeb6663c19f6863d03e81e7180f6b585595a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236386, "uuid": "b82c59dd-b4a1-4dd1-b6cb-7294386c3ffb", "comment": "Malware payload (Mirai)", "value": "a8e9bc9d9ad5a649d835db5d8bea617594ee92fa4005a005dbed2a6a6e17efe77467d77c9476b434acdc18adb8afe2b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236386, "uuid": "67b3b725-91db-4ae7-807a-8a244d4b8281", "value": "T1E5C2D1505651B970C610DD319A3C46C376818EB9F1F0B530147425E0FAFBC8DABBA79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236386, "uuid": "5d9cf7a1-2d8f-401b-b079-a605bfed6da5", "value": "768:kU1h9OhcL7T/cWUvPtD7ezC3ypYs3Uoz3i:kUL9OSbmPRm/zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236386, "uuid": "b52bd8ad-3048-4323-8540-1ff0b9ee42fb", "value": 28088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236386, "uuid": "787a0da9-993d-4a18-829f-2693d091884c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236386, "uuid": "6a30fc1d-f739-408f-982a-b91c711fcd95", "value": "FGx8SNCa4txePA.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d9f4cd-b9a9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762279799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279799, "uuid": "7f0d443b-79bc-479b-b046-f9e88b4592d0", "comment": "Malware payload (Mirai)", "value": "4e813a1c391c3d875016ebc1f1f2557d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279799, "uuid": "9bbcb605-b731-4aca-ab4f-6e0b3f097165", "comment": "Malware payload (Mirai)", "value": "927a0fae401f906b23b3fa2c105c06fd3314b1c25bde58920077a8c8fcbc2c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279799, "uuid": "119a803e-18a6-4837-963a-3a6e18c137a0", "comment": "Malware payload (Mirai)", "value": "acdd1b4f1d281c5ea7ef811d8981c14f839df2f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279799, "uuid": "12d58d39-ca1d-4715-a679-12e2045ca4d2", "comment": "Malware payload (Mirai)", "value": "04bd8035e809f144bd0ce5dafe30657f61367af09a350b956c9ac8db43b093004a3e8b30df0c56a270e6c8aead03cb8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279799, "uuid": "1159b33c-681a-4717-895b-f953de7899d5", "value": "T1AB8329C1FA8BC1F5E95748304176F33FDA32E92950B2CB5DDF5AAE36DA33540621224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279799, "uuid": "974e482c-5ed2-48b9-955c-138755efbccc", "value": "1536:WGOuajJyydzqsI6yF8yN/WL8wKxD1d9EJfLosl:WGoDdWsUF8bowKxD1LE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762279799, "uuid": "1bc67a5e-53b7-42f8-811f-736ac8883db7", "value": 83124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762279799, "uuid": "d3319eba-6108-4f44-a26f-afd752881d02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279799, "uuid": "78a1d613-9caa-4cbf-94bc-e9402764eb73", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b02a66-b98d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267841, "uuid": "2c993b88-16d7-4423-bb5f-bfe39e29ff02", "comment": "Malware payload", "value": "08c310412c5af22aab79406581ef317d", "object_relation": "md5", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267841, "uuid": "168ff695-8a51-4509-8ddb-f8e77d64ee2e", "comment": "Malware payload", "value": "92f3842112048f02a7b6888725791cbc0065767c16540ada641af9e2d1a04683", "object_relation": "sha256", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267841, "uuid": "098b05af-6b77-4045-804a-2d055f346776", "comment": "Malware payload", "value": "364979d702d4842c34e48831be4779fdde48c142", "object_relation": "sha1", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267841, "uuid": "625f41f9-ac8b-46ac-a8b2-fb591a175032", "comment": "Malware payload", "value": "764258918970aa3221439e8ef4b83663ca755f1eae22df1f8bb8cc20784153005406fa17f0a9ad7a67a0357e34120891", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267841, "uuid": "94ed244f-19ad-443a-b023-8607d5b7095a", "value": "T1BDB6333AD502DFD7518BCFC1CAAED4FE8DAB1B6811B9AA51E0458C7F68F025205350EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267841, "uuid": "ca4e247c-1eea-402c-8be7-d385a34439a4", "value": "196608:NIeyjFWjgPG+p7YVR3O+wvIuq6r/MOpsyi8iJcRTcbYp+eK/vR:meyjcjgjYn3O+8Ij6YOpsz6RQb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267841, "uuid": "513da72c-a825-4721-adf5-b3762eded33c", "value": 10618680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267841, "uuid": "f8e91b97-d244-41c5-ab11-7f56886d4584", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267841, "uuid": "ca30e57b-94a6-492b-ac4e-0de14ccc2e5b", "value": "Complete_Files20251104151858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183138dd-b990-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268898, "uuid": "b16ff3ed-d840-40b0-8319-03881937a41b", "comment": "Malware payload", "value": "1eba3d1a1ba8ffe376566ab13a9dc6cb", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268898, "uuid": "1061ec14-6e04-4585-bc7c-6abdc226f235", "comment": "Malware payload", "value": "92fea18ddd79fd92aa50d8d240f8f86729692f80df490ec4bf46652fd3051755", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268898, "uuid": "ffc51cb4-05bd-442b-9b58-117c707b1128", "comment": "Malware payload", "value": "2e5e87a7e3b3bff6597447db1d24a0d25f17a3f8", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268898, "uuid": "8f2c5234-6f0d-4cfc-a3c7-0706d6637c85", "comment": "Malware payload", "value": "66cf2ec994fc64a9bd00f40b7fcfb2345c07e880140358af10e42a445aa24668ba3f907c38cb83b16c134be3c72ff212", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268898, "uuid": "e178e0b5-3c98-421f-8bb7-33f85f1171c8", "value": "T1F7B193E7E2E89A5F345510E9942A310B64E1C2BE4CAF8344A5D2250FE52F851FF2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268898, "uuid": "e3802113-068f-4ad3-b4de-844ced7537e4", "value": "96:WeikZ2V+iOf8x8kfeVc3ADANCotxMT1RytxMT18AC/20dVDaOO9iZmRxsFAJAC/7:Ws2V+jpkfeVmA0teT1RyteT1hC/dJZOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268898, "uuid": "2f7d66ac-9636-4b35-a19e-3c10e612eb6c", "value": 5415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268898, "uuid": "0fe178e0-530f-4ba8-80c2-b49b79e291c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268898, "uuid": "3bedd3f2-14fb-4633-bb71-1a724ec40b2b", "value": "codebase5533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd24632-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762245499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245499, "uuid": "5dea151e-edf7-4b95-af93-3e5941625b69", "comment": "Malware payload (AgentTesla)", "value": "0952e49b440ef2ba700d1825ab5bc8a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245499, "uuid": "b1882804-371f-4cde-a514-7c7b6e429d75", "comment": "Malware payload (AgentTesla)", "value": "93bc7b4eee235151f3a03f7206d85ba524d614f516d29255eb664cfd3e1f6baf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245499, "uuid": "b697b9ce-7f13-4d3e-8535-374436f5f297", "comment": "Malware payload (AgentTesla)", "value": "623b38d10ce938be974a3bb85595c26e22d385b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245499, "uuid": "e321dd9b-92f7-448a-9612-ac8dec18622f", "comment": "Malware payload (AgentTesla)", "value": "7ae98c3b9c4a86a6ffe4a32ce670871f639cccf0ea7e6de9622f5e24a21d16fc13e82758d51944a706b9be711223bae7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245499, "uuid": "024cd09a-d3ee-491c-8ffb-9dc112252059", "value": "T16345F2244AC82FB8CFAC4A1890BF160FA3E04A8E5556754EFB3BBD46AFF7544450B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245499, "uuid": "b951668d-3fe0-4a57-82c1-7b51048d38ff", "value": "24576:wn+1yTR1yJfYrOHFoCzrwga5565GMGq/JGUKVnZaBeNy4:ITe2U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245499, "uuid": "8139ed60-4865-4a97-8896-a9f6410b9e5b", "value": 1237782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245499, "uuid": "957d82da-044a-4534-bd9e-50a891a7007b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245499, "uuid": "6929e3c0-4e57-4032-88cf-218fda1c9562", "value": "1941468967000125 pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d2f7e7-b947-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237750, "uuid": "34ae6c3a-8b48-4617-9a3d-5e6cd8090171", "comment": "Malware payload (Mirai)", "value": "f1ad5016866462ae089bc1b3f03b98fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237750, "uuid": "7e4146b7-3aaa-477b-a90c-fe7fb77b8933", "comment": "Malware payload (Mirai)", "value": "93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237750, "uuid": "85f1dcab-9b2f-43bc-b0fb-5ac961998ef8", "comment": "Malware payload (Mirai)", "value": "ca93ba3f17f4cabdf570b8ce0c519b505cc52b05", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237750, "uuid": "20f921dd-a84d-477c-99c6-80e61ac31a35", "comment": "Malware payload (Mirai)", "value": "4cf920c580940900241c61ce707ac615f0d8d5b2c32a19968343cdbb3de6571e5ff767600a1751aca2f99ac163a98082", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237750, "uuid": "eefd543e-518d-4683-91f9-2eb86df2528a", "value": "T11BF0BBC80A5525350EC7AA4723628DC4F397D456ED338EF85D9CF8E16854C20682CD7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237750, "uuid": "b5aac7bd-d216-43ff-892f-a2f0d8ca9fe4", "value": "12:v0Fv7Mf/p7Mfk70TNnrv7gzo75D5N7Q5q:UTMftMfw2/ic5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237750, "uuid": "deeaee25-5dbb-4344-b1ef-a335c84d3667", "value": 538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237750, "uuid": "0151799b-e6b0-4b68-87e3-2c24821d2efe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237750, "uuid": "69a68544-295f-4e96-8f9c-d62d9d94c9de", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77edd425-b98c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267340, "uuid": "a75562f1-3b13-4547-98f8-8b2e87405977", "comment": "Malware payload", "value": "b038b886089bea7dfed7f01b5f7f96da", "object_relation": "md5", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267340, "uuid": "cd02328a-5233-4734-9d41-f8a843ffa7ea", "comment": "Malware payload", "value": "94a241e26a55a46726dd848ea27c1431b6d580d22ec268827098df173d0233c8", "object_relation": "sha256", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267340, "uuid": "4f7e2fef-73cf-4364-92fe-d7728dbce217", "comment": "Malware payload", "value": "3fc714d17e1fe52306f2140181f25eb7e42b6a39", "object_relation": "sha1", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267340, "uuid": "9fc0989e-4417-40a7-b0a2-8681cde2e089", "comment": "Malware payload", "value": "77b87e3cfa59afa64e6567ea1c5bd1b5f35848db17f9774b9c1c7b656e067a379b15736c9e5dfd3ef71043de71c70c28", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267340, "uuid": "4a424e67-8754-4010-ab29-8ed5172ba1dc", "value": "T1399523263AE0C562CD9797F2F8F602E3062C7C69CF5406536684BD8A3C7254F9876B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267340, "uuid": "aaba4474-eef8-42d2-8e49-56c1ae8112e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267340, "uuid": "46333ffa-6c9f-46b4-a7a6-144a91bc55ce", "value": "24576:xUy4bihbCbA6Y1UYD9I4bYBYWtnCVXYV8WB9v4p9KHW9dhi1/os9CGOPidshy8M8:lmfbjYFD6BrCCWLYKixc28lLLwEMQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267340, "uuid": "9d634dc3-cdb9-42d6-99f0-d5cb107cf779", "value": 2032128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267340, "uuid": "186b5db2-a0af-4ea3-965b-6516dd6267f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267340, "uuid": "19341a95-36e9-43ee-81d4-0b5aa9ea36c0", "value": "adobe_premiere_pro_2024_v24.6.1_(x64)_ _fix_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f323a0e-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281096, "uuid": "3d21b1be-297e-4623-b622-9ba944560eb2", "comment": "Malware payload", "value": "4faaa162681238002113151603b23cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281096, "uuid": "b53d3a5e-0fff-4cfb-b728-2c4b1951d4bb", "comment": "Malware payload", "value": "94a8762051269a716db67e78f540edf0af08cabac7b1c223edda4ffec195b453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281096, "uuid": "12f73e8e-d489-41e9-92b2-53a0f92eba26", "comment": "Malware payload", "value": "54e75ae4e9312f761502d061d027aa0a560af5d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281096, "uuid": "a1130593-efce-4187-9d38-7e8880a24d14", "comment": "Malware payload", "value": "9307bc99d8321d7d412f01baed5e5be0b5f59236fe9796e25eca944daec603cc5427fd67277f38db3218ff67179a6a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281096, "uuid": "196cf161-f213-4fad-86a2-75b7ec650c9b", "value": "T169346C5933B88B17E25F8BBED5B1548F87B1F103E90AF7CE0C8895E82412742E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281096, "uuid": "368cff48-359e-4c45-8600-973780f03e9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281096, "uuid": "d04523c3-d2e1-46b4-86d7-5b1f4b9b40e4", "value": "6144:xloZMTrIkd8g+EtXHkv/iD49tw1ET5KyNk4ZL22j9xb8e1m3i:DoZ8L+EP89tw1ET5KyNk4ZL22jrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281096, "uuid": "f8c4c3d5-af8f-4797-8fe7-060a25cd4588", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281096, "uuid": "e3814ad3-4582-44b9-ab35-e3e80a09be7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281096, "uuid": "b2abbbf0-ee3b-47b2-a808-7bf4738ab5fe", "value": "um.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c61cfe2-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261147, "uuid": "573c6529-3320-4b95-8ddc-7dd18c472603", "comment": "Malware payload (Mirai)", "value": "c5d9de419148fd3baddd6555e06fb8a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261147, "uuid": "23c32908-dffc-4406-9d67-7b97baf35630", "comment": "Malware payload (Mirai)", "value": "966202da8b8817a3b3dd30cfd74babda4f216b8d6782e51410c86094f7dd32f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261147, "uuid": "1a00f46c-40d2-44f7-946e-335a8e3dc833", "comment": "Malware payload (Mirai)", "value": "69bd65103f08afd2c3c1a37f9464e752f00dd940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261147, "uuid": "4a71e4f1-b9b2-47bb-814b-b7d345799254", "comment": "Malware payload (Mirai)", "value": "4c5f0e919d76fdf260e183c755b0c32ba73ec9491188576b02f66ce6993e1a0e5856c616a98a73e0025c8b6a0ad3c1dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261147, "uuid": "34a90053-d8c4-4a00-9245-573d9cf8ad6e", "value": "T14C33F2F996029AD4EFB3F6675C4F9FA4BB2205D1E76BCBC19105AB40246B1A43204FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261147, "uuid": "5bf1ad04-13db-4a7b-94ef-9bfd38e1ec85", "value": "1536:PVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINn0944u+qgw09Z:9aovZsIRfoPaaKYaY0K4u+qgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261147, "uuid": "0ab95ac1-32a2-4533-bc75-82c48870f833", "value": 53116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261147, "uuid": "5bb2c7ad-f4b9-4bb8-a5d3-bd47eb537beb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261147, "uuid": "73b66ef2-f45b-4631-a06b-db3ed1dd4b05", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1666a186-b990-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762268895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268895, "uuid": "a9a47f12-6596-4341-af92-02a1ff000c34", "comment": "Malware payload (Adware.Techsnab)", "value": "705bb7fb651991356a6a9ccea5d48426", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268895, "uuid": "3609b5dd-4505-4f8d-a91a-5edd6b4d979c", "comment": "Malware payload (Adware.Techsnab)", "value": "968dccc0d70ff3324b8b85ae1eb0bf2b84d1fb6c18ea993ff05709fb3ccf825b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268895, "uuid": "df66b9cb-4d27-470b-a1d4-ff58686e1792", "comment": "Malware payload (Adware.Techsnab)", "value": "b21acffb9e890011269e941b1f2a7d440de611dc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268895, "uuid": "34f8c5ff-f0d4-411c-8ba7-177d3af5a070", "comment": "Malware payload (Adware.Techsnab)", "value": "e86d6f1dc095c33ff320be51733628b2b5eee5afc61029451d6f9f8f00bf94989d1ef8126a4330d4780c2dfc6ae5d4df", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268895, "uuid": "519af7d7-8ecb-4cee-ba35-e9dc3ae42fa0", "value": "T10E668C82F2F482E5D1378038A593A213E7717818071497CB57E0AE6A2FB7BD46DBE351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268895, "uuid": "b09ce6bb-cfd4-4e8b-ad43-fbd48280ed81", "value": "49152:YXIgutc6W8SQEh/BX4iEI762U0FxDcLwU/WlKHfcXPh+Kp1B9sub/fJ/CkgUVt6Y:YXnDXEe3ziM+KLsubw41GePKXHczhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268895, "uuid": "14c88a95-c76b-46e3-b1f6-5348828452f2", "value": 6707200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268895, "uuid": "ab704de6-844e-481a-9081-08cf6f868114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268895, "uuid": "d7071a34-ebcf-4bf8-8f6a-e9c6efbbb73e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6689cef3-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762244548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244548, "uuid": "2087ec08-7b14-42de-9ac6-d37d10973eb4", "comment": "Malware payload (Mirai)", "value": "40e1cbfc9333ba5dc4a83529e2aecc1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244548, "uuid": "364d6745-5d16-4491-9658-4b4670af9eba", "comment": "Malware payload (Mirai)", "value": "96edcf5c1ad8ee71499ba6dc5a84ba5faf138b5abf3061020c37991a24f3f35a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244548, "uuid": "b0c01e5c-f1b3-464a-a608-47030cdd0bfa", "comment": "Malware payload (Mirai)", "value": "704adc579ceb7fa02e0f99b739c508b8a7872442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244548, "uuid": "e4c3cb78-7f29-489e-ba10-30613caf4eba", "comment": "Malware payload (Mirai)", "value": "57a916f8f69fbef12b64b671fff776bc9273c8391220f248324712def415074fc15c636d781880d8f7a20e7262c02df2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244548, "uuid": "0df1f837-cf22-4170-8a33-1cd8176e93f6", "value": "T1D003026157E2C748D6EA50765BFB26AE6E20151EF1FE00B76F7032B21448BA49F3CD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244548, "uuid": "d9604db2-5446-4426-8d01-25fc5f7c4576", "value": "768:yrJpPvlq44rw8cTmmOZNRFUYISWS/DunkQNnbcuyD7UHQRjA:y1pPdqEjTmmOnTUrBGunZnouy8Hys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244548, "uuid": "951c2b6e-1983-415b-b618-e2aa19ad5037", "value": 39836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244548, "uuid": "4ad7b1f8-3a5d-4561-8b2c-6b77d99a9394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244548, "uuid": "e78b9dcb-0cea-45db-90f1-10f857cccd4a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003d5d91-b9a5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762277877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277877, "uuid": "c388ca4e-5be1-4fb8-8839-b3ebebd54327", "comment": "Malware payload (Mirai)", "value": "d20252ef3eca9b4c164c65a741d9d130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277877, "uuid": "ba4ecf9e-c600-4c7a-b9a8-ab7c8c1e4dd2", "comment": "Malware payload (Mirai)", "value": "971d4b1b75a2320c1263bacb253093e3b5bd019aac0a26b73212615e2bddbaae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277877, "uuid": "78ef57c7-8997-48ea-99bd-ca3dbb48b418", "comment": "Malware payload (Mirai)", "value": "bd0c9d4a59386e352362039d791d65da803c6607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277877, "uuid": "34cdbfbe-bfac-4980-9070-f86f2f5e7399", "comment": "Malware payload (Mirai)", "value": "28d5c386dcb7105c2ebc6c904d9ea31e1dda3299d70bdbb04e12e150d6e5f084eb2a0cf76fcc7fcf36a0add8aeb2230e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277877, "uuid": "147bedf8-17ff-4c58-a67e-b82007083688", "value": "T192932AC6B400DC7DF84FDABB4863490EB531E7621A931F36676BBD53AC321A44857E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277877, "uuid": "c81e613c-0def-4753-ab31-1eb37ea3ea71", "value": "1536:Plag2hg5R42/vhyFI1CTNw7bkqfsNI5VWGLZ6IGYUWZhPX8rAQrviEYwE2OIM5vC:P+WhOIi8Uc6XVWZ5fC2L2tMNqmaZhyt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762277877, "uuid": "0526b837-ced5-4980-8483-83a6809a8c8e", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762277877, "uuid": "548c3760-2b8f-4691-9873-79184a4b805d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277877, "uuid": "be3d63ab-d53e-4f50-8c90-2463c8ec680a", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5b84ad-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237340, "uuid": "03fd50ca-dda9-4efe-a3a7-576dcab372b2", "comment": "Malware payload (Mirai)", "value": "7661802734085138171c15b6dc4b24e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237340, "uuid": "7cf1e975-44cc-490d-93a6-e4a035a26cd1", "comment": "Malware payload (Mirai)", "value": "9742f53a278f9f0536531fdeebeeef55fff806db555515b920800ad5d98d5325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237340, "uuid": "8f48f778-d852-4603-a133-71575269f704", "comment": "Malware payload (Mirai)", "value": "ebc8308dbb01636c64258f1c4c19e30a44ea0544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237340, "uuid": "b4aca6d6-3978-4d51-9b09-4b3bc0ba0c3f", "comment": "Malware payload (Mirai)", "value": "c7da83ba40346c7980d7d28da4b9e28e9115af3cc7538bc60f9417dc56bade44dee669f5d90d19aebd0e2a9296f3c607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237340, "uuid": "f07cbc6f-8881-4681-a627-0f8e660e68f7", "value": "T12793E705BF610FB7DC6BCC3709A91B0529CD955B22E47B36BA34D828B24B25F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237340, "uuid": "bf9348ec-066d-48fe-8f0d-086659a17503", "value": "1536:WMdJKiESq2A7GOiWOphoTItggCKp3kWTZ5BtFFJa10O:WMdJKixqF7GtWqhoeUED4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237340, "uuid": "748cc6de-4db7-4584-b16b-79c68ec5c267", "value": 89604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237340, "uuid": "927522e1-2a29-45e7-962b-491829b6e5e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237340, "uuid": "a772ce25-55ce-41a0-b166-bba34772c7d0", "value": "uYtea.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b73b6e-b98c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267420, "uuid": "541c0da2-e2bd-4dba-9f34-a6db335d0dbe", "comment": "Malware payload", "value": "e6a4e85280ef376b4df838cf1087873a", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267420, "uuid": "cb8d9321-1bd6-4f32-bdfc-9bfcb415b563", "comment": "Malware payload", "value": "988a73c36d469c08efacac7e414d096480f783e1b8fc975e9e7b91ed1755231e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267420, "uuid": "20618c6d-0258-4ac5-a8e2-a0cc4feffad3", "comment": "Malware payload", "value": "6cb59b369111de8fa2b6195cf31a710a31738d1d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267420, "uuid": "8b0caf48-0247-4d34-bdae-58d0b8b951d2", "comment": "Malware payload", "value": "02a5412cae6eaab6c150f37fc578f22c43b677eda3bf29be918c5acfb5ae05a7c79ea5709fb54d0d2b05ad971f595603", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267420, "uuid": "8ff16f19-0357-40d6-aa44-f4b1632a4663", "value": "T1F546334F4D49ECAAE1994A743142B5493352BD437E629E11B33F271B1FB748AB4E3A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267420, "uuid": "fe849440-9a24-4c29-af1d-a0072673685f", "value": "98304:hMKgyKvxpiKMsLyBgRSajqQUVDaAMftp5qCRbBYkhB+zSnkopU10YZ:hMyeORswiRb6kKzSndpUyYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267420, "uuid": "7f4679a6-fe06-482b-a4e1-c974d9c64ccd", "value": 5693440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267420, "uuid": "86776a4b-c95a-4d7d-8223-d91f7090d17d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267420, "uuid": "0e892709-7417-4c70-afdc-a6faff999fc8", "value": "InstallerPacked.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c4799c-b98d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267870, "uuid": "28fba0cf-bd25-49e6-9911-c322ba36dc3a", "comment": "Malware payload", "value": "15dc3ff9217f700e71e7c270095b18af", "object_relation": "md5", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267870, "uuid": "bd5521f9-7f80-4054-a9c3-5d028b851d51", "comment": "Malware payload", "value": "98a8dce356f8eb30274a5c687a19ea7146e60d51f65ac778779a55adb214dca5", "object_relation": "sha256", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267870, "uuid": "baafe63d-723d-4129-93a9-f856e6434449", "comment": "Malware payload", "value": "59dcff5b4d20443639ccdc50c2015e668df14b8a", "object_relation": "sha1", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267870, "uuid": "f18ae1d4-2548-43c2-ac3c-9f8bf8e05a91", "comment": "Malware payload", "value": "fe0619cf09dc3bcb3539e9b80e2038bad0bff4070718f544bf3214f199e7b0f9c53661238dbb8de0d9599f67b5e5ce4b", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-243-106", "colour": "#290BF0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267870, "uuid": "3abdaade-827b-4102-9605-cf861e3acf76", "value": "T194E60500A4D99A07FD3ADFFC999E73500F7AB2951901AB388F4259DD2AD1B58D8039F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267870, "uuid": "2fd45a43-ae3d-46ed-a491-04002c43f810", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267870, "uuid": "6cc290ad-204a-4547-a0df-990724ed5da1", "value": "196608:IQI27i0lUtreVrByEwLOAgUVtCQ/a0IKA:60ketByE8O7UqQ/aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267870, "uuid": "dc689c42-b8e0-4563-a504-b5fd9171c941", "value": 14278144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267870, "uuid": "34f58eeb-b2fa-408c-8f9c-a1978330fdd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267870, "uuid": "e5c50076-41ef-4866-8adb-6e6a4e64ee97", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06bcebf-b9ab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762280803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280803, "uuid": "2bfe00a7-0800-4fa5-8303-73bad0f7913c", "comment": "Malware payload", "value": "698aaef134cace60b8aa39d3d814e58a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280803, "uuid": "8a037378-93a9-4aac-9d20-90401a6f52f3", "comment": "Malware payload", "value": "98d095613f420203d445efeca9e371f280b31f3045a206994d8b7269b2992be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280803, "uuid": "9d2d637c-5ffe-44a5-abab-da7570ac59ec", "comment": "Malware payload", "value": "8a8b4aa6477b35d70bdf6b0f3bf4e89d918042ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280803, "uuid": "ce2e8df9-516c-4283-8577-4f371d13e14b", "comment": "Malware payload", "value": "fef8ecb31cb125dcaf80d53878ef25f1876f183425f3dd5c5b17d7ad9bb654172ae08f6822eec8cda4b7f7337b47705b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280803, "uuid": "4b383d40-7e60-459c-81c5-6efe6e11b82b", "value": "T1E304E0807786AAB5E7BE06F854F1936C8275C39B1102DB1A0CCB55ED1631BD9E213CEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280803, "uuid": "86ce3b4f-faa3-443b-ab88-d21c5a64118a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280803, "uuid": "7f0a98a6-c851-43e5-899a-94186d8303f4", "value": "3072:DmAoHczqCQgVuq0ENQtVEtGO/L1rVItIl1fkgcufu/6MW9DQ9bavWiV:yAo+QgMLENQwkYL/cyfkUfu250b2Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280803, "uuid": "920b3f18-f292-46cf-afc4-daadca86a037", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280803, "uuid": "ce5e1056-3984-4d00-a04b-058df211a22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280803, "uuid": "6cc12b43-10e6-49b3-bcb9-b18d84da4ddf", "value": "XenoUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecbe134-b9a6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762278572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278572, "uuid": "62fb11ec-ed0b-4172-b3b2-86883d0efc53", "comment": "Malware payload", "value": "352568df205aabbfe413f749217d3442", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278572, "uuid": "1da43e12-9653-4a62-9d82-0e3030b98df7", "comment": "Malware payload", "value": "99876df986c45bfdb44f933041413991364f54044f224da29daacb8f49be07b6", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278572, "uuid": "647fb6ba-b970-40ca-84ad-ba79d8fd915e", "comment": "Malware payload", "value": "a3048cf6621b3456bc2ea989558af1ff5c222e04", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278572, "uuid": "a166178a-24a5-4c4c-9009-7f8a1292b3fb", "comment": "Malware payload", "value": "092d11178e64ada3df3759ee94dddd3ea2312bb3f20812decdd318321c74a284db6b0790322a7d82dd268dfe0e087923", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278572, "uuid": "5ae8b471-761c-44e9-bbf7-937db96bc8ea", "value": "T16C763369B2F109F2F9F32A79C8419555D271BC560F20CEDB43980AA91F2B5A0493FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278572, "uuid": "ab75911f-85b1-46f4-b87c-21589546686f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278572, "uuid": "7d9af7f7-83ec-40ba-b41f-4cb4e3e5728e", "value": "98304:ODjWM8JEO/rfZamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRPYRRJcIhEIqWv:O0R8eNTfm/pf+xk4dWRPoPAW3M3lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762278572, "uuid": "ef594f7a-2f2a-47ca-814b-31690a6e5cc8", "value": 7255145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762278572, "uuid": "566d5a9d-86b9-41db-9757-120308ba3fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278572, "uuid": "12838f4d-492b-4cfd-b3a5-b667ac46cbc7", "value": "EXTERNAL.exe (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917d2f20-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236459, "uuid": "2d8ace8e-c73a-4017-b04e-7e28822a0d4c", "comment": "Malware payload (Mirai)", "value": "65cf6f0acef64c5338e1dc1114d09a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236459, "uuid": "90238a09-89f6-4791-8ad4-282d7e5ae7b9", "comment": "Malware payload (Mirai)", "value": "9a1456d97a53a867e7362d5e13220fe1802cf6d4423420778b8873345ed1236b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236459, "uuid": "d6bb1d8f-851e-4f7b-9cdb-88ace5793ee3", "comment": "Malware payload (Mirai)", "value": "ba817c9e9cf41337559d7c7bd2658c2adebd536c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236459, "uuid": "e321d72e-ec09-49f9-82e9-1565ac6a8edf", "comment": "Malware payload (Mirai)", "value": "68f27b806cc6eccb4874f7cbb4baca6d1b658ba0c870117d62130a3b5925b4e5bb2c0cbbe7ccce931740cbffeaa5f0cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236459, "uuid": "0154494f-ec03-4e42-940f-20ac69c62b67", "value": "T1A8C3E70ABFA10FFBD85BCC3B0AE92B0825CD555722B97B36B634D518B50B21B19D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236459, "uuid": "ba45bfcd-df47-445c-b5e1-c5bdeab64f76", "value": "1536:BxTkGL55S/CcNf4BEcGiBXt5EDcKzRsyeNBwW+nTZSBU2K1gk:Byq55S/CcNf4BEcGQ95ED9lsB+nTRek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236459, "uuid": "cb194ad7-030d-4000-b07e-8771c0babcc9", "value": 121964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236459, "uuid": "b45672fa-31f5-43d2-a057-a10c902d4c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236459, "uuid": "1c399947-4c87-48eb-b182-8ddd03bc5d44", "value": "FGx8SNCa4txePA.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a1c304-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244605, "uuid": "94b71c10-c47f-4780-9ba9-07270eb019db", "comment": "Malware payload", "value": "094e00222dfa1f239e741b740016dcd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244605, "uuid": "eefc9c97-798d-4de5-b35f-901fdb635ba5", "comment": "Malware payload", "value": "9a5852e83a19114231cfae62bd110b06dc7240164e3970e174fce43cc8259a79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244605, "uuid": "14d74089-4b88-4cfa-a149-58bb62074585", "comment": "Malware payload", "value": "e82fd219a2d5e509e4a2eacf7b6f7bb5f2007285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244605, "uuid": "70f1a87b-aea6-45a5-89b7-1670afd7fe26", "comment": "Malware payload", "value": "20305fb2188a8aefe8220da6cb5de0f143ae7f9b453624c62f678d1744b6d919cfe7fc52f783065ae2de3db8694f08dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244605, "uuid": "a485f11a-ff9e-4a1b-8913-817bfff3bd2b", "value": "T10395CF13F24E673EE46A5A3649729A50443FBE60641A8CA3D6EC3E4CCE391601D7FE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244605, "uuid": "2fd784bd-5488-4da6-bd9b-7581525345ae", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244605, "uuid": "d810e33b-5456-43b2-921c-e209cac45efe", "value": "24576:pXkwiiUWhWXKaOEMrNFNf+2CyF7KDFbJnPrUXsazZ+Jsp1B34FGohdN1YL/iM7pM:pDXr9PCywnjUX9zZ0U12GIyNtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244605, "uuid": "93c2288c-91d6-4049-9c54-4f53b160a7a5", "value": 2041861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244605, "uuid": "73f0d7b9-5e9c-4780-84b7-d4cc384537da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244605, "uuid": "7ac8aa4a-1d56-48d9-983a-d4b0745d2c65", "value": "SastashaCheatInjectorManyInjectionMethodThemes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979311b1-b955-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762243771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243771, "uuid": "515df66a-a8c0-44e4-8bf4-9ed42cec6a92", "comment": "Malware payload (DonutLoader)", "value": "302aff8afb00b6d22d1bed9b667c3266", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243771, "uuid": "6fa7520e-8bc6-4b6d-a5bc-2eabcf873498", "comment": "Malware payload (DonutLoader)", "value": "9a8057b07ef25912763b238cafed2941ac266e8b4edba123b77ab2785104d4fd", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243771, "uuid": "90645e74-0a01-4c6e-835c-4405b1541b2f", "comment": "Malware payload (DonutLoader)", "value": "6f4de3de80fadb236ccbe1f5642dedf9404f8d71", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243771, "uuid": "8e69e157-c4ce-4f45-9f19-b752effd1f3b", "comment": "Malware payload (DonutLoader)", "value": "fcefbdee2961c4084189ca6d3aa79fa86c059093be3b056f11a1e515d39b6862c529561f5d5a35354235e58c2eb00f84", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243771, "uuid": "07273b91-60eb-45bc-8670-32fee7721ff2", "value": "T15AE423BBE833C9F8F99F30B0DD06D85437222269C16EE8DD0AE6763595F71422D8964C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243771, "uuid": "7555ead9-99f2-45fb-bd9d-47a63fb05934", "value": "cf9fe8688c9cad7a9539ec9bed0bae85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243771, "uuid": "0ca30c0c-5c77-4885-8845-ceaf80a5e312", "value": "12288:QnR4drgbPucp6p5BOrAVUHM9msmvW2Qb0yVhqudovjdkRhP5/BRuUlc6o:cR4JgbmcaIjHOhmvWk0q+ovBK5fhy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762243771, "uuid": "bd560a82-d4b0-4f5d-b660-86d786f7d063", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762243771, "uuid": "ff9bb147-fb05-4495-a14b-1fda19e72ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243771, "uuid": "632612d9-e2b1-4dad-9468-d3f9e65084ac", "value": "External2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2d7a50-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217499, "uuid": "5c6320ca-6085-40ba-bed3-b3c33c127f59", "comment": "Malware payload (Mirai)", "value": "e5310b2507527fa98af7988c87ccd398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217499, "uuid": "a2e73f3c-4af7-41cb-8e76-a4e95aa3c2a7", "comment": "Malware payload (Mirai)", "value": "9b23d9f659c4aa8487523537a5b60f2c6120025343c5348d6f0a9d5ea537e120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217499, "uuid": "0fc3e2ae-6bf4-45cb-b7c2-075cccbf58ed", "comment": "Malware payload (Mirai)", "value": "8caefd41e51088d522b86c62fa2fe2d41d0a8c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217499, "uuid": "2b1372a7-75fc-4c9d-8c9c-1a524a0b1394", "comment": "Malware payload (Mirai)", "value": "a9e8040b29ef06d607a8a2e440856112a8017d833c3e5bd57d4fd6fd31d7afb180ff8e6e7c8effbbb45f54b7a95f096d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217499, "uuid": "585200d8-ad2e-46e3-b5f7-507ebfe3e546", "value": "T104D35C0A79D270FCC687D170926E9F61E63A745C02183DBBA3C2AE711937ED05E15FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217499, "uuid": "975c1d1f-47d7-4681-aab6-7996eeeff171", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQ2:yIRfe3xvvSrlvZZ7U2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217499, "uuid": "055dfa57-4c70-48a3-b2da-7b78fd6748e0", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217499, "uuid": "b473240a-6bba-4ddf-9584-3f5b293cc24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217499, "uuid": "1f9adde4-68c1-48be-87cf-e4e0528db6b5", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c82728-b993-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762270417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270417, "uuid": "2c8ad9ed-6b3e-462c-ba41-292c0e88f875", "comment": "Malware payload (Rhadamanthys)", "value": "1b8df57a967479d1362838a9a293e95d", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270417, "uuid": "de76c056-8f80-448f-b479-64283f462aa0", "comment": "Malware payload (Rhadamanthys)", "value": "9b4e1688b372fb2d86ab88a68db7c99bf039c007bea409dfd70081a5b0e3104c", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270417, "uuid": "c6decac5-e9ef-4e31-915a-aec3e9cdf837", "comment": "Malware payload (Rhadamanthys)", "value": "460c8fabde8d1924f31c6825cea58654c30e753b", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270417, "uuid": "5908c3c8-8800-4fe3-9562-3680168a896d", "comment": "Malware payload (Rhadamanthys)", "value": "b9c88e6894bb87e7a1fa000503380435d47b7b01d1d12d67ba26a1d7086525c8a0eb7cb67edfff1f178ce262c59d09cd", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270417, "uuid": "e29af337-0f49-49d4-b3b0-6718fdf0850a", "value": "T19275232416D15977E0708BB695F301C3F631F8921B7A5BDF72C980BC4E328E0A676B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270417, "uuid": "d9fcbdaa-73c7-4fea-89a0-cc38dd18b538", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270417, "uuid": "8dfdeeba-fbd1-442a-853b-70e1dfb02940", "value": "49152:oj32dvRsEYSEetD1oN5rF1TuljUeri5V7g5wLyjH:4FcEetDqfvODirk5wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762270417, "uuid": "69649704-c615-4d00-bfea-5ff9cfe9283d", "value": 1650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762270417, "uuid": "677daad1-3f50-49cd-9c5b-2a40c3be9a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270417, "uuid": "2b64ddad-7bc8-4159-bd2e-4c531f0e6692", "value": "9b4e1688b372fb2d86ab88a68db7c99bf039c007bea409dfd70081a5b0e3104c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764a554d-b9d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762299120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299120, "uuid": "97deaad3-8553-4cb0-9bca-1e69880d13eb", "comment": "Malware payload (Mirai)", "value": "872799b4d8ff383ff7a29bb2af0ea600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299120, "uuid": "701dcc65-e247-4917-9941-9a197f0192b4", "comment": "Malware payload (Mirai)", "value": "9bb0f2a60870f5d02b06d38a63070042450c41434c5c26f20639fac7587f5663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299120, "uuid": "feafa2aa-32fa-42ab-89b0-66656befc6bf", "comment": "Malware payload (Mirai)", "value": "9a203ff31353e6d776631310198f313abfc6e032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299120, "uuid": "62c64427-1d0b-408b-9c71-342af178797a", "comment": "Malware payload (Mirai)", "value": "ab040366c356cf93fb6f714e5f6e551f499408f05bcc93a3d45618bf7dc3c47535ae434d86d4e08da9ea35edbe8daa59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299120, "uuid": "dbb13b4c-20fd-4b5a-9ad8-1d2bd71500ae", "value": "T1C7833AC1FE8BC1F5E91B88304076F23FCA32E96950B2875DDF5AAF36DA335415212299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299120, "uuid": "ab3b2ca7-6d9d-44e6-88fa-0b97d2a2fb1d", "value": "1536:mKz1LffGPJL/HIpk9x3by8/WE8vJTaoLEAQkfsajO:mKRGJjH/3bMFvJTaYE2jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762299120, "uuid": "967efc23-9d3c-4143-a843-5b45062ef269", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762299120, "uuid": "386576cc-51f1-4988-8810-150f4bb5f67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299120, "uuid": "0c7b7ba5-0cec-46c9-8254-11adec764615", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986448a2-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236471, "uuid": "6241f406-65e8-4470-83c3-a072231d3c65", "comment": "Malware payload (Mirai)", "value": "ca300cd99b2637313f35562fb4a42577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236471, "uuid": "3cf9961e-762b-44c4-b7c6-1272b0611b25", "comment": "Malware payload (Mirai)", "value": "9cb790cb62fef9839c315a23042e84426e980bac3dcf5093106294c3b0112e01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236471, "uuid": "06cdaf9f-0f25-4e39-9cdb-ff2662ae8191", "comment": "Malware payload (Mirai)", "value": "6ffcbd5b6dcb8e8e01cbcb024d15cbb0ce942c4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236471, "uuid": "32c9be0a-0d39-4920-8472-bd4c7c87324c", "comment": "Malware payload (Mirai)", "value": "0269d2c3a637fc0f162a3d756ac53ad4ec220b5afaa0c3d783e94c24951bdebe6e010c19f496275c25af935765cb7809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236471, "uuid": "5a650334-a3eb-49e5-8e64-c90eaef5d8cc", "value": "T1CC832885F58F81F9C44B493091ABF63FCF30C9A842748A5DEFA8AF36DA67542D10664C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236471, "uuid": "15670b8f-6942-4453-a947-89de72de0200", "value": "1536:uEMQLEfF1KWEOZWBj8fh+ukTK7r8oZGItJRfDo5aj/ZTxsyRRWjqLbFsOujbwuHs:WQki/KWm+ukTGr8oZNtjfDo5a7dxsyGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236471, "uuid": "f5a676ba-5ae6-4c59-b92a-b10a08e2736e", "value": 88176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236471, "uuid": "2e8dd547-a6d3-4156-a8c0-f23b28c01786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236471, "uuid": "0bd9d819-482b-433d-935d-1d3cd6fea856", "value": "FGx8SNCa4txePA.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe2cdb7-b9bf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289204, "uuid": "d929ea06-9efb-458e-857b-d502d134d17c", "comment": "Malware payload", "value": "fc4a4eb41afeb8b30ced228e1cb8c41a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289204, "uuid": "90c45744-4b92-4d32-b573-e63f808ab819", "comment": "Malware payload", "value": "9d218a2bfff89d088666bdf8bb5f5bcf00894d82a729f02d00dd7ec0c7097c09", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289204, "uuid": "54661ed7-b0d4-4b59-8aa9-256f5b4d561c", "comment": "Malware payload", "value": "d469cd886355a6b4309cc18ec048e0b83f977dcd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289204, "uuid": "70d2ec89-729a-4562-bdf6-3954fe4cd25e", "comment": "Malware payload", "value": "1277f87008a04df59f0a97a42440690f8855638e1fa4c41e396c07260585627e20c1fcc6a86774dd7111698c22713c04", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289204, "uuid": "f53c2c4a-f7fa-4fdd-81db-e52607b7e908", "value": "T1D1C08CF2453DC471A33A095EB121E2F88D0694290BF539B2D4188684A2A80741E4F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289204, "uuid": "6503b93b-2a4f-4871-a618-374579883235", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfAaRShMi8PVymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfFwM3opZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289204, "uuid": "4d46e075-27c8-4461-86c5-aa9bdf13ed0f", "value": 161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289204, "uuid": "2d6f0f3a-2929-4bd7-85d2-aca73cf91c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289204, "uuid": "aba2ce64-19dc-4b71-9418-b7532053a773", "value": "44hwucf9x2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3d1d77-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762249090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249090, "uuid": "f5c1d9c4-2c2f-4895-a0f7-375af679e871", "comment": "Malware payload", "value": "fdc4968b50e7bfce848d3f26d87e5384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249090, "uuid": "d696dc94-f709-4b5a-b9d4-6282e8fb65d6", "comment": "Malware payload", "value": "9d22603ce03d598b7a62ec02979187868277cca698de32ceba9587af64cdb0a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249090, "uuid": "090f2ed8-81bf-47ac-b921-54b7fab7579d", "comment": "Malware payload", "value": "e387d9739cb690a4c040a8431187b1ff53276df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249090, "uuid": "1c31d424-02ae-40b8-a521-f8623d4ede3c", "comment": "Malware payload", "value": "8181b6f1a31ff294615f36a6c646908369fe98b29181b7d2b783362655902aa1538ef2b32a57e72383da5234d1fbfe18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249090, "uuid": "38a9760d-0426-4767-b85d-7d3daaad4af7", "value": "T1A8A7335292C23CEFE0694BF529818D259EE5F807BE8245A4B52B43B58D17B48CF37F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249090, "uuid": "289525a9-7b92-4881-9408-806f65ef83dd", "value": "55745b37120ded38f38be395812554e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249090, "uuid": "84a3bdd4-804d-4f00-993d-4cba901845f6", "value": "786432:0OnI3KnVi7SqNX9VTyIthnp7QRcJ9einuSUFXZO+c5zNYELIiga53Fas0:/nI3yVi7S4XTTFtn7QWJgiutOdzNvRF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762249090, "uuid": "dff68b38-7a07-4145-a26f-c8500d042abb", "value": 45639968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762249090, "uuid": "d2bdc6da-ad7e-47a4-96c9-346a6a73cdf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249090, "uuid": "aeb8b2cb-1866-4c65-9308-c5351eb9ddd6", "value": "9d22603ce03d598b7a62ec02979187868277cca698de32ceba9587af64cdb0a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3fda41-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217442, "uuid": "12228f67-fc84-4d67-a368-a7057f28d36d", "comment": "Malware payload (Mirai)", "value": "c9044f1405667bbd194c1dc06832b9b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217442, "uuid": "6478254c-19d4-4108-9206-b0e1e2de52f6", "comment": "Malware payload (Mirai)", "value": "9e5647981fd2d0a93efa242dfaf007bf4c983e2677db31e4f3ac2437db290bac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217442, "uuid": "76458ded-f8c1-40e2-8d34-bc95ec52538c", "comment": "Malware payload (Mirai)", "value": "9b44907e585e9e686c33e0589fc094ffdaeed298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217442, "uuid": "2fca21d9-830a-4ab2-90da-f8991570ba3a", "comment": "Malware payload (Mirai)", "value": "352f84a18ebb6ba990dfb11ea76d95ce4c368ab34a8fd7216ebd071b33f9a34985c5cf96d118f64a55db7838e660c6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217442, "uuid": "36d177b1-eee3-4d60-9194-09e5774e7376", "value": "T1E5631287FFDC1F9CBCD91BF8076A61DB2252903194B341F80CE9585A859ED7111EA8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217442, "uuid": "c755f0fd-4727-4742-8cd6-ab9413bb9df3", "value": "1536:Ja7MbwKNGjjH+Xq34n/q8Zu41zmX3sDg9orPV:47Mbp2L+Xqdfoz2sFrPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217442, "uuid": "86b106c9-44a2-463f-9bb6-2d3d991a38a9", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217442, "uuid": "c3ef8825-9e15-43ee-aa50-00b25f88cff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217442, "uuid": "3cd675f5-cb92-4fa3-9a42-621813e258cf", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db1043d-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237339, "uuid": "47f8de9c-514f-4c7a-a857-9318c9b18d08", "comment": "Malware payload (Mirai)", "value": "a82ba194d63c6f64996ad8cbde0475bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237339, "uuid": "1974aaa0-457c-4460-b415-3cf2eb5a85b5", "comment": "Malware payload (Mirai)", "value": "9f638c44c6a4b6ea87044f134a99c7f578552968695ab480d61cbcb9c6b13e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237339, "uuid": "bf236c20-b6bc-4fe2-bc9a-d471ee0e97d4", "comment": "Malware payload (Mirai)", "value": "3c728da17095a3f8f364629c95c747ec749fa720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237339, "uuid": "a30dd28b-7f55-481a-89c9-e5baaa283886", "comment": "Malware payload (Mirai)", "value": "2aa17c82bbf624ddd5ffc8967365068142b5972221db64492533c1ce623641e22b1140274cdd7ee3720198b01c68debd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237339, "uuid": "3c855d4c-12a4-47e8-a617-715518108865", "value": "T1F4635C31BA362E13C0E1A47E61F78B11B5E617DE36A4C61A3D720E4AFF211506507EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237339, "uuid": "bd692240-ae58-465b-8673-9e32ea271842", "value": "1536:ngr3IAqziDiRQAaKqvOVk6MFIPApZk6VIfiV0Qq:grDita9W4IPAvZVNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237339, "uuid": "b77dd12b-1629-4c02-8c85-007dbd9baf4d", "value": 71912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237339, "uuid": "5b43c83a-6dda-4b81-bbef-212ee42885d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237339, "uuid": "d31fd55d-cbd5-4c47-9c9a-970bd9b94605", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34a5a01-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245562, "uuid": "e788bb6f-c784-448e-bd65-943be1ab4d5d", "comment": "Malware payload", "value": "8aa7f18f883d678134b02152d26de2f4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245562, "uuid": "be5f9c28-916e-4dd3-a94f-f6000f403818", "comment": "Malware payload", "value": "9f849081e3063cd912129c79c34c565a8e4078637f4c21dd791845745c06a322", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245562, "uuid": "b49c7c4d-5b38-418d-a2de-8d1b0282826a", "comment": "Malware payload", "value": "a278b0ad57d1c03f25eb315293c383bcebf46bc8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245562, "uuid": "985b0fad-3ad4-439b-a743-261194172e16", "comment": "Malware payload", "value": "5b1d2c8e05be6dd82f0b0d72b0beb08e6eb8042cc728bcad39f4ab68e6bd51dee9a555151e3afc5db4e55924392e4408", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245562, "uuid": "4b47c61f-f5a7-4cba-9c81-eaf6d715661b", "value": "T146110E20FD06D0B290B4EEC2C1AEB812EBD3D0B57872B2583559D43F7904288C62F2C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245562, "uuid": "a14845eb-6d31-4f98-b50c-5a88c0bc7ea1", "value": "24:9A+18Vnu++cB5JPXPbV1PnAf14txD5PSV1Pxp99z/:erluwhfbzS4txDxSz//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245562, "uuid": "1d3514e5-ee69-49c4-be1a-a372e0eab4a0", "value": 1018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245562, "uuid": "34420076-0bb8-48ab-be56-ee84e8cbd5a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245562, "uuid": "b9752f7a-e5d3-4867-98e4-ae239a852311", "value": "test.vbs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d866c18-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245445, "uuid": "dc54eb46-b931-4b3b-a447-ddee5b6514ef", "comment": "Malware payload (XWorm)", "value": "602e07ae679b895948361bf83286fdbc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245445, "uuid": "84dcab4d-7120-4f53-8ad5-1f069cef8d3c", "comment": "Malware payload (XWorm)", "value": "9fbdb7c445322d877ad9584cd6e346c958bfd676f2001b1d35a5793e647fdd33", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245445, "uuid": "b52f4390-25ec-4cc7-b2f1-72df3843aac2", "comment": "Malware payload (XWorm)", "value": "df4c8ecf2177fa0add198a9439fbea50f43377c8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245445, "uuid": "85759860-9c33-407c-8485-a5bbf417e666", "comment": "Malware payload (XWorm)", "value": "6ca46e7e8425cefaa87db1de3aa72e7ec89762f12a7ce5f132fa335b9abd66f927379bdb4e55bb9205dfa5029b919bbe", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245445, "uuid": "a7ac7a5e-3fdd-4dd6-9a8d-ab0596219e4c", "value": "T129F3D639892CBCED07A6F0A1EC753A01E3DBD74EA7A11624FC51D7288939148CFE615B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245445, "uuid": "29c1ed8a-4375-4655-9087-95a98421b90c", "value": "3072:hIIIbDF/aeowKWnGNrbLn3YVPRUhnf3U/6h1qdAlU1y+++wWRuBQfZsA:hIIIbDZaeowKWnGNHz3YVPRinf3U6h1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245445, "uuid": "09780516-f2af-4ebb-95d9-b9a03b1375f8", "value": 169205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245445, "uuid": "920b26f5-e5ee-4431-b7a0-76775c8cf93a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245445, "uuid": "65081ce1-9e2e-445e-84ed-2103150b2777", "value": "Samples and Specification_09373_JPEG File.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf0701e-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245310, "uuid": "b109e4b1-4235-4c54-be43-4972446dbf8c", "comment": "Malware payload (PhantomStealer)", "value": "7a091c9a134122bc53aac99b731b9bff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245310, "uuid": "da7401b5-2c53-4a59-9be4-8ed869c5854f", "comment": "Malware payload (PhantomStealer)", "value": "9fe364ce4891c9712e103e46168d5855c56593cf604a375e8ca512c85668d79f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245310, "uuid": "798c6cef-c06a-4799-bf49-dd7efd6987e0", "comment": "Malware payload (PhantomStealer)", "value": "36de782871ad984fb68ff1cab9260d82b5287280", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245310, "uuid": "fb6beeec-3417-44a5-82a8-2a7dd435fe34", "comment": "Malware payload (PhantomStealer)", "value": "5b07539899f16e05965bdc2f08576f5a2ded9915d7932cc8ee7db094a85c013ceacce92fa89f4d85501e407bf7dbb1b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245310, "uuid": "2dce881e-2cad-4ede-ae96-600600d24473", "value": "T18C161239B586F735C85AE24F9F302B94AB35A36DD853A53AF450C09C4F3065B90B8F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245310, "uuid": "46d2db7f-0950-463c-aaf0-1b7a4bab3de1", "value": "24:zRL32L32L32L32L32L32L32L32L32L32L32L32L32L32L32L32L32L32L32L32LB:ztwrsWeedh6BPXneVBd2YMrwFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245310, "uuid": "da75c76b-e958-49a9-8f0d-4d8144f5e519", "value": 4034667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245310, "uuid": "847d2a05-c950-4b80-92aa-6be59aab1544", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245310, "uuid": "c7755765-8c09-4c2e-abad-5aeb11951be7", "value": "PO10038281.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1d3120-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244612, "uuid": "dcd98aed-3822-4986-a469-bf685d12a317", "comment": "Malware payload (RemcosRAT)", "value": "3f6f64703f40eea7405289c0dcba607a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244612, "uuid": "1112e993-efc5-4839-8625-17beef727b76", "comment": "Malware payload (RemcosRAT)", "value": "a083b9bdb768a03a97d19da3e997e147d66430738d4aa27b6a852de0c537a6e6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244612, "uuid": "5027a81f-04de-41ce-9c9c-b8c1d88869d3", "comment": "Malware payload (RemcosRAT)", "value": "cb297e8d902a5d05e4f01b4619d08acf95a1f7d9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244612, "uuid": "d4393518-3add-42db-b92c-72ded1e5c403", "comment": "Malware payload (RemcosRAT)", "value": "52579fe5e5810c7331374c62a713ef58b4408f6085ab7626c4c949f5ce12f0b424f54d152a97ffe8a2a341c0575927bb", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244612, "uuid": "203b7cc1-8d30-472b-b029-32a18bba2101", "value": "T1BF95F182EEFF5D72C22AC63A05E612144325CC188A719A433ACA763476F7F95372376D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244612, "uuid": "e9bfd48f-aeb8-4032-8db0-d7663c39f600", "value": "49152:kXy613MhyImJh4iRZchzW74pjAjwU/cyU:DA3MsImJh4iRWU74pkjwU/cyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244612, "uuid": "7727c34b-b8a2-4a5e-a8a6-1c4e92b54c2a", "value": 1950720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244612, "uuid": "30ca8f3d-abdc-4ec6-8015-d95c02c480eb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244612, "uuid": "0791a7b4-94b2-46e5-af44-b99259bb90f0", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750ded3e-b989-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762266047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266047, "uuid": "36854109-fbfc-4e8e-adf4-d7847ab00951", "comment": "Malware payload (a310Logger)", "value": "49cb8c8eac6e50d97623f6f90bc1c590", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266047, "uuid": "710f8df9-1bf3-4561-ae98-74f211e136e1", "comment": "Malware payload (a310Logger)", "value": "a0c27713294ae8d166ff1646a86413b011dfc4e5407e7951c091bfc40e8c6c3f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266047, "uuid": "f0da3e7a-6225-4528-9cf1-33f1e7e2e9a5", "comment": "Malware payload (a310Logger)", "value": "c5db1d80b85996ee02e1854a3fa0f59940489cb4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266047, "uuid": "4337b78e-fcd0-4f31-9436-666ed9ef042a", "comment": "Malware payload (a310Logger)", "value": "1b504503dfef68d74f2742a8d44781d99f248a8b3bd2983ef6752c0da6069119f4960723723c11e6b762d474525b14e4", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266047, "uuid": "ee41b40e-118b-4040-86bf-078e28d07094", "value": "T19E0523D44898C862FB103774E03ADEA01ED47871CDD9379D57A9D0AA38B23835592FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266047, "uuid": "6012d515-164a-4d4a-ae80-3d114df484b8", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266047, "uuid": "b888eb2b-2878-48db-b568-36e910271127", "value": "12288:POv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPixfudbC6SlvS22RX4L+A9R9FMI/U/H:Pq5TfcdHj4fmb3g5huX4Lz1MI/nbYek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762266047, "uuid": "3b6291e8-3223-465e-b53f-0b9b2054ba6e", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762266047, "uuid": "a85a179f-0b80-4c4d-8e96-918e7723772a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266047, "uuid": "ec12229d-759a-4ee9-8021-bb645c41747e", "value": "Fa5678900987678900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fb2d24-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762244681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244681, "uuid": "48048ab6-00c1-4c12-ba63-537c99c247b7", "comment": "Malware payload (Mirai)", "value": "349a4f4d47eed0457ffbd50aab1c0f1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244681, "uuid": "1a5eab2c-47b5-44ae-be46-d6371af9b967", "comment": "Malware payload (Mirai)", "value": "a1c00af6eb48ee80beaccd851b2fe0d742cf08fc8817c9a8b13b3c3f4786ad6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244681, "uuid": "ee22c6f1-2077-4012-b275-2e956edc56dd", "comment": "Malware payload (Mirai)", "value": "b045ae8b270841d2e5752f2f5845353d18b975a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244681, "uuid": "91037140-ee7c-4bc8-ad86-004077eac32a", "comment": "Malware payload (Mirai)", "value": "ff4d2ff61f6d41f1225a82c461f4809e939f260738f407a9b9c7faccfbc6e441469a92c9bec51a293100f7674ee1c1c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244681, "uuid": "e978b987-387c-4589-8c2c-c65c10cac967", "value": "T10161A5F7034245779CAA89E731B94804768548DF98CE0FBA9FDCB4B48E8CED87D46642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244681, "uuid": "3e0c15db-45dc-4e05-8330-caf76d6deaa7", "value": "24:ItmqbZsm7sbhm89kmPglfmJamsmRyTmQlQGgJmCj6m5qnLmGlGNIpKksm/wMEmpF:iAVu1Tb1y1U3LqJBRCz8BgJs5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244681, "uuid": "c82152db-2e1c-4937-83f9-c5312394dfb4", "value": 3314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244681, "uuid": "38b68720-e6cf-468b-8936-3a350ad31da9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244681, "uuid": "1a90c23b-52d2-42ad-9e75-4a587b8c8c4d", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f21fd5e-b99f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762275352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275352, "uuid": "6d78b671-ed70-4074-94f9-da4294a6af3c", "comment": "Malware payload", "value": "203d9d52c2e15f7f7fec57139558a283", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275352, "uuid": "ac5f4c84-6652-4f4d-9241-a413ae10a085", "comment": "Malware payload", "value": "a1cbd4cff7edb91da0fe69e02ea7114cba0d3f74cf7d7314b852803177ed78cf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275352, "uuid": "71024c1b-1008-4e37-9ee6-39f51ea1858f", "comment": "Malware payload", "value": "e80c2ba7b043d2a20b60c82c1cd71a8ecc2e537d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275352, "uuid": "1fbd6c06-ec03-4d68-9220-36d92280e130", "comment": "Malware payload", "value": "5616f500a899062541d20e49e1855e5c8c5837c256bf83607a1f62c055272aaa5f28520845d9fcec5a171854373be516", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275352, "uuid": "415dd01a-b2dd-42a7-adc1-170005215e95", "value": "T105652302F3E95132D8AA27B178FF02D70F31BDE112B486E72265598F48B35D2647177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275352, "uuid": "6e6ed6b7-945f-4dd3-add2-16bd38b61e03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275352, "uuid": "0a6e6136-fad3-4c2c-bcf7-0fea864bfd75", "value": "24576:ywy03FlMarVIrj5vdGsVXkRXo+KrJrTgGUaBD2yBPBrnu5cWZnTQQZ5RrkHr/n:s0oaxIrj5vzV0XOg+FdBprnu1xkQZ5RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762275352, "uuid": "572a6305-7cfd-4638-8486-07d3e0332469", "value": 1527656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762275352, "uuid": "68365aca-b08c-45e0-a511-b5605bc2c038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275352, "uuid": "450f64a3-952e-4ba0-a1b8-80f7eaa18d89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0cb5ad-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237338, "uuid": "806c14b1-241f-40c0-91f2-4c22dad13043", "comment": "Malware payload (Mirai)", "value": "db61a955918f15efc0f65358156a8241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237338, "uuid": "11ce250f-2c1e-4ff8-88bd-9d250e872172", "comment": "Malware payload (Mirai)", "value": "a28361084ffc0228b7184f615c6c8a707827b3595497239760a94b7087817ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237338, "uuid": "8631115e-92fc-4227-9a24-1b3debf550a2", "comment": "Malware payload (Mirai)", "value": "7a6db9c019ca8fe67690eb84e6c9d930c2dc371d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237338, "uuid": "624e2ee2-ec68-484b-b5fb-55191bee1dbc", "comment": "Malware payload (Mirai)", "value": "eaa79bd50de17f3c600643e8613db601fc744822be346285a62e49eedea852b1fc08b78c0f0dbc4cf7871a6e62afc98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237338, "uuid": "960224f6-47a8-44e4-8824-eac19582b436", "value": "T106434CC5E243E9F5DC13017020B6EB33AE36E1F91119DA97D3E8EB236D92512E44AA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237338, "uuid": "a5a54bef-df9f-4859-93e3-188f5f25094d", "value": "1536:DgLG/crzf+oXU82BhVCHj54U5UtwUSNL6KB:Ui/crzf+oXDX5yNS1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237338, "uuid": "8e1766f2-9765-42e3-9bca-64d6e32d3d90", "value": 59444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237338, "uuid": "082b53e5-9fd5-417d-90be-b145b37e6723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237338, "uuid": "6efa5cbb-ffe8-444b-943a-9dc1eddf44ba", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0f9123-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237334, "uuid": "47131e4e-fa4c-4afd-b0b4-c35787236e6f", "comment": "Malware payload (Mirai)", "value": "1afc16dafef2616c1d1248713a1ff040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237334, "uuid": "c05aaaef-5312-4318-8100-5c3c7fccce39", "comment": "Malware payload (Mirai)", "value": "a3161efe40fd333990cc481716a1c64fdbe57d4db89724b1d04b4d9f3027c177", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237334, "uuid": "94e1d371-2238-4c25-b8ab-94dfd3eb4351", "comment": "Malware payload (Mirai)", "value": "30e22e21a137531be4966e769fce8200410dac22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237334, "uuid": "8b07bd18-9a55-4691-84a6-7b56aed7b770", "comment": "Malware payload (Mirai)", "value": "ad1b09582dee3d7f9418b4879723651c8f1fd6f2295f098158e46341ac244823ab440517e31ad53b51fb29df765ed942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237334, "uuid": "41c91fb1-1250-4eed-ab1c-8623dfdc3f37", "value": "T12B538D75E42A9D14D0840130B4A8CF705F63F2C982663EF75AE546B6540BEA8FA0DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237334, "uuid": "7c837cea-63d6-425a-ba1b-c4f791790cf5", "value": "1536:WjhwW9QG/+DhWgBVKqlk3viCwCl+Ja10:WuW9QGfibO3viCwV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237334, "uuid": "79dffdc1-b302-487a-a21b-bb2a1af3582d", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237334, "uuid": "e99e2a0f-35df-4cda-afd4-a86e7220aa40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237334, "uuid": "ac174ef4-3237-449b-a653-43cd3327fa58", "value": "uYtea.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec9a52f-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289847, "uuid": "a235afaa-c576-49d3-92c6-f33643a0cae6", "comment": "Malware payload", "value": "fc829f2aa1d6d3824cd0f990533401b6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289847, "uuid": "620c21d3-09de-40be-a6e1-1c0f5a2cf914", "comment": "Malware payload", "value": "a34339e96c91bf90c3ed308ca0bbf2cccfcf277ecf38759b144286359de7c2c3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289847, "uuid": "1e87246b-dffd-4e62-8d21-bbc1585e57a6", "comment": "Malware payload", "value": "a6582e0f5aab8a1f510686134983f6ccb3d4b55f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289847, "uuid": "3975b672-4da2-4703-b79e-a3a661c3ae13", "comment": "Malware payload", "value": "88e59b525f23b6dfe0ccb9aedce50bf7c1f28de6ef6a7cc8bfea2b74abde0e2e0d5568b636933da28aa93acf59eaf6c6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289847, "uuid": "03b7a2f3-9253-472c-a3f4-4fe60af03ad7", "value": "T1CFC42332AEBEC6CBF9AF64F0B40392247F4105EB934D99647D686DD00A3945BD63B381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289847, "uuid": "bbd63d7e-b2f0-4e21-99b4-8795bd6730cc", "value": "12288:bdoO0inc0yilAqgb1mzaHG//+tCWqVdeSg3HjNW9RkG:b2O0inc0yEBghGaH22tCWC4Sg3DAoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289847, "uuid": "d45d8d93-e270-4c3a-a20c-fe7f7d7e90e9", "value": 584979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289847, "uuid": "0554aa52-1897-420a-93bf-20da38ef6e52", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289847, "uuid": "4b184bd3-1e43-4f0f-9ee7-541e27f4bddf", "value": "G\u00dcNCEL , F\u0130YAT TEKL\u0130F\u0130 BEKLENEN \u00dcR\u00dcN L\u0130STES\u0130.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1e30a8-b982-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762262999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762262999, "uuid": "d7a35ed4-b94c-4c39-86e9-613c03fe2139", "comment": "Malware payload", "value": "6228c7d5f442b053bf7c887afa3b24b3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762262999, "uuid": "188fce13-3ee8-4357-8695-b245df2e43d3", "comment": "Malware payload", "value": "a4146f1d9dade9239643f0d383157933817b5aec9c43a6ca5b7ae34671b34804", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762262999, "uuid": "2e007805-a069-4e45-8528-6bbf86e2b42e", "comment": "Malware payload", "value": "8e24679239fa45afa7177940a8073f9ab8f2aee2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762262999, "uuid": "210318da-d846-4e83-880e-70d5f429e1e4", "comment": "Malware payload", "value": "2de7d22638994cc3c557ad16b7654a8c26e3f069f9f2131da61790c0cd2499117c08d9546b36dbc8a11301eb23f13c89", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762262999, "uuid": "07a3989d-c879-4705-bd17-0b94066a69cb", "value": "T187532CD0D9A23913984636DD9889CD758EB4C255272358B07EED632D3006BF863FEE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762262999, "uuid": "a9030a3d-53e0-4c15-bf35-252818b8427a", "value": "1536:dKv16aZKGMiLhfnN9tLoT9aR+bpjW1+eoHS6+1+P8Ua9Ef:dK9625VLNntLagR+bFe+l8UaOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762262999, "uuid": "0a358b9c-a390-4c29-85b6-c9fd591029d2", "value": 65755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762262999, "uuid": "02e84f44-0f1b-47ab-ae01-16caad7b0523", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762262999, "uuid": "45fe788d-b4f2-47c0-9a6f-4498d26212ae", "value": "Order #3253952# Bestellung #3253952#.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f008cd-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261217, "uuid": "75599451-8e5e-403c-9135-06bfda613244", "comment": "Malware payload (Mirai)", "value": "7a5a9559f96af42edc92f05b68d7a7fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261217, "uuid": "672e5ae8-d352-4a39-b58e-7bea947e3a64", "comment": "Malware payload (Mirai)", "value": "a432c554bd8dba87793f2c407c314859ed3f8ef6a69aff8fe69c52710f6c1f7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261217, "uuid": "5a603434-2ae5-4b6d-b248-a746ea001894", "comment": "Malware payload (Mirai)", "value": "bd9f0e832939611f4afe930300da00e54c81f40e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261217, "uuid": "165d4bb2-bcc5-4eb8-9229-08cb96a7cc98", "comment": "Malware payload (Mirai)", "value": "ea80965fa973f9283886ae6175f200d6fc024997e3cfce5b2fe19c6b1096c953dd6954a0b8fd5c3bdaf3226beecb6c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261217, "uuid": "a0845b0a-c709-4cda-802b-e88159e1b391", "value": "T197F31A42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261217, "uuid": "19b2b479-5c1d-473e-a1b6-852c0318a87e", "value": "3072:XkGROPfU3yLPrW40QdIA2XSaRuwXOcJvBCRlYOP6hh1zN5:X3RgfU3yLPrWlesXSaIwX6RlYO+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261217, "uuid": "e73efeaa-9504-4632-9d12-4209f9ad0183", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261217, "uuid": "6527f5b2-db3f-43e6-b7d9-74251db43ba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261217, "uuid": "da52a307-3e8d-481c-85f6-4cdd7c7af617", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4ea76e-b9d1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762296880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296880, "uuid": "155cd83d-e712-449a-ad80-3381a919f523", "comment": "Malware payload (Mirai)", "value": "b6bf78fbf7eab3461d9af41989655433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296880, "uuid": "670716ec-25a5-4da7-a3c5-91cff3c5a653", "comment": "Malware payload (Mirai)", "value": "a494ef703b47a134500f8bffae1885713873c62e08077aa72ae870f90603f792", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296880, "uuid": "59cdc5fe-f22d-4bd6-811f-a7eefec25115", "comment": "Malware payload (Mirai)", "value": "ee9bdf866847598de62f16325b8ed31b2530a1dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762296880, "uuid": "742940bf-8790-441f-b53b-2bb2c5766ac1", "comment": "Malware payload (Mirai)", "value": "bd7919342448a0abd522bdb933c1d88f94a286a1dfdaeab155835561c8edee6c2e679a60995d5b37262844c233ab7ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296880, "uuid": "4903b15d-d15f-400f-a798-edfed7515e7e", "value": "T14503D070EEE17BA1EBD4FE345CC2C7D057A08ECEA76B9D8325439B256AD20345609BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296880, "uuid": "4f259a76-dc92-4f7f-b269-40523e887273", "value": "768:Rs6orbDJZ1pkqaZYN5GbY6Q72ilIivH0BoyIIeeHOA4uVcqgw09Ppa:RkJZ1pkq/5GbYp4i8eeuA4u+qgw09Ppa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762296880, "uuid": "26bd802e-7ba4-4294-b1eb-c740a5f4364f", "value": 38196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762296880, "uuid": "18783747-b0de-4ef6-9d4d-858e6c6027ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762296880, "uuid": "69d807e7-f9f1-4225-ac48-476186aaf0da", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d791ae5b-b95a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Nebula)", "timestamp": 1762246026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246026, "uuid": "2def59af-5b98-4837-94cc-8a6f1a8ff980", "comment": "Malware payload (Nebula)", "value": "799aca2b3436b12a344f0e1d59fc0ccf", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Nebula", "colour": "#98E84F", "exportable": true, "hide_tag": false }, { "name": "NebulaDropper", "colour": "#869492", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246026, "uuid": "e811acf1-b84d-4cd3-8cfe-cce1c176eef0", "comment": "Malware payload (Nebula)", "value": "a74605531868b441bf8e0171b193aa26392e57779c10847fe8cb013044f1afd2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Nebula", "colour": "#98E84F", "exportable": true, "hide_tag": false }, { "name": "NebulaDropper", "colour": "#869492", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246026, "uuid": "2c422295-3db2-493a-a369-c5fee89ac12a", "comment": "Malware payload (Nebula)", "value": "41a87abf84513e53c13b56eb1e08a4deb1258521", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Nebula", "colour": "#98E84F", "exportable": true, "hide_tag": false }, { "name": "NebulaDropper", "colour": "#869492", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246026, "uuid": "7dbeee96-e482-4771-836b-49c770fa7202", "comment": "Malware payload (Nebula)", "value": "02cf1debdc12c3827bd7beaf43f232245b4d210e6308181f25655b1081a015109fabf10b6db7a72dae283a709b08d4cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Nebula", "colour": "#98E84F", "exportable": true, "hide_tag": false }, { "name": "NebulaDropper", "colour": "#869492", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246026, "uuid": "d9f19dea-a48b-4c7c-9573-2f59b7445cd1", "value": "T133135C726A03FDD53F7F2C41F18439680CE47A6747601ADCFAC528A528E9154DF2EAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246026, "uuid": "fb6b6280-c240-4007-80ff-61a70f372e21", "value": "768:P9UvNpXBPNmpCI7pIjhtZLDGjYAdkjYk5P4scKXTapelb+Slhkh6qKn72FKo37ej:PgEpCMpctBGjY6kvaelpminNoLej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762246026, "uuid": "d45e06e5-21c2-4aa1-b985-8ff15b59188a", "value": 45221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762246026, "uuid": "8f234989-16dd-4ec5-ba8b-4975968eca28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246026, "uuid": "5f2c422a-3c23-4d05-b6c4-bfa82cc15f84", "value": "advanced_3426.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679898b3-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236389, "uuid": "cd0f8f7a-534c-4caf-a8c6-f67002f71c94", "comment": "Malware payload (Mirai)", "value": "2a896aacbd7d1b980e7ab36f7bbcf1c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236389, "uuid": "1d69e5ac-b9b6-47e4-a5ec-26fbece0d179", "comment": "Malware payload (Mirai)", "value": "aa30b8e69bfe508c375b1a916ca65f158a8414d1eb1413fcb784577d4389aecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236389, "uuid": "542da0bc-7022-45c5-a37e-5935f2417d7d", "comment": "Malware payload (Mirai)", "value": "dee5946e1b1049cb742a89f44a078d00a743502f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236389, "uuid": "6ab0c278-f7cf-41e3-8a27-3023dd7c61c0", "comment": "Malware payload (Mirai)", "value": "eee6498d05f66ac9809edafbd738c751ea455e8540300ca69ef94d30be948220b4d4bec11790d006c4c2afba9dbb48d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236389, "uuid": "4c9dbb6f-5da2-429c-bc5a-8ba9097832c6", "value": "T19803F1F4C261A750DAFE003728EDF5274821C90E9D1CE4AF8A603936D9703AD291FD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236389, "uuid": "a312e6ae-5dd8-4b75-8099-5e562e16d821", "value": "768:uMsLfGX5PDOC9TkcwyM8iXSu5LJKuWt6Y0dmvccfHHYVyge92YYmR9YZcnbcuyDZ:uMsL4DfTkco8iXD5LreH0dFGnYV1Gamc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236389, "uuid": "5cf83423-26bc-4e58-8d40-5ebbb2f9dade", "value": 38636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236389, "uuid": "e4faf1e6-5ffa-4a13-bc54-b976b1ebc2ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236389, "uuid": "d0328132-3ef3-415d-b437-65b19fd6ce6c", "value": "FGx8SNCa4txePA.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5937d5-b967-11f0-91c6-42010a9c0006", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1762251320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251320, "uuid": "240af803-38e2-4f56-a340-b6127cb9af78", "comment": "Malware payload (CaminhoLoader)", "value": "807cc0ef267759406ed365edc81c8603", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251320, "uuid": "29d032a9-4163-4acb-8b7d-436cefd36544", "comment": "Malware payload (CaminhoLoader)", "value": "aaba1a4aa543002d6a13a9ae86f2214ef6917908fabfabc96ac73b1024b4128a", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251320, "uuid": "a56eee15-f283-486b-bf89-1580844b9003", "comment": "Malware payload (CaminhoLoader)", "value": "985530aff12002a98cb0ddd6b67ac8d44608c75d", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762251320, "uuid": "d68cbe69-ee28-44ab-b5d6-f5c6b2e67294", "comment": "Malware payload (CaminhoLoader)", "value": "65837a4aad66da81a5166cdb95874ec2eefdf1862eec21a0fb569d6899502b91cd9a1ed4d5cd9da49cb0429e8a664143", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251320, "uuid": "03f0888d-cba2-42f7-be9f-43d1a362cafa", "value": "T156837EC5B81A92059453AB1DC5C9B632DE90F3EDED3F5E64B8FC080847FC02BA579A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251320, "uuid": "b545803c-7f2a-426f-b718-929ca546a568", "value": "384:1JPLDKGL4fIsCXoBKWOOa42y0WX/Axkyhcy:3DXNXoBKjd0qcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762251320, "uuid": "f4e635d9-35db-4e1b-96d2-66087fc37fe6", "value": 86520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762251320, "uuid": "be078b79-2282-4272-90c2-37053f944fea", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762251320, "uuid": "a5105447-2a39-426f-99fa-04fa8ef74b09", "value": "fsdf90sfcxv0sdf0f8g8dg0a00sd000sd88sdf090adf0sd0f90sdf00sdf00sdf0.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce28c8ce-b9ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281658, "uuid": "df263859-df38-461d-b2c1-d231fd63aea6", "comment": "Malware payload", "value": "2256231a5e219e0abd78872476d8d6ab", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281658, "uuid": "b60da34f-5f25-44f5-9ec1-8671fb4194c1", "comment": "Malware payload", "value": "aaf8b6441e239acade66d3f60fae59ef4f426dc14768ee7530ccbdcd61ef6e4e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281658, "uuid": "ab07fbc1-98e7-4b87-8790-5577128f77b0", "comment": "Malware payload", "value": "082ab46342b0402752a644e924b41b551340ec32", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281658, "uuid": "3a20dc01-ba97-4240-9397-2b70bff868ea", "comment": "Malware payload", "value": "0b4882b85bb66fbe8326c340e77d9bddaca16334e97a5f850cae2f1e9425c6cae24b173a6ae67d84af83865f81b99e77", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281658, "uuid": "8ba1e245-f388-44e3-b8d7-9c556121d145", "value": "T1A2473392BAD9EEA2F1D9B8FBD4BD593D796B7C101D21818B3301722C6E726511FB0321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281658, "uuid": "02d36035-4ab8-460e-9524-4380d4b2f92e", "value": "393216:gN7NBXAEefOsNE8/gsIvcIcvJKIjb6KscUi3YfuUj+baDUDPwWWx0s:gNIbXu/vcIcv76KFUiofhjrKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281658, "uuid": "04ff491b-df1b-430d-bbe4-b20e55fb80ef", "value": 24678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281658, "uuid": "47ead6bd-090e-49c1-bc75-c2f585f94cde", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281658, "uuid": "2bb6d0b3-3eee-4bbf-8087-7a36b03f7dd6", "value": "DaVinci-Resolve-20.4.0-win-x86_64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87597a67-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236442, "uuid": "e8de3ae8-7adc-49eb-9d1c-5abb5edd1e85", "comment": "Malware payload (Mirai)", "value": "70371b35067258da34a786290d2ed337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236442, "uuid": "ae3764e0-5b2e-4168-8af4-f74d8eec7946", "comment": "Malware payload (Mirai)", "value": "abaf6fd537b2369a57028852b8e115fef0cc5ba33e9e4b07692d4adbc08c45b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236442, "uuid": "81e0aea4-ab13-429e-921c-a5448460afde", "comment": "Malware payload (Mirai)", "value": "44a289ddd54c9cf04970d4b61585232648c783a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236442, "uuid": "7858ce0f-e2dc-4c01-9e42-55ab3ad48569", "comment": "Malware payload (Mirai)", "value": "fc8f638deb70b4fe494044f0c887b7c369e56ef47af04e944ed88c7647f0c71106ba55bab329f3828354b6ef361e3d85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236442, "uuid": "0bf8766c-75af-464d-b66a-a6b9c7b35439", "value": "T1CF836C02B21C0A47C5A359B02A3F0BE5C7FBE5C122F4BA49254E9B5AD671E335489ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236442, "uuid": "a73243d1-9f44-4495-8a63-c831198ddeea", "value": "1536:VSYUdfyPAzpgujs9pmCjiPnMroRpeTVIspu6l/y:VSYUdfyPEiYCjiPng/VIYuC/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236442, "uuid": "5fab84b6-8526-488a-9267-d71e9b27631e", "value": 87448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236442, "uuid": "8f4482a1-49f7-4db5-b5fe-2db70ddecd08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236442, "uuid": "8bd5567d-1817-4792-8e95-b6b237be394d", "value": "FGx8SNCa4txePA.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4988ac-b989-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762266083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266083, "uuid": "57816c8f-bb86-4527-b177-322631c5d8d8", "comment": "Malware payload (a310Logger)", "value": "3e1d14b8eba342f47d1088e6d41aa6bf", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266083, "uuid": "a6fbc9c5-9608-4757-b051-89454f073298", "comment": "Malware payload (a310Logger)", "value": "abd484fdf1b900cb436400c131afa3831c919054a9ecd2a5f0a72e02c2efb65d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266083, "uuid": "a93fdd4b-7aef-401d-9f98-f45d8f3bd8ae", "comment": "Malware payload (a310Logger)", "value": "1f9a108a682605c72b7d3e65520d5e78967ae692", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266083, "uuid": "054c8cff-8377-4342-a80d-660037112ba0", "comment": "Malware payload (a310Logger)", "value": "56827d25b1dce861dd84a0f8d5a856cb67d5480213d6a6334a0d1f05361c6600b57ab31075ee5b4a4552556fc6561500", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266083, "uuid": "d043f455-dd9b-416f-8f70-093643ebadad", "value": "T17755D01363DDC361C7726273BA25BB01AEBB782506B5F56B2FD4093DF820162521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266083, "uuid": "f0cd77a1-2691-449e-8efa-388970f07982", "value": "0f7552f9514e3a32a8dc8a5a9d9c89a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266083, "uuid": "1e69698b-e583-42a9-964e-3385f288afb0", "value": "24576:Xtb20pkaCqT5TBWgNjVY4xg5huX4Lz1MI/nbYe7V6A:UVg5tjVY47IfGI865", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762266083, "uuid": "b9566272-8884-42a9-8f95-dfc2573b61b9", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762266083, "uuid": "74187698-5188-4328-9976-9f7bab900d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266083, "uuid": "8ba4b66a-806d-4138-8e77-f5a5ea7bf620", "value": "Fa5678900987678900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a637000-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237333, "uuid": "692daf6d-5e32-4014-a90c-c820d047fdb0", "comment": "Malware payload (Mirai)", "value": "11952d298d4d490e5448ec43ed4436a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237333, "uuid": "8c3e8e19-738c-4461-be33-ab5aabde0e7b", "comment": "Malware payload (Mirai)", "value": "ac06a5732ead3b27c08fe624037c576c76bbc359a56eb45c9fb467fe5c931bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237333, "uuid": "b4c89d35-8b1e-4650-9ac8-470b3d489294", "comment": "Malware payload (Mirai)", "value": "fe6390703d182b02a2b720cffc24cd1c7add5ded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237333, "uuid": "4e91cd64-4b58-4a04-b15f-887fe10167f0", "comment": "Malware payload (Mirai)", "value": "4b946e92ae0771f4f81cda9dc6bd31ebb0489574c65f6f776c2200fa9dbb37f84f3872be437517bef3a0cbe2c4171195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237333, "uuid": "30e7dc3a-6dc4-4c55-93b5-1ca18e21ab96", "value": "T1B5B3ADABF24B1451C85306F407CB0FCE6F5721D2AF5BC9E36D6A253B18350DB190AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237333, "uuid": "84d231dd-6643-486c-af80-1dc9e8e603be", "value": "3072:kLcBxe66f79JqyX6HTYwsSY+CrvgMWFq:k/WHT3tbiuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237333, "uuid": "8a0797f4-9eb7-47c8-9bb5-25d729ff11ef", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237333, "uuid": "bcd7771e-982d-4fcd-9c59-aac9d292852d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237333, "uuid": "4ed5516f-d0b7-41b9-8d3e-190c0ff2b7d5", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67307dac-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762244549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244549, "uuid": "f6296912-0373-4c95-91f1-9e8e7d0a39c3", "comment": "Malware payload (Mirai)", "value": "b1b242e4195d6ba01bcb629d38cfac17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244549, "uuid": "bc32a228-0b30-4f56-8e31-646b7c7db41c", "comment": "Malware payload (Mirai)", "value": "ac20c911aa7d489de8b3ffaaced746e8cb3b1d4d2174302624efbd8c174cabea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244549, "uuid": "f966aef5-b5c4-4dc8-8f0c-a5237a6fac8b", "comment": "Malware payload (Mirai)", "value": "57069811418614bcae4799380b3e011833f111fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244549, "uuid": "6f34cbe0-03b3-4b6f-8c26-e00480e5000e", "comment": "Malware payload (Mirai)", "value": "0255b6a8a3e94154d26926c7a16499bf15003477bea9f5f4bfb3bc545d5ebd123358dbf1bdc1157c3d88ff8162ac6794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244549, "uuid": "7ff7d844-8193-40f9-9336-70691d285866", "value": "T112836C22B5391D2BC5D4A47B62F34332F2F6438A24BC8A1E7D720E8EBF145503A576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244549, "uuid": "b3afc53b-0af8-4643-9319-6fd2fea3c640", "value": "1536:avkhAvLOa523NZdeFyPYUrmcIatAVYm5FZWThfStY9:uuABcTSVYOF4r9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244549, "uuid": "12760b6f-808d-423f-9320-97a18a434f92", "value": 86816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244549, "uuid": "966fb101-a2b0-41d3-aaff-e04566a3ff04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244549, "uuid": "5cd07fd2-ddd0-4a8f-8023-14857f38cbaa", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15894cd-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245559, "uuid": "479c8a67-5f7c-474f-83f7-2880501acddc", "comment": "Malware payload (XWorm)", "value": "f029bd5472db536be271bdeda9c26575", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245559, "uuid": "6cf12556-5a26-416b-8d30-6c2a626c44a4", "comment": "Malware payload (XWorm)", "value": "acdfde9bac7c316cf7c2a3e32570794fef3ee7f18f5f5ddc8e0dadb7510cc3df", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245559, "uuid": "c04e4a56-d0dc-470b-8312-ca57d7b8d2c1", "comment": "Malware payload (XWorm)", "value": "ca3697d55b5a63d287dd8f023c7220a4be5a5082", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245559, "uuid": "6d4e06ca-a88c-41b5-8811-c076bde057cf", "comment": "Malware payload (XWorm)", "value": "6863536c1900486a476518bdb4f159f006b2d9e3393c759e04b52d0534053786654c0aac6daa09da1c179f95b3049106", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245559, "uuid": "2bd623f1-914b-4945-9237-3c0680f50b08", "value": "T1EB241018DF6A63DD1626D3C50F6AD060238EF7B332095C1B7E9E4A205E1A67ACFD3815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245559, "uuid": "496f5795-4e4d-4623-a670-b1c7d7418f3e", "value": "1536:XBX0XBf2gh3Xgydb1y6ROLBTa++MV66JQILMi:XBUeg55y6QLBTWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245559, "uuid": "082216dd-d8b2-440a-ac9a-6de2644d69d6", "value": 227781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245559, "uuid": "1c765173-7914-4673-8096-08785a4f35b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245559, "uuid": "fd007aa6-fc54-4eb4-be67-945df66bc02c", "value": "CodedBy0XABDALLH_Encrypt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed565ab-b943-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762236025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236025, "uuid": "dc132390-0605-4b10-882e-edcfa3ed93c1", "comment": "Malware payload (PureLogsStealer)", "value": "330f5ad1ba369082345fe9b75dfc09e8", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236025, "uuid": "c5b18b3a-fb82-4a06-8ebb-e6e782b940fa", "comment": "Malware payload (PureLogsStealer)", "value": "ad026a3bb2bc4502277d30716ffec6ef67ae41151d79927eac41373d499f300a", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236025, "uuid": "c84a70ac-fc1e-47a7-8eed-ef04eab9ef4b", "comment": "Malware payload (PureLogsStealer)", "value": "c3058939f32f89de1f9dfd59af0dbf4dda690724", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236025, "uuid": "f2602a0c-4b4f-45a6-9298-e486e27bfaf1", "comment": "Malware payload (PureLogsStealer)", "value": "1822eb6e77de39490f52e4e44a882e77c2fa0747f191e0da88072715b0ff3b889d1951953c13b9176e6a5c5c1cdcf3cd", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236025, "uuid": "4f4e8b8e-552a-40c5-9316-275715ee6c60", "value": "T1E515F17159605CDE8BA3022332A7C408357F57C645646AAED723C8988D2E2AF53F36FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236025, "uuid": "8449ca84-709b-4faa-9e02-47589f955a26", "value": "24576:oxMT9d3eAenNOwxJp0lDNY0/MOfJIAZ/mUW/JOO3o:oxMWAIR4psYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236025, "uuid": "13adb7a7-f644-45a6-9c31-c06b999c9e35", "value": 931021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236025, "uuid": "56b0b377-590d-4901-86cf-69042a69a206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236025, "uuid": "14817d56-c187-41b4-9969-a93eeeb5f65b", "value": "FULL APPOINTMENT LETTER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c2fe5a-b915-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762216314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216314, "uuid": "978a1b06-0abe-47c2-9ee9-2263b171ccb0", "comment": "Malware payload (Mirai)", "value": "dce220aff80e155d137bf69530b2fef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216314, "uuid": "6fde636b-027f-452a-b784-19e7c76f1626", "comment": "Malware payload (Mirai)", "value": "adf2047a918b4e69339388ec5fe47774a827253ca26ddfa16d793e87c894fd31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216314, "uuid": "ea35db5f-2109-49c4-ae8f-ea27666da6d1", "comment": "Malware payload (Mirai)", "value": "fbe1363013841aba8bc1266beebb4f181afff9e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216314, "uuid": "4725e13c-ee1f-40c7-981f-c1192c63dd01", "comment": "Malware payload (Mirai)", "value": "25237dac83a8bc87a01254713ea569a6f0ebce5765f3ff8df1b9e944777bef5349aa7a6c19477c491f9e4ff1a6b306be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216314, "uuid": "87545dd7-bf88-4804-bf64-70b4a4b601b9", "value": "T17A23F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216314, "uuid": "1f87ba4f-e49c-4f1d-8c17-73f2aaed9a37", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9TH6:5DmKF7Gxyk8cqoHAmWurAufsG5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762216314, "uuid": "e8315632-3307-4e38-9d64-e9c7c7f5c1ea", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762216314, "uuid": "6edec458-a6f1-448f-9e4e-cd8602063713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216314, "uuid": "9cd03c5e-f2ee-43a5-a4df-555e94a6b829", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65648866-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762244546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244546, "uuid": "4bf547ab-1d16-4ad3-87e5-1ece1024c67a", "comment": "Malware payload (Mirai)", "value": "3e55edc93c469948b51074f37049e730", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244546, "uuid": "08c99009-ffca-41f7-b3ef-053c1bef33e2", "comment": "Malware payload (Mirai)", "value": "ae0be54022693b19fbbcc9d7b05e443aceb6903d827754671a36247814e57b40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244546, "uuid": "0c0bf0e9-671d-4b92-8964-e07d15bc364b", "comment": "Malware payload (Mirai)", "value": "038390671e36323b18974c0df4a85361ddf31a78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244546, "uuid": "f3466297-9a6b-47cb-9a9e-1c3faba04498", "comment": "Malware payload (Mirai)", "value": "19e2679044db282aa9169847795de92f2878437f6687522a1690a903dcee11c5c65ed6917793e19f835bb588a0570c69", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244546, "uuid": "d51d1686-c19a-4130-ba7f-829315f876ab", "value": "T1B3D012673C5A211D8824AC010C93CBAF388286818E202F0E2CF50333EF0EE08FC00F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244546, "uuid": "0ca179f9-4d47-4189-b1b6-30e5c6ccc99c", "value": "3:LVDNwWMA4KMTmtCWMA4KMHxWMA4KMQNUCWMA4wvSXD1DV7GBzSEyLTUWVXRISA4v:LVD0KMT9KMHxKMWzwKXD1DkIU8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244546, "uuid": "8a1ec474-0b4b-4feb-aaa8-f04ae5f9f856", "value": 209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244546, "uuid": "72823d45-2552-46bd-a7b2-60040d5e45df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244546, "uuid": "877094d0-5285-49ea-b250-a3931b5aec91", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e2f2f0-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1762245399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245399, "uuid": "633bbccc-ca28-4bfb-bc81-b049255ff98f", "comment": "Malware payload (NanoCore)", "value": "3b2912f65c5e8b2cf7d2cce072de7849", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245399, "uuid": "5b548297-754e-45ee-b494-4928c3ffed00", "comment": "Malware payload (NanoCore)", "value": "af1212b5cfb2645f2271b0210c3da1153d868f5ade7c76d2b9703b534dc5db21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245399, "uuid": "594404d2-523c-4f62-ab98-a9fd97411e21", "comment": "Malware payload (NanoCore)", "value": "932d4827cade16249f1115daf53423a166db21fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245399, "uuid": "9db1e145-cf78-4379-b377-4e55e71e2e25", "comment": "Malware payload (NanoCore)", "value": "56e2c0c6899fc3eaa7f5e21d8b06ad1ca61c319326e32d7c45b337e435e4f2f2d3f74d7ab789d029977a1a33af19c965", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245399, "uuid": "68ba95bf-61ff-4cc1-a6e2-7b01f1f5b69b", "value": "T14B53248D3ED6BCA1536595733F1FB15AF1BB2C41788D8444CAF8AC64F918348E8F2568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245399, "uuid": "8971fa2e-7650-4eae-9381-7e6575d642ff", "value": "768:UNE81ar+Pd04eoRulTLRWZ71pI5fDmwMSmrtEO6KoJ2J:UNh8r+Pd04eoRQoI7SSotEOvo8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245399, "uuid": "47f9303b-fc55-486b-bc98-7f385729a399", "value": 65208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245399, "uuid": "227498e3-1156-4a19-b264-3dd9be730c67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245399, "uuid": "882f0679-ac15-4696-9913-ded834db0975", "value": "Purchase Order_(P.O_N7584391)_KRONOSPAN APS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3229f9-b912-11f0-91c6-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1762215115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762215115, "uuid": "492a976a-9326-4643-a35d-f3f4667f2420", "comment": "Malware payload (BlankGrabber)", "value": "b11db711c9a4a6f3963a7ddb287447bd", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762215115, "uuid": "e14b9a0a-cbd1-4488-8c62-0d19bd309f1f", "comment": "Malware payload (BlankGrabber)", "value": "af6bf948f60c71a363077305c18aed511886c05279da196412404c1f55b57dfa", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762215115, "uuid": "7764161f-a650-42e9-8cad-793cc176f4cf", "comment": "Malware payload (BlankGrabber)", "value": "94999c58d8a19e8794ba953cc3954f126d966e0d", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762215115, "uuid": "2bf338ce-abb7-452d-9b75-04e626aeb975", "comment": "Malware payload (BlankGrabber)", "value": "403642a335a49ae62f5b9f2b5356c47f8c4e6724da3b05e63e99ecab0caf33b597fce728371141d2673c271ad6a39c68", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762215115, "uuid": "9fb34aaa-afe1-434e-9712-10b77963f5a9", "value": "T12DF7337D25860C51DBA54A7DD2132E75CD201A6F3A29CE03A60CB176BF1A5E4BF6EC30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762215115, "uuid": "82892319-66c4-4dcd-9e46-fe0fb7cf5a07", "value": "94e7aea3d2e237d4bb8f35712a6425f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762215115, "uuid": "33931d5b-875f-483f-91db-f94cca330cd6", "value": "1572864:yAU9RBLD8HY9wyvrU5NgENwUYBCiFmbc0pQ0s9OYDoWDK:tU9LZ9frU3gENw9COmFQ0s9fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762215115, "uuid": "b20aff14-22d8-4f6c-b7d1-3fe8e9f753e8", "value": 71186432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762215115, "uuid": "937f74af-67a9-4deb-b1ad-7d38afeabde8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762215115, "uuid": "1a150962-e706-4103-97a9-0cb2270d22d8", "value": "keylogger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5058829f-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245369, "uuid": "df8b3f6e-6460-4495-8a62-b738c898969c", "comment": "Malware payload", "value": "f3d2cbde3e3955b81101a4c990a9744a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245369, "uuid": "36342aa8-c869-4c9b-8957-21e9da0a9c58", "comment": "Malware payload", "value": "b04680509189a332d4767cc970ce67daec60742e174fdf6d72ede770afee640e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245369, "uuid": "ad90a3f9-470c-42b6-a8fc-9d565ac8489e", "comment": "Malware payload", "value": "f09635d5382b3e4f505cf6f11d1c2e705aa13f38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245369, "uuid": "e2e1efd7-70d0-4f39-b9d7-584b5fa51ffa", "comment": "Malware payload", "value": "dd37a9615c5ca6ac5e146bb672ec9f3e4df170ee08c884871148fe6f96dff07e478bc393416aa98252da1d7cac49e083", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245369, "uuid": "228a07ff-d9a4-47b5-bd0a-a94f24adce5f", "value": "T1E243108F3ED2F46252A865333D2FB059F1AB2C81B45C8405CBAEA5B4FB1471ADCF2525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245369, "uuid": "0f050d94-18c2-46a5-84b8-472c7609b6c6", "value": "768:8+ZpHY3ds9E/ebxWskLsmZ4UMEk+omnoHdXgBwCsr64YaMlCgJpFZUY03WwsXfl:8+DY9/FskLsmZ4BAodCCPclC6FOP3LUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245369, "uuid": "0118a6a5-7a15-482a-a7b0-871095cd2c01", "value": 60244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245369, "uuid": "43e72e04-7d07-4345-873d-a14f2c38c75e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245369, "uuid": "ad4740be-5ea8-408e-ad5a-cc964cfd281b", "value": "obfuscated (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f14716-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload (ClayRAT)", "timestamp": 1762239767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239767, "uuid": "8664f98d-9829-49a8-b03c-6ddd550f0f53", "comment": "Malware payload (ClayRAT)", "value": "edd210ea2a528e66c11cbd093af36e65", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239767, "uuid": "df41cc1a-e3e3-4d58-9681-145384e64671", "comment": "Malware payload (ClayRAT)", "value": "b08e5a842cd24d955a00a060d9d58cbc4297ac4d10a98958ac8e88f79018ce86", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239767, "uuid": "bc43eb7b-9440-4df3-8173-a72f57b9d4e2", "comment": "Malware payload (ClayRAT)", "value": "cd95e1a75c1558225462604dc3cadf13ec56c7ed", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239767, "uuid": "4400c89b-e32d-4a89-986e-b53516af45dc", "comment": "Malware payload (ClayRAT)", "value": "5d99f6451460eafa7cdb16519e5a9db79675d76c73a6954ff8fe2e1b89f0381828e423e670c6eb2e54bf135f490abdd9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239767, "uuid": "01e721f2-ff86-4e16-b42b-a0c6eb26fe05", "value": "T11D460192F309A47EC4FB673A057A22A00173DE268F8396876968723C68B75CC5F15FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239767, "uuid": "fd5f71ca-f564-41c7-a0c6-246acc665fbf", "value": "98304:rtdsAomGb0u2FXjWygXkd84BbsVgiozvR9xfgm773nh:rfsARGb8iygXkdnBbsVgDvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239767, "uuid": "81b140ae-5b9f-473c-90e1-e13dfaed65d8", "value": 5552819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239767, "uuid": "37a38fa4-e31c-4572-988f-c7f119330753", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239767, "uuid": "565f5366-296f-4d7c-b0b9-d13ebbbc1085", "value": "YoutubeUltra.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59a715e-b9c9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762293616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762293616, "uuid": "f192a814-ff93-42ca-b0b4-53f1d78d89c9", "comment": "Malware payload", "value": "828bdba268d65de5b154ed14caa5ad8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762293616, "uuid": "3e83d26b-3f1b-4f36-a8f9-c89ae5df90fd", "comment": "Malware payload", "value": "b0ade668aef88619166dd49e3b5529dbe2e9f983b599e1d8488113a560dda23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762293616, "uuid": "e5b9403f-be6f-4cee-a1a0-4659785700a9", "comment": "Malware payload", "value": "42d552db687411023d8e7c60ed1d8a101782ac9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762293616, "uuid": "5b2de59b-f0cc-48ac-9f92-caf8fdb68b74", "comment": "Malware payload", "value": "6d09f5d624dd2d9e1373eb9285954857add6f3ac2144e3b38cb766615487a2c32717fcd48292f7c013f81f1dc4d454af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762293616, "uuid": "48958499-0c2b-4219-a8f9-45cfe0392e08", "value": "T1A8569D69BABC00E9D86AC1B9C2865223E771B45517B05BCF1A6497F60F33AE01F7E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762293616, "uuid": "c63ea923-ba4c-442b-90d3-586d960e84b7", "value": "5909f64e406160f1fa7b0182aa73bba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762293616, "uuid": "d3a69156-206b-4554-ae1b-813c74f1f68a", "value": "49152:Z4T9/tMc8rTgYGtlqmVwASOgq3Gw1aLPGME46P5koUSrbd4godo/+t0s9IL2/6ax:GTPFWcaiM+kOCS1s9IljX+oyh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762293616, "uuid": "91bd014e-b477-4558-be98-fbd6f223d671", "value": 6122024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762293616, "uuid": "79aefe52-8ecc-4771-a722-c5e31aa4978d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762293616, "uuid": "e945df5d-3de7-44d1-b59c-5f1df1b0ec47", "value": "carrierRegistration.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16791361-b98c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267177, "uuid": "7ba17719-b68c-42f5-acff-23ab322d6791", "comment": "Malware payload", "value": "d51be91da598b5fe7f7d7be71056014f", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267177, "uuid": "3d4567f2-e7d8-4326-b895-4b831f7e1e49", "comment": "Malware payload", "value": "b0c019378317bd23a931b35d688d541098f1b5136e1e5c2c5387594f71ab7e46", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267177, "uuid": "ba226283-1f93-4904-985b-77d012733d74", "comment": "Malware payload", "value": "e15f8be498fa6c9ba3035099d67cfcb9012282c9", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267177, "uuid": "1c0d97f4-539f-4beb-9497-9d776777d069", "comment": "Malware payload", "value": "e6cad6000ba3fe3bced7dddc52db7b1063b1d1bcec36cfabd93c10fad5b3e41479656d80764b7da7f5bb2f0222642f99", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267177, "uuid": "4a020a64-358d-46b8-88fc-8686381bfac3", "value": "T1FEC733089F294FE3D539667356A9E71B69FDCF1B24C3C3871362E14529BA3AE8C75200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267177, "uuid": "ef9f85e9-1e1a-453b-8c89-e712de69804d", "value": "1572864:NekK8zYe/et5cf07jOjW7bV6U0OdgitGhriJ+P/ul0Tdb:NFKz+eTO07uiJ10HsGxO+PgA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267177, "uuid": "86d5b9a0-3682-48b6-8931-747f199e6afd", "value": 55203277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267177, "uuid": "bcff9e81-5c23-43e6-87dc-4f5ebe7a25ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267177, "uuid": "66ac1ce1-0ce2-4ef4-939c-d394866cda3d", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a2864a-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762245320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245320, "uuid": "82d4e67c-4ec6-44a3-a7b0-66b0d2b4d928", "comment": "Malware payload (Formbook)", "value": "805cbe214f9d9837e1109c293e7b884e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245320, "uuid": "b71cd16d-a801-42ef-b4c4-9f44eea6bedb", "comment": "Malware payload (Formbook)", "value": "b21a42faafd80644f0da8bb268843b2294f3bc81793b69878b9274a2a6f16bab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245320, "uuid": "a9afdfd1-6500-4e0f-a379-428f37f202b6", "comment": "Malware payload (Formbook)", "value": "8de0a17b00528a52a20aeed83d92d4d8edc0f67c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245320, "uuid": "f50bb5d7-ad9e-4bac-81a7-825eddfc404c", "comment": "Malware payload (Formbook)", "value": "3b46e5063ac76410d69b16dab277f1e833fec7462ef7e77f2ad72a8688e73462e92a5aa28b52c4ca44cb1f9f0b54caf3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245320, "uuid": "7356bd65-975f-4e22-b08e-dbc3df88312e", "value": "T1773453142BC07490139B1B7A7B1FB9E9E9AF08DD72884907C295FC90B4B5B07F9E1639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245320, "uuid": "f718462c-3a88-4f24-a6bb-8b40d17b171e", "value": "3072:MnCUrnUZn98fJGmUSv6qCkH3Bgh761Q4gv5o3R:87on98fJlUSFHRgzv5o3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245320, "uuid": "4142dbe8-0e4e-4b3b-9798-f6092ba91b9d", "value": 232909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245320, "uuid": "80d97a47-e32c-453d-941b-0815a65a340f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245320, "uuid": "e859d0f3-f2ac-49aa-b4b9-95048556cbc3", "value": "vbnplugzxc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1242035c-b976-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762257721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257721, "uuid": "57e8a3ba-6d72-41a2-9612-6dddb06cfb21", "comment": "Malware payload (Formbook)", "value": "113c281ab3d803c8edfb136aa6b756a1", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257721, "uuid": "04251d75-ae7d-499b-87c1-80a5241b9428", "comment": "Malware payload (Formbook)", "value": "b2f0a036e60d52bc0646b435eaaf139f0cc4cc6757637e1ceebdc0eb9590eb71", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257721, "uuid": "9528220d-784b-4992-868f-4154b7028abe", "comment": "Malware payload (Formbook)", "value": "5ee588537a7752aeb3868c005ea2e9f9aa1f95fa", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257721, "uuid": "fe65249f-491a-4c01-9ce6-d916179d1673", "comment": "Malware payload (Formbook)", "value": "5688c183cc82f72c0c2a21c9fe744adf5e06f800b079de2437ff5b17700afdd58be7cd265e5a81019dfc9b8b0d8aed19", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257721, "uuid": "8d2592ef-bba3-4170-8455-59b652c82e2f", "value": "T11A6533105E64BD7DDE2CC42C247FDF0C8B61ADE4D149B9BA72E462C7176E7862E03225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257721, "uuid": "7721a9a1-5fbc-4fdd-9289-ec0691d80127", "value": "24576:vKNROrjl0qt7tM4w7HRfmM6PKn81N7XN4iaW2MwOmEoaBEbap:iCnOqrMbmdp1FPKaB6ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257721, "uuid": "5a2ac07f-b386-4577-8690-1a2bb78e0030", "value": 1439091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257721, "uuid": "171c830e-8e89-49fa-99d6-807ac098c2b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257721, "uuid": "e91a90dd-17a0-4fed-bf98-a098488984f6", "value": "sirrrrdeee.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e97a180-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.IObit)", "timestamp": 1762268479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268479, "uuid": "d2f4cd83-c341-4400-9902-dd5dc47411b7", "comment": "Malware payload (Adware.IObit)", "value": "7c816420c607b7a91d2cd31d0537b78f", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268479, "uuid": "58ace47f-4d78-4de3-80a2-d2a4650c5bdb", "comment": "Malware payload (Adware.IObit)", "value": "b2ff65464943d289c66fa22abc2285c166893e3a087a6c4eae3b521bce0aaaf9", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268479, "uuid": "3b84bfc3-06ae-4d88-8fe3-c4ce0d0d4a0b", "comment": "Malware payload (Adware.IObit)", "value": "a5fcfc306b282dd13a9aa0b2508e20e67b56547f", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268479, "uuid": "b163f393-27c7-42bb-a099-bbf7d61949da", "comment": "Malware payload (Adware.IObit)", "value": "ba3d9eb3625ae211de967e71c3d0b591900a3bc47ec0d3eef660259d62542f2fe3275660132bf43f18eaac7ce937de68", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268479, "uuid": "c64973d6-e3c8-4ddf-ae4c-080ea9590765", "value": "T1D9B73321EE1BBB7EC30D27BAD261946030D2E716882EDA214491927F04167EC7DDF6F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268479, "uuid": "e2a35f5a-b6d9-4719-87dc-5fb3b06f31e4", "value": "1572864:LNFiNZQpqdpuT8YNbQtb55yPVHbfPkQQE5XnZ5TR/1nlk:LNFiNZQpqjKRQn5yPVHbP0qjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268479, "uuid": "cc663460-d432-48c8-9811-c0b6ef60a3a1", "value": 52009043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268479, "uuid": "db63a9b8-8a2a-479d-b54f-8b43b25cf7e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268479, "uuid": "e48d20e3-319b-4327-bfec-400a1f4c09c3", "value": "Full_version_repack.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0037f7c-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245503, "uuid": "ec71bd24-4ddf-45e4-8d9d-37fdeb856883", "comment": "Malware payload", "value": "140a039d653e5a3bd94988a20f00f8d0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245503, "uuid": "ed7dd717-84df-4a13-adfc-f22604905b1b", "comment": "Malware payload", "value": "b3251890b0d18af019e5fb67d15b76e70305bb4c9672ea600603248608f63e93", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245503, "uuid": "c833d207-6b28-440c-a4a6-df19bb4a361e", "comment": "Malware payload", "value": "cb812370d04ce1a6238c84ab25a2dde940b85fa2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245503, "uuid": "ac986e65-85ea-454a-bc6d-d90a0667f3a0", "comment": "Malware payload", "value": "1d0ab866f8db1224ebba44d7092ff09cfb489ef9cc402eb06cc54caba643099249721ede1c4258676253b469ed26c49f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245503, "uuid": "6e79a3e1-fc51-4e87-acb7-2e620ff8fa45", "value": "T1D536237216952C7B0AA14715F01F3773AD7E98AB854CD1B9B8CDA14B30CBAD6483F8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245503, "uuid": "25f253d4-9735-4a38-98ee-a27e300cabdd", "value": "49152:AAd646HUCjW66vFpIEVHeaFLH2iVrG0+PKoVYlELbeCMJcZ6YBNVgNoe:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245503, "uuid": "829026b9-4fb2-4cb5-8670-9cb86f5a3258", "value": 5312671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245503, "uuid": "05fbf302-0605-4c2a-b840-2cf0482cac97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245503, "uuid": "a12b2ec8-a82e-4fee-baff-55a9c2fafce0", "value": "63077Ob-ser-var0625971VKV181803.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22554553-b958-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244863, "uuid": "a45b1042-dd02-4d25-ae9c-313d6cd651d0", "comment": "Malware payload", "value": "a2dbafb05ce0ddef00d0b59a31a96f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244863, "uuid": "b98f50fd-a5fd-487c-b355-2d914522011c", "comment": "Malware payload", "value": "b3b7309ec47de072de8cdf3b50f28eaa0544dcd7e2e572dd5567b5738834d570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244863, "uuid": "58ec9293-1efc-4453-8dde-02d88dee1d4b", "comment": "Malware payload", "value": "8ea8cc9f4ce9d72346d95024e9458504a8dc8b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244863, "uuid": "89c6c281-067f-468b-8a54-ffcdd22ca9de", "comment": "Malware payload", "value": "6f22fecf87f2b4a87caf99828224cee40664ed6101c9171481366b3c9dadfe4e3f02d1d337fe696049b865b4ac168bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244863, "uuid": "0999d7e3-d4d3-41eb-9bd9-b10ba006541a", "value": "T12D0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244863, "uuid": "5f0fd7a2-63b5-4e26-a97d-efcb952a3840", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244863, "uuid": "e875b13d-709b-447d-9cb1-86947e69cd88", "value": "98304:aMT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:f2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244863, "uuid": "f78edd00-239a-44a3-8ecb-6c82d11f130e", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244863, "uuid": "58adcced-f4f2-4879-820c-e22cdea77a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244863, "uuid": "90b7e59a-50d4-44a3-8410-8f4387959122", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337d8987-b9a9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762279681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279681, "uuid": "483701a7-eb24-4800-bd44-647d20d63b20", "comment": "Malware payload (Mirai)", "value": "8d02cbc3cf4c827977e5d16c1a1dc371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279681, "uuid": "efc75ace-05cb-4180-b259-913c4a624ecc", "comment": "Malware payload (Mirai)", "value": "b3bbbfffab55229f410b534b179c5802baf3921c28e9e897972a02712c8d7bb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279681, "uuid": "15c67a1a-6ca4-477e-b991-3dbe5028798d", "comment": "Malware payload (Mirai)", "value": "a7c78fe239e5f09e7b5c44b1b21b3a8977d2475e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279681, "uuid": "a9f9c39c-c468-42bc-8912-669d65d4ac54", "comment": "Malware payload (Mirai)", "value": "94ec991681b272d216a1891e41a8198080929d3c53d11e621f4cbb65a520e06f245027425d395c89a908dbc32da1f7e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279681, "uuid": "140927b4-be9c-4d53-8ebb-e580843d5583", "value": "T18D03F1B759C9EC40C48FA37547EF705BF9C06A56174B3982AC8041BA8A62FFA703C5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279681, "uuid": "2a8ba8b5-e055-41fa-bc15-56e5565e79b8", "value": "768:BSAgxLL8yuavee+AhcE/HaiNHKDwaXbAxtS2ClD3qczW5nKsxAnbcuyD7UHQRjz:BTgF8Davu4eiejXkxtS9h3ZkKqAnouyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762279681, "uuid": "d97902e9-c6e4-4d40-84cd-f571df716ee4", "value": 39280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762279681, "uuid": "67d8aaf6-cc30-4267-b9e7-f5a8e4f50ac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279681, "uuid": "339dcc94-1091-44a1-99af-34842868bb5f", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ff85a2-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245303, "uuid": "24a0c03e-cb0a-46fc-bb60-c9aa74193f1d", "comment": "Malware payload (RemcosRAT)", "value": "32d8b4ea3a6a8d6ffe6d5d369971f8f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245303, "uuid": "3bb337b9-5df3-4505-8385-cee8fa99124b", "comment": "Malware payload (RemcosRAT)", "value": "b3f80c2f408c3e6911fc950ddcf1d9e33a45c356f9354390d62de2969b33072b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245303, "uuid": "2fa3c545-ca81-4cc6-9105-692b824d31ce", "comment": "Malware payload (RemcosRAT)", "value": "fbb90d4ff0f404a37e86a4d9f755a782decc525d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245303, "uuid": "e906e469-172c-4662-94a9-5f4f7073542c", "comment": "Malware payload (RemcosRAT)", "value": "b737f5d2952ea65f3b05a2e8deb1941a18c28bb8bdcdb883dafb8a44b3c087ee970af24302c5c22c74c05a2245e28b20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245303, "uuid": "272bc158-a65c-4a8d-99f8-060ce8db44f4", "value": "T17A05CF15B9FAC15D691251E3241090C3B80A1CBBEF98B527358859B4BFEC9FF198C2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245303, "uuid": "d51cb232-e254-437d-8e84-a5db79611d31", "value": "12288:HgzkYvWGyQRkd2KuZcgk8JOs0w6BAT29YXJ3lMxYzZd4vbyYeNWA:HQOXQRkQigkgP6sMYXJVMymbxe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245303, "uuid": "d3ef25e8-c32f-4ae8-8ca9-494833d20216", "value": 806814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245303, "uuid": "a59838af-529c-4d60-b17f-e74ade9051d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245303, "uuid": "0a752438-6e41-4d92-aaaa-242b295f9281", "value": "Items_17621.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cedf4d-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762248971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248971, "uuid": "54bc7482-9d2e-432d-9975-3a95c9c00475", "comment": "Malware payload (PhantomStealer)", "value": "501929609f98b1c49eeade7ce6443247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248971, "uuid": "a485faae-297b-4284-8871-36ad780603c8", "comment": "Malware payload (PhantomStealer)", "value": "b424b9efdda544aedf50f9e9e20eb75e994196487cdc9458a73a628489c3dae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248971, "uuid": "a4dbc0a5-ef9e-4b45-b12b-83ad51518b03", "comment": "Malware payload (PhantomStealer)", "value": "1d4859c12fb9f60362f8123ff070d8fe22c7c0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248971, "uuid": "26178227-6dcc-4050-a461-d8c958c9d426", "comment": "Malware payload (PhantomStealer)", "value": "cf9a36b66076db1f4c28ff173c9934f4d267b991acb028950d26da2c9b6613b3c48344f8217cb74cd3100671c3d00382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248971, "uuid": "f0882f90-e7fd-42cb-848a-81958f21aee4", "value": "T17B45CF2930EF1156C476E7E30FEFFCB6967EF175222EB53A24A3168687A0D019D92035", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248971, "uuid": "3ffe41db-57aa-4d91-a071-e325c73fee07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248971, "uuid": "059b0cc7-03e8-42b8-bd5b-f25f60968942", "value": "24576:0u2cpRIbOaGDGh/DIZp4SNoLIM61bxl7XtE2h:0uXpRISaGDMmpNe6/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762248971, "uuid": "0e4ee893-69f5-40ba-be56-1d4d7194ee53", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762248971, "uuid": "ea508439-c90b-467b-93a9-8aebbfa48bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248971, "uuid": "84ba0ea4-a088-4462-be19-8f5a95aa21a2", "value": "2266695701_11032025_INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb348f3-b9d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297681, "uuid": "2e97fc50-1787-47f5-a392-1178bbf6b9cb", "comment": "Malware payload (Mirai)", "value": "99343ee45aef444ed9dba0a4e45e23ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297681, "uuid": "a6ec1613-6eaf-487b-a138-b84ea5b10aef", "comment": "Malware payload (Mirai)", "value": "b4930825eeb69b2c4564c2935ff25fe57916e06594c1741e01283f341bf9ea97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297681, "uuid": "fdbc3a2f-3449-43b9-8018-6ad877b2fd26", "comment": "Malware payload (Mirai)", "value": "849c0c6609d801836d6d4b96979b63a9038cf15e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297681, "uuid": "c12305ca-8a44-49f6-a063-a20fa5136ee7", "comment": "Malware payload (Mirai)", "value": "01b3f7fb2137c354763340749e87c015f993ff5574794676a26726f65bfb62b688a3d47915bd933099d542e980e8f7b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297681, "uuid": "452a27d1-afe9-4bfe-8d3e-97bc35c43089", "value": "T1D0B3C609BF611EF7E86FCC3709E91B0528CC692A21B93B75B534D518F24A64F1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297681, "uuid": "36a3d83b-6fc6-4be9-910a-2d96ed399c44", "value": "1536:oKHGTVO/dXfCAbQ4494MlAswt1jUj9mlwNiZ52jDuANF7e1BGYggbkR:oKiedXfCAb04aIlwNi6fbEDbkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297681, "uuid": "a2c25950-46e2-4555-99c7-59d1e280068f", "value": 113856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297681, "uuid": "11941d90-4f43-421f-b9dc-bff2042edc7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297681, "uuid": "3102ee89-79bc-4793-b0d9-b47896b1a777", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b7b2aa-b94c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762239795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239795, "uuid": "5fd05a2c-b37c-4b6e-97fb-56808ae48b1f", "comment": "Malware payload", "value": "91130d31d4a2f4a407eb3afa18cf1f4a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239795, "uuid": "c2519c1b-dd3c-4ca4-ba28-32e338ea9f95", "comment": "Malware payload", "value": "b68049d3c350a64e7ad5fcce97934c76e930b0b2f9311168cf75f48101c4cb3e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239795, "uuid": "2ee513fa-ab74-4ae7-a728-b9be6d860c28", "comment": "Malware payload", "value": "b64eea7a10cced8cc9cb9e31211d502a5779f688", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762239795, "uuid": "b1dccad0-0029-4ac2-b9a1-9dae55e1f160", "comment": "Malware payload", "value": "adf252ee5fce29019e8eb96b5682d5d93f3d3a812c534c89dec2b5bf48a2b2459bd72d34ab8dc95c71888b8608a29e7d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239795, "uuid": "74252f03-f2a9-4252-989c-296028fb29c9", "value": "T19446F1C7F7D8A92FC877507289BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239795, "uuid": "15a356a2-22a9-45b1-89dd-11eaf3927058", "value": "98304:XWPg3oTwrYhKAfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClth:mY4KAfyaIbaciAFvrEZpXqmY9XrF/mpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762239795, "uuid": "6e8c71af-f10a-4454-a1d2-91b0e9a1748c", "value": 5863803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762239795, "uuid": "fdd5fe6d-fd1c-4fa3-b9eb-c7150e744088", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762239795, "uuid": "9db18238-bf23-4501-bee4-09fc6db68a30", "value": "storybet138v3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d3008c-b916-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762216513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216513, "uuid": "b99ce527-ab39-4984-95c1-d4646036895d", "comment": "Malware payload (Mirai)", "value": "7dcd74a6a5df9dab1e48342b00861a30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216513, "uuid": "b06e5e76-2e6c-4a86-8704-a0625710b050", "comment": "Malware payload (Mirai)", "value": "b6b77e2e3baa99c58e579018eebc091362728e80c44af318b08c1986328a619b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216513, "uuid": "7af319ff-912e-4bb2-ac1d-3a3daeed7011", "comment": "Malware payload (Mirai)", "value": "574bd5c478810b5f5967194f5b05069ed407fd67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216513, "uuid": "4ddbd651-1fe4-4585-a2e6-9a42e928c543", "comment": "Malware payload (Mirai)", "value": "689f41e74975655fd997c3ed8ac930615ee1642759e226b5e73d429c075df46cc6d8a5af2f474ce72239c8519ae00daa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216513, "uuid": "b0989bd6-e527-4207-b3aa-be36f047d57a", "value": "T169733A2179360D27C5C5A8BA21F34769F2F1538A36ECCA1E7D620D4EBF24650318BAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216513, "uuid": "ece844a5-6c8d-434f-b960-0899a79544c3", "value": "1536:rvOjBeODybIugD2E/YnUOSZ1Get3T/ct5MbWKtc9yO4:Dxsy3W2pSielT/c/FSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762216513, "uuid": "6c0a1081-ba24-451b-aed1-af3e681e1e3e", "value": 77532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762216513, "uuid": "69845f3e-7f7b-4f04-81f9-ed169969c6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216513, "uuid": "80351c63-a4c3-4532-984e-a618118895f6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a57a11-b975-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762257429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257429, "uuid": "29aee7d9-b930-4cf1-b4d5-41b7b77efa77", "comment": "Malware payload (XWorm)", "value": "fad02e5fa2a678351b553871e6b416cb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257429, "uuid": "e0691345-52db-446a-9459-42a398daff3d", "comment": "Malware payload (XWorm)", "value": "b7e93b89a32f2b7ed23d4e053791bd79ca4a3ad0b864797eb575ced88da59f8e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257429, "uuid": "2aaaf74a-1a97-405b-bb49-7a3e3b2679c0", "comment": "Malware payload (XWorm)", "value": "eb9c7682b89f40435618da827bac9900f8854b4f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257429, "uuid": "ae7ece54-1d5a-4513-9341-bbda30a86460", "comment": "Malware payload (XWorm)", "value": "41417cabc6df79c5f85164173e55b658ddbf6eb14bf231bdb2c946556fc7f0058ff5e31810fac5ccb8ed9a5441e6b5ec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257429, "uuid": "63942fe8-1967-45bd-87e3-6821d1e86da7", "value": "T10ED3A36B89E3BCBC327B6DB056FB3B057058CA226D70771F9D9C44AA0D16D58BB21708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257429, "uuid": "bef33b12-b719-44e6-9739-f2856ee44c98", "value": "3072:fhXll53Hxh4N1O5hIo4GBYLUTP2NqxRToMMKQuDPNAP92E/PadrY:1JSUTeNqxRTog4ad8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257429, "uuid": "29d7ea3f-479d-4127-8dee-5f41e774da05", "value": 131228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257429, "uuid": "0f6cf16f-3356-4de9-acde-fba8845984b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257429, "uuid": "82cdf216-be62-4f4e-9ce5-50c27a6ce0c6", "value": "Invoice_Challan.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038652ef-b965-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1762250395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250395, "uuid": "d3c5f3e0-7235-46a3-88ef-11e8b6f05401", "comment": "Malware payload (Arechclient2)", "value": "810f9aa0fb150c3ba40ac9ca1f230bbd", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250395, "uuid": "7e1adcad-6a99-44a1-9f19-484ca4786023", "comment": "Malware payload (Arechclient2)", "value": "b87486cee93b1cbd182a90c43723af829a784810ef79ba738949d90a0c3a8c57", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250395, "uuid": "69baf945-8d97-4bfd-a37d-c0fccf67700d", "comment": "Malware payload (Arechclient2)", "value": "f06ffb0c80393f5de51655c967c813c3edcef97b", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250395, "uuid": "f1ee0448-72ea-485a-8dbe-65b39dd4ea3a", "comment": "Malware payload (Arechclient2)", "value": "381644f9d2a460854425c94612ffea2ce142f34b2f95f01d632d764bebac66fd1e6e7dcb284dfca83d5d97cdc2b65cff", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250395, "uuid": "36025168-4c5e-4232-95d4-573f8fb608a6", "value": "T101055A7D764B9E32FEE9777881FF6C1892A022A75091658A1D8C98D81FC137EC74CAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250395, "uuid": "0f8a3790-8973-4d49-8db5-4957f4e3c759", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250395, "uuid": "ab098d1c-6522-43c1-b604-e95b6060632d", "value": "12288:owm3kTcm4u06WpKA5wi3shv6U7hqn8oPM4mLjVDbzEpiL7Xf9pLJl:Fm3k4m4u0tpO4Y5h9o04mLjBv3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762250395, "uuid": "46af2955-7d08-4639-8eb2-8303e0fca349", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762250395, "uuid": "2175bb0f-64c4-4ecd-aa59-1a99d8163cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250395, "uuid": "c413ca80-9a7f-4661-bfca-632699b1e1dd", "value": "b87486cee93b1cbd182a90c43723af829a784810ef79ba738949d90a0c3a8c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b6577d-b976-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762257701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257701, "uuid": "35108fc5-03ab-4b7d-bc10-bad7f9015536", "comment": "Malware payload", "value": "2b7543640d74a5a8bcc7399d8f8454f8", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257701, "uuid": "1b1c04e5-7500-40e0-98ad-5add783ad236", "comment": "Malware payload", "value": "b943774f76d17c86097b22aea84201788037eaeeef222c8a647fe98e795cf8af", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257701, "uuid": "92400e05-97cd-4ff8-ab6a-1fca1f793966", "comment": "Malware payload", "value": "176f478b9487c763af78d9b8b161b50f67210395", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257701, "uuid": "6e10e9b6-7182-4220-ad40-9adf186de6da", "comment": "Malware payload", "value": "7da92ac0109f6ca49e417d931852416885b81cf37039479916fdb7b9ac4fab233afec9f6b51021d0b67c41b3a0325022", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257701, "uuid": "52a23168-3e84-4f5f-a619-c342a0203e00", "value": "T18E33F1B1BE9AED20F520C1B29163BB7151A4FB07E3C73351413DDA3293C9B805A866E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257701, "uuid": "3011d3fc-bda9-4b97-8f82-ce96fec4d625", "value": "1536:tjlY6GGXjAbfeXIEjj64IsTgbtBbgfbA7:tjlXlcbfdE/aBBbR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257701, "uuid": "1332271d-ba98-4845-871b-e7722e88bbe9", "value": 51766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257701, "uuid": "9587982e-e26b-4b01-b8e7-bf872c856efc", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257701, "uuid": "dd88b394-f6a6-487c-acd0-43dcc975e4c5", "value": "RESOCONTO INSOLUTI al 31102025 - ATTENZIONE IBAN.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b4bc4e-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245378, "uuid": "a36c1914-1d67-4e70-a86b-3e3ba735b549", "comment": "Malware payload (RemcosRAT)", "value": "292d5c81ba308f0bee411dce497fb9a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245378, "uuid": "b8edd70d-619a-4dd6-9340-67579061feae", "comment": "Malware payload (RemcosRAT)", "value": "b970260bf264dbb9dd7aabe10af46d35af8f78930e0f676da450b16777ca9cd6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245378, "uuid": "553a828e-5b2c-4774-9509-f6fcf2595d6b", "comment": "Malware payload (RemcosRAT)", "value": "14084186f60868d969266a1ce3379270686f2917", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245378, "uuid": "cc7aaf07-5cc3-4b7f-b304-94f101189742", "comment": "Malware payload (RemcosRAT)", "value": "556ea185dc6cc49a53b25750d909797f87b54831d710a9b5b42aaf151bc3dc1ff884990142d9531e10d51e247e365f5e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245378, "uuid": "4bf9e2f2-9a69-40bb-bece-e6b046fea495", "value": "T1D21613B79276E038C63FE219AE95183BB9FC396A0D465B08384844D9DB67D3180F977C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245378, "uuid": "87869d59-3d4f-4921-9fed-8b1dfe185ecd", "value": "768:04zXa/tG8ds4MRdEfPU2plN2vE+Z9pJaF3jI4O6IqmPfTWpelnrL52NvUNEKE/Lv:7Laxs789+Z6ErWpWMNvOEr4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245378, "uuid": "db403921-f636-4e99-add6-5aed2f2addba", "value": 4147639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245378, "uuid": "7d16005f-e18f-448b-9bf7-6387d8578621", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245378, "uuid": "bc76d641-3009-4874-9e15-d46844a67c14", "value": "IMAGE_012456_0944.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a028cec7-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762248939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248939, "uuid": "1442aab8-c8b1-4635-b515-47cd7f6fd0dd", "comment": "Malware payload", "value": "adc67961636accdf0f6994abe9123e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248939, "uuid": "c5a6cd1f-3761-46dd-94be-27c0ff8f2d0d", "comment": "Malware payload", "value": "ba84ad6bb6c69bace91ce2f14b6c19cf16317032f9df23cddfda63c66dfdaf86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248939, "uuid": "e11b25e3-8341-4c81-9392-03db74ef42e7", "comment": "Malware payload", "value": "ffac766c002c77bbfd9ce4a24cee7b979597bc07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248939, "uuid": "00e7063d-9348-4198-877c-2808c56a490d", "comment": "Malware payload", "value": "44e48bdaf4e42819f4a7cde668157357c669eed297b918d57cb521c9cf3a8d136a17b127298119199ab6be84a4b5fc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248939, "uuid": "d573b01e-22a0-41cb-82e8-d7dbc24271b0", "value": "T1A6051C7E5962912ADA4E80FC35594B6249B1B73B03B41FF700669131270B9B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248939, "uuid": "9ecc8815-26bd-4ec1-8b0f-1843c525cbdf", "value": "12288:1IuHDkSQD8qjIGk6DTkFmdr/osQZqXLA/5P/SUHHqqhC0Gh9fa3MNSh1WmvzN:1nRQIqg6DTkFmeL/Mg+y3EuzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762248939, "uuid": "81212592-08b0-4890-9e56-b6fcb49c1893", "value": 803968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762248939, "uuid": "efde310d-1ad8-4807-9712-0beab07828a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248939, "uuid": "bcae1e92-065a-437f-80c9-dbe2164f9d5d", "value": "ba84ad6bb6c69bace91ce2f14b6c19cf16317032f9df23cddfda63c66dfdaf86.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c7a291-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261156, "uuid": "90bb5637-92e3-4321-b422-185fbd562ff5", "comment": "Malware payload (Mirai)", "value": "de234c5fca6668d7b843f16db8266cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261156, "uuid": "99db9482-9fb6-478a-9306-9860db91e6f7", "comment": "Malware payload (Mirai)", "value": "bb1f607d2b9f48ef6cd1032bdad92e8eb41441e594474ec6f8acce308b96aac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261156, "uuid": "ad153900-d142-4a20-8567-cfced7aae5d2", "comment": "Malware payload (Mirai)", "value": "c11cbe3df02e33271629a0fad1004f019bdfc8f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261156, "uuid": "acccfd89-f3c9-4327-bba5-474f1b1a14b9", "comment": "Malware payload (Mirai)", "value": "dc13d20f9aa1f6c1014856ccaed8bbd3a3ab6c43029b7af8d9576cc0f869ab930cdd1e324e46fb451d90b9658b725e5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261156, "uuid": "feb70801-e0ee-438a-a185-b242c81f1449", "value": "T1AC43F155335399B2CBC4883BC6A085536F5A3BA6D858350718E416FCB2ABE84C9F1AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261156, "uuid": "4a6ef6af-9e06-4860-bba4-23de7534c6a1", "value": "1536:AoZVdjMI2ANMTdsJb9e8Q4Y87ejMUeqPoH3Ly:AoZbb5MTdKxe8Q47ejTwXLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261156, "uuid": "66160fd1-d9ea-42d7-b849-d991b4b622a3", "value": 59004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261156, "uuid": "21aa1d07-6720-4b8d-bb66-f2e8466230da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261156, "uuid": "7d47a7ed-fcea-42e2-bfb4-19c9d9217f19", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7b7460-b973-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762256694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256694, "uuid": "098b3335-3e9d-45f4-a9f9-75015ea441bc", "comment": "Malware payload (a310Logger)", "value": "f4be164753aab4a3f5ee54ef989d7636", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256694, "uuid": "ba3dd25a-ace6-4811-b131-dc36fa9d2750", "comment": "Malware payload (a310Logger)", "value": "bbe71876eadd05fb527c215d6e3d40a204cbf6dbf8ffd65212d7c746a825e55d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256694, "uuid": "c41a89ae-ef6c-4376-8543-05770ad2b100", "comment": "Malware payload (a310Logger)", "value": "db3c9dcdb1473a095f0391908618d109000aca8d", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256694, "uuid": "1d361058-1f99-4572-ad56-515adb8ea9ce", "comment": "Malware payload (a310Logger)", "value": "187f06569794e84e5441f781b4615140418b878edad96636844227625e96b0a38202540fd790d4597f681dc603c65c02", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256694, "uuid": "b489b136-f0e4-42ad-b478-4d30718f57e3", "value": "T1AF55F11A16D46AA4E0BECB78A3B800D443F0A61FD721F7AF7D5C52F89E1178567132A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256694, "uuid": "74121ec0-1995-4207-b61a-cf93ea986923", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256694, "uuid": "48d67e92-1517-4382-8ab4-bd5ea531db3f", "value": "24576:44dzN67rUBVia9FWqjf5ZmiLf1DE0e0oXao0tCYU3g7CgZQzCcPb:44E4FFWqdciLf1I0LFo0wM7lKG0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256694, "uuid": "6de512db-4e6b-4762-9524-32f4171670df", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256694, "uuid": "08787c37-f4e1-4a10-9db5-0bda2bac0b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256694, "uuid": "c6f06472-1075-4b8f-8659-4be57c241ca8", "value": "LIQF22Y.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633e7e05-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245401, "uuid": "5695e44c-a574-4433-a238-cf4705dd2735", "comment": "Malware payload (PhantomStealer)", "value": "e60cd81c225226f497c562adc4a2dd07", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245401, "uuid": "41928aab-cc40-423c-8d74-c2d779125778", "comment": "Malware payload (PhantomStealer)", "value": "bcbbd31fcc6163555c4a372fa02dcb49da952f4f31b02c6a3326338709c78da5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245401, "uuid": "493329c8-d162-47e6-b956-f5f4991c27ae", "comment": "Malware payload (PhantomStealer)", "value": "9b9bbd12cf0073b4f51bb45c7c424d6a63c01a94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245401, "uuid": "02d4ae09-af08-41bd-8157-c1c624b16af2", "comment": "Malware payload (PhantomStealer)", "value": "f0db5d7ee8bc82a74e6cfdc99e38ce734546325cb2bc2661ac03a035c2e3f39b1da57fe95c14e40a273a45ba7fbc9f5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245401, "uuid": "df5e5b41-2f00-4df5-aa70-bbd5144ffa88", "value": "T1DB055A70ED2C01994F4717EEFD250AA0C8BEC916163754F1EAD51B5E730A99CE3BE228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245401, "uuid": "4ac5009e-9be9-4f1d-88b0-f16fe4d81488", "value": "3072:XIC2ZRjUO8VjUOhj+jUOWlBQjUOqjt7IjWjfjFG9jUO+jUOyXjUOusCpjULjUO80:lQoFjkEoEcHV0qIZu9MpGbXz9SFp/gu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245401, "uuid": "f6436068-34c2-45c3-a6cc-7b21b5599e74", "value": 808451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245401, "uuid": "7ca53f49-7ce5-4a89-ac3b-8ba9208bb82b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245401, "uuid": "64ecd834-b593-460c-bdcd-6871e57ee3c7", "value": "PROFORMA INVOICE DEC261025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddd1b0d-b9a6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762278544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278544, "uuid": "e96cad92-b3a8-4e00-b5e7-71d0375b2629", "comment": "Malware payload", "value": "4e8e2c09e15be00e11ae4550017075bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278544, "uuid": "ccad9a2d-9ca9-4ef9-8aef-3e6b666ef03a", "comment": "Malware payload", "value": "bcd643265785cf0f2a523b015b113eaeb825738b64784b3f6935bcb86796165a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278544, "uuid": "560412e4-f761-49d2-99a4-4fbb14a8c14e", "comment": "Malware payload", "value": "3e494f192621a7443557a57e141ab429e3660318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762278544, "uuid": "2462a0c2-e38f-4da4-9618-30e9401a470d", "comment": "Malware payload", "value": "c75e38e566f7aaac1ccacfe76ca31683f0ffeee5f7fc7e5c4e1b61a25612f71c61715eaf9961e5d8cac4aa3598822672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278544, "uuid": "fe4b9cbd-9252-4210-87b4-d94643a6f815", "value": "T165B429139FB98258D27AC13D13A7E223F177BC0C96ECE65786D8CA1B2391743B149B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278544, "uuid": "82dedd3e-e0f3-4a19-a990-bf1b13d59512", "value": "e64643113bcd08fd4af7868669fcec59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278544, "uuid": "a4c1386e-3b2e-4a1e-b2a2-ed73281ee20f", "value": "12288:hR8j2jEAJHJeey6nSugf921XkZ7Oyh4Y/JpuUBrhOtZ:hRrPHJeeZNt1KOyFBrhOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762278544, "uuid": "8c25143e-eaaf-4580-9821-5850bd977e55", "value": 532696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762278544, "uuid": "94e704b9-ce85-46fd-bd0a-9d8e9efc2c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762278544, "uuid": "ca04d236-261a-4d46-8d22-5522842ce1a7", "value": "ProgramFilesManager.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c051854-b958-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762244879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "8519f02b-029f-47e2-b099-628ddaaa073e", "comment": "Malware payload (Formbook)", "value": "9349d7e197b4dda3308e83c544f94111", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "802701bd-91e6-4120-8624-786ecee583c5", "comment": "Malware payload (Formbook)", "value": "bd6b578fc5b6442efdbabfc0938039ea81feb947b3fad66fc6455e8917ca8e6a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "04fda55c-ba84-4460-9d9f-9bc30c280738", "comment": "Malware payload (Formbook)", "value": "64b095286330dcc1c458ab315284de900f82559a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244879, "uuid": "330d41a1-243d-4bd3-8ee2-2fef18431abe", "comment": "Malware payload (Formbook)", "value": "b915f66ace0258429622070abe87945d0f7847494f1c1219177ef5c73153438c7f3badfe1353d0432c9be57817dc394d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244879, "uuid": "59a14043-6d81-4e94-b8c1-282df3a30140", "value": "T10D6533105E64BD7DDE2CC42C247FDF0C8B61ADE4D149B9BA72E462C7176E7862E03225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244879, "uuid": "58988928-1cda-4ef0-a6df-cdc4d83b02b3", "value": "24576:vKNROrjl0qt7tM4w7HRfmM6PKn81N7XN4iaW2MwOmEoaBEba4:iCnOqrMbmdp1FPKaB6a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244879, "uuid": "852114e7-dca1-4269-adc5-7162aae0e576", "value": 1439093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244879, "uuid": "22091dd2-992d-4697-9e3d-6f6d187952d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244879, "uuid": "17c8828e-3762-4541-9d29-720533ef8992", "value": "sirrrrdeee.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087871e4-b92c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762225922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225922, "uuid": "befcc032-a03e-40ef-98bb-a411cff646bf", "comment": "Malware payload (Joker)", "value": "a202131c42efaf040a23edc664d867d0", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225922, "uuid": "770e9fb5-e5bc-46d0-afee-af39c4019cf1", "comment": "Malware payload (Joker)", "value": "bd8c22823feaf269ee7b0b3f964a3b2392d817f2adf30f6cd735d34af8c227cb", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225922, "uuid": "24ee9d9b-630d-4802-87b9-46a6c542e06f", "comment": "Malware payload (Joker)", "value": "aaa76f521383b3bde1b1dd37af47773007fda709", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225922, "uuid": "a01731ea-10dc-4d23-827e-c393f8938c16", "comment": "Malware payload (Joker)", "value": "5e14f88d9b96a49f2cb6233f375033ebde7d04ab8023eb0edbb517c4010137dc1fb20bf51f7c449bc184fac3f873b784", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225922, "uuid": "5afc8a72-9379-418e-96fe-d690ee940813", "value": "T13367220AFB1CA92FCAD6B0BD4E5A0362A1257C48435093A73511F21CFEB76D49F1ABD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225922, "uuid": "4cefd2d1-2d86-47f2-9244-33f06bd12314", "value": "786432:O0H5/dZymHFawWedoKbubuZzhdWke660yZNj:/HXZdKhK0uZzDALjZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762225922, "uuid": "cb07edb9-4fa2-4db3-8215-46070e0f9b3c", "value": 32163210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762225922, "uuid": "ccb66671-1477-4564-aeb6-bda03c6ca3d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225922, "uuid": "15a48d58-cbee-4448-8c58-fd6d85d40916", "value": "File+Storage+Cleaner_1.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b5e800-b9d2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762297608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297608, "uuid": "a4a7e2b5-fed6-47cb-8ab5-af79d7bf12e5", "comment": "Malware payload", "value": "2c4cf8013c69a286ff9463ced94f3b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297608, "uuid": "fe39926d-7fee-4030-ae60-a25dc2d4de93", "comment": "Malware payload", "value": "be61d9c23d4359b4a4d4911f0f8fc09f69124f3cf991856d5c871e23568c5cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297608, "uuid": "540c77a8-a7d1-4875-9a71-80a0e2fe4d44", "comment": "Malware payload", "value": "89a0c562b8942fdabe451927120649bd83a52ed4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297608, "uuid": "10baef7f-d310-4126-90e7-447f65b4c656", "comment": "Malware payload", "value": "3eff3f20bd92a57987af60bce8efe49cc6ff94f874bf299f46d1c94f2789f78ca8a7f1a79ba82f24ccd1e07119ff074a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297608, "uuid": "d9aa78da-0594-4f16-98c4-e2ddb8808112", "value": "T180C3F786B881AB25C6D156BBFE1F018E33135BA8E3DE32039D185F6477CB95A0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297608, "uuid": "ce11a94a-5052-47b2-a304-f5ccc18fc081", "value": "3072:gb0D4wEt0oLlzUmMtF4bdpqDjkV8NTDKiI+tc2/od15nza:gI8t0oLlzU1F4bXqDjakhRtcP11a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297608, "uuid": "f4ed65ff-dd18-4523-9b6b-acfae6461f57", "value": 122256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297608, "uuid": "431366b0-f253-4ecc-89f2-ecb34905141e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297608, "uuid": "93772d4b-4d2b-40d1-bb16-332bfccf479c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f350e003-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762249079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249079, "uuid": "c5fbe62d-21e5-44f5-9305-b353c5c08938", "comment": "Malware payload", "value": "d6987d84b5e573c8a1d29d573289ccd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249079, "uuid": "e082ad47-05aa-4d1f-9899-c7c59d3020e9", "comment": "Malware payload", "value": "be7a21e898adb28f9ab73ac6f5b252d5af6533c2b2f19af5b1e9947953cec476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249079, "uuid": "956c7b38-8766-4523-9ef9-87c56c339e0a", "comment": "Malware payload", "value": "8a9907824c9b114978b4ee12204ded8fb2b0c4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249079, "uuid": "50890905-ee31-494e-b15a-feeb5a52e22f", "comment": "Malware payload", "value": "659139ef4131ffc08b20bbaaefbbc53b61bf28baf87bafc176fd701e6d2a0cb8c4d46d52f193d56c8c87f7f0938977f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249079, "uuid": "41d509af-b9b6-4089-b50f-2a0d443e3424", "value": "T1A6051C7E5966A12ADA4E80FC35594B6249B1B73B03B41FF70066813127079B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249079, "uuid": "5bbffd38-5595-417c-9636-7964b80a6d8d", "value": "12288:0NuHDkSQD8qjIGsSnDTkFmdreosQCvXLA4sP/SRJoLNohKF5/gAKI+ytNSh1Wmv4:0ERQIqoGDTkFmlV4zsBMIF3u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762249079, "uuid": "56481481-0d69-4e12-ae2e-9021b8454723", "value": 803972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762249079, "uuid": "235eaeca-9bea-48f8-b9ec-592bd5f62e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249079, "uuid": "555b2f2b-e572-4ca6-a26c-cfa84c707618", "value": "be7a21e898adb28f9ab73ac6f5b252d5af6533c2b2f19af5b1e9947953cec476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9353a588-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268675, "uuid": "16489f8a-f0f3-4120-8ea2-2d87d9780d4d", "comment": "Malware payload", "value": "9701fcb22261ecf78e3b5ca1791670af", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268675, "uuid": "87086516-3d58-4522-a2d6-1fbfbea5e8ab", "comment": "Malware payload", "value": "bf82d2367e71cd059d2c7ec611480a56a5a15a426f5b36954680eac9aadad51f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268675, "uuid": "41bbfcbc-fb0a-486c-a078-eff210689266", "comment": "Malware payload", "value": "49fba95607f027e8ce846ceef13284af1e402107", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268675, "uuid": "46525d4e-a6ca-4ecc-9522-8a682710002a", "comment": "Malware payload", "value": "d5685718510fe84da4e7a5e7f35606c6a88d777ac3a4d7e68a3eb8ba692d41790c6756a42aef0305883fdbfdf2fa55db", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268675, "uuid": "22500fe8-286f-4b8a-a15e-c47bb519ba67", "value": "T1B721DF155BE55732F3B20E3658F1F6398A36B403ED62DF1E0195C1481872B51AD34F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268675, "uuid": "ed0a6efa-0f40-4eca-81cb-03e775e9ccaf", "value": "24:8IJ8JsPZAO7ypgAM6Ji+/xPZeYqVwOtab/cm:8IWJG/yp3x4BvtaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268675, "uuid": "d0bf52db-b9db-4319-bf8d-3d39e734b5de", "value": 1433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268675, "uuid": "b973ea69-5fc5-4841-95c8-d388f4cd3142", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268675, "uuid": "248d1db1-df4b-461a-a365-8ed10be10f60", "value": "RE-5704937421.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9398b5cf-b9cc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762294874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294874, "uuid": "b3ee3bd6-f0ca-436c-89f3-09c687afb98d", "comment": "Malware payload", "value": "2e7bb70e88afa30d0d4ffae9b8fb16aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network-ransomware", "colour": "#4C0FAF", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294874, "uuid": "bbe8610e-ed0e-4f1a-a19e-e3d6fd33a94d", "comment": "Malware payload", "value": "c09065e575639c63ee5e74b4def1cd6300f37b56a5454d3a98302478f7840338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network-ransomware", "colour": "#4C0FAF", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294874, "uuid": "5a31394c-67c9-4101-97f8-d383eb2f81ac", "comment": "Malware payload", "value": "b8c1a1ecc1cd7b8a34dda461efea3eca43396fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network-ransomware", "colour": "#4C0FAF", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762294874, "uuid": "a8df2339-2c04-42e9-a1f5-a55d6c99cf4d", "comment": "Malware payload", "value": "47865100126f94bc87b9ade81d9bc4f8ce853e60a9180ed832ad140cec0900696dcf75fd7e1ffe99d39d1cbedbb40cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "network-ransomware", "colour": "#4C0FAF", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worst", "colour": "#2BE077", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294874, "uuid": "04388a39-8416-4f15-ae9e-77819a5093b6", "value": "T15AC39E45B3E201F7EAF1053100A6727FDB36A2389724A8EBC75C2D525913AD4A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294874, "uuid": "c43a479d-d2f9-47f0-a0cc-29dfc50d253f", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294874, "uuid": "511f4a67-197d-40e6-a575-301e8ad91e7e", "value": "1536:U7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfZw4kD4ylumE3iRz:q7DhdC6kzWypvaQ0FxyNTBfZL1w4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762294874, "uuid": "538297a2-fe27-4704-889b-c4e158d5c02a", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762294874, "uuid": "7a7178ee-02c7-4af5-92ae-226bf2665a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762294874, "uuid": "e2217d39-bdf6-408c-83dd-6a1d7d7c17cd", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f15500-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244684, "uuid": "797f37e2-07b0-4ddd-96a3-e8fc7a2f5e6d", "comment": "Malware payload (RemcosRAT)", "value": "94047bd5575bed7219fc422c211242c1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244684, "uuid": "f37d2e01-3dc6-4dde-8abe-2057f094cccc", "comment": "Malware payload (RemcosRAT)", "value": "c15afbd157f3ab68d1b99e9fc1cf5cd6bab5624f470abf1887b329fd274f5392", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244684, "uuid": "5dce5b83-3bac-4f15-a444-de0729635bfb", "comment": "Malware payload (RemcosRAT)", "value": "1a068fcfc04bde34231865cc72509a0dce7326f9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244684, "uuid": "63ce4d2d-8485-44fe-b090-b0773b9145eb", "comment": "Malware payload (RemcosRAT)", "value": "3f1fff9186b6830872aa21c0a064f723002ec5741aa50834a487cda8b0331443c232d52a2357d4cea790876b66f89279", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244684, "uuid": "f66766f5-57e3-4573-a30c-88d6b548f6ad", "value": "T14283240BA83800582232E15D0F77675BCD9DE237EA791CA5748D32778FFCE2199AB614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244684, "uuid": "da89e0b8-6142-45d1-a479-a6c28592a12d", "value": "384:qbJ5LBLZqlaLpV89fdQl9XIRqXWvlCIlkjW9jc+l9xuTWnj++XwlvvrcXxTRuXzT:SBLG2g9fd2oBKQBVOcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244684, "uuid": "63fb626a-d704-40bd-9a49-a17e0656dd6e", "value": 84747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244684, "uuid": "2cb61ade-6d7f-4e67-a555-148f9770a6ca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244684, "uuid": "0a27d39f-f8bf-4877-b83b-ef2703749e72", "value": "fds0cx09vsfjjf923009d0g9fg9c9cv8bcv9b0cvb90vdf909c898cvb8cv9b89cv9b89cb99vb89cv9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f99230e-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245476, "uuid": "3d7e9a3b-59b7-4afc-b2ed-2c0a2c4d0b76", "comment": "Malware payload (RemcosRAT)", "value": "6d2ca0ae64b2ef580d46f7b5dfd222a8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245476, "uuid": "5631a276-4af6-4a73-8105-42bbe4fa0652", "comment": "Malware payload (RemcosRAT)", "value": "c17eaee58ab8b2f803550f0b246f0b48c045e5bebd0c01b4cf9460bdd43fcbde", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245476, "uuid": "98502feb-69c8-4179-b125-b24220c2d500", "comment": "Malware payload (RemcosRAT)", "value": "a9abe4b879059165e2cdcfc411b2e6c73d8f0954", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245476, "uuid": "110b399f-6d9f-4e02-ab7e-661c7515b70e", "comment": "Malware payload (RemcosRAT)", "value": "58a7327263234dea1046f82f1802ae7a2c4011abc63ca4868ec95a2a23deb03ad8d3cf72e4d29d400533fa85f7fa1717", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245476, "uuid": "6845f9ea-76e9-4870-9c48-7823614f11f1", "value": "T113C33C3295B48F258F037E5DF87D85224D6861D58331C0AE654BD2AB180EF78EA7E3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245476, "uuid": "6afb01b7-1126-4fc6-9443-d5bb54bfd5b4", "value": "1536:DQeuvbu7SS7JA7ZWgh0Ceunr8rdrBaiv1Y+LKhx0kEcc1XgizFzey4V:DQNbu7qsgh8dlaQKhx0kEvQizBfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245476, "uuid": "82c04374-ed15-47a3-9855-39ebd96855e9", "value": 120072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245476, "uuid": "168f4cc8-5e8f-4a55-a022-97201284e547", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245476, "uuid": "ee328b38-f646-4ba4-86c6-c609be396478", "value": "Documento recibo 30K.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ecc392-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217435, "uuid": "eba0a5e6-f5b9-428e-b134-7112dbe6077e", "comment": "Malware payload (Mirai)", "value": "823b7b9489c5b752efd25a1736189db1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217435, "uuid": "738ad012-62eb-41f5-8fd6-e9fdff086ccf", "comment": "Malware payload (Mirai)", "value": "c185765ba0952d63188ac1415db1f1961365c2b1974c1aa667a00c7373d904bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217435, "uuid": "c8635dd9-7af4-4bb3-8d1a-17f6070586c8", "comment": "Malware payload (Mirai)", "value": "d36c476f561fee7404ac18364137f79afb7c5a62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217435, "uuid": "55dd9edf-eeec-4b8d-8174-f7503db423b4", "comment": "Malware payload (Mirai)", "value": "30a45bff440ef6d926a9bab7d6360452c7ac29ca648085addb96015b368b07e4c9277ce8c75c3baa265f72e536d9cedf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217435, "uuid": "20f7f158-61c5-46c6-8eb0-142de3631737", "value": "T11D6301CB6EB02B56D1D8A1B1703415D5CD3ADCCAE743869CC3E2EB954B3D82651C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217435, "uuid": "6d7d2e0f-9ce2-4fbb-95e4-0eb570dde816", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMG/MhvNB:1axZLmYKX+t08jmeJhYTU9NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217435, "uuid": "cd0068ee-5c53-493a-a093-b0db4cec4c9f", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217435, "uuid": "c08603bc-e3d0-48fb-b3e8-bccc2584e2ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217435, "uuid": "f0e53305-14fc-40b3-bdeb-f9c2f58cac0c", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d047ac01-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762245584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245584, "uuid": "4f89a7dc-b1ac-408c-b7b8-02015cc820f6", "comment": "Malware payload (AsyncRAT)", "value": "9a47622fb654927f0cb53d04ea86a385", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245584, "uuid": "cf2f0fdf-721f-44b2-90ed-2676d2606319", "comment": "Malware payload (AsyncRAT)", "value": "c2549871f187941f3d37bfba8c5ae8da8f88eb964c676da2a5cab1c580e68013", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245584, "uuid": "757d1c6a-5c0b-4952-a611-3627f1859925", "comment": "Malware payload (AsyncRAT)", "value": "868e88bca9f49fb9572bec08b29d79aba3980167", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245584, "uuid": "d4ee610e-a2e6-4143-a03f-442f6a6c980d", "comment": "Malware payload (AsyncRAT)", "value": "ad8e7e72c73cbf854a6fd2fe2e5b877d971640123e9c23e7fa698cd3b50f369fe9e7d61557415419bbbba97a4e85d50f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245584, "uuid": "7aba9d02-7651-448c-a497-d34a7c38f5e7", "value": "T19D723377966CEFF00A3E22F045873D1520509326A93B8D6CE89AC195BF27B518F578DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245584, "uuid": "7277d896-a453-4744-a820-8c8ca57e2bf4", "value": "384:XXeXqvuy7jhVcoTsuaGwNwRZU68+5YBcTc6S1FE+wAopNrq0:WJy7VW+cj+AcTeFITjrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245584, "uuid": "f176c8fb-eee9-452b-a76d-f0f162d77e21", "value": 16508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245584, "uuid": "c46bef6f-7a40-409e-8011-14cfa4d1600a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245584, "uuid": "374d16b7-0f28-446d-a1f0-53d0e943efcf", "value": "PO.JQLSIPO03\u2011082025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb528b5c-b958-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245227, "uuid": "431c2360-c6f6-4db5-97a5-96fd55f0d6d6", "comment": "Malware payload", "value": "6769474a974ecbbc89087f4d02b0d9be", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245227, "uuid": "8d2047d2-df34-457b-ae12-83bccd4cb198", "comment": "Malware payload", "value": "c25c28f4ccb6f4c5c3375e01931f7e2bea1da08b8486d7a2c8ca01e31b8090d0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245227, "uuid": "e776c1ac-27ed-4ba2-8b6d-0abdad4a9252", "comment": "Malware payload", "value": "44ed3c7f46094a72979eaeb577ff5a99aa33aed6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245227, "uuid": "2fdbe043-acaf-4402-b06d-4b3c30211235", "comment": "Malware payload", "value": "058513d3f6fc421c5ae13eab5214fe5219c224d567e8329faa15d695651dedee20e8e02063b587f2716bfa99e335b093", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245227, "uuid": "09521b70-b70c-4f78-bb16-e233ad5ec719", "value": "T10F110E61FC05C0B2D178AEC2C1ADB822FBD2E1A46571B2183599D43B6944788D62B6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245227, "uuid": "577b7fa2-ec43-40d4-81ba-2251c01af38c", "value": "24:9A+18Vnu++cB5JPXPbV1PnAWoUD5PSV1Pxp99z/:erluwhfbz4UDxSz//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245227, "uuid": "6845c966-8876-4b5d-a212-bd6cbae89338", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245227, "uuid": "60e30770-9fe3-4826-be47-3f8505908db4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245227, "uuid": "6bfba713-b1bf-4941-b719-3e343359ce6c", "value": "script.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b012121-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217443, "uuid": "997502a9-b090-4561-a048-f2f22f24d6c6", "comment": "Malware payload (Mirai)", "value": "db7799de3ba1d772eacefb42e4eeeca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217443, "uuid": "8f2291c3-d977-426c-bf99-dd070878d634", "comment": "Malware payload (Mirai)", "value": "c3b485aa5b3b50f8f7db071c826d1bcb93d2a22a2d413bfb119270ef131ccc8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217443, "uuid": "9d0cd6cd-995d-4d24-853b-8a1832227235", "comment": "Malware payload (Mirai)", "value": "115d3fc437b56c9d136131b24eb0e87c84de4de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217443, "uuid": "416fbb78-b052-4338-b296-4962974972fe", "comment": "Malware payload (Mirai)", "value": "7ebc256b65bcfa8821e70d890352257c5251bccc7f9d09ffa0aae94912004bf5a010ec30146d0277b60952dfb5bd1f86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217443, "uuid": "957445da-b67d-47b7-a67e-e1321fbb6a30", "value": "T1B7B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217443, "uuid": "cc5e9835-f18c-4057-ab5d-d32200493767", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzo8rSR:t3SrlGWnKTU83AQB5A5Liy36f0USR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217443, "uuid": "9fa6368e-737e-4a22-8e0a-21e36962703c", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217443, "uuid": "19019db5-e015-4b8a-8197-a07189f3ef40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217443, "uuid": "f1da32e4-d19f-4e6c-975f-7f043cde0ce7", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936746d0-b954-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762243334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243334, "uuid": "3077bd3a-706b-4dcb-b58c-5d28b9ba03a0", "comment": "Malware payload (AgentTesla)", "value": "fe22de41f21f187b751b04dd3b2c4142", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243334, "uuid": "dd4338cb-e775-480a-9eba-f23588f8b0ef", "comment": "Malware payload (AgentTesla)", "value": "c3bc8e08346c373bab800cd771916d9f87604a72ea7ca8ef8079f4cbd9d71112", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243334, "uuid": "fe09e0c7-5dca-4bea-8029-70a94522ca69", "comment": "Malware payload (AgentTesla)", "value": "9e2784eff2eda7edaeacf71035b802b6c76a964b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762243334, "uuid": "3265480c-7117-4c2d-9877-1bf2d6f1056b", "comment": "Malware payload (AgentTesla)", "value": "ca83793a40e6513a56438a5a20ce13a866d3c1ccf7a872c4b32a5db49176220b252645ce8835cf5b113651b0d1fb46dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243334, "uuid": "76ef710c-af76-4305-acb6-a9ee47ca3621", "value": "T1C60502347ECA8577C1300F7B9C61F76261B4F8471A4D5AB361180F6EA4BE295CA0E736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243334, "uuid": "1b3fe306-fb3c-49cd-a6ba-a3e0a38c4919", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243334, "uuid": "338d8573-1970-42af-a353-5fe9bbf5d87c", "value": "24576:TfL2kAhhHtWDtHeX3NlG8dJjpdSjxhP4NDO3:7CPHWDt+nXFdNpduxp4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762243334, "uuid": "dc4d83fb-2d1b-4949-a5d0-711ef05ea98b", "value": 855880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762243334, "uuid": "773cf633-1bf9-4f17-b6c6-1050a980089d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762243334, "uuid": "3e6ca006-b68d-4db0-b4a8-55049839c14e", "value": "ZAM\u00d3WIENIE_Dobopack_Nr.2511041178972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4523e587-b971-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762255659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762255659, "uuid": "870f781b-5c4c-4e6b-8cc4-eb647ec78078", "comment": "Malware payload", "value": "4a3316121aef2d67d1764899ad6d408a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762255659, "uuid": "f74a66e2-635e-4d70-b61a-49418f926401", "comment": "Malware payload", "value": "c4aa191fbb92de300094df02a193d6d95cbae22d2953b826d2a628a029280071", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762255659, "uuid": "5748d842-2f25-444d-863f-67834efcb529", "comment": "Malware payload", "value": "fe66440e10a67ab943b44426a983f99f3c36aaf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762255659, "uuid": "11e26f84-75a1-454f-bfb4-cf9611fc9751", "comment": "Malware payload", "value": "eafe8216ae2f29cffbe3dfea3e443ddfba250ea6b87d21e69c40a85d2b875cb4d5cff7f0d0f4550d201d246ae59b4ebc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762255659, "uuid": "234a483d-aa62-4705-8e01-04bee0293d84", "value": "T1AFC59E865C2BA5DED70673BD0C1B2AFF0F939067C594E881D98D69923422FFC0682F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762255659, "uuid": "3ba684f0-9926-48cb-81ea-86e35812c6e5", "value": "24576:drvwZdFZdZ8ZdZtQXDpkmbX/lLK8p1DMn3/X:wVSOXD+mbkw1cX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762255659, "uuid": "af289c0b-a8d5-4aa6-9d83-adb4655085aa", "value": 2534740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762255659, "uuid": "db078b25-6898-4715-a77b-f4d8ccdff12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762255659, "uuid": "29c951c1-1fd8-4f36-9ced-deee85cfc1c3", "value": "c4aa191fbb92de300094df02a193d6d95cbae22d2953b826d2a628a029280071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c28ae5-b976-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762257693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257693, "uuid": "a33ddd13-9680-4f6c-9ee9-129753056077", "comment": "Malware payload (Formbook)", "value": "9c9eb3987c07ed19b8786cad5f5d93a7", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257693, "uuid": "7ecb0609-98e9-4d62-8102-0d930d71ab43", "comment": "Malware payload (Formbook)", "value": "c52a2cf1c3033792b71a3fa7ccb6c94f5b46e6b8e6f3737dc316294418ddde9d", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257693, "uuid": "e0017553-1987-4b91-a37d-8e61a3891a95", "comment": "Malware payload (Formbook)", "value": "e9d6ac48a99ae1242b6f45c2c187b320f4406e80", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257693, "uuid": "15c27591-1399-4b80-b6a6-f24c5f9b2b15", "comment": "Malware payload (Formbook)", "value": "747d47dc05cec53f09aae952b5256ccad4ca42e9088f0a3c1b567f8100ab516afecf9bf900fd269b18a724a78adc7bd4", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257693, "uuid": "d1111bc8-abfc-48cb-9710-2f8406c947b7", "value": "T1B8A2F0CDBFC2B36113B7B4A36D17B05AA36BBC40F44D6198F238D5A4F860728D992875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257693, "uuid": "d0f3821d-86e2-4afc-a59f-0371963fc309", "value": "384:JziL6g3ihi7AP03Mc2DwB2nBXzh5QpAVjaw0wJStrR76:xiL627Jh2DNNzLQaVAw+R76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257693, "uuid": "c5968d55-71d5-436a-8190-5959b0b1dd19", "value": 23265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257693, "uuid": "b7dda40e-ff77-44c4-864a-741900ff6248", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257693, "uuid": "4ded2f42-1914-493c-89dc-f142f86c03ed", "value": "RESOCONTO INSOLUTI al 31102025 - ATTENZIONE IBAN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3282de0-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244649, "uuid": "3bcb6c0c-43a1-4ad5-a0e4-12cfc793c94a", "comment": "Malware payload", "value": "1c1503df1d8c8c627972bbc45ecdc9a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244649, "uuid": "e17311cc-3edd-4621-83a5-2ac53af66ac2", "comment": "Malware payload", "value": "c65304e33903ff6ad510595f76158ea48e235cf50ff30018bd4137f93c22b39f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244649, "uuid": "43d26358-0ea1-4ece-ab6f-89c849c15ceb", "comment": "Malware payload", "value": "1411ee2f61ef682bc515e07da33485baea03fa37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244649, "uuid": "ea29f286-0a68-4631-8d08-dcb4659e2d9e", "comment": "Malware payload", "value": "682bfebc30ceb7f1de2d434ee05b84bdcff0854ba39c768268ced7ac3200a708db9c88a72200be03046ad3bade9d5b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244649, "uuid": "4cb97a1a-db12-45b6-96e6-842e7a78fa9a", "value": "T186D54A07FCA508E9C1AAA33589379552BB71BC481F3227D72A64B3B82F72BD05D78714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244649, "uuid": "5cab715f-99b3-48fe-8377-01234c9089e1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244649, "uuid": "234e370a-b98f-44d6-8e58-349e7b2fc903", "value": "24576:tf3xRVKD3CgeKDntZPuuDVSCdyzEDwm99gPcrCVOj6S6elepo9zpAs+sM5k+yBAs:tf3fVq3NtDtZPuuZJoq9CLVUDNAmyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244649, "uuid": "ab03abc6-6bbf-4c32-98f0-1264419a9e10", "value": 2939904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244649, "uuid": "3e474a7a-bd7b-41d7-91f4-00b2150c5568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244649, "uuid": "5480d8b1-c856-4c38-b7f8-bcc6608e1efc", "value": "0rXld4E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695205a-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217436, "uuid": "954e7ef2-c67c-494a-8440-b736dd5f7d69", "comment": "Malware payload (Mirai)", "value": "b36f034251f938ff51099d97163d615e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217436, "uuid": "04ad8a0c-0bd2-4671-b1ae-b01fb774545d", "comment": "Malware payload (Mirai)", "value": "c65cd329c7a40eb60736a72484f778c9c1d60cba3d47bfe73ecb67badbaac77e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217436, "uuid": "8230801a-429d-4bbb-b4ed-426f7357cb94", "comment": "Malware payload (Mirai)", "value": "d56baf9dd450608a1fe527fffc5b49ddcab7ae83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217436, "uuid": "63b30838-5920-41c7-b8dd-c08e31e20a26", "comment": "Malware payload (Mirai)", "value": "1cef68dab189603072109b74b8f3e67d652b084c2998a09fd40f00978b6d9c2894c47cb3cacc970922388114ad3e010b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217436, "uuid": "e2c73688-04ec-4423-a5f7-ee862c9b2ae9", "value": "T1BFB3E085B210AA55C02672FCB187099093B17E7B4B9A150B44B3F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217436, "uuid": "65a0c744-25e6-4ac7-a2a8-a1cf8af80a2b", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuw:as5zqhr5Nzy7w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217436, "uuid": "4af2e025-8479-4c81-9904-e7403f4c08b9", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217436, "uuid": "3f1b0c97-bea4-489a-bf63-4bc463afc368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217436, "uuid": "cc69865a-d349-469a-9ee2-43e9539c0444", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6049aec0-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236377, "uuid": "edca90d7-82eb-4233-b337-93ed54714fa7", "comment": "Malware payload (Mirai)", "value": "9b370b359f9f751a30fd1d50a9aa3c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236377, "uuid": "8e9bb598-d4c1-4ae1-ba67-db6c4d8741a7", "comment": "Malware payload (Mirai)", "value": "c6c9fc2b8b74553adbbf51c4461667e41f84eea4b309f721f802a1b6664bc21f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236377, "uuid": "7718882b-a127-4443-abb0-bd8a26975d1a", "comment": "Malware payload (Mirai)", "value": "1ed3ac459c61a98c61d6e34a590ec90b57986c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236377, "uuid": "ce280fab-d9b4-4164-acec-92485c97473d", "comment": "Malware payload (Mirai)", "value": "89cb8a2fe9b09925bebbcf2cafd6549731ac46ae6928519190b8fe547a232cfb9ded91da5cfb14e68248353f5010f3c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236377, "uuid": "6d519b10-82ce-44f1-a995-5a53cb0f19e9", "value": "T1D8F2F14194D2CB03CCBA407AAC9FBD8B405E662971E902554BC4AA73FCD3F636B36395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236377, "uuid": "6e25bf88-5b4c-486e-bb00-25555c677738", "value": "768:E7RmXfLBY7Ru6dNroYuU6rpO/cHAj2jXZKQCWzE8j9PaOH++nbcuyD7UtQRjM:YeBY7Rboi6YvWE85PaIVnouy8ty4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236377, "uuid": "f5492eff-3648-41f3-838e-a37e7d7deb15", "value": 36640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236377, "uuid": "ae3cc0b7-1b63-4ba6-af71-8204181d6a36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236377, "uuid": "2e7f5192-0200-4f1c-b2d9-06c09ddccab4", "value": "FGx8SNCa4txePA.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f169124c-b9c3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762291166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762291166, "uuid": "6f2f228e-e74c-4674-aeb4-12ec37ff2ae1", "comment": "Malware payload", "value": "fd3aba1d9c336fc238653f3bcc51e1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762291166, "uuid": "4c1e6f03-c641-4bfb-941f-cf42b46e451e", "comment": "Malware payload", "value": "c70b3b2d863b3d23477c24cc6c7e6f441498bfbe8a1c5142216fdefead98bf3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762291166, "uuid": "8ab359c4-8bdb-4191-8082-19fe8323f3bf", "comment": "Malware payload", "value": "0757d7bd23f2f579f28119f0bafa7431ea560191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762291166, "uuid": "1f197011-6e43-45c9-bc64-299c05830f1e", "comment": "Malware payload", "value": "705dc6520530d2242632c91527626dfe529aad07f1faa0eae5a221c34c4666657d05f4b021ebc1754eb8e02b42ec7413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762291166, "uuid": "4560e573-8425-4bbc-88ef-31927a637a6b", "value": "T12DB5E60776805BE1E0D9A93175219891267CBF452F2322E31BEDFF69393E1F40AB6364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762291166, "uuid": "abc09533-0937-47fa-b1a6-611778fb70f8", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762291166, "uuid": "4bab5656-800c-469e-8992-fcdf4d1d7907", "value": "49152:4QvBogqE/ecOqEnGovlBrJvGXgbYCyj3g9Ab:5GLPr5n8Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762291166, "uuid": "4d0bb324-2a16-4662-9331-df35d83c8634", "value": 2270536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762291166, "uuid": "fbc2aa48-b4e1-4b6a-afba-32c5914f5fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762291166, "uuid": "6e246473-5f1e-4a72-b275-89de035b76ab", "value": "SecuriteInfo.com.Win64.Evo-gen.68245972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267f15d1-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261191, "uuid": "5d046e2c-6130-40bd-afd6-9be82deb718f", "comment": "Malware payload (Mirai)", "value": "e66cef6b06627a4d895c6da70a61793f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261191, "uuid": "12ba2bd2-5e59-4812-965f-87c11348ff36", "comment": "Malware payload (Mirai)", "value": "c737bab002cb5643b1ea19e6334645149b678897e19cf22379d5d0768e329bb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261191, "uuid": "7c6ff31c-8786-4744-a4c7-a72e12844e38", "comment": "Malware payload (Mirai)", "value": "090ac4ed2cd8e5512db333e6d89e7fd04dd25d14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261191, "uuid": "a8983832-1213-4725-943f-53eaf312c015", "comment": "Malware payload (Mirai)", "value": "5904149bddbabdc7d05610af2d800f8743441c840ae47dd3600d5e7a1b26c2c38095a8a97989a0b7be1d5e8c9ce6d293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261191, "uuid": "51d1a6f7-f855-4d6f-a280-6eed709d50be", "value": "T1F2F32981F9414F27C6C712BBFB9E428D3B2A13A9D3EA7103DD215F203B8695B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261191, "uuid": "bf06f1ea-beb9-4f29-929e-12fc7b2a6ce9", "value": "3072:tQC7toK0cm5aWW/i4SXdAcTvEG7kJ6hh19OMY:tQ2PoDUi4sd1T80kmOMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261191, "uuid": "722a7a52-8cee-4c8f-8b49-46fab90e2ee2", "value": 158848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261191, "uuid": "9cd5d016-c7ea-4043-9b7b-a9763b6f4e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261191, "uuid": "5f0d2730-b144-4d8a-94ab-8c11aa62d2c6", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd9db6d-b9ab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762280799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280799, "uuid": "bd14d0eb-f45e-46f7-8d42-f2c45e87a26a", "comment": "Malware payload", "value": "2051514eeefa7e40f089beeffe721a5b", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280799, "uuid": "1fd2975d-65f6-4f0e-80cd-781649307179", "comment": "Malware payload", "value": "c82467743dfc704a08eb3e1413b2c95bd8684905dd442cf7b99b829e23be5a92", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280799, "uuid": "42adc298-fa0f-484b-a3cd-b41dcdd06356", "comment": "Malware payload", "value": "d03deecc040afcbcc986f59ed1204b09708b3cdf", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280799, "uuid": "db9220f7-29bd-4570-8af7-07051ffec061", "comment": "Malware payload", "value": "8503be1c77c101e085063738c66170468397a241b45043c1babdb85b9be0b357fd1cb70a5caf09fbb2453f1d8287bb53", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280799, "uuid": "490e1478-2c4e-4cf8-a1c7-c4320bc0248d", "value": "T1F4A423834B3745FF7066C667E4B0005B74C90E149DE328BA5EED3A482BC4B956B26DB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280799, "uuid": "642448b9-63db-49bf-9636-8d9e27e4cc0e", "value": "12288:qnAdJgS1aY3cB4rxfB+XURtCecLZb9VOOKl1i1crxgQrp0ggo:qnAdJgqaqaCxfB+EPCecLZbrDKl1i1ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280799, "uuid": "14da5321-cfbd-49b1-93e0-d4fe23287fda", "value": 479593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280799, "uuid": "8b7612ec-cedd-48b6-ba44-1c7f29f6e300", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280799, "uuid": "3c3a927d-ec46-4d1a-9584-221a255cc2a3", "value": "Set of Documents (BL,PL,CL,COO) 3789994_48833.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c41f32d-b9b4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762284554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284554, "uuid": "cc49c716-2a54-4a8f-8897-2023fc89822f", "comment": "Malware payload (Mirai)", "value": "f34de3a66b69f74434d0aa13a03b9a10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284554, "uuid": "00c5a722-08b5-418b-854d-9c5591f4eff1", "comment": "Malware payload (Mirai)", "value": "c87e0c3d25451421729705118fd5b9c34ed9ce1f14cf40b067e6c2a6f86c9188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284554, "uuid": "518d0a27-dfcb-4c7a-bb95-a922bbe3e0c1", "comment": "Malware payload (Mirai)", "value": "e824a2f98bc591a286722c420436e7acef9923f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284554, "uuid": "53e38912-91b4-4307-aa63-15c41d782d55", "comment": "Malware payload (Mirai)", "value": "fd2293355ad6016ada1eb37e4bb6b8c8c2b53a071ee86b5ebc2973d8798affe4ff54356bd2b331f3280e35d9c0d16f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284554, "uuid": "3cc08755-261f-4ed8-a83f-d82f2b5fba8e", "value": "T177B2D03C1B111FA8DE0DC0BE839C0B6138B81B759182AD4B7217FD97AF968747453AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284554, "uuid": "b3a9122e-06d2-4476-b54c-3bf69b869913", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiftFmdzJgGlzDpH7uNj1Jm:neD8ZSWvZHZbs1row697qohQvg9ftFiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762284554, "uuid": "a1ecef57-1a34-455e-87fb-9a5f7e2647dd", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762284554, "uuid": "d932ab54-b084-4351-91a6-e88cda6f4360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284554, "uuid": "d4216b2f-8587-4716-911e-a2e1dde3f2d8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9b57b8-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245341, "uuid": "041feec5-a0dc-4d29-8f6c-a41cef3dbf28", "comment": "Malware payload (XWorm)", "value": "a08ebb1f84b2ba5789367a57431a0cf5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245341, "uuid": "5806acc5-f92a-4ba2-b73d-2db8cc92a067", "comment": "Malware payload (XWorm)", "value": "ca6452b33f57888116c221b88180f9561c0ed38cb778ee41bbfed5ed1a993332", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245341, "uuid": "d6983b5b-1eae-46d1-ab37-e4b87dee8b43", "comment": "Malware payload (XWorm)", "value": "fe3f6ba1161f0720552b75873289b9ad72a3d90b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245341, "uuid": "e2ae27a3-742f-400d-bc0d-0467e0415460", "comment": "Malware payload (XWorm)", "value": "739fb777aacd5e95d0bf902485b3e22bc010f7f18a76f5797cd4eab21be852ffaeaeca6af4304a68253afe423e3da5ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245341, "uuid": "8aca763b-7a16-4f2a-92ba-d67ec07ffeff", "value": "T19A055B70ED2801990B8B17EEFD6607A0C9BEC916123754F1F6D51B5D730A99CE3BE228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245341, "uuid": "d030473f-1e82-42fe-b290-a4607269777f", "value": "3072:XIR3ZRjUOiljUOpjEjUOsdHQjUOCjN7IjWjfjAK3jUObjUO0wjUOBcgjULjUOxGr:L4W3G9VLEfk66JIxn0eIZaqknigk/2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245341, "uuid": "67712b62-dbb7-4212-9386-810c07d3154f", "value": 811903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245341, "uuid": "cc718561-f83a-4f67-a8f1-fad78d0bed14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245341, "uuid": "848d395d-9f3d-42cd-9201-4103f7c556ec", "value": "RFQ_Items_list_AL OTHA-20251103_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801e6bb2-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762281098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281098, "uuid": "c163c9fe-e89f-421e-99be-6d0cfac84b17", "comment": "Malware payload (AsyncRAT)", "value": "caf0b5a87447c5bcaac97febd1cdf3e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281098, "uuid": "afefe774-412a-48b8-b8fe-359d00998ea9", "comment": "Malware payload (AsyncRAT)", "value": "caffd30a4dd6e48d1c921053995b2d1003536049c9ff2d09c35f398f3f7410a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281098, "uuid": "cb78b1c5-b738-49e6-939a-578f287c839e", "comment": "Malware payload (AsyncRAT)", "value": "cbaca50abaa752ee067e0dd035f6d15b9fc6f105", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281098, "uuid": "56f22c23-f646-4ce1-8c3a-10440cbb5c6c", "comment": "Malware payload (AsyncRAT)", "value": "7641b516448100bfbf21f4c8ccd9ea3f0b38d706e3f239950c0d6118a1eb66d61985fd75be686c8a61f2f91c635ce69c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281098, "uuid": "eccf0f7a-b578-4c32-b33d-c73d60ff4fad", "value": "T19C737D187BE64428E1FFAFB01EF57686DA79F7631503DA6F24C5028B0613A88CE416F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281098, "uuid": "237a0cd5-b7c0-4e47-a43e-bf8d78bf9bc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281098, "uuid": "126b2ff5-59ac-4f06-9f95-f3de42ea1385", "value": "1536:SK2955A/6XJHqzIaXa61x+by5GJZ63tcOX6LRwqkmUHR:ByJBaKO+b+eEtcOX2Gq2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281098, "uuid": "a2fa7f16-d7e4-4ec4-aeed-bf9e2b74c71f", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281098, "uuid": "4403d89b-2e32-42df-94ff-aee8a554c1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281098, "uuid": "145b9630-d485-4fe2-aa83-bf141362c438", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb21745-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237342, "uuid": "df1bd33b-58f1-4166-b51b-cf899d84f064", "comment": "Malware payload (Mirai)", "value": "43ac59c4c43349af1fa377c12c207270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237342, "uuid": "005e6101-8063-4320-bfe1-3c3582d6ceea", "comment": "Malware payload (Mirai)", "value": "cb67e37a84ceb8267538231d89cf2ae52b1bbebe513ea472cfcdbb933e309144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237342, "uuid": "c9036718-1b9c-4372-88d6-94f172c4d31f", "comment": "Malware payload (Mirai)", "value": "9b588df10cbd2808f23303d8930843dbf4b67a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237342, "uuid": "4c1b5fd3-91f8-4c7d-b778-2b630420ecaf", "comment": "Malware payload (Mirai)", "value": "6002ce4ca874221a0ab11d542346cf482c3eaf74f0e7aa67485a485d90d3ad94b00830e187e040ee6be2036dd3cbcfe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237342, "uuid": "b4dfa4c2-00c4-4310-a1f2-d1ee28a7ab53", "value": "T1F8634A62B8815A27C5D423BBF66E468D3B2563E8E2DF32079D312F5137C682F0D27A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237342, "uuid": "601a6104-2d58-45d3-ab48-63845e1553ba", "value": "1536:HJh0i6BIG8vgiNTFu91uf+oIHELX7qBI8rDJa10:HJh0UUCfJuE7GBprD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237342, "uuid": "97f96697-f8d6-4f84-9167-8191d1aef864", "value": 69028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237342, "uuid": "e1d20f57-78c0-48dd-b0b4-85fde99541a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237342, "uuid": "8f34c0df-461a-4915-9e6d-98caa151451e", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2afebd7-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289880, "uuid": "9b6ebd87-e15e-4108-be4c-6f212f50b04e", "comment": "Malware payload", "value": "f8a36614f3ec2862ecbf5e20e079196f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289880, "uuid": "cf9adf2d-ffdb-4654-8985-a46b87726a47", "comment": "Malware payload", "value": "ccd171c1cdc74d6462711d51fad299ebb30bcd433b39581f7315c22d48d90e1f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289880, "uuid": "50466fbc-9920-4d4f-90fe-37be5abbd13a", "comment": "Malware payload", "value": "251af937783b2d9a018a686659fe007ce9f0a8fc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289880, "uuid": "0bbf162c-8c76-4d7c-8d08-ca107d6affed", "comment": "Malware payload", "value": "555437f568eb728c512215f85a82816e44512f682fb997ca1f2d412f822a436d2dc83b9bdcd50011e6dfb9fc21dc3d2e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289880, "uuid": "bdc4d08c-f3fe-4bb8-a2a0-877edea400cb", "value": "T16D2284BCC5F1FCD04B1F33E075D6FAD5108A9B13ADAB1A58EA9C14A50B80355ABBC58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289880, "uuid": "bf93908a-d376-4330-ab00-e53d36b9323a", "value": "192:O1n97yTHMPZ0vLs6NlGZXCDzmVdh4PfB/TBiRC9hAhiPbyCh1xNiJy1ra2hI505J:e9OTHMKQ6utCDzmV7+pVvAhizyC3xr91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289880, "uuid": "7fc3d0e5-e5e2-4e59-b117-7886fad770ef", "value": 10699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289880, "uuid": "1e3757b0-01d6-4558-b3e7-0f736276598b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289880, "uuid": "fb950958-6e08-4b4a-a4cf-d8d2a4e047e8", "value": "PAYMENT CONFIRMATION RECEIPT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f00fa72-b946-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762237341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237341, "uuid": "f07464cc-ff99-4bf3-9f8b-17b960560834", "comment": "Malware payload (Mirai)", "value": "d67cdefd467a05c3b7fbc3f9ebffc7a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237341, "uuid": "4db58918-e5c6-4200-ac40-1f1672527bd3", "comment": "Malware payload (Mirai)", "value": "cce32047922f90084fa7c6fa16e13c795e82d250fc0a50fd9cbe85bf04f7ad8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237341, "uuid": "1acc9b8d-d39e-4c3e-8b4d-64cafd5e6dfa", "comment": "Malware payload (Mirai)", "value": "5316cfd6405169d0339c6b305bfaefef9aac3d56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762237341, "uuid": "ebd7cf50-e204-42c2-a09e-ec2a3e294fcf", "comment": "Malware payload (Mirai)", "value": "0de5d212da978cbaa68eae1a9ffcc33539595cc26fc55f44a3d28381baede5705a99224c5d1f1fcc22724b13cfb6f2cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237341, "uuid": "cf835a31-2720-4f3e-aa32-903ac387da2e", "value": "T1C7E35E56FA404B13C4D51779B6AF42453322A794E3DB730699285FB43F87B9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237341, "uuid": "5950519d-04ed-43e6-bd5f-9436462a2dd7", "value": "3072:atP5jHwaVnor/ZwLU03ZfFrgc7Yd/ak4nXD/oM/9g+HBmNwaCST3:UhjHwaVojaLUsZfFrgccdPsXDAM/9/HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762237341, "uuid": "cb3ce88d-6e17-49a0-84fd-18f0574a7e5e", "value": 144845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762237341, "uuid": "2662b61c-8f66-4832-a6e7-1fb353b965df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762237341, "uuid": "4024e918-da03-42ff-a7cd-af0f81f000ec", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30da4597-b98d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267650, "uuid": "fe5de4ac-5856-44df-a679-c32dcda80133", "comment": "Malware payload", "value": "73d26eb56e5a3426884733c104c3f625", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267650, "uuid": "c9abe932-6de6-429a-9464-bdcca0bb8591", "comment": "Malware payload", "value": "ccf7f7678965105142f6878d7b1f1f1c6f31fdbc45b0e50b8e70d0441f0b7472", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267650, "uuid": "b8f3a706-b00b-4318-970b-cff5ddc3ad32", "comment": "Malware payload", "value": "4d101f0ca2bd81c23f0e68dbf34b3cd6625188b7", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267650, "uuid": "db485092-336f-472b-bc0d-8f4967cfa677", "comment": "Malware payload", "value": "ebf99a6755825e6c697d3497bdfe9b57ec3b3aed70c6ec1c1b436e0d1fc324e0c1b218faf41acfdd506d41aae5bd43bd", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267650, "uuid": "7701ae44-131b-482c-8f7a-f62eb03a7b96", "value": "T1B803C403FB1E6536C05D83B0A69F03664B01F1151EA6630F2790C62C9EE97B66F5978F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267650, "uuid": "615b250b-aaa3-4d9b-ba8f-26aea4bea853", "value": "384:68UegNz5fDVuql3y/7y13JYD7gDqlOa7HUJCl:6Ul7yRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267650, "uuid": "9ec22da8-6bf1-4f4b-a9fa-95389afe98cd", "value": 39504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267650, "uuid": "ea2005a8-4306-4999-a315-dde0d945d51e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267650, "uuid": "431e1cd5-d3d1-4d15-ade7-b87279644c88", "value": "ccf7f7678965105142f6878d7b1f1f1c6f31fdbc45b0e50b8e70d0441f0b7472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7908a0ba-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217520, "uuid": "6c08c22f-cb84-48df-bef0-c2c7aecb6a2d", "comment": "Malware payload (Mirai)", "value": "660559f7f976317d0521209444273a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217520, "uuid": "39d9ead9-7214-4978-8f78-8d28f5f40c42", "comment": "Malware payload (Mirai)", "value": "cd704accf1b5afbc03ecfd59c6e68fdfc01291c8b4c3f5e6cbfa03e0934ef6bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217520, "uuid": "c6046279-165f-4aff-9b14-c7206f0dcb08", "comment": "Malware payload (Mirai)", "value": "97346a60035b8d78f28640c9524a5d050f8b2699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217520, "uuid": "3c7173d2-e058-4418-8446-877636927d4f", "comment": "Malware payload (Mirai)", "value": "6554593b3ee44686c8b1901f08db658360d43d9026b2dd2ade3a0c287985f33756c693df661c72fb4c02c9acf017ce68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217520, "uuid": "09ee4696-0a9a-4522-8570-b926d1e3d81b", "value": "T1A6F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217520, "uuid": "9d347c37-6f54-4590-9d16-31f6bb3fc580", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHmfam:9FJMgWPZr8IaCWReS1WpPej7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217520, "uuid": "be5d3c33-7d4b-47ef-8647-5b769fff8ed9", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217520, "uuid": "047bcf59-73d2-407a-adb5-73238f0ef535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217520, "uuid": "f8ab0f26-2d14-40e0-8976-c22528ef6211", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fb019b-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281099, "uuid": "3996a453-1042-4300-b0bf-17befcc14b36", "comment": "Malware payload", "value": "0be8f0b62a7ede9474cb09588488c1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281099, "uuid": "55030b4c-5d03-46ba-a81d-629e0c1c8c7f", "comment": "Malware payload", "value": "ce9ffdd4c4aae628610a18c000844f4963d763f6c3c13181c243f351b26572c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281099, "uuid": "dec8e267-962e-4aa4-bfee-4ec1b9fc503f", "comment": "Malware payload", "value": "719681c521dbfd4b54bb4b6ef9839798811fcd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281099, "uuid": "59ac10f5-e2f0-49e5-a9c4-f42fb880e103", "comment": "Malware payload", "value": "f88107956777dcf51d3d79d667128bbda90289842984a7dc8483410342600b4a0405a10ead61a49a279c4911b5fd9b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281099, "uuid": "8cbc86a8-70a0-472a-9ba7-421c9448805c", "value": "T1AA44D60CFF91E805DE5A3C37CFE610108B7121C22E22964276596FFD8B9937A58E65BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281099, "uuid": "af9841cc-6c4c-477a-aabf-ce15fa443aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281099, "uuid": "473691c2-00b4-4ccc-aba4-0157a634db59", "value": "3072:NbuAUTZeQ4NM1nNeN3w/jhlhE1Z8Nig9D8B/FGbvw+ldb:Nf8X4Qe6VlWT8b9IBYbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281099, "uuid": "c6af79be-528f-4610-8284-58bc68be386c", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281099, "uuid": "d5124800-b236-4028-9860-5a7c78010fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281099, "uuid": "b5e8bae3-3400-4b75-a641-e2c56438a842", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef487bf3-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289874, "uuid": "11ec958e-b42f-4fc4-8970-29dc5d037a7b", "comment": "Malware payload", "value": "72998b8432204cc61417183169ca9332", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289874, "uuid": "984217e1-bf4a-44ff-9900-e633a9c89921", "comment": "Malware payload", "value": "cec3480411041c615fa16fa1c62c0dad469e06ff013381244b5e7b11f87f1e45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289874, "uuid": "b57d684b-7667-40d5-aa6a-b10ad11fa6e0", "comment": "Malware payload", "value": "fbefcb4b7697118115b35f200572902d0b6add31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289874, "uuid": "ee4931e9-5893-4b6d-8ed0-f43231652bb8", "comment": "Malware payload", "value": "85f8c3c98388750819ec187e23f1a8bce107f83fecc38a8429c2f8aca6422fa5ceb978013a66a77b7f64f5aae12ef899", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289874, "uuid": "08cf97ae-6ff0-48ce-9238-15458d2c8f05", "value": "T12616337987AEC31C753846461FB03B00A54401EAF947D29A34CD07BE9B35AEF91BA93D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289874, "uuid": "72d6b9fc-0e39-4559-ba1e-d4188f133703", "value": "768:kUtXa/tGcBG4u1HghO4dp5UxYW+b9yqWkjK398mPfTWpe3n/q+Xr3f03PSswcbpj:RNaxGfYe+b3ErWpUDr3f0fn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289874, "uuid": "710393f5-0c90-463a-93d8-d0853ca8c8ac", "value": 4204050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289874, "uuid": "84d577a9-5eac-4371-837c-1f25537736b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289874, "uuid": "535e38f9-5ea0-47e0-88a9-a3a28156656d", "value": "Swift Payment 202510314891581415.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5cf97c-b993-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762270438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270438, "uuid": "c6903c3a-fb78-4426-84c0-c202bc4e443e", "comment": "Malware payload", "value": "b40d3801182ef2e4c5584af3499933bd", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270438, "uuid": "06a0a878-890f-4b0d-8d3a-c232d2d46b93", "comment": "Malware payload", "value": "ced6f0e86377df269f92007123890005f6a96931901eca9b6b9da87fe5fab48f", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270438, "uuid": "63e70d71-e2bf-474b-add9-aef13851effa", "comment": "Malware payload", "value": "07e92d2af8aa76398d29289852c019b3d8695384", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762270438, "uuid": "5c15d413-8c5c-48f3-9ebe-3298447f5953", "comment": "Malware payload", "value": "c2fbd753daccb9aee034fcc99b8ba52c5f5fabb19957e8c8ddc8d7c56be9400d703437d690b6fad7fbdfbaa77534c2e4", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270438, "uuid": "1e61b59d-0094-409e-ae50-5b3f51c23f02", "value": "T176952331BAE80026D4B787B089F323F717363CD89A64A2C72741581A6DF13D5A97876F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270438, "uuid": "ab9776c8-e467-4415-8d58-be87d8c05bba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270438, "uuid": "7c317109-5240-40f4-9555-bbf0bdb8ae60", "value": "24576:X1yVgfQRXhMbkkTJDruFnKfE6NsCQrS8xo6RMLwn4vX81od/1ztMuv1t3FA7nw83:ggWXxwJDSFAEgsCMSJ6YvfrzyCtAE83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762270438, "uuid": "3076d66b-f372-4d78-82d8-aa196be05fc4", "value": 1985896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762270438, "uuid": "26b35ff6-d71d-4c58-881f-2a4fa25f6845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762270438, "uuid": "6a9c600e-7d02-4301-a317-c28d1c4c86d5", "value": "ced6f0e86377df269f92007123890005f6a96931901eca9b6b9da87fe5fab48f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d3e014-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762289879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289879, "uuid": "eb2d0183-9248-40a3-b9ed-b163f9d3969c", "comment": "Malware payload", "value": "fb30196933e1db157ba94b4aaae8f5d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289879, "uuid": "680d0a1c-89d1-48dd-a284-158498c5b048", "comment": "Malware payload", "value": "cef9d1c9906840fc5441afe203af73605bf51012d1cd78310a68e63971ac7f55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289879, "uuid": "9c535874-8cb1-4994-8e51-3e93d44acacb", "comment": "Malware payload", "value": "6af61e966e27e2eb344a8574feac7e0e3941a7ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289879, "uuid": "9684a992-caa0-4db1-8d49-7047dbd169bc", "comment": "Malware payload", "value": "f46a6d7cd4e515324f40cd4ddb5f824175715829260eb2a74ddd90f375f85117dd44308b08f3428c8b701d199e91b62e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289879, "uuid": "cec5e0b1-5ce7-4565-90c3-e9711d244813", "value": "T1F473141232AF821876F6178D92AF11740B7B7E4A093D815912DCB64E8FF39058C9A7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289879, "uuid": "2f6b1f4b-5bbe-46d3-9708-9891a9f79145", "value": "768:A1C47MLXgPaTuxWuxWuxWuxWuxWuVuxWuxWuxWuxWuxWuxWt:A1LxyTfffff6fffffft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289879, "uuid": "1323fbcb-e9c1-4d26-a0c9-de878f3c90b9", "value": 76476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289879, "uuid": "ad101538-9489-4645-8e38-31023c8cdab3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289879, "uuid": "dfc949c5-a1a8-4ca3-911e-a23ad38e0af7", "value": "Trip route and Pax details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ef9ff0-b9c0-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1762289884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289884, "uuid": "9384f40d-9851-45c2-a475-ca528c3865ea", "comment": "Malware payload (ConnectWise)", "value": "6f0aa5221c6475b8aa0b899ec1fedaed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289884, "uuid": "dec31275-9a10-4253-9346-b1865d059087", "comment": "Malware payload (ConnectWise)", "value": "cf5fb8b24dc350c3294e4ec3f06cb2cb6b142769226a5396a6ff3a0243720950", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289884, "uuid": "1dd6af3b-e424-4920-a993-588fd42eb40b", "comment": "Malware payload (ConnectWise)", "value": "0140379f50b4c71ccd26873693ea8c8594b71ff6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762289884, "uuid": "e4719ea4-d99e-4a31-a890-8854f28e98ef", "comment": "Malware payload (ConnectWise)", "value": "a1a30566ac810be42d8681341c66f27c6e97afa67bb3a0f746d91df8bab2004244f01e1bfc9de52e42fdae76c6826e14", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289884, "uuid": "7c782fc0-3863-4bd1-bba1-682da0a03b26", "value": "T1C2838D43B5D19871E9B21D3118B1C9A15E3FB9211E348EBB2398026E5F741D0AE36F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289884, "uuid": "2a27d782-3096-4fc2-b2ad-bd1e1333de27", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289884, "uuid": "5cc9bb9a-e241-4f26-a7fc-9e534023eb12", "value": "1536:KXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWeuHi9:gE3x5KBDYiKWm/iSw0fRMvyge/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762289884, "uuid": "633782e7-198f-41fc-98e2-e5e3d9e26667", "value": 85272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762289884, "uuid": "ed2f832d-b3d5-47ed-9ff7-1d29c7d1560f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762289884, "uuid": "a1fac537-0882-4a15-b4a8-96d01148578c", "value": "manager-wodugK-6192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8f9af4-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245472, "uuid": "1a3c1af1-366f-4203-9ee1-88d0ad7fac87", "comment": "Malware payload (XWorm)", "value": "4b7d676740224c471fcdde7928f6c7cb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245472, "uuid": "e1110adf-2073-4568-bab1-eac669bb660b", "comment": "Malware payload (XWorm)", "value": "cfd84924505878361e9813ac5466a8340b7be8d73816b4c1ea74d0ed1bfbc2f4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245472, "uuid": "3da24762-d8c6-4275-b64d-7223909d7cdc", "comment": "Malware payload (XWorm)", "value": "8c7d7cd696d67724319699bdb600ad852d0671d7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245472, "uuid": "fff7c71b-6df9-4987-ae41-b594158bfaba", "comment": "Malware payload (XWorm)", "value": "a29889e2206f6c4ab0b33250f757b24995ee06e4e1eecd4b65710c754710d44ac07efa1471f66d1763195081e54d9dc5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245472, "uuid": "8909f07a-6787-4135-936f-c9e280415ff4", "value": "T1DF453644ED9E62CD1536F3E40A3BC060534EE7733A158C277E5E9A242E96169EFD3C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245472, "uuid": "b5a5809a-e7b7-4e42-9f27-a51b1b762bcf", "value": "3072:eOOlBMXHwciCLIkqVCkoeNV+QHVH+RFVybyq6bAmRmfZz6ZJZOK5wZuDq:MKXrjsNVcQHVCU6bFRmfZz6ZJZOK5wZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245472, "uuid": "d0bb1397-8748-4a21-9eeb-84fa28992b96", "value": 1276059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245472, "uuid": "84bf4667-cb82-44b1-926c-dca8c4535945", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245472, "uuid": "622d2fb9-a37b-419c-bff0-7f1fb2a6dcc2", "value": "uhqdump.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5f14f3-b984-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1762264131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264131, "uuid": "a16b503f-eba0-4fb8-a33f-e12fc7548c63", "comment": "Malware payload (a310Logger)", "value": "3b687a99a8dcf4b24901a17e57d69d7a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264131, "uuid": "14666739-286b-46e0-99e1-a6db3f97e18e", "comment": "Malware payload (a310Logger)", "value": "cfdc444b512308ef7d1effd534746589807a6366a8b7dae8786bcc9c0e601d64", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264131, "uuid": "7d12a6ab-f0dd-4353-88af-d5493fd26d1d", "comment": "Malware payload (a310Logger)", "value": "ebcd0cfb18210eb26fc90f8f0cd8b863ac595568", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264131, "uuid": "d70bcd89-9342-418d-81ee-9cfa8cd2388a", "comment": "Malware payload (a310Logger)", "value": "7648c431344ced906688123f9bac55d2f64d793b6177094fcae175ad602efdfd87b431c28813d4e7be0722f8177b5be8", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264131, "uuid": "c10f75b6-cdcc-4ea8-8b42-9b3d5d4e6134", "value": "T1B85423D9A9366516BDA4400A059D2D8EA83F86D70570F4DFDE2C00E8B22FEC53D7EE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264131, "uuid": "39b2bdc5-922c-445d-b56f-5e21ad773b91", "value": "6144:kT9X0oQbagV5znzQWtkeDf3SD3vdbrzyWTkVrk/vC8sljT6ALWVD8ms:kTJ0oOay5ztS+KRrHgVA3iT6ALgDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264131, "uuid": "4db28ab9-5fe3-43fd-83b6-3e45a4aaf4d5", "value": 291455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264131, "uuid": "9861a022-31a8-4d18-a50e-346ed749e490", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264131, "uuid": "24503f4e-e8c6-4349-962a-737cf781c02d", "value": "DWG5675456754.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45958c03-b9b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762284865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284865, "uuid": "4f9673db-a1c9-4ce3-8b10-eb37c3084aa8", "comment": "Malware payload (Mirai)", "value": "19604055da83d9014a60149148ca1d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284865, "uuid": "91fac9b0-2068-4b8e-9b4f-db8dafbc8579", "comment": "Malware payload (Mirai)", "value": "d0d648d3fe0478497fcd8aa035ca6093fbee2a2da49703e14f8b13532e505d61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284865, "uuid": "1f2276b0-82f5-491a-b96a-445aa5c2122f", "comment": "Malware payload (Mirai)", "value": "39d864ad3a80678ae4bda30ab8054e89a2d290ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762284865, "uuid": "54e75ace-f434-44e4-b08f-c175e4085850", "comment": "Malware payload (Mirai)", "value": "e1e1fd92667656a25a40af39eafffff76a0d6eba7e475a5ba012aa1d6fc7d09f1ac1da01bea96f6361ac24d469667bde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284865, "uuid": "cb723133-5085-478f-b373-1290d3e70680", "value": "T12AB2C0CC61543084C98D7C7C578D4A664F68A1D0BAED8B26E364CD98B3BEA8F385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284865, "uuid": "f9615626-e46b-4151-91c7-ad8b03376f91", "value": "768:otrQlS07dEv0UXqUhvQE+CXQKMQKCXBpwmZqqWvA:iQlS07FUXqIYSXQKquwqqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762284865, "uuid": "61035624-3d15-4e55-b768-df4b038c1d8e", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762284865, "uuid": "86773d68-2431-445d-b7f8-fff2758232dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762284865, "uuid": "2605b2a5-6067-4991-b2c9-e5b8c83453fc", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc433577-b92b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762225847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225847, "uuid": "b8ddff8c-bb87-43ad-b92b-a561471a50e2", "comment": "Malware payload (Joker)", "value": "95111a599051852e17045cfaa40dd141", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225847, "uuid": "67ae606c-27bb-4895-9e19-67e7c4a98a09", "comment": "Malware payload (Joker)", "value": "d15bba544b3197e67c3b32931d93eb41e69fa62696e7ca9c0cb870c7b9b9fcd0", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225847, "uuid": "72326998-94af-4207-968f-aebc58569623", "comment": "Malware payload (Joker)", "value": "0b4d71ca804d7baf13952796441cb3760ed7987b", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225847, "uuid": "0ed54d0f-a6cc-4688-b27c-72da4963c007", "comment": "Malware payload (Joker)", "value": "5a14897dc11374e82a6e9d9872c95a7a111f42c09f35c19d4909674279116c7d7663c8eb8a1afc77cc6d7980681baeb5", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225847, "uuid": "3569f230-8f5b-4c23-889a-6a54c7778ef9", "value": "T1F6171245F70CDE1FC8B7B0B64E699272621AAC114683C3976C087B5CBAB76E40F56BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225847, "uuid": "273aeaf6-b116-4a7d-9ccc-cfb2cf7f1777", "value": "393216:SL3iamwcr2tEeIKeyvFWJrprXDQCkWlnJm70oX6R6c6i6Q6wNJccNJ6Z:k3i5bUSKIprLk4nJmQYivBzrNLNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762225847, "uuid": "80f35d67-7496-41c3-8f1e-a7d9e743f1a4", "value": 19668128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762225847, "uuid": "cbfda96a-6826-4d9b-ab25-2a68b8521875", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225847, "uuid": "7c24fd57-7c35-4a76-b412-8005809ec0d3", "value": "Emoji+Smiley+Wallpapers_3.0.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8eaa5ac-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762245599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245599, "uuid": "ba39847f-0ccf-4e07-ad29-0cea198955ca", "comment": "Malware payload (QuasarRAT)", "value": "729c33511834266c3ef49e0b62c0e4ba", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245599, "uuid": "837c5818-b27e-4e3c-80ad-32007132a3f7", "comment": "Malware payload (QuasarRAT)", "value": "d25df8d5b45fe5cd79e2b45896459838b06ccc9abf6358d97232af011d273976", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245599, "uuid": "8dce5b26-cab0-48a3-a93c-07759fb3dc8a", "comment": "Malware payload (QuasarRAT)", "value": "d157eb7921c0ffdb0e885d7d07977304c69c5b37", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245599, "uuid": "d76db14b-52f4-4bc6-930e-967e62ab94dd", "comment": "Malware payload (QuasarRAT)", "value": "f881fa5164736cd041de300fb9d116d31524262bdfcf31e3fe1194e40a80e5d124c2ad6ca5417d3a0e78692992747fdd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245599, "uuid": "274eb62b-c4ef-4813-99a7-fc1afcc52ee8", "value": "T1CB46233635815E44D07F4BB8C93444C167F26E4FAF11DB9E75A92A9C7E02287E32272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245599, "uuid": "debc6858-1bec-4ab9-90c1-12fd4a7784b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245599, "uuid": "f52fe065-9150-48ed-9eb5-b9835968c253", "value": "98304:BE4FFbyuSmKB526pCSP7GImvSyrdD1nv9Q37PE4rm:BZqLCSPKLKyrn9Ibr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245599, "uuid": "17628b0f-b32a-4138-b684-c8fc446900c2", "value": 5618176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245599, "uuid": "e55db0c2-2d86-4d50-9208-2cb98ca03387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245599, "uuid": "261771f3-39e0-4e52-a532-0d986a47c24b", "value": "DHL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa3068b-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236376, "uuid": "3fb1d2e4-c0dc-4477-9d50-a949070fa348", "comment": "Malware payload (Mirai)", "value": "89224c46bcf241447dd53a4dc052918b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236376, "uuid": "7d429868-29d7-4b04-a901-26095b2d0bd9", "comment": "Malware payload (Mirai)", "value": "d3f7afaebecd6ae6215918608ff2691f48faa64a146e5aeffd18924a0fdb2db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236376, "uuid": "bff88c77-0201-4375-afd8-6421953326ad", "comment": "Malware payload (Mirai)", "value": "24c72b69f9ce819613de6751452ff3c394cfa15b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236376, "uuid": "e5b42ed6-560f-47af-97a4-b3b3cb559123", "comment": "Malware payload (Mirai)", "value": "d7e3da9f4cb0b19ee7fda187e7c4fb367060d54c2772fef83bfb5615871f46f1e8e6c61253b7cabb427eb9a985bfb195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236376, "uuid": "001ba3e5-ff89-4594-8f10-3ec4b66b3ef1", "value": "T14203F1731677E7F9C47B773AC0CE9C24ED72302292471F1709A517EEAAF6A5206A08D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236376, "uuid": "53d75d7b-0bfd-4251-9207-439534718ebf", "value": "768:kQ+SzH9P95JAY6MTv8Erjgyyp86BZE2Ou8dk70Cd1W/FtEVs+x0YP:kQ+YP9bAY6289I6PE2Ou8+J1oFtEVjxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236376, "uuid": "acc52ba2-db2b-46a1-ac09-139a7ee0fe46", "value": 38972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236376, "uuid": "dc5c8523-8ff4-486a-b0e6-60e53d08b626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236376, "uuid": "891a24ae-6c60-45bb-a1c9-1eaeafbd9858", "value": "FGx8SNCa4txePA.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441d85d5-b990-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268971, "uuid": "9cf604d4-e57f-4a3e-a380-69855804f199", "comment": "Malware payload", "value": "b576ea6088c89efcfa92b5865084f001", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-0555", "colour": "#974297", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268971, "uuid": "cde901fb-0256-47e0-8256-d9e380d867ea", "comment": "Malware payload", "value": "d49a51bbc86b86267ada38ab192f88c8d7ee210cd430beef2cae3d7af00a4d5a", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-0555", "colour": "#974297", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268971, "uuid": "728ae9a8-2e5d-4392-a2ba-b05a7c7962b6", "comment": "Malware payload", "value": "927fd8ca657515e46fd20c9c3711132738b3cff8", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-0555", "colour": "#974297", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268971, "uuid": "fe875a45-f54b-4126-9f4d-edaee06d8cd8", "comment": "Malware payload", "value": "97b3ac055288229eca0d17aeec041cbfdfb04eb6d6ca6270cc0a22eb77e5a7b1fa90c48b7a50ab6d0d2bd780cf6acd6e", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-0555", "colour": "#974297", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268971, "uuid": "bb603b37-7ed6-4408-9763-6438ce3ed867", "value": "T15A66339476EA6E720E20F3F5E26B14F061B2FBE3D211C5C22751565DECB1210EA88EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268971, "uuid": "d36c5af6-f550-4591-ae0c-bdb422d61b2f", "value": "98304:AajDRM32A7Q4iR9lb5xRpzWqcdkPX6oaPULADYsaOvk7cR+KDmwR2hTGXpHaeHIo:AaO3Wx+qhXFU3DY4R+KhGShHILqoo52C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268971, "uuid": "45f78e78-e4cb-4402-baca-d11437290a58", "value": 6766602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268971, "uuid": "08e5afcf-9591-448e-86e9-c7907a0f081d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268971, "uuid": "2157b486-2198-496a-83ea-12ea44dabc8a", "value": "\ud835\udcd3\ud835\udcf8\ud835\udd00\ud835\udcf7\ud835\udcf5\ud835\udcf8\ud835\udcea\ud835\udced \u27ff \ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f \u27ff \ud835\udcd2\ud835\udcf8\ud835\udcf6\ud835\udcf9\ud835\udcf5\ud835\udcee\ud835\udcfd\ud835\udcee - 0555.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31f990b-b951-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762242207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242207, "uuid": "9c658707-f9b1-49b4-b3a1-f4196b7199cd", "comment": "Malware payload (Mirai)", "value": "c580ec396cf58cb578fc5067ea487baa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242207, "uuid": "197753b0-8195-4aef-ac8b-d20e666d1450", "comment": "Malware payload (Mirai)", "value": "d51e3825c28a858d438229bd88050835e090f1923b1935fb321d9d5790828653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242207, "uuid": "5efaa910-1387-4e2c-8899-b88cbc63e50c", "comment": "Malware payload (Mirai)", "value": "417eb95fe7ceedaa1bdda6c6e37478f4f94b7df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762242207, "uuid": "bb4899d1-e7d0-4e48-9d00-336fb474da17", "comment": "Malware payload (Mirai)", "value": "85b7c5d63f3481f646cbb43fb13630c4e01b8ba79e67328c2e762eee56e82f11882b05f760601a1175cf3577e81966b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242207, "uuid": "8ebfa5e5-fc68-471f-badb-132e7e78bf50", "value": "T131E2E193C5A22FC1FFBB0B7AACE2C79AA3D01D15594ACDE325EAA6211252167E500CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242207, "uuid": "469421a2-f407-4614-8694-a5b1ce9aeae3", "value": "768:wVU0vqgi/0mba0aZDoeYmaA5TpFD/XTLIg3hkye24uVcqgw09W:w9DlxDoXmR5lF8gxe24u+qgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762242207, "uuid": "7485ae3f-9bf4-45a8-a569-c867c2448b7d", "value": 33492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762242207, "uuid": "908cda92-ea8d-455b-a30b-6ee83a7b098b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762242207, "uuid": "b7066f85-394c-4809-84ab-b97b32b786ac", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200018ff-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261180, "uuid": "c92b921e-8df3-4efe-86fa-f6d1a9dc8f3c", "comment": "Malware payload (Mirai)", "value": "a686e5f1248fb6f99d32fe4b5510450c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261180, "uuid": "23fbf25b-d995-45ee-a760-db6fae520c97", "comment": "Malware payload (Mirai)", "value": "d59d7f2375248d55409ca3e8b0a0a0d9fba3502451b915c53515f6cc4495fa7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261180, "uuid": "c270769a-ed9c-4ed5-9bd4-62ab390ecc03", "comment": "Malware payload (Mirai)", "value": "c13b7d6f10004bd7f9e9ea1cccfca969d1352548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261180, "uuid": "4691f9b5-1827-430d-a0dc-5095c9029fd0", "comment": "Malware payload (Mirai)", "value": "c7a1e78d9bc12017717be8f39c6e2c100d6a40302ffba4b21d8bd6c3865e69faf860d207e69fda9956300fe168fbff44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261180, "uuid": "cb3ef31d-7f79-48a4-96f2-0dce951f0d29", "value": "T1BCF34902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261180, "uuid": "66667557-2a2c-4c6b-954d-2211778b5c28", "value": "1536:SW3bmyGKnCcQjYpySAxgDVT5vhiX+EFW+tk4lvAbRoeDG/t2ErQqh7M2IymQY2AS:tLm3Iy4y5xAVDiFWokPbdE66hh1X8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261180, "uuid": "5c647a94-2f2e-468f-a053-8776f25edb5b", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261180, "uuid": "a3c91ac7-da82-4a3c-b7ea-5016748bc122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261180, "uuid": "822845b6-d338-4c86-82ba-db092c4e1d3b", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289b6d99-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261194, "uuid": "07b602e9-496a-443e-8c90-183cdc608bb1", "comment": "Malware payload (Mirai)", "value": "d3db093868295e6897c82ebfefe7c5ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261194, "uuid": "4ae68266-1f20-475d-8ab3-6bfd8e71137c", "comment": "Malware payload (Mirai)", "value": "d5e0d76046a8d3e45f4504ecde8709068189b67ba03771b6c7732ffa9efe9f5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261194, "uuid": "66bea5a6-d2ad-4188-b2ac-631337668ca5", "comment": "Malware payload (Mirai)", "value": "5641774ac560ddb8542b11dc9217d3058c6fc186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261194, "uuid": "88f026d5-2bb9-44f0-85e0-c532f786b5a5", "comment": "Malware payload (Mirai)", "value": "ae9ff67b9db39c1fc79ef96c725915ffdbeac17bc1cc9f5a874905fa2308d0e5b858edb5477b4b10b1ce2eb7e45918b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261194, "uuid": "e35129e2-1288-46ff-8312-552bb72b3393", "value": "T1E5243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261194, "uuid": "ac769c62-2a82-4348-a4b8-6b6ca84d6a42", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKeYxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwM2yQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261194, "uuid": "9b752697-8c20-4ecf-87eb-03eadde2ceef", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261194, "uuid": "8323eecf-6038-493e-974e-6d9e981a3cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261194, "uuid": "743ef975-343d-4477-b5a0-0fd24b1434ce", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478c143a-b9d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762299042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299042, "uuid": "19abbf1d-2240-45cc-9644-16c3225d7804", "comment": "Malware payload (Mirai)", "value": "f8fd437cea340e9625ab94039e91d5fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299042, "uuid": "4ec4d45f-5231-43d1-9097-56a1d1c9101e", "comment": "Malware payload (Mirai)", "value": "d6168c8fe0f32a6f14fc9d03d2ed012684d0c9399f9af00684cd3cd6a995be6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299042, "uuid": "8cd04743-9331-426a-8e43-0955293deabb", "comment": "Malware payload (Mirai)", "value": "a3073aec5bad825421b7c033df1fddaf9718c3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299042, "uuid": "3465b335-5cee-487f-b1ec-3a3f10468ad2", "comment": "Malware payload (Mirai)", "value": "1ad514f2e8287778cc36c08f6fea12b6f691ee265b381d3035b7ee42d3337ab8c35b3ea82a06cbf409c3c056696a7a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299042, "uuid": "a89fb83e-0168-4739-9507-124aef87ed13", "value": "T12603E22BC8E48B8ED735527D654F2B872500E05F140C897889BDBA79854AF3BBD392C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299042, "uuid": "3bf1130d-3b81-4565-b1d2-e51be1f5f2da", "value": "768:gSr++uLn10o4L9wBZusvDmANwjt8c+k8lKdFbhmBConbcuyD7UHQRjt:gSBkyxL9AoImCOOHDIrcsonouy8Hyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762299042, "uuid": "b51cda79-8bd2-46b2-a84d-249c4bb89c9a", "value": 39384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762299042, "uuid": "1c108296-ed99-4ee2-bc39-d4087344d0eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299042, "uuid": "50845852-57e5-4fca-bccb-0fc740d26217", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1eb03d-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762249063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249063, "uuid": "2f6cb352-784f-461d-b9ee-9edce8478734", "comment": "Malware payload", "value": "40408ad220cf977f4aec5a7edef1e6bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249063, "uuid": "b65a3130-860b-4a49-8724-b0516080b3f1", "comment": "Malware payload", "value": "d62cb31f67d74be189eabba37031a49f3bcfc33e5e5be644890e79fc658e5846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249063, "uuid": "84285bd5-51d6-4794-886f-ac3b21f23868", "comment": "Malware payload", "value": "5355d1333f4c8d54b97977e8e88fa9eefbf526fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762249063, "uuid": "ec03b061-6e76-4787-b373-4c809e435c1d", "comment": "Malware payload", "value": "549661b7f715c44c2e773e188e76ecb0abfc3e07cba862fffa3d89fb1781632ac71a8c3e96e693e7f5aeafd1be866420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249063, "uuid": "a8364533-4c97-4504-8aea-e4c0f7b1216e", "value": "T1DA051C7E5963A12ADA4A80FC35594B6259B1B73B03B41FF70066813127079B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249063, "uuid": "9e83804c-c6a3-4138-b116-05afa7fbe855", "value": "12288:mWncAtJ1cYLaQriMI1FXweW/QAHqYoX/fq6VPzm4JJVxxmbCCWvdkEWRKBNSh1Wz:mItkYWwiMI1FApyjmmvd0Kju8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762249063, "uuid": "9a20c7e5-8476-4bf4-999c-98dce81851e0", "value": 803460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762249063, "uuid": "872b08e0-9698-4a30-bec1-f62cf0470c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762249063, "uuid": "5fe32708-435f-425d-8c1c-a08bc5c9781c", "value": "d62cb31f67d74be189eabba37031a49f3bcfc33e5e5be644890e79fc658e5846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e330b4-b95c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762246875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246875, "uuid": "d1674768-ea42-439e-be26-67427bce9d45", "comment": "Malware payload (AgentTesla)", "value": "eacf14cdbc418f9aef2c3d4cc3ac6de2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246875, "uuid": "1ab0b3f4-dc46-4b82-aa0e-be7edf6eb841", "comment": "Malware payload (AgentTesla)", "value": "d6a2f7958a8b164ecf961d01e8ea8545dac0965d6b36e5360c896c780cbf5092", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246875, "uuid": "ad971d9e-095e-4f52-8e02-70c4e597bca3", "comment": "Malware payload (AgentTesla)", "value": "697368dfe0467f49a82e2a0e5057cf09eb57c609", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246875, "uuid": "bfce9425-4352-4938-97ee-09d0b9d38aa0", "comment": "Malware payload (AgentTesla)", "value": "2e7becac36362bb0fc65f7380e6084b3f66b24332663e056a6baf7caaefdc08bc4b02e08697bb5d3bbc1ca12b8e9a26d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246875, "uuid": "17a5ea0c-cc0b-4434-89a7-c62a1aa199ed", "value": "T1503512F22983C390F1E6C473A86FBDB249D121B8F3CC2A0C96F1A659BD65CA56D3D450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246875, "uuid": "3c0d4078-c56b-4b5b-88ad-bc0fb68e0efb", "value": "24576:avGRpf4ZwDlZBirWdV1ABamIqUUnswhgjKLrkllO9qNYvtksPX:EG74Zwhq8f0JIqUungjQrJhvtPPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762246875, "uuid": "f471468c-8b58-44bf-886a-5bd8d41b7063", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762246875, "uuid": "9a38fd12-b504-4beb-aa3c-47acbce46c50", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246875, "uuid": "c8da305b-fab2-4bac-bdff-796df531c3b1", "value": "nOrder_No__20251104-70611_of_04112025.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60388027-b98c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762267300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267300, "uuid": "73ceee16-03c0-4e66-ac4f-4d4c0f400e30", "comment": "Malware payload", "value": "391957b1224e597562a3e179d70a8546", "object_relation": "md5", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1464", "colour": "#5DFC4A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267300, "uuid": "05438760-2ccf-48fc-972c-e826f1cace40", "comment": "Malware payload", "value": "d777a2285a2f10e70633a7f17ad3235683712acdc703f9f0eac115e209de2da1", "object_relation": "sha256", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1464", "colour": "#5DFC4A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267300, "uuid": "0684adb9-3599-45a8-bcd1-ab5dfe5c30a1", "comment": "Malware payload", "value": "5c0fd2d150b0615434d7ef4c51859a8388e95934", "object_relation": "sha1", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1464", "colour": "#5DFC4A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762267300, "uuid": "a4bfa6d8-08c6-4822-84c4-bb52b9ba82b5", "comment": "Malware payload", "value": "d3c8846d16c6596e04217f71fcb6faf0c833bbc16682cc969cd48e4292aee03b255d8db2d4cdbceb5b47e2e8fa98d13c", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-67-156", "colour": "#C8A607", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1464", "colour": "#5DFC4A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267300, "uuid": "bd668ad2-bd3b-4fad-903e-811bfc8e9c82", "value": "T11116332DB0F065C6E3D4D1AF036F18D5263901266CF347E771A9D0FE899C47EAC49A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267300, "uuid": "d469c00c-ed74-4834-b251-7fa5e7542eed", "value": "98304:NjbbP3UuXPdXWbMUk6VGWR/zB8eKNZ7/humGi+gGm7y:13UmdXWbMOQWlvKNamn+u7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762267300, "uuid": "3534a564-5fdd-4afd-be07-c344f2723c6b", "value": 4313395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762267300, "uuid": "6d45d66c-4ef9-4b45-bd46-26f36953ec67", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762267300, "uuid": "782ce6c3-603c-4305-9881-82959a17d567", "value": "adobe_premiere_pro_2024_v24.6.1_(x64)_ _fix.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac247b5f-b956-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244235, "uuid": "52f3b9b2-54ab-4466-8104-7910b7659452", "comment": "Malware payload (RemcosRAT)", "value": "20704193cbcfe68b7d3964c91784bb12", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244235, "uuid": "247d8f22-2550-48c8-9784-371f8cb8c4bc", "comment": "Malware payload (RemcosRAT)", "value": "d7b1295a73986d21cdce36c035e880b67789545ad6227db18e712a40ba252be8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244235, "uuid": "bf99730b-0a6a-4a62-af9c-54e979f30657", "comment": "Malware payload (RemcosRAT)", "value": "d42b42b16e19e062eaa24e354dd4007cb69f72e4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244235, "uuid": "54c2f8a3-ce9e-44b2-9643-39362e7645b6", "comment": "Malware payload (RemcosRAT)", "value": "6e9322d2e308c166918bb5d323694c60823b142631f1cb1b58a1b31f861a521fca0ff06464c6820422d1c4fb339cdf4e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244235, "uuid": "39fd2f8c-58db-44fb-a096-e548d877edca", "value": "T14FF48A2AAB6C79ED3318208C857F3A061155FF0ACD35D6ACBF5552E74CC5942BA3A2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244235, "uuid": "362b12a2-4cc9-4bca-8874-6acc52b0575b", "value": "12288:JuYqLhbtN9T5b/Jk9iLBPZb3pl2looFnYMZPs5L+qVHHcjtcO0IyGhTCApLSdU/:Je9ZH1b4i7T2dFnYZBDVnkmGhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244235, "uuid": "949851cd-89b4-4a7d-9544-2dc408687467", "value": 792883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244235, "uuid": "3037401d-f9d4-44a3-94bf-32e44a9e892e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244235, "uuid": "a983444c-c8ac-4240-adc9-5f3e1da84b7a", "value": "DHL Doc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e522268-b974-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762257097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257097, "uuid": "d5695bfb-ef11-4d8c-88db-e83c1ef82818", "comment": "Malware payload (RemcosRAT)", "value": "3c2d7903451f2d4b7558d2deef37da6a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257097, "uuid": "8c158838-b727-4796-ac56-2b9e45722b75", "comment": "Malware payload (RemcosRAT)", "value": "d8a61370f97491b1af554b214864378a5ec447343c8d5a217b037823f3269b22", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257097, "uuid": "31b3803a-1dc6-45ec-bc61-83de0c1b9797", "comment": "Malware payload (RemcosRAT)", "value": "e5052573e7dddeda7b964864439cd5d44e0b0d7f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762257097, "uuid": "7678459e-3db1-41c9-aee4-9c85c35f0a06", "comment": "Malware payload (RemcosRAT)", "value": "a5c0e2ae0ea075599d0e604ac36d5d92acf72b91343b2008c6543b702d8842d15eac59399eacc0aa0a7513f6179e214a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257097, "uuid": "2f806dba-8854-4c24-a30b-1efa4a678a32", "value": "T1E0F4792BA51FB88CAED8A8D4F5F93ED833580B5693B1064C900FCC672C15EAD8E5715B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257097, "uuid": "8abc36e0-71cd-4041-892f-b55fb3b79497", "value": "12288:qwwmaIrxPh+kuEbN7HW8tDrwRHpQxdP90goci/lozMgOK/A:qwwxID6bwrwRHpWn0ZWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762257097, "uuid": "0cd2d2d4-665d-49e8-a293-03ef4492bbbf", "value": 794792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762257097, "uuid": "d68e6639-67c1-4ca4-9fd9-2641d71da149", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762257097, "uuid": "f4684683-62ce-4246-a7eb-dfb6bae85543", "value": "RFQ_urgent_1125.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07718535-b9a5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762277889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277889, "uuid": "dd79ebca-9bc3-4dc3-af64-bf56eef9348a", "comment": "Malware payload", "value": "70cd22059538fc8d0ddd2b85e7d2c2f5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277889, "uuid": "74549350-a4bd-42ca-8e3b-21e69ae58bd5", "comment": "Malware payload", "value": "d8f11fe16666255b4be2a16416de176217c51f9fe8a063ec19df6691ff82a0fc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277889, "uuid": "ab71a325-ace2-4705-8200-640ca01673ae", "comment": "Malware payload", "value": "2e4f346458fc0ca1d7624fa9a039cd19d7ea9ab4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762277889, "uuid": "afef10df-7406-4a87-93b5-e217e3578bf3", "comment": "Malware payload", "value": "4c142bc64493d65ece358d8edd631c8bc7146434bc6b0481a514d0e49c7ec16fa2398080146f13621b0d5db3b0c03275", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277889, "uuid": "f8dbff88-a73d-46ef-ab60-52677bf498be", "value": "T1DFF5339BB8452328C52B4EF2C35031D57136EEE137BB118D3CA5F9CE8C7689482E65DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277889, "uuid": "e148b70a-bdea-40c7-9d94-addf0c9fded0", "value": "98304:mHmZZni6/uj2Sjg8J316HpuppPEpZaVBgj4roL:UY9mKS9fgpu564r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762277889, "uuid": "b923a942-f5fb-40f5-b765-fa15c54e93f3", "value": 3588096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762277889, "uuid": "d9418517-9772-4c14-89f3-e9eab295d00b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762277889, "uuid": "fdd73cd9-5f9a-4639-a368-be9de5c2ecdd", "value": "SecuriteInfo.com.Trojan.SuspectCRC.30700.19841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34acd622-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245323, "uuid": "55e54c31-1fd0-4b97-8820-71ee63d350f2", "comment": "Malware payload", "value": "680f293f1cbae99e2ec1817f84470ace", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245323, "uuid": "3e8c7e12-055d-43cf-a11a-5be4f23a81cf", "comment": "Malware payload", "value": "d9c22eb6ff9ca3bc85fcfeebe00b2aa972512ef6d5acd35bc7e9d938fe6b64c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245323, "uuid": "33bd55b3-db19-4619-ba22-d440fb47f79e", "comment": "Malware payload", "value": "3fd5c797a4186faffeb895110fc87104a7fd16b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245323, "uuid": "98585e8c-bf01-4b0e-a058-9b98a4a1fed2", "comment": "Malware payload", "value": "ca618657131e4a91b4e9b43bbb927622da98adbcebb7d9340d0dc0eee328f2446246b104b5bd9e1d4f3b2c12f5b3dea5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245323, "uuid": "f849d978-6b1d-49c1-8b2a-8379e40e8fe4", "value": "T1E60602346126A5509EFA1A3BEF520426EE309126DC99579F38CBB8C7DF5E1BE0C34934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245323, "uuid": "e441a7e2-b853-4548-862f-ebb1df77c314", "value": "24:eowIx2oW26hCjpDA82MBkj4P3soA8z5NvoDS:eodx02nx2MB/PcHg59o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245323, "uuid": "7c5cd66e-16e8-4b78-b2a0-26f5af3d013c", "value": 3914254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245323, "uuid": "9d576c63-944a-4ffe-9514-a3f654a81b59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245323, "uuid": "071946ec-6ced-4fe7-95eb-f2db98c76302", "value": "PO10038281.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b480be4-b94a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762238972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238972, "uuid": "07a57efe-c8e4-497a-ad71-32571cc91d02", "comment": "Malware payload (Mirai)", "value": "ffc773af5ed8744c4aede94bd2c17f3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238972, "uuid": "d70b920b-4519-4cd0-af85-90226e87ee15", "comment": "Malware payload (Mirai)", "value": "daf00b268985c262afd1d3af5930bb10d3eb33679440fd5d59dc7d9f56366e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238972, "uuid": "342f7b10-ca59-462c-b326-f1d711a01893", "comment": "Malware payload (Mirai)", "value": "289941909cdebf7c5d66fc17b2be45647e785d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238972, "uuid": "f5306bb0-c69c-49ad-889a-69e44608eaef", "comment": "Malware payload (Mirai)", "value": "08ff218a7bea8c2a54698cd8e103a3624d1b1faa06a76f51b54bed113e57d0d11ce904cf10d4739d1b694170409829ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238972, "uuid": "a0603217-ffef-4911-846f-c03fc2f76205", "value": "T100D3B021E4006DD1EC2129F578BA97B80350EE700BDE5582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238972, "uuid": "7eaa8f43-64c3-4b98-ada5-2ec5a526add3", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xh:PiySSGp+PMmT7zMplj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762238972, "uuid": "ecd1e62a-1417-48f4-9f7c-1f7d4ff1d8ca", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762238972, "uuid": "9f8dabc3-276e-43dd-b6fc-866090d47f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238972, "uuid": "3e973169-ddab-47bd-bba8-6f9e0fe109d3", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510ecc47-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224325, "uuid": "6162c09b-6c51-4317-b4f3-6bced573c32d", "comment": "Malware payload (Mirai)", "value": "7bb6d11bc2e258410244f089610ab14b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224325, "uuid": "77a89496-265b-40cb-a0c6-c16b06a3e372", "comment": "Malware payload (Mirai)", "value": "db3f899d142d3d4d8ecf60017e8ba1098bcac4274449e53d24657b4dddee1f1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224325, "uuid": "f7168722-9f3a-45c6-a087-ca1bb3e68f00", "comment": "Malware payload (Mirai)", "value": "38661706aef0d43fff7d96d1ff937e9f16d04df6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224325, "uuid": "5a28cdbb-4ed8-4a1b-b43a-5935006aa465", "comment": "Malware payload (Mirai)", "value": "ae3f599bc808c0c006825a0cd949abc2ae718e69818343cc877d680b17bc5aa02d231ebfa8a443e3849339446572e31f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224325, "uuid": "3d2172dc-49ed-4629-9b87-f587572d568b", "value": "T1ABA2D025D3456EF4DFAF9DA052C1C2C2B6E587C7678AC8F340FEAF012506046BB88D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224325, "uuid": "11ef388f-a459-4cd1-ab57-ccbdb73ede9a", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5KCXM4uVcqgw05VxJi:9RxsSVsMD6xiJJE5zRWNYL4uVcqgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224325, "uuid": "370eb021-fb1e-46df-a4c2-5fc8dcb80006", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224325, "uuid": "46454442-464d-46e4-8d26-3c7f85dd47f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224325, "uuid": "eea70e67-0293-4b27-87a0-6444bf4dca63", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3516639-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245536, "uuid": "ddc01ed0-4a94-4dd5-bd5f-6de1cc5235c1", "comment": "Malware payload (RemcosRAT)", "value": "dc88cc794f67ed159106a12f1ba62e2e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245536, "uuid": "fe29563e-18c7-463d-8d3c-046001011eae", "comment": "Malware payload (RemcosRAT)", "value": "db4e9f15c7239c5eea2e5cea9ea80571d9fc8919cb69b08122270beb48de6ce1", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245536, "uuid": "326985d5-5a3e-44e8-8fb2-fe7382bfeb3e", "comment": "Malware payload (RemcosRAT)", "value": "db4fd084f5515d053040dea0087e5e08c3e991b8", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245536, "uuid": "877b1db9-0744-480c-a38a-3bfe4c096e60", "comment": "Malware payload (RemcosRAT)", "value": "99f45972f36047390f4229330425297623b17232ef59851d0bbe313bb0d83fc4cf2c8159b8f3fa8b909bab0c5c290a65", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245536, "uuid": "816295cd-19bc-472e-b68b-e32565699aac", "value": "T1F405DFEAB920AC9CF6EC29A3191E1B03103ECE539376172C9553D6B5C9146C88BF735B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245536, "uuid": "998c7a73-586e-4ae0-a115-7ab344a61f19", "value": "12288:3wiexokGARl9ew3+2wtNzulmyQspT7tAzlixBzS1+7zV2j:4okVhewOBtNzM9I0BzDVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245536, "uuid": "ab9f01d0-a789-4088-bf6f-89e9efe6ddff", "value": 854785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245536, "uuid": "3ea6b1fb-6fa7-47d5-8a93-b35b6a487f34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245536, "uuid": "164e44fa-8c0c-4260-950e-7f9f4cd736d9", "value": "Quotes & Specifications_1762117331_xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b622c011-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245540, "uuid": "baaa3263-7bb4-46bd-bae5-9aaf0b3db93a", "comment": "Malware payload", "value": "b7dfd24b8decd52d2e852cb73eec031d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245540, "uuid": "ef6f02dc-f63f-4849-8a0b-646d4142f388", "comment": "Malware payload", "value": "dcb01ac862ddf8129ec1039dcca56be4e0bed27959c33477e9241978d3067059", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245540, "uuid": "929d0106-875c-4f02-a65a-d6cf5d924254", "comment": "Malware payload", "value": "f50d740c0c497a57dbdfbe80fad14d423e4de420", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245540, "uuid": "5db4bd8c-e9bf-4017-a814-086a013e09b0", "comment": "Malware payload", "value": "0acc91ea8b0c700569e3769a8c6756cfce56a2b50e1c82d14f417e3dc16ac20c4ba05c73b0ba708bef3268a080d3b7e2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245540, "uuid": "eda88d2f-c42d-4520-b5b7-607913377602", "value": "T130A32918D9D78327CA4612DAFB5605D0897D811D43B650A9FF8BD3CDDB025E8B2BB238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245540, "uuid": "a479babe-4f52-424c-8458-ea22852849fa", "value": "3072:mkNs/649KlBPQ5i1sj1waKXYO72f2M3VgXgZL/vl:mkl4qBRS3KXYO7s2M34gZLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245540, "uuid": "2e012bcb-9c5b-4169-86db-0a4aa2ba537b", "value": 105362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245540, "uuid": "09ade163-58a8-4a5d-93d2-2f5cc28bc724", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245540, "uuid": "b799f87f-1e14-4a20-a79f-e9a129c6baca", "value": "Tender_Document_202511028649856739741.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224e25f0-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261184, "uuid": "d49f6e5d-f9d9-4139-9175-c0a63b8b6298", "comment": "Malware payload (Mirai)", "value": "ae03927f596258a900c4a8f8d0961b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261184, "uuid": "73656bda-cef7-4683-95a4-fabf13085516", "comment": "Malware payload (Mirai)", "value": "dcf9fec0ce580fbd15ffa14ff22527aab3d1a8790cfd17cd8a979bcd15db3917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261184, "uuid": "d1c44b26-3042-4c7f-a430-e80cb4e910bc", "comment": "Malware payload (Mirai)", "value": "db260627fdcf9345fe5020f09980abe7d20663db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261184, "uuid": "5d4e2970-e4e1-4f35-a70c-15740d4981c7", "comment": "Malware payload (Mirai)", "value": "aa409340ce566d16cfa3f19109d5209ce7cb84ed9cfae5c0664295ab6f42bce6a9b78ced0b7cc03ee4b537897bff34b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261184, "uuid": "0d304944-2a3b-4dfb-87b9-1a434dab2eed", "value": "T19EC36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261184, "uuid": "62020294-c94b-471d-b6d9-e6ca7b30880f", "value": "3072:7W2WA4KfsQDNSHjiz2FBOe95Bts4ceGM5UQ30hAB1E1:Zr4KEKcHmz2F4eUeOQ3G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261184, "uuid": "c140a616-a28e-4659-a50f-2d3e9edb3cc7", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261184, "uuid": "d0c4a792-d0ae-48f2-abb2-a100ebde3ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261184, "uuid": "5da6eaed-de96-44bd-bf95-a709b35ec1a3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c51b7e-b915-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762216233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216233, "uuid": "0976be89-1198-4f9a-8fa1-3e27b287a772", "comment": "Malware payload (Mirai)", "value": "1214caddfc24497430056ffd43765366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216233, "uuid": "a2019ef5-4160-4d47-925c-9f8b3a285375", "comment": "Malware payload (Mirai)", "value": "dd92788bedf3f4ef0fac81e8edef3b8b5b8c694325354fbf3d0ab5ad65768c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216233, "uuid": "be5bb000-501e-4e43-8cf4-1636d1b00d36", "comment": "Malware payload (Mirai)", "value": "145c55c85d73961eb5cdcc8c67fd165a9ac848a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762216233, "uuid": "a2493f86-f233-4b80-bb0b-0c3a3f4816e7", "comment": "Malware payload (Mirai)", "value": "0964a03171fefcfbc8afca83907fb0446a590a62de8819295b8b89ab72bfe71ea030f8c97c66efc3f7246f494eebd5c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216233, "uuid": "ecac5f3e-f508-4925-955d-1e982a0a7076", "value": "T1BAB2C0CDA1543084CA8D7C7C1B8D4A674F6CA1D0BAED9B15E360CDD8B3BAA4F3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216233, "uuid": "a88a119d-5f7f-440a-9732-5434afd59fe5", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpZH3YZqSWvZ:4QlS07FUXqIYSXQKquZXgqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762216233, "uuid": "28f7699c-6518-4571-817a-f6e6686b3486", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762216233, "uuid": "5a533b93-fe7f-4061-9e17-1a638b95ce75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762216233, "uuid": "5326f8a0-583e-4cc9-ac4c-a929b06bdd90", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8637b0a-b95f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762248228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248228, "uuid": "4a4515c0-0f3b-40cb-8a8f-c2cb75d75ea9", "comment": "Malware payload (Rhadamanthys)", "value": "2c766b989767000fd47741c30ab837ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248228, "uuid": "46db16af-ac66-4ef2-9b79-193a6ac2a31f", "comment": "Malware payload (Rhadamanthys)", "value": "de8c1b61ab8f752e047235c987d7af4d989e79a6159d77d64583239826358f9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248228, "uuid": "b9f2f7a0-ab5b-4d2e-955c-d3430d1521ec", "comment": "Malware payload (Rhadamanthys)", "value": "8b2cf6b5df2807c2fd520468af8f90810d172d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248228, "uuid": "446dee19-e236-4591-a495-f62775ef3800", "comment": "Malware payload (Rhadamanthys)", "value": "dc18bdaf66f6328903e71f31993286302e09cbfe4188838e0f919453b103a13e58b3e1923ba263ab352fd564c141a49f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248228, "uuid": "1e2bfb17-5e95-413e-a328-82416d3d0f19", "value": "T1E0B26D8D3A7350E9DA46C4B0E0EB8B33ACF1B5620D210B7F51A4DA711F31B916B2A55E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248228, "uuid": "dccb1f7c-f836-4d6f-96ff-b477f49cf9c4", "value": "8751e9a3ecc5493766a5880fd3ae0de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248228, "uuid": "b82e375d-1c8c-4211-9709-c0b3faadcb94", "value": "384:ErJUW8oMDQoSmitOK3Ti3Jjt5CWZ+XCW63N2Wqdelx7bLIBG:ErJ81Qozi3ir5C8fWyFNnbLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762248228, "uuid": "75f96879-5730-48c4-80c9-7aef62ce0715", "value": 24864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762248228, "uuid": "6d224759-496a-49c8-b504-e71273d77ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248228, "uuid": "13a8b8ba-0703-4641-805f-c95fd23cf9bf", "value": "iilustr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa5927f-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224323, "uuid": "3b5d3cdb-dec9-448d-a809-cd3dd9955e20", "comment": "Malware payload (Mirai)", "value": "decd036bb858a3f985eb9db82f12de47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224323, "uuid": "70f4d193-a990-49c4-a224-188eabe4c225", "comment": "Malware payload (Mirai)", "value": "deb9be9ef3007eb4c01154d9bdab41ebcfa0a8f73ee499710d7658b9653f2f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224323, "uuid": "d2853db2-d218-4557-b6d3-b8be9b6903cf", "comment": "Malware payload (Mirai)", "value": "60ce565515ba9c406f281f015c4d35d3e43c032c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224323, "uuid": "43f6e914-2f28-486e-80e9-fc22919cbb2a", "comment": "Malware payload (Mirai)", "value": "e0e5a207796cd0b0f03dfac6db397a1941a8cc71ccfcf968ac3017378b8e8f68626a59b22401105bd58f94cd81acc1e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224323, "uuid": "bb84512a-ecb2-4dc4-b997-eb5f8c80fb75", "value": "T176A2D11472632D66E3EC1C3DC96A8367FDA61BFC90F6327639455620C90920A3E3CA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224323, "uuid": "d95863ca-737b-4b54-92f4-c306c36117e8", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjEhymdGUop5hR:vvQn4j+ZO5fKAlx4s3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224323, "uuid": "b00a5bc8-535e-4f8b-a988-36f4662b91c2", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224323, "uuid": "11909ac4-a4c4-431e-a7a4-7bdbdc5cd804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224323, "uuid": "809ba985-1f92-4016-88db-0a1b2402fda5", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0423d237-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762245242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245242, "uuid": "6509f97e-3ab4-4dad-aea5-e0cefad6b8e2", "comment": "Malware payload (AgentTesla)", "value": "7594e8d273af2bbf83b5a3c1b659b04e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245242, "uuid": "3c8ee6fc-c93c-4da2-af8c-6416913ccef1", "comment": "Malware payload (AgentTesla)", "value": "e4b24b63ffecc4ee565d1de7de6bb8064993b24886ae3a887a4fa309b7b2c819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245242, "uuid": "c0a15616-3e11-4cce-8ee5-6c166df836d8", "comment": "Malware payload (AgentTesla)", "value": "d16a97d1e13ed740b22b68f61a99fe7a78f71751", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245242, "uuid": "632157a0-6f8f-42ea-8248-823b3efa18e4", "comment": "Malware payload (AgentTesla)", "value": "efc13d42733a3092fe4c6661954e784c7251ee11971612eb4c0ba52e0e046e6dca0f4306a65c5652cb316148a4b98c3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245242, "uuid": "28d4016c-eb06-43a8-a005-3d507032a6f5", "value": "T191A44A61DD64076A4F071BAAFD805B6285BCC61E463610B5F9EF074E610A4ECE2FE36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245242, "uuid": "eb2edcd6-308b-4e33-8ce0-c3bc53e1fcb2", "value": "12288:UJH1J6JvJHRHtJiJH9UJc2JH0JHYJDJHDJdJwJBJyJHTJHpJzJhJ/:Uh14NhRHtsh9Ui2h0hYZhDfCTEhThpJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245242, "uuid": "57fdba39-b3d7-4948-b613-9625a3dbdfcd", "value": 490192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245242, "uuid": "644f197c-2f01-4866-82e9-10a56101d9e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245242, "uuid": "6c83c65d-dad4-43fa-bebb-0a1e6b674000", "value": "2025-11-04-0915.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c21a55-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762245426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245426, "uuid": "59d2959e-efb4-4f1b-aa88-e6546f53b96d", "comment": "Malware payload (XWorm)", "value": "ded733442e52e50062095237b3358b99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245426, "uuid": "22d91c1f-bb9d-4635-8b9f-d00742374318", "comment": "Malware payload (XWorm)", "value": "e4bfc7c97b4bdc47c62afe4aab320a54e769d426b3998f7e86b3337d01a3c679", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245426, "uuid": "710b8d5b-c194-4437-b9c3-c112525c3fe0", "comment": "Malware payload (XWorm)", "value": "2a033b05738528e69695178cbf53eb203d47a460", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245426, "uuid": "bc3eef4e-d692-445d-8668-5ae4a1146fb6", "comment": "Malware payload (XWorm)", "value": "67cac2a597b2f5a7f9b559aee902a3f0cf8d5515992f0ae4d1c25e109548da5c28bdf527c1ef6d628eec99717302ca0c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245426, "uuid": "101f4fc5-a7d0-4743-adac-a7493728b188", "value": "T1510463ABE9109888F99E288FC746A99431D24733F751494840D7D7AE3E0747D8E8FE1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245426, "uuid": "1262c403-bd69-4c1f-b5db-35369aa35775", "value": "1536:/q8jaouRYNOCsc2jaSNUemQRQ8uBu3Mv4lqidqxJv99nVqF+uKGidCgorwGn/SXM:fgBfuR8j3G4lqn7nVWBKjCRwG/SXWdkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245426, "uuid": "fd392a8e-fd8b-4c9f-af8c-99b0a1759100", "value": 181881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245426, "uuid": "424ed219-ef86-488e-ab10-3232d26fe7ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245426, "uuid": "f176aaef-1324-42c5-a2ca-2dea908c1067", "value": "PURCHASE ORDERS-0393748.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92845f6a-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244621, "uuid": "fc7770a8-eb0e-45b0-81a2-8aa086952030", "comment": "Malware payload", "value": "06618933e6efdddeea385d41483bfba8", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244621, "uuid": "9a0c9b97-05b6-497e-8caf-401eef4d767a", "comment": "Malware payload", "value": "e4db7df3f7d9cd9634ceb577dc3d5995139e6cceba6cfc9af74c04756aa86a1d", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244621, "uuid": "e4d8cbe2-29f2-4965-a941-335fa9c5b7e3", "comment": "Malware payload", "value": "7885503a276d3f460a1c41a166813a30711e045f", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244621, "uuid": "8e03a8e7-2b00-4652-ba91-045066ee6c89", "comment": "Malware payload", "value": "98950a1998749af330dc1fa86b565ae94a74e5a6f00a83aa118e88bf48d28d58abb99f46c902724925f669699c58d859", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244621, "uuid": "23a18786-029a-45f2-a350-c3a609dce483", "value": "T15B15AE42FF90FA07C124033999F763A1A335EC4256674F0B2744B3262DB36E49E97AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244621, "uuid": "49e707ca-21c9-4feb-b727-f19b6195fc05", "value": "12288:I6OJ10U6Ew33EjQFLQONg4pmKmk3yhORauZoGGwYaH6NNu:6wt33E8F1L7mkimVFYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244621, "uuid": "043000b7-b434-48e1-823c-15bf39daf11e", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244621, "uuid": "9ff7cf25-bc1d-4d8f-a222-c3cc49672aac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244621, "uuid": "11b4e801-3a97-419b-96a9-17e4f178c70b", "value": "Quo11032025.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0a130c-b964-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1762250380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250380, "uuid": "fa1d55f1-ed90-43aa-ac17-c34aaf101fdf", "comment": "Malware payload (Arechclient2)", "value": "57c499f1f7acc02b37427062c87c87ae", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250380, "uuid": "56b94a28-494d-43cc-9d45-b7ad8e87dbc5", "comment": "Malware payload (Arechclient2)", "value": "e4e0e9aed8391aeb9ee98043fe5de357b56cc6e3677d72a88c732e01092534de", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250380, "uuid": "906f073d-71f8-4573-add2-73b554bfdffd", "comment": "Malware payload (Arechclient2)", "value": "d1df5dc8bee6de3f51d41e51bc2cad2a60c28c8b", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762250380, "uuid": "b711cedc-5f7e-4dfb-b82a-4477f22c166e", "comment": "Malware payload (Arechclient2)", "value": "8d06d973a213f1f28483b615757fd1ea0c936e4c6a72678c56a069b0179e09f63c9ce6b474f79f833a2632543ab4cc34", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250380, "uuid": "8e48cf8e-43cc-43d8-8d41-c539a7270710", "value": "T1A8055A7D764B9E32FEE9777881FF6C1892A022A75091658A1D8C98D81FC137EC74CAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250380, "uuid": "0fd08aaf-80f4-4704-a061-00fb6a91c523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250380, "uuid": "4d718ec4-a625-4c6c-99bb-2b251ae2dc51", "value": "12288:Lwm3kTcm4u06WpKA5wi3shv6U7hin8oPc45LjVDbzEpiL7Cf9CLJl:0m3k4m4u0tpO4Y5hVok45LjBv42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762250380, "uuid": "8eedc21b-64d9-48c3-bf12-235a4ceced3d", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762250380, "uuid": "d3a1eb50-295e-4a11-9a57-f05922d719e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762250380, "uuid": "fd28c8f0-4a8e-4e7c-b289-d9d6a7055edd", "value": "e4e0e9aed8391aeb9ee98043fe5de357b56cc6e3677d72a88c732e01092534de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138ee0db-b983-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762263306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762263306, "uuid": "b9f17668-db2d-4b9a-a979-67bfa9c9abad", "comment": "Malware payload", "value": "47c4749cf15ca5a52f2d40c9f3310600", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762263306, "uuid": "0eb690eb-3274-4634-a5f1-3154aaaea383", "comment": "Malware payload", "value": "e5e567dfa2f634539e30e3a95752af7e26ad7eff8481fb05c495d22cc13a9cf7", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762263306, "uuid": "03a28f4b-190c-4ec7-b093-b2dcb2c816bb", "comment": "Malware payload", "value": "5e8583a5868be69d95583d94489df431ca330f0b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762263306, "uuid": "30d976bb-4e05-4f35-a5d6-4a47ec6dbe53", "comment": "Malware payload", "value": "ecef91234c4b5acd841e86630be89185ab8705556edb27b4746438b48756f4bae57344aa2ca265a2cf0fd563a7a61a8c", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762263306, "uuid": "ec3f16ff-c820-40ae-8d5e-a63217b034cb", "value": "T1EE41F296D6F06E6EFFF454D06A9F89D0D083E62344097AC7B46A4302BA2640F31D3BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762263306, "uuid": "7ff4e658-e4fd-4543-9166-d798265d7941", "value": "48:ZJM7nExtEKyfYhsRX7KwSzsVusrc02C+lFSgD0wJ4x4c4m63utirR:Zmo3oHRLTS4peC+lgO0CtEcutit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762263306, "uuid": "cfa29c3f-6424-4cf0-adca-2ee2572b4e22", "value": 2361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762263306, "uuid": "459f574b-b825-48f7-b46b-86c167d41a4b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762263306, "uuid": "0598d43f-db36-4e24-913a-e87061684a87", "value": "toumaf.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb53d36-b9d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762299136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299136, "uuid": "4fad8bac-f9e9-4e71-9a5d-20362775c8da", "comment": "Malware payload (Mirai)", "value": "e91aafb2f8b53618c997225bce28fc1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299136, "uuid": "451990ae-2844-4e65-994e-33055d77ddfe", "comment": "Malware payload (Mirai)", "value": "e656cb93b41f1924f55be38e709fabcf71b8496a2d965794fd12ca74a1fe4b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299136, "uuid": "3065375e-7106-4fae-976d-5cfec7da9a32", "comment": "Malware payload (Mirai)", "value": "7b6b296d2f8886626361a63c9c8877ebf6bd0a3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762299136, "uuid": "56438705-cdf2-45dc-9657-7cdacce3c732", "comment": "Malware payload (Mirai)", "value": "516fa6f08eb9b1ff1769441d90f72e06a83968bcafee3fd198fd035d37397f038f28c4797ecf78c36a7faf9678d90cca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299136, "uuid": "db48a759-66d5-48c0-b5cf-c81fecb20971", "value": "T19E736CC6F6C7C8F6EC130A3111767B2759B3E13E32A5CB83C3A9E636D812980E15665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299136, "uuid": "53961abb-26b4-42c2-95f3-d131482e6471", "value": "1536:zD+FnUYl4dUYbkJED2op8NW2Mzd+REYaGL3SGQAsBn:zD+Fh4dP7aoONVMBEEADQ3Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762299136, "uuid": "a25dc3d7-d3e8-4f09-aacd-7c25f5e82c4f", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762299136, "uuid": "781f264a-5b2d-4a4c-bd44-c216fbe65cfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762299136, "uuid": "e23ed0ba-835e-4e8b-b909-422ecce991b3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b420a6-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217439, "uuid": "39bb5dd2-da3f-44e9-ab45-3dc04af4b847", "comment": "Malware payload (Mirai)", "value": "e3729de0da073416757c80c8662e44de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217439, "uuid": "cfc5e719-2f0e-41a2-91f5-0e528817b476", "comment": "Malware payload (Mirai)", "value": "e6f5d7f66e65b6147e2b9d6bef6b2190d3ea551ecf2027ba6fa9014432e39ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217439, "uuid": "3ae2f23b-d4b9-4c93-995a-7de430054e31", "comment": "Malware payload (Mirai)", "value": "28f39b5b4efee251282e4fca1533270a6be998c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217439, "uuid": "08c9dc5f-3bbd-45e8-8514-01eadfe0ff33", "comment": "Malware payload (Mirai)", "value": "1e6e09bc5260deb8f2afc90b5860c6209ab1e056c04378e03e480ce5049c15fa00a85acabe8e1d3a4e18696459edeee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217439, "uuid": "e2e944bf-c0f8-407d-8283-04e4530ccf70", "value": "T1575302521AACE83ACAE2C4390F6841E646D85DE85497601F43CD7DF88A05D6CBFEC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217439, "uuid": "fc017ac7-8b36-40c6-b287-bd324e8dc007", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/4rOSYafAQd:IaHJgMo8FwOA4zUFGUO3Uh2Kg4Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217439, "uuid": "f9f46864-4c8c-4eef-bcd7-420cd61d6a74", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217439, "uuid": "9b60ac31-fcb1-4653-ac4e-7af88269c4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217439, "uuid": "2b8c3080-a552-40eb-b1be-fbd3983114bc", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd0343d-b9d9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762300284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300284, "uuid": "1df9d970-64eb-4b40-80da-1b45ebf6056c", "comment": "Malware payload (Mirai)", "value": "7f13bbcd603cd36ab24d0ccd88c1b4e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300284, "uuid": "6c883f8f-31a0-4af8-b531-175054796b68", "comment": "Malware payload (Mirai)", "value": "e820f6bed9514899e98d0707b3ce072187683bd9e864a2e4a3b8dbadd9659c68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300284, "uuid": "84c6cd15-f676-4349-8969-a8596be1472b", "comment": "Malware payload (Mirai)", "value": "058a5b380a585d028dbe92e43e03d72d82e8be83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762300284, "uuid": "e3404fa4-4dea-4db9-96fd-678339c9e326", "comment": "Malware payload (Mirai)", "value": "ba05f2edfab236ee90497bdc3a23c7789d38331499b806facd866ad6ad30a2d51f8d42a60e63027fa4bc0516cd3b7c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762300284, "uuid": "bb645780-ca25-4bb5-b53f-e89d33ab3fb5", "value": "T10C932A42BD828F13C5C622F6F7AE058D37167BA9D1EB3203DD24BFA1338659A0D6B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762300284, "uuid": "446cc5c6-c201-41e1-92d3-cc191f02e433", "value": "1536:F3nr4HwsaM8ISK4AWXSWhTHkmNxqu7XjP22pDqvHpCC:F3nr4oM8Y49vT3NxlT6HpCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762300284, "uuid": "a766f8d7-9bac-453f-ae13-c850ad3b40f8", "value": 90680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762300284, "uuid": "7f5e5958-d401-4b47-a057-5baccdb60fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762300284, "uuid": "cb1fbad3-473c-4c70-9d14-5eb4a66c7da6", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225724b4-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762268056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268056, "uuid": "a5b04848-1bed-454b-991b-f53c2703849b", "comment": "Malware payload (RustyStealer)", "value": "22df759f783633a3bfb142528b76412c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268056, "uuid": "0743f2ec-c119-404d-9b1a-7db7c2e610c4", "comment": "Malware payload (RustyStealer)", "value": "e868ed292b7ec0b615491ecc1f59d3407ff6431a87707ba76bda16a95dcef751", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268056, "uuid": "14c265fd-95b3-4ae3-ad33-148ef4277e1e", "comment": "Malware payload (RustyStealer)", "value": "ebbb9b4db5566303840a03bde48c6c4bc13ad75a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268056, "uuid": "72c7e60d-e4d4-43a2-9c27-cbcb7c63c645", "comment": "Malware payload (RustyStealer)", "value": "7de79f90d07a7c6f0244d10874c8b32b95995f8129007d6c4207526faaa5865bd1dbe499eded54adde452a4d0b0ccf0a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268056, "uuid": "c5565244-2713-4c7a-8622-6e4ad03e4309", "value": "T195A66D07F69580E9C0ADC1B8832BE637EB72BC894524B26B5BE44F212F26F506F1C755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268056, "uuid": "dd1a0ed5-e21e-4313-b131-f946cd93afb4", "value": "3dfa51e4cf68b44c0c70f94433caee3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268056, "uuid": "34dd88d1-3dda-4069-b165-d4d841d76dff", "value": "98304:cdAcC/hqWaCTSgsiTQGWeY+rdpz9O7suz5sx1yWekzn+u:ZfTuEQfeY+rZOouq0xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268056, "uuid": "cb1a8e58-e935-432c-92c6-03c782e5ac6e", "value": 10054144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268056, "uuid": "915731b2-01f3-42ea-9898-cd64263faf47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268056, "uuid": "ddf9c597-5836-42cd-af56-ea4a6d0d96a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acaea73-b9ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281545, "uuid": "97f9c236-35dd-4ab9-9390-318e1c789cc8", "comment": "Malware payload", "value": "44245978f2dceeb7882e67b8c6cde51a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281545, "uuid": "9d1e1057-3b85-4b13-bde5-0e287b093935", "comment": "Malware payload", "value": "e86a80b8594c853508b2c64c2b831a464d2e0e1ad0cbbfec132490f4436cad42", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281545, "uuid": "90bc9ae0-c0f7-4d25-a8d7-5eea388197ca", "comment": "Malware payload", "value": "a4a17a6ec39c265429a76e281419055eabe6e59a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281545, "uuid": "07722a05-88d0-401f-96c9-b073476a8f0e", "comment": "Malware payload", "value": "48349124a103549f5ff53acb10c8b4be77e04e6fc7f9050aef4cbcd044259e5f2e5823da21082dc812d2cdd331f21433", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281545, "uuid": "7c4b86ee-01ff-43fd-88c4-9ac5c8b9624d", "value": "T14D263331F0597F71F6AF94B30E134E2E70EDAE658765C6D72839B60D263922E3221319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281545, "uuid": "08a55053-6ef7-4943-a0a1-2f65082e19bc", "value": "98304:dMd2h4M0Y7uK9j+hIDZmYABuLYawrehtcNF:dMd22GTEhIDFeuLVKBNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281545, "uuid": "0ea18001-cca2-4aad-8041-0f32330915b8", "value": 4501504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281545, "uuid": "09ffba06-3396-43b3-953b-d85639e70aec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281545, "uuid": "6f37a874-7935-4166-ae9e-ef0169a4a950", "value": "SecuriteInfo.com.FileRepMalware.58132275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efc6f03-b95a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245877, "uuid": "e8101c34-65a4-4d4e-8055-0939a7cb5752", "comment": "Malware payload", "value": "158b6073a470ced06335644ca728188f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245877, "uuid": "e48dd23b-c2b2-4d26-a015-1a94f609fccc", "comment": "Malware payload", "value": "e89aacf39f962a3fbd203ed408b475d3f9ac985ab23ce3489d0dc98fcceaeb37", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245877, "uuid": "f0bdb4a8-0955-477e-93de-8239c8b4ff4a", "comment": "Malware payload", "value": "b126ece8fbf24fdcbbc128774dbf51a61f8e1f05", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245877, "uuid": "4962c6a6-bbe3-4320-bd80-b06fa2c8f472", "comment": "Malware payload", "value": "8a6fcb920e1ff1c5ac734b4435fe12969ae914d7bb12616cb0fe5c0a3ba78be6d79368339af380968d2644993a3f134b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245877, "uuid": "ea25d70e-df75-484e-b98a-5f42e82df9a4", "value": "T144119A9E0B226805C30CCE19342A891457CB86CDE63AAE485819187BACE460BF41EF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245877, "uuid": "b03ac98f-781c-47b7-8122-83f3e3177abd", "value": "24:E7xnN+cNIpTwKloGho6sEVyovOqOnhplXv:8NE0Ufyfzhnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245877, "uuid": "742e0ebc-c157-4823-93a8-e41a3e634930", "value": 873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245877, "uuid": "cf33f585-c505-4b20-b47b-fd602ee43e80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245877, "uuid": "c740a097-52d3-4780-85ff-5fd6255743fd", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912353e1-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244619, "uuid": "39f214de-4aed-45e9-9df3-e498d78bccaa", "comment": "Malware payload", "value": "a95506130d5ade2abc37b94fd97c25c3", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244619, "uuid": "ce271f2c-90c5-4636-9435-a06a69296f80", "comment": "Malware payload", "value": "e905b5f65520d8d8860e3fd9be259b3afff255c248a13267d04e36dc71da1a21", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244619, "uuid": "f414716b-9b21-4fe7-a531-3d54c1a2ece6", "comment": "Malware payload", "value": "1cd33c9483db0e6fc13b1b3518308a3290e432f5", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244619, "uuid": "e34bdd6a-0e8b-4de7-adbc-884e46161b29", "comment": "Malware payload", "value": "e78ada431b26f3e883a1fb820485399f01b44832ede27b710be61c030d65c7e46abc727370702371fcce4f5a9e29f65c", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244619, "uuid": "dee65835-6334-48c7-8190-d4f930e5450d", "value": "T147852305FF426946C469077897D7B5E8E325BC2729C19E0B3B8877797E33A80C23395A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244619, "uuid": "690b473a-b4ee-4f0d-94f4-b65fdbee9918", "value": "49152:0NCV3MVHyE4xV+ENfrfZag6149SDdpbyWvmfRw+DByO:YVH/m+qzfp6CgDOGet8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244619, "uuid": "56407ea3-5f8c-4507-b7fb-2530a2f499b4", "value": 1838592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244619, "uuid": "970d09eb-f1bc-4a92-9c6d-ac1442cb4301", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244619, "uuid": "3f299aa9-3c13-47a1-a773-2e5ca6fa7c0f", "value": "REVISAO CNC.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15d231c-b9d2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762297609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297609, "uuid": "2f1a0290-1819-4a75-9e7a-e420331cf7fb", "comment": "Malware payload (Mirai)", "value": "105f18cea0d741fcb85cc6b0f78e8011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297609, "uuid": "81624963-7b37-48ac-9f86-86cfb4541dd1", "comment": "Malware payload (Mirai)", "value": "eaf0015f9d081aae8b2e43ae4810c2b564a86cb64d9a3cf46a16d7197f817b46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297609, "uuid": "30f3c05a-7a34-4e32-b958-d907653ffa13", "comment": "Malware payload (Mirai)", "value": "e9f058127e2727bba9d9777311058f2db6131d26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762297609, "uuid": "ea74d702-42f1-4879-83e8-79fa7d4b27fc", "comment": "Malware payload (Mirai)", "value": "782245cb0bd0c1fe398f73da049f2b66fd79621bdd689887009669a11370fa085351bc18ac1fb71a8d86a6827f624693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297609, "uuid": "b349c285-eda4-4ad0-8d28-d991bf6f3a26", "value": "T1E313E178D6957246CD7E5EF6B2EC1B30091CD09473772B0D8A201985BE7560F7ACB1B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297609, "uuid": "d13419be-bce2-4dc1-b005-53d783489cd7", "value": "768:TJPeRTuwDNIYJg7SbAFdsrd+lr/oHknrqLdxn9+kz8aWc/dteb1gdu9jnLWF:gC7l++1/oEna9waWADexgy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762297609, "uuid": "f3284297-9e37-4f36-ad40-851a8add860a", "value": 42228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762297609, "uuid": "fca71f07-3460-4d1d-8498-da68ed5479e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762297609, "uuid": "cfd524ac-d45a-4de6-b0c9-299bd2bcc5d1", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838849b9-b98a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762266501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266501, "uuid": "b99c0965-cc5b-412a-8ff6-deb4b6e35128", "comment": "Malware payload", "value": "a9b717d4d038bf50b08c5de5b491e32e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266501, "uuid": "ae0ffc22-a28c-4f6a-b529-c527e600ab65", "comment": "Malware payload", "value": "ec5b4770ceba01ec679192f46f99e4aac9c31a79a3884cf859ecbbb760720488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266501, "uuid": "e4750c2e-d2c6-4bd6-9d42-a05e84cf975b", "comment": "Malware payload", "value": "cbbef2cf493ce80e80556d30f11f2c48827c6ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762266501, "uuid": "f2704dd0-b82f-4bb5-9175-d8b3a140b657", "comment": "Malware payload", "value": "c671cddc859f07b487ad7d195300790ae8acb4c21d6da2dd8dacd9023f062a418f573e1e4e6d13c41cfe1ddbff4d5bf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266501, "uuid": "5da5e5ee-4e60-429c-b51e-283bb6907bad", "value": "T178D31907B14659FDC0E5D5B886CB5417AA20B84982307F5E7A88A7371E52B34CF2EF63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266501, "uuid": "9e33219d-66ca-4132-a3fa-fb0300ce4178", "value": "3072:CW0c1hsTvW5+cLZMHWpF12clImWw5Omn:p0xvW5rLSHWHag5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762266501, "uuid": "97c37c4d-b863-40de-889f-ffc9b6201d4b", "value": 130568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762266501, "uuid": "907c916b-e9e5-4d84-aad9-9a5d6e3d0cda", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762266501, "uuid": "6310a634-9701-4de5-85d0-c2707343a8b8", "value": "ec5b4770ceba01ec679192f46f99e4aac9c31a79a3884cf859ecbbb760720488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f58a96-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244657, "uuid": "d458d437-21f6-47df-9361-30c10700de79", "comment": "Malware payload", "value": "b67148ad8a386ad1ebdbf301dee6c790", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244657, "uuid": "75f8b868-0a56-433a-8e21-7b7747cc7c17", "comment": "Malware payload", "value": "ec8929334a4ed0b5a9849ff244a34c6542c3f6769580bf8c450b3c4e5329a14c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244657, "uuid": "22f1cd55-4f5b-4554-b58e-70738c1c2501", "comment": "Malware payload", "value": "740d71fdfd293a5e9bd3c5fdedd66caf9c7f0a1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244657, "uuid": "3abdd138-8e1b-4b35-a1a9-d19d7da949ca", "comment": "Malware payload", "value": "c379ae02410a88205de687e0edc31a5ffb9c4c28459004dd7248d28da8a70fa3a2274a7184e85aafd087dad3e16bc36d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244657, "uuid": "f384a935-1b53-4496-9d67-fddffbf01668", "value": "T152D43BEC31ADB6265EE342F5106F1507B2782823580C8860F121EDBD37B999951BBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244657, "uuid": "2a2da6c8-6580-453f-8d2a-7d560a2f3fe0", "value": "6144:T69o4f0ENXYoOTwiZ+N30pzozzGql4erLnQEsDFx6FuPuuNp1m8LcgigN2kI/:mZfxNXd930pzoZlzo7IFudN+9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244657, "uuid": "afe372b7-e019-4826-9643-c9fc3973cdd2", "value": 612292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244657, "uuid": "9fe82d9c-31c0-4dcb-81fb-c8dd5eb3d749", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244657, "uuid": "28374cca-5e4f-4089-bf2f-07efb5bee88d", "value": "bof.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f2ce6f-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236388, "uuid": "5b031d76-87c3-4102-9549-f0b041241a91", "comment": "Malware payload (Mirai)", "value": "b894d22b0e8b2765bde514e1c2538c34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236388, "uuid": "2bc050fe-9233-4e70-a029-4fde01ff1877", "comment": "Malware payload (Mirai)", "value": "ecfde830182b911bd0b449c6a08413a8cf4fc16b863f80a8ed6df6de820e8961", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236388, "uuid": "6486b28b-6ca5-4b9b-8f86-0fef95f94d3f", "comment": "Malware payload (Mirai)", "value": "07b976842923d666b74a6c2c12e7715115e04efc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236388, "uuid": "4bc1748e-a7dd-469b-a9f7-47205fdd6f4c", "comment": "Malware payload (Mirai)", "value": "eca15bcf2c38a8f805cbbaad60124d983e17fe0c5fc741ad7b200443e1e071838a63ac23f2452ae8f12f7b3d1d3db008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236388, "uuid": "b61dd818-5874-43c3-aa22-d896792658f0", "value": "T1D483AF22D06AA9C4C4E54934B0F88FB82B13E5C452576FFB29D587B66883D98F905FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236388, "uuid": "fa2ffc52-0223-44e0-9200-1ff463423a94", "value": "1536:mam0dXOlGQLyWYnay5aiHgm3SzPghQuLAVLKJE2xFxVc4C2tjXb:mb0dXOlr2WHoa2Sz7uUVuJnxVc4vXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236388, "uuid": "c60cca05-4085-41b3-a396-f3acd218d9fc", "value": 83252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236388, "uuid": "d067a448-987c-4bb1-b0bd-b8bef60a3bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236388, "uuid": "0b411fcf-8bfc-4120-8f39-eb36acff1eb4", "value": "FGx8SNCa4txePA.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff41ffc-b974-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762256938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256938, "uuid": "d2e29a11-498b-4a35-a437-011c87279746", "comment": "Malware payload (Formbook)", "value": "2fae3d476ab918f654d39ec12ac1718c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256938, "uuid": "9cd75d5c-1643-4577-aac0-1b33d4df14e5", "comment": "Malware payload (Formbook)", "value": "f003bf2b94cfd2a0b1c7a156459d2aeecbb7f78785795a4aec275e5be848df25", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256938, "uuid": "97bb09cd-1cd9-4b25-a9ef-eb1c5ba971fc", "comment": "Malware payload (Formbook)", "value": "113e1558817239b807835a8fe6f167417da527dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762256938, "uuid": "49ed8657-2992-4241-938c-2a58c264e96a", "comment": "Malware payload (Formbook)", "value": "5a87dffe2dbc84e20b44d30649f7eaf14318c2e25e2333c2043367cbc6f8d39cbdbdc3ed24865d5c263081db87ffe0d3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256938, "uuid": "137a47ec-43ac-4978-8486-4a2e8cd5a367", "value": "T12EE423182FA53191B1D1E3A04507D423F9EA2D8A3736C56B4D6DAC75CE689ECCF4A0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256938, "uuid": "2d4a86b4-b3a7-4528-9ea1-4b10d81013d2", "value": "12288:FkvCxnjqyxr5I5BuNHIbzSFKPWltRLIkQmWHHDBNae7oyKwIK9GDIpNkkm:Fk6xjr1LNw74takQmWt0e7oq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762256938, "uuid": "7d9e6c85-de91-4a56-beb2-88967440945c", "value": 711084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762256938, "uuid": "e7f213e1-58ea-468d-9b78-c0afebd4fc90", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762256938, "uuid": "952ba745-8059-42fe-90c2-9def537d304b", "value": "REQUEST FOR QUOTATION.PDF.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce9bf76-b92a-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762225070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225070, "uuid": "f0d3d54f-a623-46a6-8f50-a1c80a23e882", "comment": "Malware payload (CoinMiner)", "value": "79be1a57f0f5078d4e649de88d8b90da", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225070, "uuid": "a96929f9-d944-4705-bd72-603b260196f0", "comment": "Malware payload (CoinMiner)", "value": "f1055f6ba87754ae11cae119248d5feb7552d0bc207c66efdd1211036d8bbe65", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225070, "uuid": "b537d7db-38b7-4721-af92-4f47f3a5a528", "comment": "Malware payload (CoinMiner)", "value": "6c6e6810369e0540306e225fcd47a9ade8d22d87", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762225070, "uuid": "67b761b5-c615-46ea-bdf1-8fb6355ebc7d", "comment": "Malware payload (CoinMiner)", "value": "7601b48820a1230e90ccb258187143710a3f0ee3062d6975acb388768695c00b1aef3b9a20e08038570c4bf1dc8997c3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225070, "uuid": "27cf1969-0c98-4502-8fb9-695768c97cd7", "value": "T178F6236120405DACFBFA4B32F0EDBB1CD3E43297F6DE340E4599698226A15C4B919D8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225070, "uuid": "5c00e5e0-34b2-4132-a5d9-35dbf4a90ad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225070, "uuid": "518dcce8-a7ec-49a7-91aa-4e49beacf3d8", "value": "393216:y1ZCYxtuyimGu96cHL6VdpRJ6vSoKRptAcb+t9/Jor/KE0NdSLrExhr5kQSEkxqs:y1ZCSIee7pivSH0wuN8Ixfip8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762225070, "uuid": "c49bd7d8-1eba-4944-b159-453f3f96325b", "value": 15363072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762225070, "uuid": "d6517b38-9690-4db8-89e9-d5a7257b0a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762225070, "uuid": "7e981752-b21f-4c4a-b939-5d81f127b17f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39191cd4-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762245330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245330, "uuid": "76eab403-4979-4e52-823e-9ad6ff965f48", "comment": "Malware payload (PhantomStealer)", "value": "58990ed64407941fb699364c32b21eb7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245330, "uuid": "57297867-1362-4309-bad3-cce615a02541", "comment": "Malware payload (PhantomStealer)", "value": "f18568fc16eaf7b92afdcd39cc796aaf29d0948e573963cbb42335a3e32a27d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245330, "uuid": "25cf9e44-29f9-4384-8407-f49af0c8818a", "comment": "Malware payload (PhantomStealer)", "value": "5718247271162f4c0eda8cf8c64311bf3d2ada33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245330, "uuid": "dcf92cd3-acd0-4ab8-bf37-f255775ad240", "comment": "Malware payload (PhantomStealer)", "value": "8c8f64b37c400d549d17e5463fbb1a567f0ebc378822af0136ac56b798922b44a9a39c98d1b7c7fb60fc7fdb6e4b90f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245330, "uuid": "18c4bbe1-f951-4e9b-986c-640ee160d64d", "value": "T1A8054B70ED2802994F8717EDFC2506A0C9BEC916127754F1EAE51B5D730A99CE3FE228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245330, "uuid": "79895a8b-8756-4884-855e-c0f721200941", "value": "3072:XIVEZRjUOsxjUOjjajUO27NQjUOcjVvIjWjfjf/4jUObjUOR3jUOfjWjULjUOm+R:sqSdtTVOEUtskvIs0M41I2p/XkhP/2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245330, "uuid": "1e0659c9-680f-4128-98fa-71e3598ec48b", "value": 810037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245330, "uuid": "b219bc6f-f376-43b7-b2d5-340501196271", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245330, "uuid": "808537a4-a0b2-4e15-95a1-393b54c08002", "value": "ORD-003023_INV-7B3C099D2_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e27285b-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762281095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281095, "uuid": "ab232731-5852-4d6a-b797-a5f2bb6039f5", "comment": "Malware payload", "value": "3823c59afe93ad5f687644b57664f81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281095, "uuid": "fafd3a67-f7bb-4c12-a53f-2bbb32d08ffa", "comment": "Malware payload", "value": "f220e60f655d3e78bf22d140c2f2d1b5f9332ac3785eab6add91eb1588cbbafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281095, "uuid": "b1dcf304-f3cc-4739-923b-7d0702708155", "comment": "Malware payload", "value": "b4718cda21f1645c0ef34f899c92ca31c21b124e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281095, "uuid": "931b1a69-397b-48d3-943b-88e158afe03f", "comment": "Malware payload", "value": "925b32969a254f80b7152dcc08ef115c272e23da8045d57468ca0a3052c671cd6b9d126826696d644a62a43a51dd8b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281095, "uuid": "a5898dc0-226e-4f5f-b814-42e7dedbd01c", "value": "T15E346B5937B88B17E25F8FBED5B0148F87B1F103E90AF78E1C8895E82411B42E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281095, "uuid": "691e2bdf-6fb9-4090-a198-275251eaf5af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281095, "uuid": "44773ac5-d0ce-4498-be3a-6346e5ea4d60", "value": "6144:FloZMsrIkd8g+EtXHkv/iD4p+rX+8D/0gVA+Pv+ekb8e1m4i:HoZrL+EP8p+rX+8D/0gVA+Pv+zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281095, "uuid": "2616e47b-18e7-4dae-8278-3bb1e11555e1", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281095, "uuid": "7a9502bc-80dc-411b-83e8-313b012438d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281095, "uuid": "45e68811-a201-4608-9090-ef856d09e2ea", "value": "Umbral.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f94cd86-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244643, "uuid": "7742dfb4-7073-4a82-9d43-59450e3ddb1a", "comment": "Malware payload (RemcosRAT)", "value": "02e6f277ed7589c3348f55b468265b4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244643, "uuid": "3c3858a8-e8e0-4ee8-9dec-1508feda1ab5", "comment": "Malware payload (RemcosRAT)", "value": "f2288d4b43bc586d8617e48ad7259e600819e4c5907e403faeb068380abf35a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244643, "uuid": "fa9adab0-633d-4aa2-a17b-aff2c7072c36", "comment": "Malware payload (RemcosRAT)", "value": "b66caad011b0deb85005236d964ed814ebf4b69a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244643, "uuid": "4f0438bb-a877-4cbe-8457-ee61189e1d2a", "comment": "Malware payload (RemcosRAT)", "value": "ecb7cf1e6db46eab3ccf9bd72c7c2ccada78dca1e52f70c73a6e92a510d70969b0e06857c043d1be734e7d9f3134e040", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244643, "uuid": "ff88c1bf-ae1d-4e44-8628-8cbabf83a58f", "value": "T141B622DA73ED978D5D844CE570B92896B0D3A22A34794BD7E1E2F9CB302EC8CA55D430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244643, "uuid": "083d2f2e-b59e-4e8c-92b8-1680162c3869", "value": "768:jhlSA6Zi8hPzeG/hs7RvDFVU1SPD730bk/2FTBCs+xCUOo5ZVYiB:jhsA69/YDFVUk30bxFLs5ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244643, "uuid": "c3171837-2cc8-4874-b428-68ea88d2fc65", "value": 10713006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244643, "uuid": "d759ac5e-4713-47b4-a198-e8c6937ce2af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244643, "uuid": "a16dac24-e815-48d3-9c92-d97fa1ed2582", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638feedc-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236382, "uuid": "783e8cc9-f2ae-4a7b-b084-f0f3e8026b6c", "comment": "Malware payload (Mirai)", "value": "0113e06a6ac491ee6e936d2dc9f45258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236382, "uuid": "804ecbaf-d4c6-4157-921b-f929514d0af0", "comment": "Malware payload (Mirai)", "value": "f2a646c4d30044428520f414facc65344df8ea7d0b37b052e410fb6acb846d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236382, "uuid": "2557c9a0-063b-4839-97e9-676f9c0833df", "comment": "Malware payload (Mirai)", "value": "564142d9da7070f6cc53ef39310ecfdce1bb0f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236382, "uuid": "020ce878-18aa-4f43-997d-94339f34dfab", "comment": "Malware payload (Mirai)", "value": "ed9e38dbd52863cc2d795df947f7669ff016363ee5a73a3d9605ac4d0eb9c8173a678c833860bdde48b7d57be33769b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236382, "uuid": "1f6030db-c41b-41a2-a8f0-4a8717caae6f", "value": "T108D3ADD7F78B1451C85206F44BCB4FDE2E6361C11E1BC6E27C6AA53A6C741DF4A02B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236382, "uuid": "b490c904-b772-416e-8d54-e43f759bbd48", "value": "1536:SyGkvZFz/Oy5wLzmV0p+mGeA9k70eBxR1+1gxAO/LWJ:SyDvPOywLPp+mG/W706R1+1gxAOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236382, "uuid": "9443abfe-147d-40ce-81b9-998634eaea65", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236382, "uuid": "e1921a29-f589-4730-ab56-93c7ebc969c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236382, "uuid": "66001f04-75c6-4ebe-af1e-2d2cfc74ea9d", "value": "FGx8SNCa4txePA.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a190da9-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762245440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245440, "uuid": "3809d545-e5f2-48df-9ca8-fe007e89fa03", "comment": "Malware payload", "value": "3de56403ad6be9eee5ca7a43b1f04e16", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245440, "uuid": "d9472630-0444-4f60-90f5-fd0f2883ce47", "comment": "Malware payload", "value": "f2fef410becf576e63577754294260a5fb44c84e77f52285b9bc0a7985b22210", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245440, "uuid": "cca0249c-ee83-411f-aa4f-548c497af33d", "comment": "Malware payload", "value": "2b9dc0274df673e22990c388ae9e6a7d21c3d7e9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245440, "uuid": "d79d1ea5-455e-4556-a52b-fe436c9726c8", "comment": "Malware payload", "value": "3c319e70c889cec173e5882bd159a5dfb6a389e75d213447b4c046f863a64eec49867f29d4d1a356c079b1bbf3cf3e2e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245440, "uuid": "4e20615b-fc33-4b61-91a0-51cd2888b09d", "value": "T1105623B16A94391F06600B15B01F23736D7D4C978A8C92EDB8CCF15A31CBBE6856F4B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245440, "uuid": "4c9caf3c-1493-44a9-9e10-de68a53c03fc", "value": "49152:jDgVJOLD2xQhjo55HMeUcZ8TZKrAPDFnTTVDGd5HofpyrCDJW5x+fZr6YzDfgpBK:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245440, "uuid": "84d10693-0f3e-445a-9fdb-dc29ec52fa5e", "value": 6380161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245440, "uuid": "5450559c-7d18-4ae5-8dc2-1d8a1ced63db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245440, "uuid": "205eda01-061a-4d0a-8812-84b27f713a52", "value": "6951Ob-ser-var8588268HBK7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0598f60d-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762245244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245244, "uuid": "8c84e1d8-48d7-452f-8ff7-eef84300cbf4", "comment": "Malware payload (RemcosRAT)", "value": "058cb4843a61e906f52847f463c35045", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245244, "uuid": "5203e2bc-6b84-4bfe-a965-6daf03f643ab", "comment": "Malware payload (RemcosRAT)", "value": "f3a59f1ff32aadb987879f6d67e99577695569869ea686196bfe0c14292f8f44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245244, "uuid": "01f6a69b-9396-49d6-a205-c1f7e3565cd0", "comment": "Malware payload (RemcosRAT)", "value": "a680202884365479a40f79178f8ea59a74268bfd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245244, "uuid": "fcce7815-26ef-46f1-a81c-985ecbe157eb", "comment": "Malware payload (RemcosRAT)", "value": "aaf990e283a7c54854543cdf438ab7643558100fd3aa34f1dce52b0d3d1871e6b1f504bbcfebf96832046c9303aaf8ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245244, "uuid": "3889a6f7-71df-4115-a85d-f26e33a7ce94", "value": "T18626236A4B9B3310D4F116C6CE92B419D42DB82F1A934A7CFC894FF95A3BC129D61E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245244, "uuid": "ce062c2c-6b85-4ef2-bae5-e5f289e36c95", "value": "768:k5lXa/tGsc/4vHXy7KaJpLva32+q9kBELM1S4k8g4Ao9HInxn7PD0gKl7fFFF0we:UFac/EoF+qGErWpwrnDhKJKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245244, "uuid": "c1fbe610-9c0d-4a95-a6da-56b05312fd29", "value": 4443176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245244, "uuid": "d0e7217f-7f45-49d1-86bc-cbcb1756cdb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245244, "uuid": "c8d8ef9c-7ea5-43a9-8119-a50056c47730", "value": "Our Company Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1bd6c4-b957-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762244614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244614, "uuid": "0a085537-3ac0-4831-9e9f-6b277668d738", "comment": "Malware payload", "value": "ae41ad75005ce078dae7a3136ce60f14", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244614, "uuid": "9645ce21-30cd-48be-be2e-617fb7e5807a", "comment": "Malware payload", "value": "f3f74809b819eab48dc4212c2b161c9d306814418d232a25ff558f4d720ede3e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244614, "uuid": "3bf30050-8dea-4d68-87b3-03a75c1d92ef", "comment": "Malware payload", "value": "4c2d04bc99d3d9ac3f80955f40d47243411dd42f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244614, "uuid": "40c68a0a-8525-4c4a-8c5e-2ad10f5ee992", "comment": "Malware payload", "value": "ceb8d168faeb6c62239a409618f6d1204b93f1430bea75cbfa8fcdb895e7bdbc899a7fd92ad94c24e59d881d375af552", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244614, "uuid": "cba73d47-69ed-4f38-b0ce-8dc36862c3a4", "value": "T1FD95F182EEFF9D72C22AC63946E712144321CC189A719A433ACE763479F6F457723369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244614, "uuid": "ccf7a222-ddbe-45c0-bcde-07d8dd5a6c5a", "value": "49152:aXy613MhyImJh4iRZchzV7Zv3FzgBCLQHAYMgQY:ZA3MsImJh4iRW37Zv2BpVXQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244614, "uuid": "b460fe9f-88a5-4d82-9c7e-69c8fb2542fc", "value": 1950720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244614, "uuid": "7c476458-1696-4af3-92b1-77d3735d4b56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244614, "uuid": "c684864a-b591-4a3b-baa1-9c1f0a349913", "value": "Docs7652.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82fd310-b98f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268817, "uuid": "03d92cf1-3ef9-4bd9-92cc-418fd43c25f3", "comment": "Malware payload", "value": "09b20ab098ed3a7e0a8ff215f3b99037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268817, "uuid": "9792203a-95ad-478d-b2b4-d1e25e85176c", "comment": "Malware payload", "value": "f499e385f4a4249fadbe00260417c51b26b4cbb32abdf933b6e772d6f22a6cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268817, "uuid": "9c3e0744-4898-41cc-9a05-82b3cc3c264e", "comment": "Malware payload", "value": "8a05376bb8a28113df02cc84d8d57e4f0278551a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268817, "uuid": "f43c360c-101b-41df-8d93-d6c43b51f46a", "comment": "Malware payload", "value": "e8b3922f0bc27c412c85fb76fe006d9b97afcea389bbb8581131fd1883f40fb09f1f5109c5edef84983261e53a20684e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268817, "uuid": "368e79c7-c9d9-4923-86b9-0d0118edd493", "value": "T131C5094369DF0DA9C9D277B8A1C35336B734FD708B295E3EAA48C23119536C4AE1BB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268817, "uuid": "db560cf6-a897-403d-bbc2-a4fce1f06a64", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268817, "uuid": "7fa147a3-9362-497f-b38f-88aa762e3b49", "value": "24576:OmXVveqs51pom/YaekDoXDFOB09DIERoZ1W+xneNJ6clMi81s3Adc+zM8f:OmXVvE51pom/NPDozFBx+xnc+o8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268817, "uuid": "b4d00ec1-552a-4268-9058-1c654d18a0e7", "value": 2644023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268817, "uuid": "e6b2943c-245e-452d-9316-ab2d52fd87b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268817, "uuid": "fbe4384b-b51b-4ae2-9fff-023127c55671", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f37e455-b918-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762217477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217477, "uuid": "15532402-910b-4d67-8f91-e9a824bf1331", "comment": "Malware payload (Mirai)", "value": "44b287570620ad47de49cc7426e800cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217477, "uuid": "d6e16e57-750c-46c0-99f6-88d739989e08", "comment": "Malware payload (Mirai)", "value": "f5339957f3da54da1d479909843eebf0359c1a746570940db9b89e79b84c4084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217477, "uuid": "925c9da1-d75a-4059-b872-8a18dc6a847e", "comment": "Malware payload (Mirai)", "value": "4fd4b60f5e07a1ce6bc6d73d59a1b157679a4648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762217477, "uuid": "e10ed015-1382-46bf-a808-b7c1868a52d3", "comment": "Malware payload (Mirai)", "value": "e67dd70a51b45283559a0832e63719df8dd2dea4968873d7cbe9d0d031c91997fb79dbf4f74d0c4ff35ef277198f773d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217477, "uuid": "16629030-10bf-4b90-a21f-ab560774691b", "value": "T19D148D68FE4F68D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217477, "uuid": "8085cea1-386a-4ed4-b024-b52ef926a003", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxC:bOVfbEdxm4iub8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762217477, "uuid": "a5236f70-bc85-449d-8404-340eab7f2179", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762217477, "uuid": "405ab84d-cee8-445d-b2d3-208e93931923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762217477, "uuid": "afddada8-4e3e-469d-a24d-c97777b3ba7e", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d159a6-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268122, "uuid": "0b4ad1a7-c137-4f6a-a517-1e6cd85c0fbe", "comment": "Malware payload", "value": "4c947d6d320aa946c278b94a47f13bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268122, "uuid": "4e936a0b-a858-433b-a54a-86d77f695c4a", "comment": "Malware payload", "value": "f545a623de2d19a73f4a112a997427085f91c728d7f2e06c333a8126b3560b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268122, "uuid": "01308434-fdc7-4611-ab96-cef941b38abf", "comment": "Malware payload", "value": "09c59dd1e6d99d1f6e660a1863d34297b6d78319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268122, "uuid": "30e3d578-5a67-4a0d-82a0-699b4e70e0f0", "comment": "Malware payload", "value": "ce8fb4f0a7f32adcc6ffbb6ba8db014635a0927b294d80bca683d69a348803a554b959bcb8f564a0bc655037632ce911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268122, "uuid": "6df89c1f-168b-420f-839a-eceab05943b1", "value": "T170F59D7BF8A04165C09ADA3D4466617179A3BC140B7227FB6FC0B7641FB9BC07A3A790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268122, "uuid": "c896a465-bde1-4423-8523-85c127979200", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268122, "uuid": "cd92cf54-77d6-496d-9210-e65bce7cc0fb", "value": "49152:MfWVW1zh4s3Lg85ro9A3Nqw2Ccbdqr54VlSYzkXPOWMr5mOlUVA9XWAGJ22mbSrh:MMfIXPOWMA29XWAGJjo2gSuhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268122, "uuid": "cfccb594-adc8-4b4a-950a-a35fc244a431", "value": 3538920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268122, "uuid": "54a2bfc9-81c1-45be-b862-6c19da39e652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268122, "uuid": "7395cb56-1e0a-4f8d-af53-2ac6291f206c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427764d4-b95c-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1762246635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246635, "uuid": "551262f4-23bc-4823-bc72-169b80568489", "comment": "Malware payload (DarkVisionRAT)", "value": "fe0ac28a34fb049e8de275a1653b649b", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246635, "uuid": "83e70f2d-67f4-42fa-b1a3-22851c486e01", "comment": "Malware payload (DarkVisionRAT)", "value": "f5da060ad7dfd1eb1825fa455c4fe1b8b375d71206b100bad198467221751d1b", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246635, "uuid": "0487ebd2-b963-432a-9c3a-f4b45dcb5a6f", "comment": "Malware payload (DarkVisionRAT)", "value": "62ae2894975873bef45f7964ce64f54a8d7b2d73", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762246635, "uuid": "f4202a2e-453c-4d5c-90c3-66becacfe4d3", "comment": "Malware payload (DarkVisionRAT)", "value": "35c139b71f7623959fea2de882c3282a457ba88afd17a509538dfd5c1c1fb5f5ca88566df8145e44213e5604d8deee28", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246635, "uuid": "d815d5fe-6196-4621-8528-f4251723fef8", "value": "T11495239D66C241FFD812F5FA1293792CA6E67D538E60CE8673B13604DF31AC16DA2243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246635, "uuid": "d22a024b-936a-4114-aadf-52e8b11aaa12", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246635, "uuid": "42f0a11f-3bcd-4450-9c46-a4a61ba95f91", "value": "49152:ruJ7Sr4BXD+h/r93HOjvOAaG1f1y2PJNdszNWeR/YsKK9hWXf:rqZXD+h/J3e2I17MNWO/TrWXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762246635, "uuid": "21362f23-3140-4bb5-887a-b04624f37b63", "value": 2020864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762246635, "uuid": "d084497e-efd5-48c1-8a94-a16c1cd61a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762246635, "uuid": "bfc1f474-83b4-4ace-ae84-18e9a736f0ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2707b8ee-b949-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762238428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238428, "uuid": "3abcca41-0c82-440a-911a-708091985378", "comment": "Malware payload (Mirai)", "value": "a55a791f7742287ff60383f66c10d362", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238428, "uuid": "dc45c8a4-67e9-42d9-ac08-a9ab9fc25bd0", "comment": "Malware payload (Mirai)", "value": "f6c0e81a211d47beac6c201fa8024d4cf1423df035335c7706ffc7fa9115c5c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238428, "uuid": "03abfa1e-bdd3-459e-846f-938e38de488a", "comment": "Malware payload (Mirai)", "value": "b454e2fea648f5f2e6d98a02b9b32199d9aa854f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762238428, "uuid": "eaf6a46f-711d-4623-8d7a-33b96dc6ab31", "comment": "Malware payload (Mirai)", "value": "bdec9a8470098fefcda95237c13087081c72dcdbf15b84c982cb28d03304af2155d7c5399f07588615df0230ab4af208", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238428, "uuid": "97fe6624-cb33-44a5-9ef6-dddfb7d413e4", "value": "T1C3119A9E0B226805C30CCF19342A891457CB86CDE63AAE485819187FACE460BF41EF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238428, "uuid": "d22da3fa-0fe2-4e03-a193-0e291f5214d5", "value": "24:E7xnN+cNIpTwKloGho6sEVyovOqOnhplX3:8NE0Ufyfzhnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762238428, "uuid": "bf45fbbb-1d76-4416-b067-9cd2f45f57a9", "value": 874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762238428, "uuid": "696c360a-5ad1-4980-b162-b3f6e7210ef0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762238428, "uuid": "4f85c7dc-fb29-42aa-b74a-dee29959edd0", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6457be68-b9a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762279333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279333, "uuid": "0d97044d-0cfd-404b-a0f9-c0a7119823f0", "comment": "Malware payload (Mirai)", "value": "2328cedb29dbc51d6bab975912afa3f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279333, "uuid": "c43bf0f7-96a6-4c86-9018-08656252d5f4", "comment": "Malware payload (Mirai)", "value": "f721ed62501a3e612b7822848788ebce9a6b3d3c006900a35e2e915fffdf2d42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279333, "uuid": "275130c8-7e98-40de-baa8-aea42e5dfa0b", "comment": "Malware payload (Mirai)", "value": "4137e4428172ddd56a07f049d84c33ebb66de63a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762279333, "uuid": "1a1872d7-b9d4-4141-9ca9-df551fbb8cc2", "comment": "Malware payload (Mirai)", "value": "f0a3c168853a08c96b4d293761a44ffbac766ed4ee3105fde99f6ef5c09576055779ee3143e4113d4b0b49aa6d98db1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279333, "uuid": "f7f75d0a-7a42-49f5-a8ac-cb63dad7f8bb", "value": "T1EF736CC9F6C3C8F6FC120A3511B6BB3B5AB3E13E21A5DB43C3A89576E812541E61674C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279333, "uuid": "d14c57de-10e2-4632-a3d0-e5867597516d", "value": "1536:eG1hOzgl664fNdAfulQdb2ldWr0iP+RAwzc3S0I:eL8lCKf+Q6Qr0UEAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762279333, "uuid": "afbe1dc0-d26a-4502-92e0-e442f7d21e9f", "value": 79636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762279333, "uuid": "5e15d230-b354-40c5-832d-d60aa097911c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762279333, "uuid": "a9f2335a-559b-4d7a-891b-2e72b8c97234", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6991d9dd-b944-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762236392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236392, "uuid": "9587bf26-5abc-4264-88ae-60e3fe0a31c1", "comment": "Malware payload (Mirai)", "value": "44d207b68410589948ad3dda99cd610e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236392, "uuid": "1de9ea5d-a260-4fb2-96ce-ed90de1c1536", "comment": "Malware payload (Mirai)", "value": "f7efc9025574ceacaba61d1cb5d62cc80f4396bd5e42766a9e0254d2f6aa8d3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236392, "uuid": "cdedf127-b0c9-41e4-ae14-447db1ae185d", "comment": "Malware payload (Mirai)", "value": "eaec96c81bd0ab01e46fa50f8b2403c6476b1a71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762236392, "uuid": "f0fbf25f-c8ea-4b2e-a44c-5d779ee30229", "comment": "Malware payload (Mirai)", "value": "3f66fe940ff463f31d3bb6600afc325a4600d6de129f238ccc4cd1db0ca10cba2b77ef303aac5527950367eea8475bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236392, "uuid": "416be291-bb04-43fa-a007-0ec6952730bd", "value": "T177147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236392, "uuid": "345b0161-3447-455f-a4ec-8c3f0754d7ce", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRIUKG:IcY5JpMByVs9jS7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762236392, "uuid": "cf7cfaac-e340-4856-a3ff-716ea77d2ab8", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762236392, "uuid": "45f67176-0c9a-4a86-84b7-8cfbe33da202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762236392, "uuid": "8a58aac7-b9c8-4689-9f3f-b03560132146", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bd721d-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762281292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281292, "uuid": "4dc17aad-34f3-45a2-8a6f-36b9ef33603b", "comment": "Malware payload (PureLogsStealer)", "value": "a4ea8d4472bdafc11d6c0818fcb4126f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281292, "uuid": "33031f35-e061-4d9c-9a12-48a31accdcaf", "comment": "Malware payload (PureLogsStealer)", "value": "f827bb940b54f21208cf998e5f5ca511a35316d514cbaf6a2ea79c1092630af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281292, "uuid": "276f3cbb-b2f8-4caa-8c93-254deb41d899", "comment": "Malware payload (PureLogsStealer)", "value": "a11a40cefce1e1f7ef80be1ed71d6d49ea3de2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762281292, "uuid": "f604fb82-80e6-4081-81d0-1cc8e7ef98e9", "comment": "Malware payload (PureLogsStealer)", "value": "14f62aa4004a23c6367a2169583ddde03179c6db2da62ca1148c368374e15f107ca979f4be02a69eda39cc497b36631c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281292, "uuid": "016cbb92-110c-4262-850e-32f01c8ddd35", "value": "T13BC512624E50DD88778869393EAC6554E3D0EE773C77D6A14263EBEE233A9404720F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281292, "uuid": "19ab2233-6f51-46f6-9e64-2c6ed920e33a", "value": "24576:yvIrlYsGWARykHG5ELreug1f2iKQeONwEc5p2XxzmkdodRVFTLQylJrmkO1PbBfb:yvx70ZA0nZdo/T17hR2mQQI6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762281292, "uuid": "85cbbc34-3647-41fa-ac26-dde3e520e259", "value": 2538889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762281292, "uuid": "a5d12f42-daa5-49c0-b476-02fe2eb6a72b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762281292, "uuid": "e7fc50fe-e0fd-49eb-85ce-460069499d88", "value": "New Order 81064275900.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761aadf6-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1762245433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245433, "uuid": "dc6aba00-08a8-4773-bbba-542eeb813da1", "comment": "Malware payload (DarkCloud)", "value": "684be60e66e16eb9ba3933a3ca854093", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245433, "uuid": "ae0ef8f0-be79-4140-96d7-ee10da1bc702", "comment": "Malware payload (DarkCloud)", "value": "f82bac6933d4baeabfcb1264787499127f7ece3bbd15fda8ca009fdc83b04afb", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245433, "uuid": "acddca52-e108-46d6-bb25-b5f421e60ed7", "comment": "Malware payload (DarkCloud)", "value": "064440af811926a6ba929a68c39233b6123a9b5c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245433, "uuid": "dc42d2b7-e833-40f7-b64a-f0894481ba47", "comment": "Malware payload (DarkCloud)", "value": "c3b007da36977fbdd075a825c4a39d2cc8c178ea33800f6164ba8e3b4de29a53f266ea2f856d8d0e9877204cfbbbf325", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245433, "uuid": "13ffa11c-ee2c-40e1-93a4-e2d78d683e35", "value": "T193E512FB98B2A9576F504563E70F2C1A339B19E53B14D302E941909C6F7B1938EA2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245433, "uuid": "f7931763-4449-4c55-b95f-f8dc09294ec7", "value": "49152:mOc2yD4lTPUFjP3MJWgCEraXBdetxbbqtlc7qUjy4BNClOxzGH04W2OE:moyEFPUNP3o9CEOBdefbbp7RjDCUA04n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245433, "uuid": "efb73826-7903-4301-8fe6-2af8e96f02da", "value": 3032693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245433, "uuid": "7c858a8b-8989-49f0-8566-015785d43284", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245433, "uuid": "af7acb62-1ce9-4f30-8f89-431f3b7132eb", "value": "PI #49358 - SOA 3-11-2025.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fcdcc7-b961-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762248687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248687, "uuid": "7e9f4c15-7957-4437-bf90-7075d2002ffe", "comment": "Malware payload", "value": "cd43aaff03775b7137bcfb18c3c15cf9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248687, "uuid": "c0c303e4-103c-466d-83e3-39da248be63c", "comment": "Malware payload", "value": "f89cf05f241af544ab5e11ae162d728ca8ce6ad95b84ec08c6286f643f7dc3c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248687, "uuid": "857c1aec-3f14-4a54-8b3c-f36cc2a9f295", "comment": "Malware payload", "value": "a3c5c544e1fdf3a4e02c64c810739a455e64ba4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762248687, "uuid": "f26d1edb-1783-41a1-8e86-cb5db4ce22ce", "comment": "Malware payload", "value": "d43fbb67bb40982c43547f0c20a2db9e9529903a86dfad7d393b7f9ea4a3bb71a35c9c6e62bcb85ddd2439bd6eb98bd2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248687, "uuid": "31c71671-d478-4078-98c7-dacef6aeeb85", "value": "T14DC08CA2453CC471633A0A5EB361E2F49906A4280FA138B2E4188788A2740741C4F73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248687, "uuid": "85cb289d-1994-48be-b8eb-1d628666c3df", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfDx9HhMitUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfd7MhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762248687, "uuid": "fd2279da-12b0-4e78-9f6f-8c53e7205c82", "value": 166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762248687, "uuid": "c7460cd7-2ef6-4107-8755-2c4db6835069", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762248687, "uuid": "638420e3-482a-470d-89ee-bad1a2cb1821", "value": "8sy77e56hi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c5f167-b985-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762264147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264147, "uuid": "76e06c75-2253-4368-addc-5a53d105a1eb", "comment": "Malware payload (Formbook)", "value": "ffa38a5a72b193ff447bb9b8b1edd85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264147, "uuid": "55524e39-c0f7-4657-977c-d80e604c8393", "comment": "Malware payload (Formbook)", "value": "f8b0f66cf4778ac6c5c91358e523994efec3065636e25d9487ec5d87dfbef14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264147, "uuid": "ceb13fa5-7698-45c1-9d1a-712e04e90371", "comment": "Malware payload (Formbook)", "value": "758ed607429a00ae75cc669647a1318a934d4d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762264147, "uuid": "d2833792-fe80-4fe7-b487-b2080ca269fd", "comment": "Malware payload (Formbook)", "value": "ea22c643d738a60045d90ad7e705df1f51e9100f3eabb42ce83efdadde9383e110c06a8d375273dc1438836b90f99ca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264147, "uuid": "a7e6feee-11d4-40e3-a68c-fe990fe2684e", "value": "T1F945BF0273D1C062FFAB96334B56F6115BBC79260123AA2F13981D79BE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264147, "uuid": "a447c497-ca76-4e3c-9926-e530c9d92dc4", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264147, "uuid": "8048d05f-0dbd-486e-bbf2-40541d57d05c", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdakGrKV59v7VbKC/:ZPVt/LZeJbInQRaklVPvhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762264147, "uuid": "6384b64b-dea8-4e3a-91e9-f85631affe8a", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762264147, "uuid": "82a1d2c4-9daf-45c5-93f2-6acaa86ddbaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762264147, "uuid": "27076dfe-9229-4f0c-97c5-1c8a15a285ab", "value": "revised quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8054ebc5-b98e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762268213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268213, "uuid": "36cf68d5-9d96-46cf-adf4-0d44768511fb", "comment": "Malware payload", "value": "6d16a649093ee7eb33dc5850ef15be24", "object_relation": "md5", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268213, "uuid": "37eef97c-9c56-4d2c-8fdc-52e0c05e073d", "comment": "Malware payload", "value": "f969df0ce745696abef1614682c3a47fa041b64f0c8666cdbc5d40680dfa52a7", "object_relation": "sha256", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268213, "uuid": "612c43ef-ad71-403e-8c3b-abf4f20923f2", "comment": "Malware payload", "value": "638e54611cbcf047dc179d3d7a02cd9c6966f5ea", "object_relation": "sha1", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762268213, "uuid": "4ff6a725-dd54-4904-8830-56bf39058c61", "comment": "Malware payload", "value": "7e5a28d0621d7406af80f80697b5b51311f1f1e23efc69a8b731a1f6d43611348ef4a7a4737d08789c5ff784db6dfcea", "object_relation": "sha3-384", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268213, "uuid": "0a91d8ea-5441-418e-b698-705bd94caa23", "value": "T1773733C6C6B20FC9D988153881EB5B5B725947560821C32B4B75E20F7FF3BE4CA76A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268213, "uuid": "f16d48a9-d597-4922-9c48-a71554a2dee4", "value": "393216:4w5lDyqIpQpQK7Wne0VqDYv48X4KIMAwOYX8VXVJC2LejoJbnBu9UxbqdKvYYpXo:4w5lDFIaQKrYAKgwOYMVFJGa7PYKbF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762268213, "uuid": "a3b66040-431c-4620-a24f-2799c60db89f", "value": 24307789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762268213, "uuid": "db8deb48-3009-4d58-9d44-ec8340aa6177", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762268213, "uuid": "b6a727ec-f56c-4bda-ab7e-7dc258a7bed8", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf84482-b9ac-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762280905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280905, "uuid": "e8dbecda-2a26-40a3-8ea6-bb61e0ac3174", "comment": "Malware payload (Mirai)", "value": "37b2bfcfe6a23096c9b70c86e34d6ce1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280905, "uuid": "52064502-aed5-4ab5-a861-e8bc69c768aa", "comment": "Malware payload (Mirai)", "value": "f991c28eedbf49cba8120deaf6d0f14e3feefcebf1574154a0ffd264e8057b65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280905, "uuid": "2e70735d-b87c-4ccd-8153-2a9b1ccf86ae", "comment": "Malware payload (Mirai)", "value": "c0431ed5c8d4be073c56c0fe86e7396b71333d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762280905, "uuid": "361306b0-df91-4927-a9e7-a91a558e59cf", "comment": "Malware payload (Mirai)", "value": "8989e0e5e5a874b3f7273d8b279bd5b4beffdb8e7e98c42bf37dd9a7b1b9f29e5006f1b08cac02a9b543811fee3d9a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280905, "uuid": "11040f3a-8754-4b21-9a4f-d75e3723867b", "value": "T195E2D1DE7F8A6B16CDCC1AFE46982370BAC8628E31CF5D4983260C985DFC8CA655457C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280905, "uuid": "fa1d3339-85e2-479f-81c6-a86d5c64f476", "value": "768:QVsO11WxCDlVkIWdwj7cNCljV2sRVF5NcepLW0:ssO11Wx4lSIWdkdlws7JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762280905, "uuid": "362cfdb6-4f29-4538-bd05-0a6bea21a5c9", "value": 31160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762280905, "uuid": "25ace5d4-b7d0-4990-8c96-0870f27adb4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762280905, "uuid": "b7016a96-5c11-43cc-96d1-87fc79dd1c68", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf7e99c-b9a0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762275803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275803, "uuid": "13c83939-f21e-4395-ae96-ad46909b99ff", "comment": "Malware payload", "value": "3e512bf9b63573702982fe4e013d55e8", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275803, "uuid": "612e51d4-aed5-4a24-bfe1-b8be2ff784d1", "comment": "Malware payload", "value": "fa4f46cecc9fe46c8bee01df128ebd03829f1a8ad0a8c4838276a3737f11a06e", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275803, "uuid": "7678b279-a652-4217-a66b-a3e60d3ceb3f", "comment": "Malware payload", "value": "8b5b4bc62b5c3cf14c3c85d692dfae383f514f64", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762275803, "uuid": "dbfa7b64-e462-468c-ade4-dfcc9a6a6dbe", "comment": "Malware payload", "value": "5d5f8786eb04776d541ee32355538090c04c9fc1fb796823796fa7b4a5262dc76d55f40a26eb97496687c2d17a1407d2", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275803, "uuid": "91e3996f-1d8f-47bf-b44f-97218388c4fc", "value": "T19967333FB238B13EC4AA577489B3A320497B7A65A96B4D1F53F0450DCF6A5200E3F652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275803, "uuid": "bcb719db-96c9-40a5-90e6-ffec64c70115", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275803, "uuid": "70b2878a-03de-4a68-b720-09767171b471", "value": "786432:s8TpL31QaamfL0ZknfsHISALt+Kd+wSKKUmE:vb5amfLznfIotVswSjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762275803, "uuid": "833895fd-23af-4180-9cae-7d4f2ba02e66", "value": 31798100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762275803, "uuid": "c5dde8a9-c288-4768-b4fa-26269a351a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762275803, "uuid": "ec8cc136-8c1d-4202-9623-d7afcf7ca2b6", "value": "109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11188025-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261155, "uuid": "b14f028e-618e-458e-b490-09bcf7035324", "comment": "Malware payload (Mirai)", "value": "d527c93d36f9f259711fee6ee7596c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261155, "uuid": "6cf653c3-41bc-4cdc-9f3d-c5b0df2f7451", "comment": "Malware payload (Mirai)", "value": "fc2eac0160593a2979fb11f37dcd079e48701aa127b43d3a141c249952191186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261155, "uuid": "7fc5a948-ce46-4f81-a3ee-b802e11244da", "comment": "Malware payload (Mirai)", "value": "a1e6ca0c4e0222350de5277424af4dc5b59695cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261155, "uuid": "98493f43-2f4b-406c-abf5-37455a42c9fd", "comment": "Malware payload (Mirai)", "value": "e9ed16d497b43d62f520c59fce949045f0b559532a5140fb3729a67360d5ae3f1b77362b5b713b1d74bf4d6b416d2dfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261155, "uuid": "22f17733-f0f6-4b43-8c8c-a38d6b035d5b", "value": "T179043BC7F901D9BEF80BE77648170915B630B7E210924B337257796BEC3A0991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261155, "uuid": "9246c09d-a728-4114-b0dc-5feff88a0c2f", "value": "3072:BptxkKrqSc9UcMmm+PD64K39U2VXgVijbi0LoaAS8yY0p1uh/FEGf:3txkKrqScm+PDFKNtVXPLayYYJGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261155, "uuid": "b9ac4c26-a800-429c-a0e6-f987da13e0d2", "value": 175744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261155, "uuid": "19f98e33-70a0-4931-bce6-d0dd492be9f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261155, "uuid": "19b0cc7e-c4d9-44ce-95cc-3bafd9e5015c", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b2ca7c-b97e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762261188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261188, "uuid": "6afe7ab3-848d-4fb6-8409-71865223c9d3", "comment": "Malware payload (Mirai)", "value": "a000f577b9c5dc75d5462660e28d3365", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261188, "uuid": "a89b6ea7-2aed-414c-b695-08f918894867", "comment": "Malware payload (Mirai)", "value": "fcac23405d40243dfa40b8b10f1f21073cabff754abd6827160fa88c847d5125", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261188, "uuid": "f5ffc9cf-cc33-4ed2-af3f-db64cef84acd", "comment": "Malware payload (Mirai)", "value": "c42495b3235533aeed3fa1b56717a68f84c0ffed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762261188, "uuid": "dfb17333-873b-4922-9c3d-42fb52c20643", "comment": "Malware payload (Mirai)", "value": "3f7cb96fdbcea7564ab3e4e140dc91b69a5e0a4411cad13d6e57d46969f37f63d9645c16e749ae20cd6510ab06e78450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261188, "uuid": "ff952675-dee6-4186-8bfe-de95c9acfd60", "value": "T15C531A92FC424A2BC1D402B6B5BE5A8D376213F9D1CB7227DD614B407BC5A1F0D6AEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261188, "uuid": "b46d49f3-abc1-4c41-8082-16db35cbd937", "value": "1536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762261188, "uuid": "634ec827-1ae7-4fda-88b1-e144a669056b", "value": 63820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762261188, "uuid": "c327f401-2f11-40e5-aebb-4a124001aafb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762261188, "uuid": "4a039da8-e70a-4d9d-9fee-9c08998d7678", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9cbfda-b956-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762244289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244289, "uuid": "b25f37e6-0ade-448c-8821-6940eab107dd", "comment": "Malware payload (RemcosRAT)", "value": "0002e88b6e44f97aff3a1bbfad153b47", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244289, "uuid": "d1e36136-eee8-482a-ab1a-849fb70a2382", "comment": "Malware payload (RemcosRAT)", "value": "fdae1e2c0116a4ab17e0b36ffb8b910f9be20e51486afbc402b984999e64a79e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244289, "uuid": "d640aaab-95c8-4e81-9703-c078f77db6ae", "comment": "Malware payload (RemcosRAT)", "value": "83347a606abc6950692b521b9d641928c98cd52f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762244289, "uuid": "fc58c586-73a3-40a6-a5bb-c59922bfc298", "comment": "Malware payload (RemcosRAT)", "value": "9f4db3b6962dd1093ab125921b04d450d9c84b74d7f9bb54da5a34d8e7969aff0eabf0299518e588edc6d7d613257f4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244289, "uuid": "fb77ea5a-32de-4965-a71f-c54d7e461921", "value": "T118B3EE8866C1A450A3872B7B372FA1E5FA6E68CC31C44E0BC25BBD91B076747F5D1A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244289, "uuid": "e4b6cfef-de6f-4eb7-949e-2a1bc982b261", "value": "3072:zbG/g2qjiweo7OdSxAIvDHAMY4FUnrUs1zCdPq3KNb/VGWqpatAcpJNO5GmjPvcC:88jiWoSxAIvDHAMY4FUnrUs1zCdPq3KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762244289, "uuid": "e2aafdf4-e421-4cdd-8ec6-3370757a1b97", "value": 116842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762244289, "uuid": "9b6ffad5-d159-4421-91bb-083d0a37d378", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762244289, "uuid": "351c945e-bb29-4e35-a608-5c485291f3f3", "value": "Comprobante-98567899567809695678795657708796856976576.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50624e0d-b928-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762224324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224324, "uuid": "858654ef-27a2-42cd-904f-861fa39ecaf9", "comment": "Malware payload (Mirai)", "value": "c2cc926e056fab1047fcbee971e391e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224324, "uuid": "1b9d633b-4625-4f3c-8bbf-6efe9d4d8a1e", "comment": "Malware payload (Mirai)", "value": "fe11b23bd5fac1969f261962207cad3ad114e458aa015901fcc2445e98af8bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224324, "uuid": "abcb6678-242d-4a71-ba4a-099b1f5bfe80", "comment": "Malware payload (Mirai)", "value": "f2d13e4cc80270fdbf53fe90e82ab062cbabec19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762224324, "uuid": "28fd9cf7-1b61-4b72-be97-78fa45a844b8", "comment": "Malware payload (Mirai)", "value": "c9775b65e34d3a2071abc9de882af8fdd9d7fc2ae61330bda380c04d714ab3bde9f30ffbd4e984197ae1b146d861ea88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224324, "uuid": "d8c521b5-7e8a-4d9d-9470-463c6c978c6d", "value": "T1B2C2E1E07726F931C520AC3DE52B4D863A51067C90FF393664258D398FC269B67E88A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224324, "uuid": "97fde435-98ee-41c6-a292-af3b024ea783", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrDD39q3UELuA:OKy4qfqoeJdXWgXGLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762224324, "uuid": "fbce9da7-fbc9-4845-a245-11dc0eca93bb", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762224324, "uuid": "79111d6f-3f37-4f4c-ae51-e20a4b25f746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762224324, "uuid": "56fbbbe0-57a4-4e1b-b1ee-db67b9a36694", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b901b-b996-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762271527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271527, "uuid": "15ef0656-07b9-41b1-9725-1c5d9dafdc1b", "comment": "Malware payload", "value": "cfcc1d1e3309516de735bb36fe01646d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271527, "uuid": "9cc9809f-069b-4cc4-bcfa-4a479f8c77e6", "comment": "Malware payload", "value": "fe345c884a521223ec9482d7dc7e3583c080fb6c2fafd8c761fc4963240a9b2b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271527, "uuid": "c944343b-584d-4f44-b09e-89fe58da3a6e", "comment": "Malware payload", "value": "2c5b3b5a2c6bb1982de8ae4661593a200a546ea5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762271527, "uuid": "f5315296-1650-469d-ac50-827879c60f42", "comment": "Malware payload", "value": "f3a3ad390d17e8ac9e7d0172decd044ac3ade54783be82c10b9e6ad495dd4dbf23933b95ed4d14bae8190d8f785998ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271527, "uuid": "52ddc01f-1e38-457e-ad5c-aa3d1cec9a18", "value": "T14993F742E4A0A47FFAEA86FA91F28D68542CBF75134948E392502657C7207FFBC75027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271527, "uuid": "308fcc9d-fd71-47d5-ac13-ed1076dc66e5", "value": "f7da79b7c3f003ced1454bf7330a5f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271527, "uuid": "f774da3b-61d3-4009-9a64-8bc8bbda2734", "value": "1536:+2qBXVOFmav82jRrjCfGQYNDpcZ8J9mBau3z:nqxnOrRrjJQstccUauj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762271527, "uuid": "1d87d8f5-a9b7-4c98-af14-c5c4b5b05175", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762271527, "uuid": "3e4553f9-818f-43ad-81da-22691cc9ec16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762271527, "uuid": "e9266b0a-d8cf-4ad8-a8a4-822630a33807", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91232557-b959-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762245478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245478, "uuid": "b2b307db-f70b-4ea1-a459-483f71101c44", "comment": "Malware payload (Formbook)", "value": "48588fe54666f09aa8cf2ebb0e71241f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245478, "uuid": "d32d23d6-3838-4a7c-97fc-b4d99595c007", "comment": "Malware payload (Formbook)", "value": "ff150b0097aab76df019506ee9cbb2a1da97bc6ac4f2b574054ab6eace3f5c1a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245478, "uuid": "c0affa7c-cc66-490f-9766-3a9f12d2c5bf", "comment": "Malware payload (Formbook)", "value": "1c7490873073470152f7164c16d7c33af3b80f27", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762245478, "uuid": "35777dab-aa76-4b95-970e-788838ea8f73", "comment": "Malware payload (Formbook)", "value": "b1cdd1b0f8bc2bc81ecb48b9ad6a52b6ab6fab28eec1e46ec209a0e6c54e2a689b0d05602bf4f47583aa8e5670e91149", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245478, "uuid": "a3fc615d-b121-4fe9-9f83-4dff9834b927", "value": "T1B6C3821297D0A1AC0981CAB5FBB937104568CA2D01FF8CBB5C451EFD98035B89F6DBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245478, "uuid": "e1363c10-cbf1-4d96-b056-24f34b0d13e1", "value": "1536:AWtOFco7/SxX3AXZ2TjCj3V29F6D8zwzV8sStBmXzK3z+ticlenDn7iofH3u2Zwg:AWK/egEjCj3EGL5K36t9WT7iGH/AHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762245478, "uuid": "1c8308b0-b94a-4aac-a615-7a9caed8b618", "value": 119357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762245478, "uuid": "60f2818c-7ead-45a1-9a5d-c51d27ff6069", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762245478, "uuid": "7f22b0b0-64df-46b6-95eb-32b6060f5a36", "value": "Justificante_de_pago_202511028649856739742.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }